router-authz.js revision 3032add8d51a0dcb46e076c4dc6105e78a7c9150
/*! @license
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
*
* Copyright © 2011-2012 ForgeRock AS. All rights reserved.
*
* The contents of this file are subject to the terms
* of the Common Development and Distribution License
* (the License). You may not use this file except in
* compliance with the License.
*
* You can obtain a copy of the License at
* See the License for the specific language governing
* permission and limitations under the License.
*
* When distributing Covered Code, include this CDDL
* Header Notice in each file and include the License file
* If applicable, add the following below the CDDL Header,
* with the fields enclosed by brackets [] replaced by
* your own identifying information:
* "Portions Copyrighted [year] [name of copyright owner]"
*/
/*
* This script is called from the router "onRequest" trigger, to enforce a central
* set of authorization rules.
*
* This default implemention simply restricts requests via HTTP to users that are assigned
* an "openidm-admin" role, and optionally to those that authenticate with TLS mutual
* authentication (assigned an "openidm-cert" role).
*/
/**
* A configuration for allowed requests. Each entry in the config contains a pattern to match
* against the incoming request ID and, in the event of a match, the associated roles, methods,
* and actions that are allowed for requests on that particular pattern.
*
* pattern: A pattern to match against an incoming request's resource ID
* roles: A comma separated list of allowed roles
* methods: A comma separated list of allowed methods
* actions: A comma separated list of allowed actions
*
* A single '*' character indicates all possible values. With patterns ending in "/*", the "*"
* acts as a wild card to indicate the pattern accepts all resource IDs "below" the specified
* starting with "managed/". Note: it would not match "managed", which would need to have its
* own entry in the config.
*/
var accessConfig = { "configs" : [
{ "pattern" : "*",
"roles" : "openidm-admin",
"methods": "*", // default to all methods allowed
"actions" : "*", // default to all actions allowed
"customAuthz" : "disallowQueryExpression()" // default to only allowing parameterized queries
},
// Clients authenticated via SSL mutual authentication
{ "pattern" : "*",
"roles" : "openidm-cert",
"methods": "", // default to no methods allowed
"actions" : "" // default to no actions allowed
},
// Additional checks for authenticated users
{ "pattern" : "*",
"roles" : "openidm-authorized", // openidm-authorized is anonymous
"methods": "*",
"actions" : "*",
"customAuthz" : "ownDataOnly()" // Custom auth function
},
{ "pattern" : "policy/*",
"roles" : "*",
"methods": "read,action",
"actions" : "*"
},
// Anonymous user can:
// * create user using POST with action=create
// * invoke some queries which are public:
// check-userName-availability,
// for-security-answer,
// for-credentials,
// get-security-question,
// set-newPassword-for-userName-and-security-answer
"roles" : "openidm-reg",
"methods": "read,query",
//"customAuthz" : "checkIfIsPublicQuery()",
"actions" : "*"
},
"roles" : "openidm-reg",
"methods": "create",
"actions" : "*"
},
"roles" : "openidm-reg",
"methods": "read",
"actions" : "*"
}
] };
function ownDataOnly() {
return true; // temporarily bypass authz until we have a method for comparing requested userId against secured userId value.
if (
(
requestIsAQueryOfName('for-credentials') ||
requestIsAQueryOfName('for-internalcredentials')
)
)
{
return true;
}
// Additional Checks (if failed access configuration check)
if (
(
requestIsAQueryOfName('for-credentials') ||
requestIsAQueryOfName('for-internalcredentials') ||
requestIsAQueryOfName('notifications-for-user') ||
requestIsAQueryOfName('user_application_lnk-for-user') ||
requestIsAQueryOfName('for-userName')
) && userIsAuthorized(roles)){
//authenticated user can only manage his data and cannot change a role attribute.
if (requestIsAnActionOfName('patch')) {
if (requestValueContainsReplaceValueWithKeyOfName('/role')) {
return false;
}
}
} else {
throw "Access denied (Manipulation with data of user not equal to logged-in is forbidden)";
}
return true;
} else {
return isPublicMethodInvocation();
}
}
function disallowQueryExpression() {
return false;
}
return true;
}
// Check resource ID
// Check roles
// Check method
// Check action
return true;
}
} else {
return true;
}
}
}
}
}
}
return false;
}
if (pattern == "*") {
// Accept all patterns
return true;
// pattern matches exactly
return true;
// Ends with "/*" or "/"
// See if parent pattern matches
if (id.length >= parentResource.length && id.substring(0, parentResource.length) == parentResource) {
return true
}
}
return false;
}
if (configItems == "*") {
return true;
}
return true;
}
}
return false
}
if (configItems == "*") {
return true;
}
}
function contains(a, o) {
if (typeof(a) != 'undefined' && a != null) {
for (var i = 0; i <= a.length; i++) {
if (a[i] === o) {
return true;
}
}
}
return false;
}
/**
* Public methods are accessible by anonymous user. They are used
* during registration and forgotten password process.
*/
function isPublicMethodInvocation() {
var publicQueries = ['check-userName-availability','for-security-answer','for-credentials', 'get-security-question', 'set-newPassword-for-userName-and-security-answer'];
}
return true;
} else {
return false;
}
return true;
} else {
}
} else {
return false;
}
}
function userIsAuthorized(roles) {
}
function requestIsAQueryOfName(queryName) {
}
function authorizedUsernameEquals(userName) {
}
function requestIsAnActionOfName(actionName) {
return request.value && request.params && request.params['_action'] && request.params['_action'] == actionName;
}
var key = "replace";
return true;
}
}
}
function allow() {
return true;
}
var action = "";
}
// Check REST requests against the access configuration
return true;
}
}
}
if (!allow()) {
throw "Access denied";
}