e531e7a6a510768ba4b6ac8bffe35efc7c31164f
[java-idp.git] / src / edu / internet2 / middleware / shibboleth / aa / arp / ArpEngine.java
1 /* 
2  * The Shibboleth License, Version 1. 
3  * Copyright (c) 2002 
4  * University Corporation for Advanced Internet Development, Inc. 
5  * All rights reserved
6  * 
7  * 
8  * Redistribution and use in source and binary forms, with or without 
9  * modification, are permitted provided that the following conditions are met:
10  * 
11  * Redistributions of source code must retain the above copyright notice, this 
12  * list of conditions and the following disclaimer.
13  * 
14  * Redistributions in binary form must reproduce the above copyright notice, 
15  * this list of conditions and the following disclaimer in the documentation 
16  * and/or other materials provided with the distribution, if any, must include 
17  * the following acknowledgment: "This product includes software developed by 
18  * the University Corporation for Advanced Internet Development 
19  * <http://www.ucaid.edu>Internet2 Project. Alternately, this acknowledegement 
20  * may appear in the software itself, if and wherever such third-party 
21  * acknowledgments normally appear.
22  * 
23  * Neither the name of Shibboleth nor the names of its contributors, nor 
24  * Internet2, nor the University Corporation for Advanced Internet Development, 
25  * Inc., nor UCAID may be used to endorse or promote products derived from this 
26  * software without specific prior written permission. For written permission, 
27  * please contact shibboleth@shibboleth.org
28  * 
29  * Products derived from this software may not be called Shibboleth, Internet2, 
30  * UCAID, or the University Corporation for Advanced Internet Development, nor 
31  * may Shibboleth appear in their name, without prior written permission of the 
32  * University Corporation for Advanced Internet Development.
33  * 
34  * 
35  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 
36  * AND WITH ALL FAULTS. ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 
37  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A 
38  * PARTICULAR PURPOSE, AND NON-INFRINGEMENT ARE DISCLAIMED AND THE ENTIRE RISK 
39  * OF SATISFACTORY QUALITY, PERFORMANCE, ACCURACY, AND EFFORT IS WITH LICENSEE. 
40  * IN NO EVENT SHALL THE COPYRIGHT OWNER, CONTRIBUTORS OR THE UNIVERSITY 
41  * CORPORATION FOR ADVANCED INTERNET DEVELOPMENT, INC. BE LIABLE FOR ANY DIRECT, 
42  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 
43  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 
44  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 
45  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 
46  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 
47  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
48  */
49
50 package edu.internet2.middleware.shibboleth.aa.arp;
51
52 import java.net.URI;
53 import java.net.URISyntaxException;
54 import java.net.URL;
55 import java.security.Principal;
56 import java.util.Collections;
57 import java.util.HashMap;
58 import java.util.HashSet;
59 import java.util.Map;
60 import java.util.Properties;
61 import java.util.Set;
62
63 import org.apache.log4j.Logger;
64
65 /**
66  *  Defines a processing engine for Attribute Release Policies.
67  *
68  * @author Walter Hoehn (wassa@columbia.edu)
69  */
70
71 public class ArpEngine {
72
73         private static Logger log = Logger.getLogger(ArpEngine.class.getName());
74         private ArpRepository repository;
75         private static Map matchFunctions = Collections.synchronizedMap(new HashMap());
76         static {
77                 //Initialize built-in match functions
78                 try {
79                         matchFunctions.put(
80                                 new URI("urn:mace:shibboleth:arp:matchFunction:exactShar"),
81                                 "edu.internet2.middleware.shibboleth.aa.arp.provider.ExactSharMatchFunction");
82                         matchFunctions.put(
83                                 new URI("urn:mace:shibboleth:arp:matchFunction:resourceTree"),
84                                 "edu.internet2.middleware.shibboleth.aa.arp.provider.ResourceTreeMatchFunction");
85                         matchFunctions.put(
86                                 new URI("urn:mace:shibboleth:arp:matchFunction:regexMatch"),
87                                 "edu.internet2.middleware.shibboleth.aa.arp.provider.RegexMatchFunction");
88                 } catch (URISyntaxException e) {
89                         log.error("Error mapping standard match functions: " + e);
90                 }
91         }
92
93         public ArpEngine(Properties properties) throws ArpException {
94                 try {
95                         repository = ArpRepositoryFactory.getInstance(properties);
96                 } catch (ArpRepositoryException e) {
97                         log.error("Could not start Arp Engine: " + e);
98                         throw new ArpException("Could not start Arp Engine.");
99                 }
100         }
101
102         public ArpEngine(ArpRepository repository, Properties properties) throws ArpException {
103                 this.repository = repository;
104         }
105
106         public static MatchFunction lookupMatchFunction(URI functionIdentifier) throws ArpException {
107                 String className = null;
108
109                 synchronized (matchFunctions) {
110                         className = (String) matchFunctions.get(functionIdentifier);
111                 }
112
113                 if (className == null) {
114                         return null;
115                 }
116                 try {
117                         Class matchFunction = Class.forName(className);
118                         Object functionObject = matchFunction.newInstance();
119                         if (functionObject instanceof MatchFunction) {
120                                 return (MatchFunction) functionObject;
121                         } else {
122                                 log.error(
123                                         "Improperly specified match function, (" + className + ") is not a match function.");
124                                 throw new ArpException(
125                                         "Improperly specified match function, (" + className + ") is not a match function.");
126                         }
127                 } catch (Exception e) {
128                         log.error("Could not load Match Function: (" + className + "): " + e);
129                         throw new ArpException("Could not load Match Function.");
130                 }
131         }
132
133         private Arp createEffectiveArp(Principal principal, String requester, URL resource)
134                 throws ArpProcessingException {
135                 try {
136                         Arp effectiveArp = new Arp(principal);
137                         effectiveArp.setDescription("Effective ARP.");
138
139                         Arp[] userPolicies = repository.getAllPolicies(principal);
140
141                         for (int i = 0; userPolicies.length > i; i++) {
142                                 Rule[] rules = userPolicies[i].getMatchingRules(requester, resource);
143
144                                 for (int j = 0; rules.length > j; j++) {
145                                         effectiveArp.addRule(rules[j]);
146                                 }
147                         }
148
149                         return effectiveArp;
150                 } catch (ArpRepositoryException e) {
151                         log.error("Error creating effective policy: " + e);
152                         throw new ArpProcessingException("Error creating effective policy.");
153                 }
154         }
155
156         URI[] listPossibleReleaseAttributes(Principal principal, String requester, URL resource)
157                 throws ArpProcessingException {
158                 Set possibleReleaseSet = new HashSet();
159                 Set anyValueDenies = new HashSet();
160                 Rule[] rules = createEffectiveArp(principal, requester, resource).getAllRules();
161                 for (int i = 0; rules.length > i; i++) {
162                         Rule.Attribute[] attributes = rules[i].getAttributes();
163                         for (int j = 0; attributes.length > j; j++) {
164                                 if (attributes[j].releaseAnyValue()) {
165                                         possibleReleaseSet.add(attributes[j].getName());
166                                 } else if (attributes[j].denyAnyValue()) {
167                                         anyValueDenies.add(attributes[j].getName());
168                                 } else {
169                                         Rule.AttributeValue[] values = attributes[j].getValues();
170                                         for (int k = 0; values.length > k; k++) {
171                                                 if (values[k].getRelease().equals("permit")) {
172                                                         possibleReleaseSet.add(attributes[j].getName());
173                                                         break;
174                                                 }
175                                         }
176                                 }
177                         }
178                 }
179                 possibleReleaseSet.removeAll(anyValueDenies);
180                 return (URI[]) possibleReleaseSet.toArray(new URI[0]);
181         }
182
183         public ArpAttribute[] filterAttributes(
184                 ArpAttribute[] attributes,
185                 Principal principal,
186                 String requester,
187                 URL resource)
188                 throws ArpProcessingException {
189
190                 Set releaseSet = new HashSet();
191
192                 //Gather all applicable ARP attribute specifiers
193                 Set attributeNames = new HashSet();
194                 for (int i = 0; attributes.length > i; i++) {
195                         attributeNames.add(attributes[i].getName());
196                 }
197                 Rule[] rules = createEffectiveArp(principal, requester, resource).getAllRules();
198                 Set applicableRuleAttributes = new HashSet();
199                 for (int i = 0; rules.length > i; i++) {
200                         Rule.Attribute[] ruleAttributes = rules[i].getAttributes();
201                         for (int j = 0; ruleAttributes.length > j; j++) {
202                                 if (attributeNames.contains(ruleAttributes[j].getName().toString())) {
203                                         applicableRuleAttributes.add(ruleAttributes[j]);
204                                 }
205                         }
206                 }
207
208                 //Canonicalize specifiers
209                 Map arpAttributeSpecs =
210                         createCanonicalAttributeSpec(
211                                 (Rule.Attribute[]) applicableRuleAttributes.toArray(new Rule.Attribute[0]));
212
213                 //Filter
214                 for (int i = 0; attributes.length > i; i++) {
215                         Rule.Attribute attribute = (Rule.Attribute) arpAttributeSpecs.get(attributes[i].getName());
216                         
217                         //Handle no specifier
218                         if (attribute == null) {
219                                 continue;
220                         }
221                         
222                         //Handle Deny All
223                         if (attribute.denyAnyValue()) {
224                                 continue;
225                         }
226
227                         //Handle Permit All
228                         if (attribute.releaseAnyValue() && attribute.getValues().length == 0) {
229                                 releaseSet.add(attributes[i]);
230                                 continue;
231                         }
232
233                         //Handle Permit All-Except and Permit Specific
234                         Object[] resolvedValues = attributes[i].getValues();
235                         Set releaseValues = new HashSet();
236                         for (int j = 0; resolvedValues.length > j; j++) {
237                                 System.err.println(attribute.isValuePermitted(resolvedValues[j]));
238                                 if (attribute.isValuePermitted(resolvedValues[j])) {
239                                         releaseValues.add(resolvedValues[j]);
240                                 }
241                         }
242                         attributes[i].setValues((ArpAttribute[]) releaseValues.toArray(new ArpAttribute[0]));
243                         releaseSet.add(attributes[i]);
244                 }
245                 return (ArpAttribute[]) releaseSet.toArray(new ArpAttribute[0]);
246         }
247
248         private Map createCanonicalAttributeSpec(Rule.Attribute[] attributes) {
249                 Map canonicalSpec = new HashMap();
250                 for (int i = 0; attributes.length > i; i++) {
251                         if (!canonicalSpec.containsKey(attributes[i].getName().toString())) {
252                                 canonicalSpec.put(attributes[i].getName().toString(), attributes[i]);
253                         } else {
254                                 if (((Rule.Attribute) canonicalSpec.get(attributes[i].getName().toString())).denyAnyValue()) {
255                                         continue;
256                                 }
257                                 if (attributes[i].denyAnyValue()) {
258                                         ((Rule.Attribute) canonicalSpec.get(attributes[i].getName().toString())).setAnyValueDeny(true);
259                                         continue;
260                                 }
261                                 if (attributes[i].releaseAnyValue()) {
262                                         ((Rule.Attribute) canonicalSpec.get(attributes[i].getName().toString())).setAnyValuePermit(true);
263                                 }
264                                 Rule.AttributeValue[] values = attributes[i].getValues();
265                                 for (int j = 0; values.length > j; j++) {
266                                         ((Rule.Attribute) canonicalSpec.get(attributes[i].getName().toString())).addValue(values[j]);
267                                 }
268                         }
269                 }
270                 return canonicalSpec;
271         }
272
273 }