ff37a5ef1513283886c54967876e97da0831d43e
[java-idp.git] / src / edu / internet2 / middleware / shibboleth / aa / attrresolv / AttributeResolver.java
1 /* 
2  * The Shibboleth License, Version 1. 
3  * Copyright (c) 2002 
4  * University Corporation for Advanced Internet Development, Inc. 
5  * All rights reserved
6  * 
7  * 
8  * Redistribution and use in source and binary forms, with or without 
9  * modification, are permitted provided that the following conditions are met:
10  * 
11  * Redistributions of source code must retain the above copyright notice, this 
12  * list of conditions and the following disclaimer.
13  * 
14  * Redistributions in binary form must reproduce the above copyright notice, 
15  * this list of conditions and the following disclaimer in the documentation 
16  * and/or other materials provided with the distribution, if any, must include 
17  * the following acknowledgment: "This product includes software developed by 
18  * the University Corporation for Advanced Internet Development 
19  * <http://www.ucaid.edu>Internet2 Project. Alternately, this acknowledegement 
20  * may appear in the software itself, if and wherever such third-party 
21  * acknowledgments normally appear.
22  * 
23  * Neither the name of Shibboleth nor the names of its contributors, nor 
24  * Internet2, nor the University Corporation for Advanced Internet Development, 
25  * Inc., nor UCAID may be used to endorse or promote products derived from this 
26  * software without specific prior written permission. For written permission, 
27  * please contact shibboleth@shibboleth.org
28  * 
29  * Products derived from this software may not be called Shibboleth, Internet2, 
30  * UCAID, or the University Corporation for Advanced Internet Development, nor 
31  * may Shibboleth appear in their name, without prior written permission of the 
32  * University Corporation for Advanced Internet Development.
33  * 
34  * 
35  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 
36  * AND WITH ALL FAULTS. ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 
37  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A 
38  * PARTICULAR PURPOSE, AND NON-INFRINGEMENT ARE DISCLAIMED AND THE ENTIRE RISK 
39  * OF SATISFACTORY QUALITY, PERFORMANCE, ACCURACY, AND EFFORT IS WITH LICENSEE. 
40  * IN NO EVENT SHALL THE COPYRIGHT OWNER, CONTRIBUTORS OR THE UNIVERSITY 
41  * CORPORATION FOR ADVANCED INTERNET DEVELOPMENT, INC. BE LIABLE FOR ANY DIRECT, 
42  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 
43  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 
44  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 
45  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 
46  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 
47  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
48  */
49
50 package edu.internet2.middleware.shibboleth.aa.attrresolv;
51
52 import java.io.IOException;
53 import java.io.InputStream;
54 import java.security.Principal;
55 import java.util.ArrayList;
56 import java.util.Arrays;
57 import java.util.HashMap;
58 import java.util.HashSet;
59 import java.util.Iterator;
60 import java.util.List;
61 import java.util.Map;
62 import java.util.Properties;
63 import java.util.Set;
64
65 import javax.naming.directory.Attributes;
66
67 import org.apache.log4j.Logger;
68 import org.apache.xerces.parsers.DOMParser;
69 import org.w3c.dom.Document;
70 import org.w3c.dom.Element;
71 import org.w3c.dom.Node;
72 import org.w3c.dom.NodeList;
73 import org.xml.sax.EntityResolver;
74 import org.xml.sax.ErrorHandler;
75 import org.xml.sax.InputSource;
76 import org.xml.sax.SAXException;
77 import org.xml.sax.SAXParseException;
78
79 import edu.internet2.middleware.shibboleth.aa.attrresolv.ResolverAttributeSet.ResolverAttributeIterator;
80 import edu.internet2.middleware.shibboleth.aa.attrresolv.provider.ValueHandler;
81 import edu.internet2.middleware.shibboleth.common.ShibResource;
82 import edu.internet2.middleware.shibboleth.common.ShibResource.ResourceNotAvailableException;
83
84 /**
85  * An engine for obtaining attribute values for specified principals.  Attributes values are
86  * resolved using a directed graph of pluggable attribute definitions and data connectors.
87  *   
88  * @author Walter Hoehn (wassa@columbia.edu)
89  *
90  */
91
92 public class AttributeResolver {
93
94         private static Logger log = Logger.getLogger(AttributeResolver.class.getName());
95         private HashMap plugIns = new HashMap();
96         private ResolverCache resolverCache = new ResolverCache();
97         public static final String resolverNamespace = "urn:mace:shibboleth:resolver:1.0";
98
99         public AttributeResolver(Properties properties) throws AttributeResolverException {
100                 if (properties
101                         .getProperty("edu.internet2.middleware.shibboleth.aa.attrresolv.AttributeResolver.ResolverConfig")
102                         == null) {
103                         log.error("No Attribute Resolver configuration file specified.");
104                         throw new AttributeResolverException("No Attribute Resolver configuration file specified.");
105                 }
106
107                 String configFile =
108                         properties.getProperty(
109                                 "edu.internet2.middleware.shibboleth.aa.attrresolv.AttributeResolver.ResolverConfig");
110
111                 try {
112                         ShibResource config = new ShibResource(configFile, this.getClass());
113                         DOMParser parser = new DOMParser();
114                         parser.setFeature("http://xml.org/sax/features/validation", true);
115                         parser.setFeature("http://apache.org/xml/features/validation/schema", true);
116                         parser.setEntityResolver(new EntityResolver() {
117                                 public InputSource resolveEntity(String publicId, String systemId) throws SAXException {
118                                         if (systemId.endsWith("shibboleth-resolver-1.0.xsd")) {
119                                                 InputStream stream;
120                                                 try {
121                                                         return new InputSource(
122                                                                 new ShibResource("/schemas/shibboleth-resolver-1.0.xsd", this.getClass())
123                                                                         .getInputStream());
124                                                 } catch (IOException e) {
125                                                         throw new SAXException("Could not load entity: " + e);
126                                                 }
127                                         } else {
128                                                 return null;
129                                         }
130                                 }
131                         });
132
133                         parser.setErrorHandler(new ErrorHandler() {
134                                 public void error(SAXParseException arg0) throws SAXException {
135                                         throw new SAXException("Error parsing xml file: " + arg0);
136                                 }
137                                 public void fatalError(SAXParseException arg0) throws SAXException {
138                                         throw new SAXException("Error parsing xml file: " + arg0);
139                                 }
140                                 public void warning(SAXParseException arg0) throws SAXException {
141                                         throw new SAXException("Error parsing xml file: " + arg0);
142                                 }
143                         });
144                         parser.parse(new InputSource(config.getInputStream()));
145                         loadConfig(parser.getDocument());
146
147                 } catch (ResourceNotAvailableException e) {
148                         log.error("No Attribute Resolver configuration could be loaded from (" + configFile + "): " + e);
149                         throw new AttributeResolverException("No Attribute Resolver configuration found.");
150                 } catch (SAXException e) {
151                         log.error("Error parsing Attribute Resolver Configuration file: " + e);
152                         throw new AttributeResolverException("Error parsing Attribute Resolver Configuration file.");
153                 } catch (IOException e) {
154                         log.error("Error reading Attribute Resolver Configuration file: " + e);
155                         throw new AttributeResolverException("Error reading Attribute Resolver Configuration file.");
156                 }
157         }
158
159         private void loadConfig(Document document) throws AttributeResolverException {
160
161                 log.info("Configuring Attribute Resolver.");
162                 if (!document.getDocumentElement().getTagName().equals("AttributeResolver")) {
163                         log.error("Configuration must include <AttributeResolver> as the root node.");
164                         throw new AttributeResolverException("Cannot load Attribute Resolver.");
165                 }
166
167                 NodeList plugInNodes =
168                         document.getElementsByTagNameNS(resolverNamespace, "AttributeResolver").item(0).getChildNodes();
169                 if (plugInNodes.getLength() <= 0) {
170                         log.error("Configuration inclues no PlugIn definitions.");
171                         throw new AttributeResolverException("Cannot load Attribute Resolver.");
172                 }
173                 for (int i = 0; plugInNodes.getLength() > i; i++) {
174                         if (plugInNodes.item(i).getNodeType() == Node.ELEMENT_NODE) {
175                                 try {
176                                         log.info("Found a PlugIn. Loading...");
177                                         ResolutionPlugIn plugIn = ResolutionPlugInFactory.createPlugIn((Element) plugInNodes.item(i));
178                                         registerPlugIn(plugIn, plugIn.getId());
179                                 } catch (DuplicatePlugInException dpe) {
180                                         log.warn("Skipping PlugIn: " + dpe.getMessage());
181                                 } catch (ClassCastException cce) {
182                                         log.error("Problem realizing PlugIn configuration" + cce.getMessage());
183                                 } catch (AttributeResolverException are) {
184                                         log.warn("Skipping PlugIn: " + ((Element) plugInNodes.item(i)).getAttribute("id"));
185                                 }
186                         }
187                 }
188
189                 verifyPlugIns();
190                 log.info("Configuration complete.");
191         }
192
193         private void verifyPlugIns() throws AttributeResolverException {
194                 
195                 log.info("Verifying PlugIn graph consitency.");
196                 Set inconsistent = new HashSet();
197                 Iterator registered = plugIns.keySet().iterator();
198
199                 while (registered.hasNext()) {
200                         ResolutionPlugIn plugIn = lookupPlugIn((String) registered.next());
201                         log.debug("Checking PlugIn (" + plugIn.getId() + ") for consistency.");
202                         if (plugIn instanceof AttributeDefinitionPlugIn) {
203                                 verifyPlugIn((AttributeDefinitionPlugIn) plugIn, new HashSet(), inconsistent);
204                         }
205                 }
206                 
207                 if (!inconsistent.isEmpty()) {
208                         log.info("Unloading inconsistent PlugIns.");
209                         Iterator inconsistentIt = inconsistent.iterator();
210                         while (inconsistentIt.hasNext()) {
211                                 plugIns.remove(inconsistentIt.next());
212                         }
213                 }
214                 
215                 if (plugIns.size() < 1) {
216                         log.error("Failed to load any PlugIn definitions.");
217                         throw new AttributeResolverException("Cannot load Attribute Resolver.");
218                 }
219
220         }
221
222         private void verifyPlugIn(AttributeDefinitionPlugIn plugIn, Set verifyChain, Set inconsistent) {
223
224                 //Short-circuit if we have already found this PlugIn to be inconsistent
225                 if (inconsistent.contains(plugIn.getId())) {
226                         return;
227                 }
228
229                 //Make sure that we don't have a circular dependency
230                 if (verifyChain.contains(plugIn.getId())) {
231                         log.error(
232                                 "The PlugIn (" + plugIn.getId() + ") is inconsistent.  It is involved in a circular dependency chain.");
233                         inconsistent.add(plugIn.getId());
234                         return;
235                 }
236
237                 //Make sure all dependent Data Connectors are registered
238                 List depends = new ArrayList();
239                 depends.addAll(Arrays.asList(plugIn.getDataConnectorDependencyIds()));
240                 Iterator dependsIt = depends.iterator();
241                 while (dependsIt.hasNext()) {
242                         String key = (String) dependsIt.next();
243                         if (!plugIns.containsKey(key)) {
244                                 log.error(
245                                         "The PlugIn ("
246                                                 + plugIn.getId()
247                                                 + ") is inconsistent.  It depends on a PlugIn ("
248                                                 + key
249                                                 + ") that is not registered.");
250                                 inconsistent.add(plugIn.getId());
251                                 return;
252                         }
253                         
254                         ResolutionPlugIn dependent = lookupPlugIn(key);
255                         if (!(dependent instanceof DataConnectorPlugIn)) {
256                                 log.error(
257                                         "The PlugIn ("
258                                                 + plugIn.getId()
259                                                 + ") is inconsistent.  It depends on a PlugIn ("
260                                                 + key
261                                                 + ") that is mislabeled as an DataConnectorPlugIn.");
262                                 inconsistent.add(plugIn.getId());
263                                 return;
264                         }
265                 }
266
267                 //Recursively go through all AttributeDefinition dependencies and make sure all are registered and consistent.
268                 depends.clear();
269                 depends.addAll(Arrays.asList(plugIn.getAttributeDefinitionDependencyIds()));
270                 dependsIt = depends.iterator();
271                 while (dependsIt.hasNext()) {
272                         String key = (String) dependsIt.next();
273
274                         if (!plugIns.containsKey(key)) {
275                                 log.error(
276                                         "The PlugIn ("
277                                                 + plugIn.getId()
278                                                 + ") is inconsistent.  It depends on a PlugIn ("
279                                                 + key
280                                                 + ") that is not registered.");
281                                 inconsistent.add(plugIn.getId());
282                                 return;
283                         }
284
285                         ResolutionPlugIn dependent = lookupPlugIn(key);
286                         if (!(dependent instanceof AttributeDefinitionPlugIn)) {
287                                 log.error(
288                                         "The PlugIn ("
289                                                 + plugIn.getId()
290                                                 + ") is inconsistent.  It depends on a PlugIn ("
291                                                 + key
292                                                 + ") that is mislabeled as an AttributeDefinitionPlugIn.");
293                                 inconsistent.add(plugIn.getId());
294                                 return;
295                         }
296                         
297                         verifyChain.add(plugIn.getId());
298                         verifyPlugIn((AttributeDefinitionPlugIn) dependent, verifyChain, inconsistent);
299
300                         if (inconsistent.contains(key)) {
301                                 log.error(
302                                         "The PlugIn ("
303                                                 + plugIn.getId()
304                                                 + ") is inconsistent.  It depends on a PlugIn ("
305                                                 + key
306                                                 + ") that is not inconsistent.");
307                                 inconsistent.add(plugIn.getId());
308                                 return;
309                         }
310                 }
311         }
312
313         private void registerPlugIn(ResolutionPlugIn connector, String id) throws DuplicatePlugInException {
314
315                 if (plugIns.containsKey(id)) {
316                         log.error("A PlugIn is already registered with the Id (" + id + ").");
317                         throw new DuplicatePlugInException("Found a duplicate PlugIn Id.");
318                 }
319                 plugIns.put(id, connector);
320                 log.info("Registered PlugIn: (" + id + ")");
321
322         }
323
324         private ResolutionPlugIn lookupPlugIn(String id) {
325                 return (ResolutionPlugIn) plugIns.get(id);
326         }
327
328         /**
329          * Resolve a set of attributes for a particular principal and requester.
330          * 
331          * @param principal the <code>Principal</code> for which the attributes should be resolved
332          * @param requester the name of the requesting entity
333          * @param attributes the set of attributes to be resolved
334          */
335         public void resolveAttributes(
336                 Principal principal,
337                 String requester,
338                 ResolverAttributeSet attributes) {
339
340                 HashMap requestCache = new HashMap();
341                 ResolverAttributeIterator iterator =
342                         attributes.resolverAttributeIterator();
343
344                 while (iterator.hasNext()) {
345                         ResolverAttribute attribute = iterator.nextResolverAttribute();
346                         try {
347                                 if (lookupPlugIn(attribute.getName()) == null) {
348                                         log.warn(
349                                                 "No PlugIn registered for attribute: ("
350                                                         + attribute.getName()
351                                                         + ")");
352                                         iterator.remove();
353                                 } else {
354                                         log.info(
355                                                 "Resolving attribute: (" + attribute.getName() + ")");
356                                         if (attribute.resolved()) {
357                                                 log.debug(
358                                                         "Attribute ("
359                                                                 + attribute.getName()
360                                                                 + ") already resolved for this request.  No need for further resolution.");
361
362                                         } else {
363                                                 resolveAttribute(
364                                                         attribute,
365                                                         principal,
366                                                         requester,
367                                                         requestCache,
368                                                         attributes);
369                                         }
370
371                                         if (!attribute.hasValues()) {
372                                                 iterator.remove();
373                                         }
374                                 }
375                         } catch (ResolutionPlugInException rpe) {
376                                 log.error(
377                                         "Problem encountered while resolving attribute: ("
378                                                 + attribute.getName()
379                                                 + "): "
380                                                 + rpe);
381                                 iterator.remove();
382                         }
383                 }
384         }
385
386         public String[] listRegisteredAttributeDefinitionPlugIns() {
387
388                 log.debug("Listing available Attribute Definition PlugIns.");
389                 Set found = new HashSet();
390                 Iterator registered = plugIns.keySet().iterator();
391
392                 while (registered.hasNext()) {
393                         ResolutionPlugIn plugIn = lookupPlugIn((String) registered.next());
394                         if (plugIn instanceof AttributeDefinitionPlugIn) {
395                                 found.add(((AttributeDefinitionPlugIn) plugIn).getId());
396                         }
397                 }
398
399                 if (log.isDebugEnabled()) {
400                         for (Iterator iterator = found.iterator(); iterator.hasNext();) {
401                                 log.debug("Found registered Attribute Definition: " + (String) iterator.next());
402                         }
403                 }
404                 return (String[]) found.toArray(new String[0]);
405         }
406
407         private void resolveAttribute(
408                 ResolverAttribute attribute,
409                 Principal principal,
410                 String requester,
411                 Map requestCache,
412                 ResolverAttributeSet requestedAttributes)
413                 throws ResolutionPlugInException {
414
415                 AttributeDefinitionPlugIn currentDefinition = (AttributeDefinitionPlugIn) lookupPlugIn(attribute.getName());
416
417                 //Check to see if we have already resolved the attribute during this request
418                 if (requestCache.containsKey(currentDefinition.getId())) {
419                         log.debug(
420                                 "Attribute ("
421                                         + currentDefinition.getId()
422                                         + ") already resolved for this request, using cached version");
423                         attribute.resolveFromCached((ResolverAttribute) requestCache.get(currentDefinition.getId()));
424                         return;
425                 }
426
427                 //Check to see if we have a cached resolution for this attribute
428                 if (currentDefinition.getTTL() > 0) {
429                         ResolverAttribute cachedAttribute =
430                                 resolverCache.getResolvedAttribute(principal, currentDefinition.getId());
431                         if (cachedAttribute != null) {
432                                 log.debug(
433                                         "Attribute ("
434                                                 + currentDefinition.getId()
435                                                 + ") resolution cached from a previous request, using cached version");
436                                 attribute.resolveFromCached(cachedAttribute);
437                                 return;
438                         }
439                 }
440
441                 //Resolve all attribute dependencies
442                 String[] attributeDependencies = currentDefinition.getAttributeDefinitionDependencyIds();
443                 Dependencies depends = new Dependencies();
444
445                 boolean dependancyOnly = false;
446                 for (int i = 0; attributeDependencies.length > i; i++) {
447                         log.debug(
448                                 "Attribute (" + attribute.getName() + ") depends on attribute (" + attributeDependencies[i] + ").");
449                         ResolverAttribute dependant = requestedAttributes.getByName(attributeDependencies[i]);
450                         if (dependant == null) {
451                                 dependancyOnly = true;
452                                 dependant = new DependentOnlyResolutionAttribute(attributeDependencies[i]);
453                         }
454                         resolveAttribute(dependant, principal, requester, requestCache, requestedAttributes);
455                         depends.addAttributeResolution(attributeDependencies[i], dependant);
456
457                 }
458
459                 //Resolve all connector dependencies
460                 String[] connectorDependencies = currentDefinition.getDataConnectorDependencyIds();
461                 for (int i = 0; connectorDependencies.length > i; i++) {
462                         log.debug(
463                                 "Attribute (" + attribute.getName() + ") depends on connector (" + connectorDependencies[i] + ").");
464                         //Check to see if we have already resolved the connector during this request
465                         if (requestCache.containsKey(connectorDependencies[i])) {
466                                 log.debug(
467                                         "Connector ("
468                                                 + connectorDependencies[i]
469                                                 + ") already resolved for this request, using cached version");
470                                 depends.addConnectorResolution(
471                                         connectorDependencies[i],
472                                         (Attributes) requestCache.get(connectorDependencies[i]));
473                         } else {
474                                 //Check to see if we have a cached resolution for this attribute
475                                 if (((DataConnectorPlugIn) lookupPlugIn(connectorDependencies[i])).getTTL() > 0) {
476                                         Attributes cachedAttributes =
477                                                 resolverCache.getResolvedConnector(principal, connectorDependencies[i]);
478                                         if (cachedAttributes != null) {
479                                                 log.debug(
480                                                         "Connector ("
481                                                                 + connectorDependencies[i]
482                                                                 + ") resolution cached from a previous request, using cached version");
483                                                 depends.addConnectorResolution(connectorDependencies[i], cachedAttributes);
484                                         }
485                                 }
486
487                                 Attributes resolvedConnector =
488                                         ((DataConnectorPlugIn) lookupPlugIn(connectorDependencies[i])).resolve(principal);
489                                 requestCache.put(connectorDependencies[i], resolvedConnector);
490                                 depends.addConnectorResolution(connectorDependencies[i], resolvedConnector);
491
492                                 //Add attribute resolution to cache
493                                 if (((DataConnectorPlugIn) lookupPlugIn(connectorDependencies[i])).getTTL() > 0) {
494                                         resolverCache.cacheConnectorResolution(
495                                                 principal,
496                                                 connectorDependencies[i],
497                                                 ((DataConnectorPlugIn) lookupPlugIn(connectorDependencies[i])).getTTL(),
498                                                 resolvedConnector);
499                                 }
500                         }
501                 }
502
503                 //Resolve the attribute
504                 currentDefinition.resolve(attribute, principal, requester, depends);
505
506                 //If necessary, cache for this request
507                 if (dependancyOnly || !attribute.hasValues()) {
508                         requestCache.put(currentDefinition.getId(), attribute);
509                 }
510
511                 //Add attribute resolution to cache
512                 if (currentDefinition.getTTL() > 0) {
513                         resolverCache.cacheAttributeResolution(
514                                 principal,
515                                 attribute.getName(),
516                                 currentDefinition.getTTL(),
517                                 attribute);
518                 }
519         }
520
521         private class DuplicatePlugInException extends Exception {
522                 public DuplicatePlugInException(String message) {
523                         super(message);
524                 }
525         }
526
527         class DependentOnlyResolutionAttribute implements ResolverAttribute {
528                 String name;
529                 ArrayList values = new ArrayList();
530                 boolean resolved = false;
531
532                 DependentOnlyResolutionAttribute(String name) {
533                         this.name = name;
534                 }
535
536                 public String getName() {
537                         return name;
538                 }
539
540                 public boolean resolved() {
541                         return resolved;
542                 }
543
544                 public void setResolved() {
545                         resolved = true;
546                 }
547
548                 public void resolveFromCached(ResolverAttribute attribute) {
549                 }
550
551                 public void setLifetime(long lifetime) {
552                 }
553
554                 public long getLifetime() {
555                         return 0;
556                 }
557
558                 public void addValue(Object value) {
559                         values.add(value);
560                 }
561
562                 public Iterator getValues() {
563                         return values.iterator();
564                 }
565
566                 public boolean hasValues() {
567                         if (values.isEmpty()) {
568                                 return false;
569                         }
570                         return true;
571                 }
572
573                 public void registerValueHandler(ValueHandler handler) {
574                 }
575
576                 public ValueHandler getRegisteredValueHandler() {
577                         return null;
578                 }
579         }
580
581 }