javax.security.jacc.EJBMethodPermission Java Examples

@Override
public void addPermission(GrantedPermission permissionDeclaration) {
	// todo : do we need to wrap these PolicyConfiguration calls in privileged actions like we do during permission checks?

	if ( policyConfiguration == null ) {
		policyConfiguration = locatePolicyConfiguration( contextId );
	}

	for ( String grantedAction : permissionDeclaration.getPermissibleAction().getImpliedActions() ) {
		final EJBMethodPermission permission = new EJBMethodPermission(
				permissionDeclaration.getEntityName(),
				grantedAction,
				null, // interfaces
				null // arguments
		);

		log.debugf( "Adding permission [%s] to role [%s]", grantedAction, permissionDeclaration.getRole() );
		try {
			policyConfiguration.addToRole( permissionDeclaration.getRole(), permission );
		}
		catch (PolicyContextException pce) {
			throw new HibernateException( "policy context exception occurred", pce );
		}
	}
}
 

private void doPermissionCheckInContext(PermissionCheckEntityInformation entityInformation, PermissibleAction action) {
	final Policy policy = Policy.getPolicy();
	final Principal[] principals = getCallerPrincipals();

	final CodeSource codeSource = entityInformation.getEntity().getClass().getProtectionDomain().getCodeSource();
	final ProtectionDomain pd = new ProtectionDomain( codeSource, null, null, principals );

	// the action is known as 'method name' in JACC
	final EJBMethodPermission jaccPermission = new EJBMethodPermission(
			entityInformation.getEntityName(),
			action.getImpliedActions()[0],
			null,
			null
	);

	if ( ! policy.implies( pd, jaccPermission) ) {
		throw new SecurityException(
				String.format(
						"JACC denied permission to [%s.%s] for [%s]",
						entityInformation.getEntityName(),
						action.getImpliedActions()[0],
						join( principals )
				)
		);
	}
}
 

@Override
public boolean isCallerAuthorized(final Method method, final InterfaceType type) {
    final ThreadContext threadContext = ThreadContext.getThreadContext();
    final BeanContext beanContext = threadContext.getBeanContext();
    try {
        final String ejbName = beanContext.getEjbName();
        String name = type == null ? null : type.getSpecName();
        if ("LocalBean".equals(name) || "LocalBeanHome".equals(name)) {
            name = null;
        }
        final Identity currentIdentity = clientIdentity.get();
        final SecurityContext securityContext;
        if (currentIdentity == null) {
            securityContext = threadContext.get(SecurityContext.class);
        } else {
            securityContext = new SecurityContext(currentIdentity.getSubject());
        }
        securityContext.acc.checkPermission(new EJBMethodPermission(ejbName, name, method));
    } catch (final AccessControlException e) {
        return false;
    }
    return true;
}
 

/**
 * Process the request
 * @param callerSubject
 * @param role
 * @return
 */
private int process(Subject callerSubject, Role role)
{
   EJBMethodPermission methodPerm =
      new EJBMethodPermission(ejbName, methodInterface, ejbMethod);
   boolean policyDecision = checkWithPolicy(methodPerm, callerSubject, role);
   if( policyDecision == false && PicketBoxLogger.LOGGER.isDebugEnabled() )
   {
       PicketBoxLogger.LOGGER.debugJACCDeniedAccess(methodPerm.toString(), callerSubject,
               role != null ? role.toString() : null);
   }
   return policyDecision ? AuthorizationContext.PERMIT : AuthorizationContext.DENY;
}
 

public boolean onPreDelete(PreDeleteEvent event) {

		EJBMethodPermission deletePermission = new EJBMethodPermission(
				event.getPersister().getEntityName(),
				HibernatePermission.DELETE,
				null,
				null
		);

		JACCPermissions.checkPermission( event.getEntity().getClass(), contextID, deletePermission );

		return false;
	}
 

public void onPreLoad(PreLoadEvent event) {

		EJBMethodPermission loadPermission = new EJBMethodPermission(
				event.getPersister().getEntityName(),
				HibernatePermission.READ,
				null,
				null
		);

		JACCPermissions.checkPermission( event.getEntity().getClass(), contextID, loadPermission );

	}
 

public void addPermission(String role, String entityName, String action) {

		if ( action.equals( "*" ) ) {
			action = "insert,read,update,delete";
		}

		StringTokenizer tok = new StringTokenizer( action, "," );

		while ( tok.hasMoreTokens() ) {
			String methodName = tok.nextToken().trim();
			EJBMethodPermission permission = new EJBMethodPermission( 
					entityName, 
					methodName, 
					null, // interfaces
					null // arguments
				);

			if ( log.isDebugEnabled() ) {
				log.debug( "adding permission to role " + role + ": " + permission );
			}
			try {
				policyConfiguration.addToRole( role, permission );
			}
			catch (PolicyContextException pce) {
				throw new HibernateException( "policy context exception occurred", pce );
			}
		}
	}
 

public boolean onPreInsert(PreInsertEvent event) {

		EJBMethodPermission insertPermission = new EJBMethodPermission(
				event.getPersister().getEntityName(),
				HibernatePermission.INSERT,
				null,
				null
		);

		JACCPermissions.checkPermission( event.getEntity().getClass(), contextID, insertPermission );

		return false;
	}
 

public boolean onPreUpdate(PreUpdateEvent event) {

		EJBMethodPermission updatePermission = new EJBMethodPermission(
				event.getPersister().getEntityName(),
				HibernatePermission.UPDATE,
				null,
				null
		);

		JACCPermissions.checkPermission( event.getEntity().getClass(), contextID, updatePermission );

		return false;
	}
 

/**
 * Generate all the possible permissions for a bean's interface.
 *
 * Method permissions are defined in the deployment descriptor as a binary
 * relation from the set of security roles to the set of methods of the
 * home, component, and/or web service endpoint interfaces of session and
 * entity beans, including all their superinterfaces (including the methods
 * of the <code>EJBHome</code> and <code>EJBObject</code> interfaces and/or
 * <code>EJBLocalHome</code> and <code>EJBLocalObject</code> interfaces).
 *
 * @param permissions     the permission set to be extended
 * @param ejbName         the name of the EJB
 * @param methodInterface the EJB method interface
 * @param clazz           clazz
 * @throws OpenEJBException in case a class could not be found
 */
public void addPossibleEjbMethodPermissions(final PermissionCollection permissions,
                                            final String ejbName,
                                            final String methodInterface,
                                            final Class clazz) throws OpenEJBException {
    if (clazz == null) {
        return;
    }
    for (final Method method : clazz.getMethods()) {
        final String methodIface = "LocalBean".equals(methodInterface) || "LocalBeanHome".equals(methodInterface) ? null : methodInterface;
        permissions.add(new EJBMethodPermission(ejbName, methodIface, method));
    }
}