AuthorizationServiceImpl.java

/*
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
 *
 * Copyright (c) 2012-2013 Oracle and/or its affiliates. All rights reserved.
 *
 * The contents of this file are subject to the terms of either the GNU
 * General Public License Version 2 only ("GPL") or the Common Development
 * and Distribution License("CDDL") (collectively, the "License").  You
 * may not use this file except in compliance with the License.  You can
 * obtain a copy of the License at
 * https://glassfish.dev.java.net/public/CDDL+GPL_1_1.html
 * or packager/legal/LICENSE.txt.  See the License for the specific
 * language governing permissions and limitations under the License.
 *
 * When distributing the software, include this License Header Notice in each
 * file and include the License file at packager/legal/LICENSE.txt.
 *
 * GPL Classpath Exception:
 * Oracle designates this particular file as subject to the "Classpath"
 * exception as provided by Oracle in the GPL Version 2 section of the License
 * file that accompanied this code.
 *
 * Modifications:
 * If applicable, add the following below the License Header, with the fields
 * enclosed by brackets [] replaced by your own identifying information:
 * "Portions Copyright [year] [name of copyright owner]"
 *
 * Contributor(s):
 * If you wish your version of this file to be governed by only the CDDL or
 * only the GPL Version 2, indicate your decision by adding "[Contributor]
 * elects to include this software in this distribution under the [CDDL or GPL
 * Version 2] license."  If you don't indicate a single choice of license, a
 * recipient has the option to distribute your version of this file under
 * either the CDDL, the GPL Version 2 or to extend the choice of license to
 * its licensees as provided above.  However, if you add GPL Version 2 code
 * and therefore, elected the GPL Version 2 license, then the option applies
 * only if the new code is made subject to such option by the copyright
 * holder.
 */
package org.glassfish.security.services.impl.authorization;

import java.net.URI;
import java.security.Permission;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
import java.util.Set;
import java.security.AccessController;
import java.security.Principal;
import java.security.ProtectionDomain;
import java.security.Policy;
import java.security.CodeSource;
import java.security.CodeSigner;
import javax.security.auth.Subject;

import org.glassfish.security.services.api.authorization.AuthorizationService;
import org.glassfish.security.services.api.authorization.AzAction;
import org.glassfish.security.services.api.authorization.AzResource;
import org.glassfish.security.services.api.authorization.AzResult;
import org.glassfish.security.services.api.authorization.AzSubject;
import org.glassfish.security.services.api.context.SecurityContextService;
import org.glassfish.security.services.common.PrivilegedLookup;
import org.glassfish.security.services.common.Secure;
import org.glassfish.security.services.config.SecurityConfiguration;
import org.glassfish.security.services.impl.ServiceFactory;
import org.glassfish.security.services.impl.ServiceLogging;

import javax.inject.Inject;
import javax.inject.Singleton;
import org.jvnet.hk2.annotations.Service;
import org.glassfish.hk2.api.PostConstruct;
import org.glassfish.hk2.api.ServiceLocator;

import com.sun.enterprise.config.serverbeans.Domain;

import java.util.logging.Level;
import java.util.logging.Logger;
import com.sun.enterprise.util.LocalStringManagerImpl;
import org.glassfish.logging.annotation.LogMessageInfo;

import org.glassfish.security.services.api.authorization.*;
import org.glassfish.security.services.api.common.Attributes;
import org.glassfish.security.services.config.SecurityProvider;
import org.glassfish.security.services.spi.authorization.AuthorizationProvider;

/**
 * <code>AuthorizationServiceImpl</code> implements
 * <code>{@link org.glassfish.security.services.api.authorization.AuthorizationService}</code>
 * by delegating authorization decisions to configured
 * <code>{@link org.glassfish.security.services.spi.AuthorizationProvider}</code>
 * instances.
 */
@Service
@Singleton
@Secure(accessPermissionName = "security/service/authorization")
public final class AuthorizationServiceImpl implements AuthorizationService, PostConstruct {
    private static final Level DEBUG_LEVEL = Level.FINER;
    private static final Logger logger =
        Logger.getLogger(ServiceLogging.SEC_SVCS_LOGGER,ServiceLogging.SHARED_LOGMESSAGE_RESOURCE);
    private static LocalStringManagerImpl localStrings =
        new LocalStringManagerImpl(AuthorizationServiceImpl.class);
    @Inject
    private volatile Domain domain;

    @Inject
    private volatile ServiceLocator serviceLocator;
    
    private volatile org.glassfish.security.services.config.AuthorizationService atzSvCfg;

    @Inject
    private volatile SecurityContextService securityContextService;

    private volatile SecurityProvider atzPrvConfig;
    
    private volatile AuthorizationProvider provider;
    
    private static final CodeSource NULL_CODESOURCE = new CodeSource(null, (CodeSigner[])null);

    enum InitializationState {
        NOT_INITIALIZED,
        SUCCESS_INIT,
        FAILED_INIT
    }
    private volatile InitializationState initialized = InitializationState.NOT_INITIALIZED;
    private volatile String reasonInitFailed =
    		localStrings.getLocalString("service.atz.never_init","Authorization Service never initialized.");

    private final List<AzAttributeResolver> attributeResolvers =
            Collections.synchronizedList(new java.util.ArrayList<AzAttributeResolver>());

	private boolean isDebug() {
		return logger.isLoggable(DEBUG_LEVEL);
	}

    /**
     * Initialize the security service instance with the specific security service configuration.
     *
     * @see org.glassfish.security.services.api.SecurityService#initialize
     */
    @Override
    public void initialize(final SecurityConfiguration securityServiceConfiguration) {

        if ( InitializationState.NOT_INITIALIZED != initialized ) {
            return;
        }

        try {
            // Get service level config
            if ( !( securityServiceConfiguration instanceof org.glassfish.security.services.config.AuthorizationService ) ) {
                throw new IllegalStateException(
                		localStrings.getLocalString("service.atz.not_config","The Authorization service is not configured in the domain configuration file."));
            }
            atzSvCfg = (org.glassfish.security.services.config.AuthorizationService) securityServiceConfiguration;

            // Get provider level config, consider only one provider for now and take the first provider found.
            List<SecurityProvider> providersConfig = atzSvCfg.getSecurityProviders();
            if ( (providersConfig == null) || ( (atzPrvConfig = providersConfig.get(0)) == null ) ) {
                throw new IllegalStateException(
                		localStrings.getLocalString("service.atz.no_prov_config","No provider configured for the Authorization service in the domain configuration file."));
            }

            // Get the provider
            final String providerName = atzPrvConfig.getName();
            if ( isDebug() ) {
                logger.log(DEBUG_LEVEL, "Attempting to get Authorization provider \"{0}\".", providerName );
            }
            provider =  AccessController.doPrivileged(
                            new PrivilegedLookup<AuthorizationProvider>(
                                    serviceLocator, AuthorizationProvider.class, providerName)); 
            if (provider == null) {
                throw new IllegalStateException(
                    localStrings.getLocalString("service.atz.not_provider","Authorization Provider {0} not found.", providerName));
            }

            // Initialize the provider
            provider.initialize(atzPrvConfig);

            initialized = InitializationState.SUCCESS_INIT;
            reasonInitFailed = null;

            logger.log(Level.INFO, ATZSVC_INITIALIZED);

        } catch ( Exception e ) {
            String eMsg = e.getMessage();
            String eClass = e.getClass().getName();
            reasonInitFailed = localStrings.getLocalString("service.atz.init_failed",
                "Authorization Service initialization failed, exception {0}, message {1}", eClass, eMsg);
            logger.log(Level.WARNING, ATZSVC_INIT_FAILED, new Object[] {eClass, eMsg});
            throw new RuntimeException( reasonInitFailed, e );
        } finally {
            if ( InitializationState.SUCCESS_INIT != initialized ) {
                initialized = InitializationState.FAILED_INIT;
            }
        }
    }

    /**
     * Determine whether the given Subject has been granted the specified Permission
     * by delegating to the configured java.security.Policy object.  This method is
     * a high-level convenience method that tests for a Subject-based permission
     * grant without reference to the AccessControlContext of the caller.
     *
     * In addition, this method isolates the query from the underlying Policy configuration
     * model.  It could, for example, multiplex queries across multiple instances of Policy
     * configured in an implementation-specific way such that different threads, or different
     * applications, query different Policy objects.  The initial implementation simply
     * delegates to the configured Policy as defined by Java SE.
     *
     * @param subject The Subject for which permission is being tested.
     * @param permission The Permission being queried.
     * @return True or false, depending on whether the specified Permission
     * is granted to the Subject by the configured Policy.
     * @throws IllegalArgumentException Given null or illegal subject or permission
     * @see AuthorizationService#isPermissionGranted(javax.security.auth.Subject, java.security.Permission)
     */
    @Override
	public boolean isPermissionGranted(
        final Subject subject, final Permission permission) {

        // Validate inputs
        if ( null == subject ) {
            throw new IllegalArgumentException(localStrings.getLocalString("service.subject_null", "The supplied Subject is null."));
        }
        if ( null == permission ) {
            throw new IllegalArgumentException(localStrings.getLocalString("service.permission_null","The supplied Permission is null."));
        }

        Set<Principal> principalset = subject.getPrincipals();
        Principal[] principalAr = (principalset.size() == 0) ? null : principalset.toArray(new Principal[principalset.size()]);
        ProtectionDomain pd = new ProtectionDomain(NULL_CODESOURCE, null, null, principalAr); 
        Policy policy = Policy.getPolicy();
        boolean result = policy.implies(pd, permission);

        return result;
	}


    /**
     * Determine whether the given Subject is authorized to access the given resource,
     * specified by a URI.
     *
     * @param subject The Subject being tested.
     * @param resource URI of the resource being tested.
     * @return True or false, depending on whether the access is authorized.
     * @throws IllegalArgumentException Given null or illegal subject or resource
     * @throws IllegalStateException Service was not initialized.
     * @see AuthorizationService#isAuthorized(javax.security.auth.Subject, java.net.URI)
     */
    @Override
	public boolean isAuthorized(Subject subject, URI resource) {
		return isAuthorized(subject, resource, null);
	}


    /**
     * Determine whether the given Subject is authorized to access the given resource,
     * specified by a URI.
     *
     * @param subject The Subject being tested.
     * @param resource URI of the resource being tested.
     * @param action The action, with respect to the resource parameter,
     * for which authorization is desired. To check authorization for all actions,
     * action is represented by null or "*".
     * @return True or false, depending on whether the access is authorized.
     * @throws IllegalArgumentException Given null or illegal subject or resource
     * @throws IllegalStateException Service was not initialized.
     * @see AuthorizationService#isAuthorized(javax.security.auth.Subject, java.net.URI, String)
     */
    @Override
    public boolean isAuthorized(final Subject subject, final URI resource, final String action) {

        checkServiceAvailability();

        // Validate inputs
        if ( null == subject ) {
            throw new IllegalArgumentException(localStrings.getLocalString("service.subject_null", "The supplied Subject is null."));
        }
        if ( null == resource ) {
            throw new IllegalArgumentException(localStrings.getLocalString("service.resource_null", "The supplied Resource is null."));
        }
        // Note: null action means all actions (i.e., no action condition)

        // Convert parameters
        AzSubject azSubject = makeAzSubject( subject );
        AzResource azResource = makeAzResource( resource );
        AzAction azAction = makeAzAction(action);

        AzResult azResult = getAuthorizationDecision(azSubject, azResource, azAction);

        boolean result =
            AzResult.Status.OK.equals(azResult.getStatus()) &&
            AzResult.Decision.PERMIT.equals(azResult.getDecision());
        return result;
	}


    /**
     * The primary authorization method.  The isAuthorized() methods call this method
     * after converting their arguments into the appropriate attribute collection type.
     * It returns a full AzResult, including authorization status, decision, and
     * obligations.
     *
     * This method performs two steps prior to invoking the configured AuthorizationProvider
     * to evaluate the request:  First, it acquires the current AzEnvironment attributes by
     * calling the Security Context service.  Second, it calls the Role Mapping service to
     * determine which roles the subject has, and adds the resulting role attributes into
     * the AzSubject.
     *
     * @param subject The attributes collection representing the Subject for which an authorization
     * decision is requested.
     * @param resource The attributes collection representing the resource for which access is
     * being requested.
     * @param action  The attributes collection representing the action, with respect to the resource,
     * for which access is being requested.  A null action is interpreted as all
     * actions, however all actions may also be represented by the AzAction instance.
     * See <code>{@link org.glassfish.security.services.api.authorization.AzAction}</code>.
     * @return The AzResult indicating the result of the access decision.
     * @throws IllegalArgumentException Given null or illegal subject or resource
     * @throws IllegalStateException Service was not initialized.
     * @see AuthorizationService#getAuthorizationDecision
     */
    @Override
    public AzResult getAuthorizationDecision(
            final AzSubject subject,
            final AzResource resource,
            final AzAction action) {

        checkServiceAvailability();

        // Validate inputs
        if ( null == subject ) {
            throw new IllegalArgumentException(localStrings.getLocalString("service.subject_null", "The supplied Subject is null."));
        }
        if ( null == resource ) {
            throw new IllegalArgumentException(localStrings.getLocalString("service.resource_null", "The supplied Resource is null."));
        }

        // TODO: setup current AzEnvironment instance. Should a null or empty instance to represent current environment?
        final AzEnvironment env = new AzEnvironmentImpl();
        final Attributes attrs = securityContextService.getEnvironmentAttributes();
        for (String attrName : attrs.getAttributeNames()) {
            env.addAttribute(attrName, attrs.getAttributeValue(attrName), true);
        }

        AzResult result =  provider.getAuthorizationDecision(
            subject, resource, action, env, attributeResolvers );

        if ( isDebug() ) {
            logger.log(DEBUG_LEVEL,
            "Authorization Service result for {0} was {1}.",
            new String[]{ subject.toString(), result.toString() } );
        }

        return result;
	}


    /**
     * Convert a Java Subject into a typed attributes collection.
     *
     * @param subject The Subject to convert.
     * @return The resulting AzSubject.
     * @throws IllegalArgumentException Given null or illegal subject
     * @see AuthorizationService#makeAzSubject(javax.security.auth.Subject)
     */
    @Override
    public AzSubject makeAzSubject(final Subject subject) {
        AzSubject azs = new AzSubjectImpl(subject);
        return azs;
    }


    /**
     * Convert a resource, expressed as a URI, into a typed attributes collection.
     * <p>
     * Query parameters in the given URI are appended to this
     * <code>AzResource</code> instance attributes collection.
     *
     * @param resource The URI to convert.
     * @return The resulting AzResource.
     * @see AuthorizationService#makeAzResource(java.net.URI)
     * @throws IllegalArgumentException Given null or illegal resource
     */
    @Override
    public AzResource makeAzResource(final URI resource) {
        AzResource azr = new AzResourceImpl( resource );
        return azr;
    }


    /**
     * Convert an action, expressed as a String, into a typed attributes collection.
     *
     * @param action The action to convert. null or "*" represents all actions.
     * @return The resulting AzAction.
     * @see AuthorizationService#makeAzAction(String)
     */
    @Override
    public AzAction makeAzAction(final String action) {
        AzAction aza = new AzActionImpl( action );
        return aza;
    }


    /**
     * Find an existing PolicyDeploymentContext, or create a new one if one does not
     * already exist for the specified appContext.  The context will be returned in
     * an "open" state, and will stay that way until commit() or delete() is called.
     *
     * @param appContext The application context for which the PolicyDeploymentContext
     * is desired.
     * @return The resulting PolicyDeploymentContext,
     * null if the configured providers do not support this feature.
     * @throws IllegalStateException Service was not initialized.
     * @see AuthorizationService#findOrCreateDeploymentContext(String)
     */
    @Override
    public PolicyDeploymentContext findOrCreateDeploymentContext(
            final String appContext) {

        checkServiceAvailability();

        // TODO: Unsupported Operation Exception undocumented, not optional

        return provider.findOrCreateDeploymentContext(appContext);
	}


    /**
     * Called when the instance has been created and the component is
     * about to be place into commission.
     * <p>
     * The component has been injected with any dependency and
     * will be placed into commission by the subsystem.
     * <p>
     * Hk2 will catch all unchecked exceptions,
     * and will consequently cause the backing inhabitant to be released.
     *
     * @see org.glassfish.hk2.api.PostConstruct#postConstruct()
     */
    @Override
    public void postConstruct() {

        org.glassfish.security.services.config.AuthorizationService atzConfiguration =
                ServiceFactory.getSecurityServiceConfiguration(
                        domain, org.glassfish.security.services.config.AuthorizationService.class);

        initialize(atzConfiguration);
    }


    /**
     * Appends the given <code>{@link org.glassfish.security.services.api.authorization.AzAttributeResolver}</code>
     * instance to the internal ordered list of <code>AzAttributeResolver</code> instances,
     * if not currently in the list based on
     * <code>{@link org.glassfish.security.services.api.authorization.AzAttributeResolver#equals}</code>.
     *
     * @param resolver The <code>AzAttributeResolver</code> instance to append.
     * @return true if the <code>AzAttributeResolver</code> was added,
     * false if the <code>AzAttributeResolver</code> was already in the list.
     * @throws IllegalArgumentException Given AzAttributeResolver was null.
     * @see AuthorizationService#appendAttributeResolver
     */
    @Override
    public boolean appendAttributeResolver(AzAttributeResolver resolver) {
        if ( null == resolver ) {
            throw new IllegalArgumentException(localStrings.getLocalString("service.resolver_null","The supplied Attribute Resolver is null."));
        }
        synchronized ( attributeResolvers ) {
            if ( !attributeResolvers.contains( resolver ) ) {
                attributeResolvers.add( resolver );
                return true;
            }
        }
        return false;
    }


    /**
     * Replaces the internal list of <code>AttributeResolver</code> instances
     * with the given list. If multiple equivalent instances exist in the given list,
     * only the first such instance will be inserted.
     *
     * @param resolverList Replacement list of <code>AzAttributeResolver</code> instances
     * @throws IllegalArgumentException Given AzAttributeResolver list was null.
     * @see AuthorizationService#setAttributeResolvers
     */
    @Override
    public void setAttributeResolvers(List<AzAttributeResolver> resolverList) {
        if ( null == resolverList ) {
            throw new IllegalArgumentException(localStrings.getLocalString("service.resolver_null","The supplied Attribute Resolver is null."));
        }

        synchronized ( attributeResolvers ) {
            attributeResolvers.clear();
            for ( AzAttributeResolver ar : resolverList ) {
                if ( (null != ar) && !attributeResolvers.contains(ar) ) {
                    attributeResolvers.add( ar );
                }
            }
        }
    }


    /**
     * Determines the current list of <code>AttributeResolver</code> instances,
     * in execution order.
     *
     * @return  The current list of AttributeResolver instances,
     * in execution order.
     * @see AuthorizationService#getAttributeResolvers
     */
    @Override
    public List<AzAttributeResolver> getAttributeResolvers() {
        return new ArrayList<AzAttributeResolver>( attributeResolvers );
    }


    /**
     * Removes all <code>AttributeResolver</code> instances from the current
     * internal list of <code>AttributeResolver</code> instances.
     *
     * @return true if any <code>AttributeResolver</code> instances were removed,
     * false if the list was empty.
     * @see AuthorizationService#removeAllAttributeResolvers
     */
    @Override
    public boolean removeAllAttributeResolvers() {
        synchronized ( attributeResolvers ) {
            if ( attributeResolvers.isEmpty() ) {
                return false;
            } else {
                attributeResolvers.clear();
                return true;
            }
        }
    }


    /**
     * Determines whether this service has been initialized.
     * @return The initialization state
     */
    final InitializationState getInitializationState() {
        return initialized;
    }


    /**
     * Determines the reason why the service failed to initialize.
     * @return The reason why the service failed to initialize,
     * null if initialization was successful or the failure reason was unknown.
     */
    final String getReasonInitializationFailed() {
        return reasonInitFailed;
    }


    /**
     * Checks whether this service is available.
     * @throws IllegalStateException This service is not available.
     */
    final void checkServiceAvailability() {
        if ( InitializationState.SUCCESS_INIT != getInitializationState() ) {
            throw new IllegalStateException(
                localStrings.getLocalString("service.atz.not_avail","The Authorization service is not available.") +
                getReasonInitializationFailed() );
        }
    }

	//
	// Log Messages
	//

	@LogMessageInfo(
			message = "Authorization Service has successfully initialized.",
			level = "INFO")
	private static final String ATZSVC_INITIALIZED = "SEC-SVCS-00100";

	@LogMessageInfo(
			message = "Authorization Service initialization failed, exception {0}, message {1}",
			level = "WARNING")
	private static final String ATZSVC_INIT_FAILED = "SEC-SVCS-00101";
}