You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@directory.apache.org by sm...@apache.org on 2018/08/27 16:55:53 UTC
directory-fortress-core git commit: FC-239 + access mgr tests
Repository: directory-fortress-core
Updated Branches:
refs/heads/master 9e7694fa7 -> 571984d88
FC-239 + access mgr tests
Project: http://git-wip-us.apache.org/repos/asf/directory-fortress-core/repo
Commit: http://git-wip-us.apache.org/repos/asf/directory-fortress-core/commit/571984d8
Tree: http://git-wip-us.apache.org/repos/asf/directory-fortress-core/tree/571984d8
Diff: http://git-wip-us.apache.org/repos/asf/directory-fortress-core/diff/571984d8
Branch: refs/heads/master
Commit: 571984d886bf6df113e73bfeeaf51ffaeb3870cb
Parents: 9e7694f
Author: Shawn McKinney <sm...@apache.org>
Authored: Mon Aug 27 11:45:18 2018 -0500
Committer: Shawn McKinney <sm...@apache.org>
Committed: Mon Aug 27 11:45:18 2018 -0500
----------------------------------------------------------------------
.../directory/fortress/core/AccessMgr.java | 2 +-
.../directory/fortress/core/GlobalErrIds.java | 4 +
.../core/util/time/UserRoleConstraint.java | 8 +-
.../fortress/core/impl/AccessMgrImplTest.java | 162 ++++++++++++++++++-
.../fortress/core/impl/ConfigMgrImplTest.java | 103 ++++++++++++
.../fortress/core/impl/ConfigTestData.java | 50 ++++++
.../fortress/core/impl/FortressJUnitTest.java | 4 +
7 files changed, 330 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/directory-fortress-core/blob/571984d8/src/main/java/org/apache/directory/fortress/core/AccessMgr.java
----------------------------------------------------------------------
diff --git a/src/main/java/org/apache/directory/fortress/core/AccessMgr.java b/src/main/java/org/apache/directory/fortress/core/AccessMgr.java
index 297e9ef..cf8f83d 100755
--- a/src/main/java/org/apache/directory/fortress/core/AccessMgr.java
+++ b/src/main/java/org/apache/directory/fortress/core/AccessMgr.java
@@ -186,7 +186,7 @@ public interface AccessMgr extends Manageable
* @param user Contains {@link User#userId}, {@link org.apache.directory.fortress.core.model.User#password}
* (optional if {@code isTrusted} is 'true'), optional {@link User#roles}, optional
* {@link org.apache.directory.fortress.core.model.User#adminRoles}
- * @param constraint Contains {@link RoleConstraint#key}, {@link RoleConstraint#value}, bound for role activation checks.
+ * @param constraint Contains case-sensitive {@link RoleConstraint#key}, {@link RoleConstraint#value}, bound for role activation checks.
* (optional if {@code isTrusted} is 'true'), optional {@link User#roles}, optional
* {@link org.apache.directory.fortress.core.model.User#adminRoles}
* @param isTrusted if true password is not required.
http://git-wip-us.apache.org/repos/asf/directory-fortress-core/blob/571984d8/src/main/java/org/apache/directory/fortress/core/GlobalErrIds.java
----------------------------------------------------------------------
diff --git a/src/main/java/org/apache/directory/fortress/core/GlobalErrIds.java b/src/main/java/org/apache/directory/fortress/core/GlobalErrIds.java
index 51ffdab..0cbe976 100755
--- a/src/main/java/org/apache/directory/fortress/core/GlobalErrIds.java
+++ b/src/main/java/org/apache/directory/fortress/core/GlobalErrIds.java
@@ -509,6 +509,10 @@ public final class GlobalErrIds
*/
public static final int ACTV_FAILED_ABAC = 2058;
/**
+ * Entity activation failed, the ABAC constraint key was not found in user context.
+ */
+ public static final int ACTV_FAILED_ABAC_NO_KEY_FOUND = 2059;
+ /**
* 3000's - Permission Entity
*/
http://git-wip-us.apache.org/repos/asf/directory-fortress-core/blob/571984d8/src/main/java/org/apache/directory/fortress/core/util/time/UserRoleConstraint.java
----------------------------------------------------------------------
diff --git a/src/main/java/org/apache/directory/fortress/core/util/time/UserRoleConstraint.java b/src/main/java/org/apache/directory/fortress/core/util/time/UserRoleConstraint.java
index 28dad62..f124c6e 100644
--- a/src/main/java/org/apache/directory/fortress/core/util/time/UserRoleConstraint.java
+++ b/src/main/java/org/apache/directory/fortress/core/util/time/UserRoleConstraint.java
@@ -26,6 +26,8 @@ import org.apache.directory.fortress.core.model.RoleConstraint;
import org.apache.directory.fortress.core.model.Session;
import org.apache.directory.fortress.core.util.Config;
import org.apache.directory.fortress.core.util.VUtil;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
/**
* This class performs dynamic constraint validation on role activation, per FC-235
@@ -35,6 +37,9 @@ import org.apache.directory.fortress.core.util.VUtil;
public class UserRoleConstraint
implements Validator
{
+ private static final String CLS_NM = UserRoleConstraint.class.getName();
+ private static final Logger LOG = LoggerFactory.getLogger( CLS_NM );
+
/**
* This method is called during entity activation, {@link org.apache.directory.fortress.core.util.VUtil#validateConstraints} and ensures role has a
* matching constraint value.
@@ -61,7 +66,8 @@ public class UserRoleConstraint
if( StringUtils.isEmpty( constraintValue ) || role.getConstraints().isEmpty() )
{
// This user does not have a corresponding property applied to a role that has a runtime constraint set -OR- Have no applicable role constraint.
- rc = GlobalErrIds.ACTV_FAILED_ABAC;
+ rc = GlobalErrIds.ACTV_FAILED_ABAC_NO_KEY_FOUND;
+ LOG.warn( "User: {}, property: {} not found matching role: {}, constraint: ", session.getUserId(), constraintType, role.getName() );
}
else
{
http://git-wip-us.apache.org/repos/asf/directory-fortress-core/blob/571984d8/src/test/java/org/apache/directory/fortress/core/impl/AccessMgrImplTest.java
----------------------------------------------------------------------
diff --git a/src/test/java/org/apache/directory/fortress/core/impl/AccessMgrImplTest.java b/src/test/java/org/apache/directory/fortress/core/impl/AccessMgrImplTest.java
index f8e0f29..f987d7f 100755
--- a/src/test/java/org/apache/directory/fortress/core/impl/AccessMgrImplTest.java
+++ b/src/test/java/org/apache/directory/fortress/core/impl/AccessMgrImplTest.java
@@ -35,6 +35,7 @@ import org.apache.directory.fortress.core.model.SDSet;
import org.apache.directory.fortress.core.model.Session;
import org.apache.directory.fortress.core.model.User;
import org.apache.directory.fortress.core.model.UserRole;
+import org.apache.directory.fortress.core.model.RoleConstraint;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -69,8 +70,10 @@ public class AccessMgrImplTest extends TestCase
suite.addTest( new AdminMgrImplTest( "testLockUserAccount" ) );
suite.addTest( new AccessMgrImplTest( "testAuthenticateLocked" ) );
suite.addTest( new AdminMgrImplTest( "testUnlockUserAccount" ) );
-*/
suite.addTest( new AccessMgrImplTest( "testCheckAccess" ) );
+*/
+ suite.addTest( new AccessMgrImplTest( "testAbacConstraintsRole" ) );
+
return suite;
}
@@ -1282,4 +1285,161 @@ public class AccessMgrImplTest extends TestCase
fail( ex.getMessage() );
}
}
+
+
+ /**
+ * Test the Rbac-Abac curly,moe,larry use cases.
+ *
+ */
+ public void testAbacConstraintsRole()
+ {
+
+ createSessionsConstraints( "ABAC RBAC", RoleTestData.ROLE_CONSTRAINTS_TR18_ABAC );
+ }
+
+ public static void createSessionsConstraints( String msg, String[][] cArray )
+ {
+ LogUtil.logIt( msg );
+ String TELLERS = "tellers"; // DSD excluded from washer
+ String WASHERS = "washers"; // DSD excluded from tellerr
+ String NORTH = "north";
+ String SOUTH = "south";
+ String EAST = "east";
+ String CURLY = "curly"; // Head Teller of the East, Coin Washer in North and South
+ String MOE = "moe"; // Head Teller of the North, Coin Washer in East and South
+ String LARRY = "larry"; // Head Teller of the South, Coin Washer in North and East
+
+ try
+ {
+ AccessMgr accessMgr = AccessMgrFactory.createInstance( TestUtils.getContext() );
+ for( String[] cons : cArray )
+ {
+ UserRole uRole = RoleTestData.getUserRoleConstraintAbac( cons );
+ User user = new User( uRole.getUserId() );
+ RoleConstraint constraint = uRole.getConstraints().get( 0 );
+ Session session = accessMgr.createSession( user, constraint, true );
+ assertNotNull( session );
+ if( uRole.getName().equalsIgnoreCase( TELLERS ))
+ {
+ List<UserRole> actRoles = session.getRoles();
+ for( UserRole actRole : actRoles )
+ {
+ // Someone with Teller role cannot activate Washer.
+ if( actRole.getName().equalsIgnoreCase( WASHERS ))
+ {
+ fail( CLS_NM + ".createSessionsConstraints " + TELLERS + " cannot contain " + WASHERS +", user: " + uRole.getUserId() + ", constraint value: " + constraint.getValue() );
+ }
+ }
+ if( constraint.getValue().equalsIgnoreCase( EAST ))
+ {
+ // Only Curly is an East Teller
+ if( !uRole.getUserId().equalsIgnoreCase( CURLY ))
+ {
+ fail( CLS_NM + ".createSessionsConstraints " + TELLERS + "," + EAST +" invalid relationship, user: " + uRole.getUserId() + ", role name: " + uRole.getName() + ", constraint value: " + constraint.getValue() );
+ }
+ }
+ else if( constraint.getValue().equalsIgnoreCase( NORTH ))
+ {
+ // Only Moe is North Teller
+ if( !uRole.getUserId().equalsIgnoreCase( MOE ))
+ {
+ fail( CLS_NM + ".createSessionsConstraints " + TELLERS + "," + NORTH + " invalid relationship, user: " + uRole.getUserId() + ", role name: " + uRole.getName() + ", constraint value: " + constraint.getValue() );
+ }
+ }
+ else if( constraint.getValue().equalsIgnoreCase( SOUTH ))
+ {
+ // Only Larry is South Teller
+ if( !uRole.getUserId().equalsIgnoreCase( LARRY ))
+ {
+ fail( CLS_NM + ".createSessionsConstraints " + TELLERS + "," + SOUTH + " invalid relationship, user: " + uRole.getUserId() + ", role name: " + uRole.getName() + ", constraint value: " + constraint.getValue() );
+ }
+ }
+ // Invalid test case
+ else
+ {
+ fail( CLS_NM + ".createSessionsConstraints " + TELLERS + " invalid test role: " + uRole.getName() + ", constraint value: " + constraint.getValue() );
+ }
+
+ // Verify that the Teller has access to the account operations:
+ for( String[] op : PermTestData.ABAC_ACCOUNT_OPS )
+ {
+ Permission validPOp = PermTestData.getOp( PermTestData.getName( PermTestData.ABAC_ACCOUNT_OBJS[0] ), op );
+ boolean result = accessMgr.checkAccess( session, validPOp );
+ assertTrue( CLS_NM +
+ ".createSessionsConstraints failed checkAccess USER [" + user.getUserId() +
+ "] PERM Obj [" + validPOp.getObjName() + "] " +
+ "OPER [" + validPOp.getOpName() + "]",
+ result );
+ }
+ }
+ // Verify the Washer has access to currency operations:
+ else if( uRole.getName().equalsIgnoreCase( WASHERS ))
+ {
+ List<UserRole> actRoles = session.getRoles();
+ for( UserRole actRole : actRoles )
+ {
+ // Someone with Washer role cannot activate Teller.
+ if( actRole.getName().equalsIgnoreCase( TELLERS ))
+ {
+ fail( CLS_NM + ".createSessionsConstraints " + WASHERS + " cannot contain " + TELLERS +", user: " + uRole.getUserId() + ", constraint value: " + constraint.getValue() );
+ }
+ }
+ if( constraint.getValue().equalsIgnoreCase( EAST ))
+ {
+ // Curly cannot be an East Washer
+ if( uRole.getUserId().equalsIgnoreCase( CURLY ))
+ {
+ fail( CLS_NM + ".createSessionsConstraints " + WASHERS + "," + EAST + " invalid relationship, user: " + uRole.getUserId() + ", role name: " + uRole.getName() + ", constraint value: " + constraint.getValue() );
+ }
+ }
+ else if( constraint.getValue().equalsIgnoreCase( NORTH ))
+ {
+ // Moe cannot be a North Washer
+ if( uRole.getUserId().equalsIgnoreCase( MOE ))
+ {
+ fail( CLS_NM + ".createSessionsConstraints " + WASHERS + ","+ NORTH + " invalid relationship, user: " + uRole.getUserId() + ", role name: " + uRole.getName() + ", constraint value: " + constraint.getValue() );
+ }
+ }
+ else if( constraint.getValue().equalsIgnoreCase( SOUTH ))
+ {
+ // Larry cannot be a South Washer
+ if( uRole.getUserId().equalsIgnoreCase( LARRY ))
+ {
+ fail( CLS_NM + ".createSessionsConstraints " + WASHERS + "," + SOUTH + " invalid relationship, user: " + uRole.getUserId() + ", role name: " + uRole.getName() + ", constraint value: " + constraint.getValue() );
+ }
+ }
+ // Invalid test case
+ else
+ {
+ fail( CLS_NM + ".createSessionsConstraints " + WASHERS + " invalid test role: " + uRole.getName() + ", constraint value: " + constraint.getValue() );
+ }
+ // Verify that the Washer has access to the currency operations:
+ for( String[] op : PermTestData.ABAC_CURRENCY_OPS )
+ {
+ Permission validPOp = PermTestData.getOp( PermTestData.getName( PermTestData.ABAC_CURRENCY_OBJS[0] ), op );
+ boolean result = accessMgr.checkAccess( session, validPOp );
+ assertTrue( CLS_NM +
+ ".createSessionsConstraints failed checkAccess USER [" + user.getUserId() +
+ "] PERM Obj [" + validPOp.getObjName() + "] " +
+ "OPER [" + validPOp.getOpName() + "]",
+ result );
+ }
+ }
+ // Invalid test case
+ else
+ {
+ fail( CLS_NM + ".createSessionsConstraints invalid test role: " + uRole.getName() );
+ }
+
+ }
+ LOG.debug( "createSessionsConstraints successful" );
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error(
+ "createSessionsConstraints: failed with SecurityException rc=" + ex.getErrorId() + ", msg="
+ + ex.getMessage(), ex );
+ fail( ex.getMessage() );
+ }
+ }
}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/directory-fortress-core/blob/571984d8/src/test/java/org/apache/directory/fortress/core/impl/ConfigMgrImplTest.java
----------------------------------------------------------------------
diff --git a/src/test/java/org/apache/directory/fortress/core/impl/ConfigMgrImplTest.java b/src/test/java/org/apache/directory/fortress/core/impl/ConfigMgrImplTest.java
new file mode 100644
index 0000000..45b3479
--- /dev/null
+++ b/src/test/java/org/apache/directory/fortress/core/impl/ConfigMgrImplTest.java
@@ -0,0 +1,103 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.directory.fortress.core.impl;
+
+import java.util.Properties;
+
+import org.apache.directory.fortress.core.ConfigMgr;
+import org.apache.directory.fortress.core.ConfigMgrFactory;
+import org.apache.directory.fortress.core.SecurityException;
+import org.apache.directory.fortress.core.util.LogUtil;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import junit.framework.TestCase;
+
+public class ConfigMgrImplTest extends TestCase
+{
+ private static final String CLS_NM = ConfigMgrImplTest.class.getName();
+ private static final Logger LOG = LoggerFactory.getLogger( CLS_NM );
+
+ public ConfigMgrImplTest( String name )
+ {
+ super( name );
+ }
+
+ public void testCrudProperties()
+ {
+ }
+
+ public void testAddAbacConfig()
+ {
+ addConfig( "ADD ABAC RBAC CFG", ConfigTestData.ABAC_SAMPLE1 );
+ }
+
+ private void addConfig(String msg, String[][] cfgArrays )
+ {
+ LogUtil.logIt( msg );
+ Properties props = new Properties();
+ for(String[] cArray : cfgArrays )
+ {
+ props.setProperty( cArray[ConfigTestData.NAME_COL], cArray[ConfigTestData.VALUE_COL] );
+ }
+ try
+ {
+ ConfigMgr cMgr = getConfigMgr();
+ cMgr.update( cfgArrays[0][ConfigTestData.REALM_COL], props);
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error(
+ "addConfig caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(), ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+ public void testDelAbacConfig()
+ {
+ delConfig( "DEL ABAC RBAC CFG", ConfigTestData.ABAC_SAMPLE1 );
+ }
+
+ private void delConfig(String msg, String[][] cfgArrays )
+ {
+ LogUtil.logIt( msg );
+ Properties props = new Properties();
+ for(String[] cArray : cfgArrays )
+ {
+ props.setProperty( cArray[ConfigTestData.NAME_COL], cArray[ConfigTestData.VALUE_COL] );
+ }
+ try
+ {
+ ConfigMgr cMgr = getConfigMgr();
+ cMgr.delete( cfgArrays[0][ConfigTestData.REALM_COL], props );
+ }
+ catch ( SecurityException ex )
+ {
+ LOG.error(
+ "delConfig caught SecurityException rc=" + ex.getErrorId() + ", msg=" + ex.getMessage(), ex );
+ fail( ex.getMessage() );
+ }
+ }
+
+ public static ConfigMgr getConfigMgr() throws SecurityException
+ {
+ return ConfigMgrFactory.createInstance( );
+ }
+}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/directory-fortress-core/blob/571984d8/src/test/java/org/apache/directory/fortress/core/impl/ConfigTestData.java
----------------------------------------------------------------------
diff --git a/src/test/java/org/apache/directory/fortress/core/impl/ConfigTestData.java b/src/test/java/org/apache/directory/fortress/core/impl/ConfigTestData.java
new file mode 100644
index 0000000..fa5beca
--- /dev/null
+++ b/src/test/java/org/apache/directory/fortress/core/impl/ConfigTestData.java
@@ -0,0 +1,50 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.directory.fortress.core.impl;
+
+
+import junit.framework.TestCase;
+
+/**
+ * Description of the Class
+ *
+ * @author <a href="mailto:dev@directory.apache.org">Apache Directory Project</a>
+ */
+public class ConfigTestData extends TestCase
+{
+ public final static int REALM_COL = 0;
+ public final static int NAME_COL = 1;
+ public final static int VALUE_COL = 2;
+
+ final public static String[][] ABAC_SAMPLE1 =
+ {
+ {
+ "Default", /* REALM_COL */
+ "Tellers", /* NAME_COL */
+ "locale", /* VALUE_COL */
+ },
+ {
+ "Default", /* CONFIG_REALM_COL */
+ "Washers", /* NAME_COL */
+ "locale", /* VALUE_COL */
+ }
+ };
+
+}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/directory-fortress-core/blob/571984d8/src/test/java/org/apache/directory/fortress/core/impl/FortressJUnitTest.java
----------------------------------------------------------------------
diff --git a/src/test/java/org/apache/directory/fortress/core/impl/FortressJUnitTest.java b/src/test/java/org/apache/directory/fortress/core/impl/FortressJUnitTest.java
index f0d2451..42d9b6a 100755
--- a/src/test/java/org/apache/directory/fortress/core/impl/FortressJUnitTest.java
+++ b/src/test/java/org/apache/directory/fortress/core/impl/FortressJUnitTest.java
@@ -112,6 +112,8 @@ public class FortressJUnitTest extends TestCase
suite.addTest( new PswdPolicyMgrImplTest( "testDeletePasswordPolicy" ) );
}
+ suite.addTest( new ConfigMgrImplTest( "testDelAbacConfig" ) );
+
// GroupMgr
suite.addTest( new GroupMgrImplTest( "testDeassignGroupRoleMember" ) );
suite.addTest( new GroupMgrImplTest( "testDeassignGroupUserMember" ) );
@@ -308,6 +310,8 @@ public class FortressJUnitTest extends TestCase
suite.addTest( new AccessMgrImplTest( "testSessionPermission" ) );
suite.addTest( new AccessMgrImplTest( "testCreateSessionWithRole" ) );
suite.addTest( new AccessMgrImplTest( "testCreateSessionWithRolesTrusted" ) );
+ suite.addTest( new ConfigMgrImplTest( "testAddAbacConfig" ) );
+ suite.addTest( new AccessMgrImplTest( "testAbacConstraintsRole" ) );
// PwPolicyMgr PW Policy checks:
if ( Config.getInstance().isOpenldap() || Config.getInstance().isApacheds() )