You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@karaf.apache.org by gn...@apache.org on 2012/11/06 11:14:05 UTC
svn commit: r1406082 - in /karaf/branches/karaf-2.3.x: ./
assemblies/apache-karaf/ assemblies/apache-karaf/src/main/descriptors/
assemblies/apache-karaf/src/main/distribution/text/etc/
assemblies/apache-karaf/src/main/filtered-resources/etc/ assemblies...
Author: gnodet
Date: Tue Nov 6 10:14:03 2012
New Revision: 1406082
URL: http://svn.apache.org/viewvc?rev=1406082&view=rev
Log:
[KARAF-979] Secure shell commands
Added:
karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/distribution/text/etc/org.apache.karaf.jaas.authz.cfg
karaf/branches/karaf-2.3.x/jaas/authz/
karaf/branches/karaf-2.3.x/jaas/authz/pom.xml
- copied, changed from r1405719, karaf/branches/karaf-2.3.x/shell/ssh/pom.xml
karaf/branches/karaf-2.3.x/jaas/authz/src/
karaf/branches/karaf-2.3.x/jaas/authz/src/main/
karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/
karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/
karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/
karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/
karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/
karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/
karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/AuthorizationService.java
karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/impl/
karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/impl/AuthorizationEntry.java
karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/impl/AuthorizationServiceImpl.java
karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/impl/WildcardPermission.java
karaf/branches/karaf-2.3.x/jaas/authz/src/main/resources/
karaf/branches/karaf-2.3.x/jaas/authz/src/main/resources/OSGI-INF/
karaf/branches/karaf-2.3.x/jaas/authz/src/main/resources/OSGI-INF/blueprint/
karaf/branches/karaf-2.3.x/jaas/authz/src/main/resources/OSGI-INF/blueprint/jaas-authz.xml
- copied, changed from r1405719, karaf/branches/karaf-2.3.x/shell/console/src/main/resources/OSGI-INF/blueprint/shell-namespacehandler.xml
karaf/branches/karaf-2.3.x/jaas/authz/src/main/resources/OSGI-INF/bundle.info
karaf/branches/karaf-2.3.x/jaas/authz/src/main/resources/org/
karaf/branches/karaf-2.3.x/jaas/authz/src/main/resources/org/apache/
karaf/branches/karaf-2.3.x/jaas/authz/src/main/resources/org/apache/karaf/
karaf/branches/karaf-2.3.x/jaas/authz/src/main/resources/org/apache/karaf/jaas/
karaf/branches/karaf-2.3.x/jaas/authz/src/main/resources/org/apache/karaf/jaas/authz/
karaf/branches/karaf-2.3.x/jaas/authz/src/main/resources/org/apache/karaf/jaas/authz/karaf-authz-1.0.0.xsd
Modified:
karaf/branches/karaf-2.3.x/assemblies/apache-karaf/pom.xml
karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/descriptors/unix-bin.xml
karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/descriptors/unix-minimal-bin.xml
karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/descriptors/windows-bin.xml
karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/descriptors/windows-minimal-bin.xml
karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/filtered-resources/etc/startup.properties
karaf/branches/karaf-2.3.x/assemblies/features/standard/src/main/resources/features.xml
karaf/branches/karaf-2.3.x/jaas/pom.xml
karaf/branches/karaf-2.3.x/pom.xml
karaf/branches/karaf-2.3.x/shell/console/pom.xml
karaf/branches/karaf-2.3.x/shell/console/src/main/java/org/apache/karaf/shell/console/commands/BlueprintCommand.java
karaf/branches/karaf-2.3.x/shell/console/src/main/java/org/apache/karaf/shell/console/commands/NamespaceHandler.java
karaf/branches/karaf-2.3.x/shell/console/src/main/resources/OSGI-INF/blueprint/shell-namespacehandler.xml
karaf/branches/karaf-2.3.x/shell/ssh/pom.xml
Modified: karaf/branches/karaf-2.3.x/assemblies/apache-karaf/pom.xml
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/assemblies/apache-karaf/pom.xml?rev=1406082&r1=1406081&r2=1406082&view=diff
==============================================================================
--- karaf/branches/karaf-2.3.x/assemblies/apache-karaf/pom.xml (original)
+++ karaf/branches/karaf-2.3.x/assemblies/apache-karaf/pom.xml Tue Nov 6 10:14:03 2012
@@ -167,6 +167,10 @@
<artifactId>org.apache.karaf.jaas.command</artifactId>
</dependency>
<dependency>
+ <groupId>org.apache.karaf.jaas</groupId>
+ <artifactId>org.apache.karaf.jaas.authz</artifactId>
+ </dependency>
+ <dependency>
<groupId>org.apache.karaf.management</groupId>
<artifactId>org.apache.karaf.management.server</artifactId>
</dependency>
Modified: karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/descriptors/unix-bin.xml
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/descriptors/unix-bin.xml?rev=1406082&r1=1406081&r2=1406082&view=diff
==============================================================================
--- karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/descriptors/unix-bin.xml (original)
+++ karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/descriptors/unix-bin.xml Tue Nov 6 10:14:03 2012
@@ -256,6 +256,7 @@
<include>org.apache.karaf.jaas:org.apache.karaf.jaas.config</include>
<include>org.apache.karaf.jaas:org.apache.karaf.jaas.modules</include>
<include>org.apache.karaf.jaas:org.apache.karaf.jaas.command</include>
+ <include>org.apache.karaf.jaas:org.apache.karaf.jaas.authz</include>
</includes>
</dependencySet>
<dependencySet>
Modified: karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/descriptors/unix-minimal-bin.xml
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/descriptors/unix-minimal-bin.xml?rev=1406082&r1=1406081&r2=1406082&view=diff
==============================================================================
--- karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/descriptors/unix-minimal-bin.xml (original)
+++ karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/descriptors/unix-minimal-bin.xml Tue Nov 6 10:14:03 2012
@@ -225,6 +225,7 @@
<include>org.apache.karaf.jaas:org.apache.karaf.jaas.config</include>
<include>org.apache.karaf.jaas:org.apache.karaf.jaas.modules</include>
<include>org.apache.karaf.jaas:org.apache.karaf.jaas.command</include>
+ <include>org.apache.karaf.jaas:org.apache.karaf.jaas.authz</include>
</includes>
</dependencySet>
<dependencySet>
Modified: karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/descriptors/windows-bin.xml
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/descriptors/windows-bin.xml?rev=1406082&r1=1406081&r2=1406082&view=diff
==============================================================================
--- karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/descriptors/windows-bin.xml (original)
+++ karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/descriptors/windows-bin.xml Tue Nov 6 10:14:03 2012
@@ -243,6 +243,7 @@
<include>org.apache.karaf.jaas:org.apache.karaf.jaas.config</include>
<include>org.apache.karaf.jaas:org.apache.karaf.jaas.modules</include>
<include>org.apache.karaf.jaas:org.apache.karaf.jaas.command</include>
+ <include>org.apache.karaf.jaas:org.apache.karaf.jaas.authz</include>
</includes>
</dependencySet>
<dependencySet>
Modified: karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/descriptors/windows-minimal-bin.xml
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/descriptors/windows-minimal-bin.xml?rev=1406082&r1=1406081&r2=1406082&view=diff
==============================================================================
--- karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/descriptors/windows-minimal-bin.xml (original)
+++ karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/descriptors/windows-minimal-bin.xml Tue Nov 6 10:14:03 2012
@@ -215,6 +215,7 @@
<include>org.apache.karaf.jaas:org.apache.karaf.jaas.config</include>
<include>org.apache.karaf.jaas:org.apache.karaf.jaas.modules</include>
<include>org.apache.karaf.jaas:org.apache.karaf.jaas.command</include>
+ <include>org.apache.karaf.jaas:org.apache.karaf.jaas.authz</include>
</includes>
</dependencySet>
<dependencySet>
Added: karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/distribution/text/etc/org.apache.karaf.jaas.authz.cfg
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/distribution/text/etc/org.apache.karaf.jaas.authz.cfg?rev=1406082&view=auto
==============================================================================
--- karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/distribution/text/etc/org.apache.karaf.jaas.authz.cfg (added)
+++ karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/distribution/text/etc/org.apache.karaf.jaas.authz.cfg Tue Nov 6 10:14:03 2012
@@ -0,0 +1,18 @@
+#
+# Copyright (C) FuseSource, Inc.
+# http://fusesource.com
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+acls=<entries xmlns="http://karaf.apache.org/xmlns/authz/v1.0.0"><entry permission="*" roles="*"/></entries>
Modified: karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/filtered-resources/etc/startup.properties
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/filtered-resources/etc/startup.properties?rev=1406082&r1=1406081&r2=1406082&view=diff
==============================================================================
--- karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/filtered-resources/etc/startup.properties (original)
+++ karaf/branches/karaf-2.3.x/assemblies/apache-karaf/src/main/filtered-resources/etc/startup.properties Tue Nov 6 10:14:03 2012
@@ -51,6 +51,7 @@ org/apache/karaf/shell/org.apache.karaf.
org/apache/karaf/jaas/org.apache.karaf.jaas.config/${project.version}/org.apache.karaf.jaas.config-${project.version}.jar=30
org/apache/karaf/jaas/org.apache.karaf.jaas.modules/${project.version}/org.apache.karaf.jaas.modules-${project.version}.jar=30
org/apache/karaf/jaas/org.apache.karaf.jaas.command/${project.version}/org.apache.karaf.jaas.command-${project.version}.jar=30
+org/apache/karaf/jaas/org.apache.karaf.jaas.authz/${project.version}/org.apache.karaf.jaas.authz-${project.version}.jar=30
org/apache/karaf/features/org.apache.karaf.features.core/${project.version}/org.apache.karaf.features.core-${project.version}.jar=30
org/apache/karaf/features/org.apache.karaf.features.command/${project.version}/org.apache.karaf.features.command-${project.version}.jar=30
org/apache/karaf/features/org.apache.karaf.features.management/${project.version}/org.apache.karaf.features.management-${project.version}.jar=30
Modified: karaf/branches/karaf-2.3.x/assemblies/features/standard/src/main/resources/features.xml
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/assemblies/features/standard/src/main/resources/features.xml?rev=1406082&r1=1406081&r2=1406082&view=diff
==============================================================================
--- karaf/branches/karaf-2.3.x/assemblies/features/standard/src/main/resources/features.xml (original)
+++ karaf/branches/karaf-2.3.x/assemblies/features/standard/src/main/resources/features.xml Tue Nov 6 10:14:03 2012
@@ -41,6 +41,7 @@
<bundle start-level="30">mvn:org.apache.karaf.jaas/org.apache.karaf.jaas.config/${project.version}</bundle>
<bundle start-level="30">mvn:org.apache.karaf.jaas/org.apache.karaf.jaas.modules/${project.version}</bundle>
<bundle start-level="30">mvn:org.apache.karaf.jaas/org.apache.karaf.jaas.command/${project.version}</bundle>
+ <bundle start-level="30">mvn:org.apache.karaf.jaas/org.apache.karaf.jaas.authz/${project.version}</bundle>
<bundle start-level="25">mvn:org.apache.karaf.features/org.apache.karaf.features.core/${project.version}</bundle>
<bundle start-level="30">mvn:org.apache.karaf.features/org.apache.karaf.features.command/${project.version}</bundle>
<bundle start-level="30">mvn:org.apache.karaf.features/org.apache.karaf.features.management/${project.version}</bundle>
Copied: karaf/branches/karaf-2.3.x/jaas/authz/pom.xml (from r1405719, karaf/branches/karaf-2.3.x/shell/ssh/pom.xml)
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/jaas/authz/pom.xml?p2=karaf/branches/karaf-2.3.x/jaas/authz/pom.xml&p1=karaf/branches/karaf-2.3.x/shell/ssh/pom.xml&r1=1405719&r2=1406082&rev=1406082&view=diff
==============================================================================
--- karaf/branches/karaf-2.3.x/shell/ssh/pom.xml (original)
+++ karaf/branches/karaf-2.3.x/jaas/authz/pom.xml Tue Nov 6 10:14:03 2012
@@ -22,16 +22,16 @@
<modelVersion>4.0.0</modelVersion>
<parent>
- <groupId>org.apache.karaf.shell</groupId>
- <artifactId>shell</artifactId>
+ <groupId>org.apache.karaf.jaas</groupId>
+ <artifactId>jaas</artifactId>
<version>2.3.1-SNAPSHOT</version>
<relativePath>../pom.xml</relativePath>
</parent>
- <artifactId>org.apache.karaf.shell.ssh</artifactId>
+ <artifactId>org.apache.karaf.jaas.authz</artifactId>
<packaging>bundle</packaging>
- <name>Apache Karaf :: Shell :: SSH</name>
- <description>This bundle provides SSH support to the Karaf console.</description>
+ <name>Apache Karaf :: JAAS :: Authorization</name>
+ <description>Karaf authorization service.</description>
<properties>
<appendedResourcesDirectory>${basedir}/../../etc/appended-resources</appendedResourcesDirectory>
@@ -39,38 +39,25 @@
<dependencies>
<dependency>
- <groupId>org.apache.karaf.shell</groupId>
- <artifactId>org.apache.karaf.shell.console</artifactId>
+ <groupId>org.apache.karaf.jaas</groupId>
+ <artifactId>org.apache.karaf.jaas.boot</artifactId>
+ <scope>provided</scope>
</dependency>
-
<dependency>
- <groupId>org.osgi</groupId>
- <artifactId>org.osgi.core</artifactId>
+ <groupId>org.slf4j</groupId>
+ <artifactId>slf4j-api</artifactId>
<scope>provided</scope>
</dependency>
-
<dependency>
<groupId>org.osgi</groupId>
- <artifactId>org.osgi.compendium</artifactId>
+ <artifactId>org.osgi.core</artifactId>
<scope>provided</scope>
</dependency>
-
<dependency>
- <groupId>org.apache.felix</groupId>
- <artifactId>org.apache.felix.gogo.runtime</artifactId>
+ <groupId>org.apache.aries.blueprint</groupId>
+ <artifactId>org.apache.aries.blueprint.core</artifactId>
<scope>provided</scope>
</dependency>
-
- <dependency>
- <groupId>org.apache.servicemix.bundles</groupId>
- <artifactId>org.apache.servicemix.bundles.junit</artifactId>
- <scope>test</scope>
- </dependency>
-
- <dependency>
- <groupId>org.apache.sshd</groupId>
- <artifactId>sshd-core</artifactId>
- </dependency>
</dependencies>
<build>
@@ -95,14 +82,11 @@
<artifactId>maven-bundle-plugin</artifactId>
<configuration>
<instructions>
- <Import-Package>
- org.apache.felix.service.command,
- org.apache.felix.gogo.commands,
- org.apache.karaf.shell.console,
- org.apache.sshd.server.keyprovider,
- org.apache.sshd.server.jaas,
- *
- </Import-Package>
+ <Export-Package>${project.artifactId};version=${project.version}</Export-Package>
+ <Import-Package>!${project.artifactId},*</Import-Package>
+ <Private-Package>
+ ${project.artifactId}.impl;-split-package:=merge-first,
+ </Private-Package>
</instructions>
</configuration>
</plugin>
Added: karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/AuthorizationService.java
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/AuthorizationService.java?rev=1406082&view=auto
==============================================================================
--- karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/AuthorizationService.java (added)
+++ karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/AuthorizationService.java Tue Nov 6 10:14:03 2012
@@ -0,0 +1,114 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.karaf.jaas.authz;
+
+import java.util.List;
+import javax.security.auth.Subject;
+
+/**
+ * The <code>AuthorizationService</code> interface allows bundles
+ * to apply authorization based security mechanisms to various
+ * operations.
+ *
+ * Each principal is represented in its string form by concatenating
+ * the principal class name with the principal name, separated by a
+ * column.
+ *
+ */
+public interface AuthorizationService {
+
+ /**
+ * Retrieve the list of principals associated to a given subject.
+ *
+ * @param subject the JAAS subject
+ * @return the list of principals
+ */
+ List<String> getPrincipals(Subject subject);
+
+ /**
+ * Asserts that the subject has the given permission.
+ *
+ * @param subject the subject
+ * @param permission the permission to check
+ * @throws SecurityException if the subject does not have the needed permission
+ */
+ void checkPermission(Subject subject, String permission);
+
+ /**
+ * Check whether the subject has the given permission.
+ *
+ * @param subject the subject
+ * @param permission the permission to check
+ * @return a boolean indicating if the subject has the needed permission
+ */
+ boolean isPermitted(Subject subject, String permission);
+
+ /**
+ * Asserts that the subject has the given role.
+ *
+ * @param subject the subject
+ * @param role the role to check
+ * @throws SecurityException if the subject does not have the needed role
+ */
+ void checkRole(Subject subject, String role);
+
+ /**
+ * Check whether the subject has the given role.
+ *
+ * @param subject the subject
+ * @param role the role to check
+ * @return a boolean indicating if the subject has the needed role
+ */
+ boolean hasRole(Subject subject, String role);
+
+ /**
+ * Asserts that the principals list provides the given permission.
+ *
+ * @param principals the principals list
+ * @param permission the permission to check
+ * @throws SecurityException if the subject does not have the needed permission
+ */
+ void checkPermission(List<String> principals, String permission);
+
+ /**
+ * Check whether the principals list provides the given permission.
+ *
+ * @param principals the principals list
+ * @param permission the permission to check
+ * @return a boolean indicating if the subject has the needed permission
+ */
+ boolean isPermitted(List<String> principals, String permission);
+
+ /**
+ * Asserts that the principals list has the given role.
+ *
+ * @param principals the principals list
+ * @param role the role to check
+ * @throws SecurityException if the subject does not have the needed role
+ */
+ void checkRole(List<String> principals, String role);
+
+ /**
+ * Check whether the principals list has the given role.
+ *
+ * @param principals the principals list
+ * @param role the role to check
+ * @return a boolean indicating if the principals list has the needed role
+ */
+ boolean hasRole(List<String> principals, String role);
+
+}
Added: karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/impl/AuthorizationEntry.java
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/impl/AuthorizationEntry.java?rev=1406082&view=auto
==============================================================================
--- karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/impl/AuthorizationEntry.java (added)
+++ karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/impl/AuthorizationEntry.java Tue Nov 6 10:14:03 2012
@@ -0,0 +1,82 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.karaf.jaas.authz.impl;
+
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.Set;
+
+public class AuthorizationEntry {
+
+ private final Set<String> acls;
+ private final String permission;
+ private final String type;
+ private final WildcardPermission perm;
+
+ public AuthorizationEntry(String permission, String roles) {
+ this(permission, roles, AuthorizationServiceImpl.TYPE_ADD);
+ }
+
+ public AuthorizationEntry(String permission, String roles, String type) {
+ this.permission = permission;
+ this.acls = buildRoles(roles);
+ this.type = type;
+ this.perm = new WildcardPermission(permission);
+ }
+
+ public String getType() {
+ return type;
+ }
+
+ public String getPermission() {
+ return permission;
+ }
+
+ public Set<String> getAcls() {
+ return acls;
+ }
+
+ public boolean implies(WildcardPermission perm) {
+ return this.perm.implies(perm);
+ }
+
+ public String getRoles() {
+ StringBuffer sb = new StringBuffer();
+ if (this.acls != null) {
+ for (Iterator<String> iter = this.acls.iterator(); iter.hasNext();) {
+ String p = iter.next();
+ sb.append(p);
+ if (iter.hasNext()) {
+ sb.append(",");
+ }
+ }
+ }
+ return sb.toString();
+ }
+
+ public String toString() {
+ return "AuthorizationEntry[resource=" + permission + ", roles=" + getRoles() + "]";
+ }
+
+ private Set<String> buildRoles(String rolesString) {
+ Set<String> roles = new HashSet<String>();
+ for (String role : rolesString.split("\\s+")) {
+ roles.add(role);
+ }
+ return roles;
+ }
+}
Added: karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/impl/AuthorizationServiceImpl.java
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/impl/AuthorizationServiceImpl.java?rev=1406082&view=auto
==============================================================================
--- karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/impl/AuthorizationServiceImpl.java (added)
+++ karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/impl/AuthorizationServiceImpl.java Tue Nov 6 10:14:03 2012
@@ -0,0 +1,182 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.karaf.jaas.authz.impl;
+
+import java.io.StringReader;
+import java.security.Principal;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import javax.security.auth.Subject;
+import javax.xml.namespace.QName;
+import javax.xml.stream.XMLInputFactory;
+import javax.xml.stream.XMLStreamConstants;
+import javax.xml.stream.XMLStreamException;
+import javax.xml.stream.XMLStreamReader;
+
+import org.apache.karaf.jaas.authz.AuthorizationService;
+import org.apache.karaf.jaas.boot.principal.RolePrincipal;
+
+public class AuthorizationServiceImpl implements AuthorizationService {
+
+ public static final String NAMESPACE = "http://karaf.apache.org/xmlns/authz/v1.0.0";
+ public static final QName ENTRIES = new QName(NAMESPACE, "entries");
+ public static final QName ENTRY = new QName(NAMESPACE, "entry");
+ public static final String PERMISSION = "permission";
+ public static final String ROLES = "roles";
+ public static final String TYPE = "type";
+
+ /**
+ * Add the roles to the ACLs list
+ */
+ public static final String TYPE_ADD = "add";
+
+ /**
+ * Set the ACLs to the given roles
+ */
+
+ public static final String TYPE_SET = "set";
+
+ /**
+ * Remove the given roles from the ACLs list
+ */
+ public static final String TYPE_REM = "rem";
+
+ /**
+ * All roles are matched using the wildcard
+ */
+ public static final String ANY_ROLE = "*";
+
+ private List<AuthorizationEntry> entries = Collections.emptyList();
+
+ public List<String> getPrincipals(Subject subject) {
+ List<String> principals = new ArrayList<String>();
+ for (Principal principal : subject.getPrincipals()) {
+ principals.add(principal.getClass().getName() + ":" + principal.getName());
+ }
+ return principals;
+ }
+
+ public boolean isPermitted(Subject subject, String permission) {
+ return isPermitted(getPrincipals(subject), permission);
+ }
+
+ public void checkPermission(Subject subject, String permission) {
+ checkPermission(getPrincipals(subject), permission);
+ }
+
+ public void checkRole(Subject subject, String role) {
+ checkRole(getPrincipals(subject), role);
+ }
+
+ public boolean hasRole(Subject subject, String role) {
+ return hasRole(getPrincipals(subject), role);
+ }
+
+ public void checkPermission(List<String> principals, String permission) {
+ if (!isPermitted(principals, permission)) {
+ throw new SecurityException("Unauthorized permission: " + permission);
+ }
+ }
+
+ public boolean isPermitted(List<String> principals, String permission) {
+ Set<String> acls = getAcls(permission);
+ for (String acl : acls) {
+ if (hasRole(principals, acl)) {
+ return true;
+ }
+ }
+ return false;
+ }
+
+ public void checkRole(List<String> principals, String role) {
+ if (!hasRole(principals, role)) {
+ throw new SecurityException("Unauthorized permission: missing role " + role);
+ }
+ }
+
+ public boolean hasRole(List<String> principals, String role) {
+ if (ANY_ROLE.equals(role)) {
+ return true;
+ }
+ if (role.indexOf(':') < 0) {
+ role = RolePrincipal.class.getName() + ":" + role;
+ }
+ return principals.contains(role);
+ }
+
+ public Set<String> getAcls(String permission) {
+ Set<String> acls = new HashSet<String>();
+ WildcardPermission perm = new WildcardPermission(permission);
+ for (AuthorizationEntry entry : entries) {
+ if (entry.implies(perm)) {
+ if (TYPE_ADD.equalsIgnoreCase(entry.getType())) {
+ acls.addAll(entry.getAcls());
+ } else if (TYPE_SET.equalsIgnoreCase(entry.getType())) {
+ acls.clear();
+ acls.addAll(entry.getAcls());
+ } else if (TYPE_REM.equalsIgnoreCase(entry.getType())) {
+ acls.removeAll(entry.getAcls());
+ }
+ }
+ }
+ return acls;
+ }
+
+
+ public void setAcls(String acls) {
+ List<AuthorizationEntry> entries = new ArrayList<AuthorizationEntry>();
+ if (acls != null) {
+ try {
+ XMLStreamReader reader = XMLInputFactory.newFactory().createXMLStreamReader(new StringReader(acls));
+ int event;
+ while ((event = reader.next()) != XMLStreamConstants.END_DOCUMENT) {
+ if (event == XMLStreamConstants.START_ELEMENT) {
+ if (ENTRIES.equals(reader.getName())) {
+ // Do nothing
+ } else if (ENTRY.equals(reader.getName())) {
+ String permission = "";
+ String roles = "";
+ String type = TYPE_ADD;
+ for (int i = 0; i < reader.getAttributeCount(); i++) {
+ String name = reader.getAttributeLocalName(i);
+ if (PERMISSION.equals(name)) {
+ permission = reader.getAttributeValue(i);
+ } else if (ROLES.equals(name)) {
+ roles = reader.getAttributeValue(i);
+ } else if (TYPE.equals(name)) {
+ type = reader.getAttributeValue(i);
+ if (!TYPE_ADD.equals(type) && !TYPE_SET.equals(type) && !TYPE_REM.equals(type)) {
+ throw new IllegalArgumentException("Unsupported ACL entry type: " + type);
+ }
+ }
+ }
+ entries.add(new AuthorizationEntry(permission, roles, type));
+ } else {
+ throw new IllegalArgumentException("Unsupported element " + reader.getName());
+ }
+ }
+ }
+ } catch (XMLStreamException e) {
+ throw new IllegalArgumentException("Error parsing ACL entries", e);
+ }
+ }
+ this.entries = entries;
+ }
+}
Added: karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/impl/WildcardPermission.java
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/impl/WildcardPermission.java?rev=1406082&view=auto
==============================================================================
--- karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/impl/WildcardPermission.java (added)
+++ karaf/branches/karaf-2.3.x/jaas/authz/src/main/java/org/apache/karaf/jaas/authz/impl/WildcardPermission.java Tue Nov 6 10:14:03 2012
@@ -0,0 +1,255 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.karaf.jaas.authz.impl;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Set;
+
+/**
+ * A <code>WildcardPermission</code> is a very flexible permission construct supporting multiple levels of
+ * permission matching. However, most people will probably follow some standard conventions as explained below.
+ * <p/>
+ * <h3>Simple Usage</h3>
+ * <p/>
+ * In the simplest form, <code>WildcardPermission</code> can be used as a simple permission string. You could grant a
+ * user an "editNewsletter" permission and then check to see if the user has the editNewsletter
+ * permission by calling
+ * <p/>
+ * <code>subject.isPermitted("editNewsletter")</code>
+ * <p/>
+ * This is (mostly) equivalent to
+ * <p/>
+ * <code>subject.isPermitted( new WildcardPermission("editNewsletter") )</code>
+ * <p/>
+ * but more on that later.
+ * <p/>
+ * The simple permission string may work for simple applications, but it requires you to have permissions like
+ * <code>"viewNewsletter"</code>, <code>"deleteNewsletter"</code>,
+ * <code>"createNewsletter"</code>, etc. You can also grant a user <code>"*"</code> permissions
+ * using the wildcard character (giving this class its name), which means they have <em>all</em> permissions. But
+ * using this approach there's no way to just say a user has "all newsletter permissions".
+ * <p/>
+ * For this reason, <code>WildcardPermission</code> supports multiple <em>levels</em> of permissioning.
+ * <p/>
+ * <h3>Multiple Levels</h3>
+ * <p/>
+ * WildcardPermission</code> also supports the concept of multiple <em>levels</em>. For example, you could
+ * restructure the previous simple example by granting a user the permission <code>"newsletter:edit"</code>.
+ * The colon in this example is a special character used by the <code>WildcardPermission</code> that delimits the
+ * next token in the permission.
+ * <p/>
+ * In this example, the first token is the <em>domain</em> that is being operated on
+ * and the second token is the <em>action</em> being performed. Each level can contain multiple values. So you
+ * could simply grant a user the permission <code>"newsletter:view,edit,create"</code> which gives them
+ * access to perform <code>view</code>, <code>edit</code>, and <code>create</code> actions in the <code>newsletter</code>
+ * <em>domain</em>. Then you could check to see if the user has the <code>"newsletter:create"</code>
+ * permission by calling
+ * <p/>
+ * <code>subject.isPermitted("newsletter:create")</code>
+ * <p/>
+ * (which would return true).
+ * <p/>
+ * In addition to granting multiple permissions via a single string, you can grant all permission for a particular
+ * level. So if you wanted to grant a user all actions in the <code>newsletter</code> domain, you could simply give
+ * them <code>"newsletter:*"</code>. Now, any permission check for <code>"newsletter:XXX"</code>
+ * will return <code>true</code>. It is also possible to use the wildcard token at the domain level (or both): so you
+ * could grant a user the <code>"view"</code> action across all domains <code>"*:view"</code>.
+ * <p/>
+ * <h3>Instance-level Access Control</h3>
+ * <p/>
+ * Another common usage of the <code>WildcardPermission</code> is to model instance-level Access Control Lists.
+ * In this scenario you use three tokens - the first is the <em>domain</em>, the second is the <em>action</em>, and
+ * the third is the <em>instance</em> you are acting on.
+ * <p/>
+ * So for example you could grant a user <code>"newsletter:edit:12,13,18"</code>. In this example, assume
+ * that the third token is the system's ID of the newsletter. That would allow the user to edit newsletters
+ * <code>12</code>, <code>13</code>, and <code>18</code>. This is an extremely powerful way to express permissions,
+ * since you can now say things like <code>"newsletter:*:13"</code> (grant a user all actions for newsletter
+ * <code>13</code>), <code>"newsletter:view,create,edit:*"</code> (allow the user to
+ * <code>view</code>, <code>create</code>, or <code>edit</code> <em>any</em> newsletter), or
+ * <code>"newsletter:*:*</code> (allow the user to perform <em>any</em> action on <em>any</em> newsletter).
+ * <p/>
+ * To perform checks against these instance-level permissions, the application should include the instance ID in the
+ * permission check like so:
+ * <p/>
+ * <code>subject.isPermitted( "newsletter:edit:13" )</code>
+ * <p/>
+ * There is no limit to the number of tokens that can be used, so it is up to your imagination in terms of ways that
+ * this could be used in your application. However, the Shiro team likes to standardize some common usages shown
+ * above to help people get started and provide consistency in the Shiro community.
+ *
+ * @since 0.9
+ */
+public class WildcardPermission {
+
+ //TODO - JavaDoc methods
+
+ /*--------------------------------------------
+ | C O N S T A N T S |
+ ============================================*/
+ protected static final String WILDCARD_TOKEN = "*";
+ protected static final String PART_DIVIDER_TOKEN = ":";
+ protected static final String SUBPART_DIVIDER_TOKEN = ",";
+ protected static final boolean DEFAULT_CASE_SENSITIVE = false;
+
+ /*--------------------------------------------
+ | I N S T A N C E V A R I A B L E S |
+ ============================================*/
+ private List<Set<String>> parts;
+
+ /*--------------------------------------------
+ | C O N S T R U C T O R S |
+ ============================================*/
+
+ public WildcardPermission(String wildcardString) {
+ this(wildcardString, DEFAULT_CASE_SENSITIVE);
+ }
+
+ public WildcardPermission(String wildcardString, boolean caseSensitive) {
+ setParts(wildcardString, caseSensitive);
+ }
+
+ protected void setParts(String wildcardString) {
+ setParts(wildcardString, DEFAULT_CASE_SENSITIVE);
+ }
+
+ protected void setParts(String wildcardString, boolean caseSensitive) {
+ if (wildcardString == null || wildcardString.trim().length() == 0) {
+ throw new IllegalArgumentException("Wildcard string cannot be null or empty. Make sure permission strings are properly formatted.");
+ }
+
+ wildcardString = wildcardString.trim();
+
+ List<String> parts = asList(wildcardString.split(PART_DIVIDER_TOKEN));
+
+ this.parts = new ArrayList<Set<String>>();
+ for (String part : parts) {
+ Set<String> subparts = asSet(part.split(SUBPART_DIVIDER_TOKEN));
+ if (!caseSensitive) {
+ subparts = lowercase(subparts);
+ }
+ if (subparts.isEmpty()) {
+ throw new IllegalArgumentException("Wildcard string cannot contain parts with only dividers. Make sure permission strings are properly formatted.");
+ }
+ this.parts.add(subparts);
+ }
+
+ if (this.parts.isEmpty()) {
+ throw new IllegalArgumentException("Wildcard string cannot contain only dividers. Make sure permission strings are properly formatted.");
+ }
+ }
+
+ private Set<String> lowercase(Set<String> subparts) {
+ Set<String> lowerCasedSubparts = new LinkedHashSet<String>(subparts.size());
+ for (String subpart : subparts) {
+ lowerCasedSubparts.add(subpart.toLowerCase());
+ }
+ return lowerCasedSubparts;
+ }
+
+ /*--------------------------------------------
+ | A C C E S S O R S / M O D I F I E R S |
+ ============================================*/
+ protected List<Set<String>> getParts() {
+ return this.parts;
+ }
+
+ /*--------------------------------------------
+ | M E T H O D S |
+ ============================================*/
+
+ public boolean implies(WildcardPermission wp) {
+ List<Set<String>> otherParts = wp.getParts();
+
+ int i = 0;
+ for (Set<String> otherPart : otherParts) {
+ // If this permission has less parts than the other permission, everything after the number of parts contained
+ // in this permission is automatically implied, so return true
+ if (getParts().size() - 1 < i) {
+ return true;
+ } else {
+ Set<String> part = getParts().get(i);
+ if (!part.contains(WILDCARD_TOKEN) && !part.containsAll(otherPart)) {
+ return false;
+ }
+ i++;
+ }
+ }
+
+ // If this permission has more parts than the other parts, only imply it if all of the other parts are wildcards
+ for (; i < getParts().size(); i++) {
+ Set<String> part = getParts().get(i);
+ if (!part.contains(WILDCARD_TOKEN)) {
+ return false;
+ }
+ }
+
+ return true;
+ }
+
+ public String toString() {
+ StringBuilder buffer = new StringBuilder();
+ for (Set<String> part : parts) {
+ if (buffer.length() > 0) {
+ buffer.append(":");
+ }
+ buffer.append(part);
+ }
+ return buffer.toString();
+ }
+
+ public boolean equals(Object o) {
+ if (o instanceof WildcardPermission) {
+ WildcardPermission wp = (WildcardPermission) o;
+ return parts.equals(wp.parts);
+ }
+ return false;
+ }
+
+ public int hashCode() {
+ return parts.hashCode();
+ }
+
+ public static <E> Set<E> asSet(E... elements) {
+ if (elements == null || elements.length == 0) {
+ return Collections.emptySet();
+ }
+ LinkedHashSet<E> set = new LinkedHashSet<E>(elements.length * 4 / 3 + 1);
+ Collections.addAll(set, elements);
+ return set;
+ }
+
+ public static <E> List<E> asList(E... elements) {
+ if (elements == null || elements.length == 0) {
+ return Collections.emptyList();
+ }
+ // Avoid integer overflow when a large array is passed in
+ int capacity = computeListCapacity(elements.length);
+ ArrayList<E> list = new ArrayList<E>(capacity);
+ Collections.addAll(list, elements);
+ return list;
+ }
+
+ static int computeListCapacity(int arraySize) {
+ return (int) Math.min(5L + arraySize + (arraySize / 10), Integer.MAX_VALUE);
+ }
+}
\ No newline at end of file
Copied: karaf/branches/karaf-2.3.x/jaas/authz/src/main/resources/OSGI-INF/blueprint/jaas-authz.xml (from r1405719, karaf/branches/karaf-2.3.x/shell/console/src/main/resources/OSGI-INF/blueprint/shell-namespacehandler.xml)
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/jaas/authz/src/main/resources/OSGI-INF/blueprint/jaas-authz.xml?p2=karaf/branches/karaf-2.3.x/jaas/authz/src/main/resources/OSGI-INF/blueprint/jaas-authz.xml&p1=karaf/branches/karaf-2.3.x/shell/console/src/main/resources/OSGI-INF/blueprint/shell-namespacehandler.xml&r1=1405719&r2=1406082&rev=1406082&view=diff
==============================================================================
--- karaf/branches/karaf-2.3.x/shell/console/src/main/resources/OSGI-INF/blueprint/shell-namespacehandler.xml (original)
+++ karaf/branches/karaf-2.3.x/jaas/authz/src/main/resources/OSGI-INF/blueprint/jaas-authz.xml Tue Nov 6 10:14:03 2012
@@ -17,18 +17,14 @@
limitations under the License.
-->
-<blueprint xmlns="http://www.osgi.org/xmlns/blueprint/v1.0.0">
+<blueprint xmlns="http://www.osgi.org/xmlns/blueprint/v1.0.0"
+ xmlns:cm="http://aries.apache.org/blueprint/xmlns/blueprint-cm/v1.2.0">
- <service interface="org.apache.aries.blueprint.NamespaceHandler">
- <service-properties>
- <entry key="osgi.service.blueprint.namespace">
- <array>
- <value>http://karaf.apache.org/xmlns/shell/v1.0.0</value>
- <value>http://karaf.apache.org/xmlns/shell/v1.1.0</value>
- </array>
- </entry>
- </service-properties>
- <bean class="org.apache.karaf.shell.console.commands.NamespaceHandler"/>
- </service>
+ <service interface="org.apache.karaf.jaas.authz.AuthorizationService" ref="authorizationService"/>
+
+ <bean id="authorizationService" class="org.apache.karaf.jaas.authz.impl.AuthorizationServiceImpl">
+ <cm:managed-properties persistent-id="org.apache.karaf.jaas.authz"
+ update-strategy="container-managed" />
+ </bean>
</blueprint>
Added: karaf/branches/karaf-2.3.x/jaas/authz/src/main/resources/OSGI-INF/bundle.info
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/jaas/authz/src/main/resources/OSGI-INF/bundle.info?rev=1406082&view=auto
==============================================================================
(empty)
Added: karaf/branches/karaf-2.3.x/jaas/authz/src/main/resources/org/apache/karaf/jaas/authz/karaf-authz-1.0.0.xsd
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/jaas/authz/src/main/resources/org/apache/karaf/jaas/authz/karaf-authz-1.0.0.xsd?rev=1406082&view=auto
==============================================================================
--- karaf/branches/karaf-2.3.x/jaas/authz/src/main/resources/org/apache/karaf/jaas/authz/karaf-authz-1.0.0.xsd (added)
+++ karaf/branches/karaf-2.3.x/jaas/authz/src/main/resources/org/apache/karaf/jaas/authz/karaf-authz-1.0.0.xsd Tue Nov 6 10:14:03 2012
@@ -0,0 +1,88 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+-->
+<xs:schema elementFormDefault="qualified"
+ targetNamespace="http://karaf.apache.org/xmlns/authz/v1.0.0"
+ xmlns:tns="http://karaf.apache.org/xmlns/authz/v1.0.0"
+ xmlns:xs="http://www.w3.org/2001/XMLSchema">
+
+ <xs:annotation>
+ <xs:documentation><![CDATA[
+Karaf permissions definitions for authorization mechanism. For documentation please visit the
+<a href="http://karaf.apache.org/">Karaf website</a>.
+ ]]></xs:documentation>
+ </xs:annotation>
+
+ <xs:complexType name="entries">
+ <xs:annotation>
+ <xs:documentation><![CDATA[
+List of ACL entries.
+ ]]></xs:documentation>
+ </xs:annotation>
+ <xs:choice minOccurs="0" maxOccurs="unbounded">
+ <xs:element name="entry" type="tns:entry">
+ <xs:annotation>
+ <xs:documentation><![CDATA[
+ACL entry.
+ ]]></xs:documentation>
+ </xs:annotation>
+ </xs:element>
+ </xs:choice>
+ <xs:attribute name="name" type="xs:string" />
+ </xs:complexType>
+
+ <xs:complexType name="entry">
+ <xs:annotation>
+ <xs:documentation><![CDATA[
+ACL entry.
+ ]]></xs:documentation>
+ </xs:annotation>
+ <xs:attribute name="permission" type="xs:NMTOKEN" use="required">
+ <xs:annotation>
+ <xs:documentation><![CDATA[
+The permission.
+ ]]></xs:documentation>
+ </xs:annotation>
+ </xs:attribute>
+ <xs:attribute name="roles" type="xs:NMTOKENS" use="required">
+ <xs:annotation>
+ <xs:documentation><![CDATA[
+List of roles.
+ ]]></xs:documentation>
+ </xs:annotation>
+ </xs:attribute>
+ <xs:attribute name="type" default="add">
+ <xs:annotation>
+ <xs:documentation><![CDATA[
+Type of this ACL entry. Will affect how the given list of roles will be used
+to compute the overall list.
+ ]]> </xs:documentation>
+ </xs:annotation>
+ <xs:simpleType>
+ <xs:restriction base="xs:NMTOKEN">
+ <xs:enumeration value="add"/>
+ <xs:enumeration value="set"/>
+ <xs:enumeration value="del"/>
+ </xs:restriction>
+ </xs:simpleType>
+ </xs:attribute>
+ </xs:complexType>
+
+ <xs:element name="entries" type="tns:entries" />
+
+</xs:schema>
Modified: karaf/branches/karaf-2.3.x/jaas/pom.xml
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/jaas/pom.xml?rev=1406082&r1=1406081&r2=1406082&view=diff
==============================================================================
--- karaf/branches/karaf-2.3.x/jaas/pom.xml (original)
+++ karaf/branches/karaf-2.3.x/jaas/pom.xml Tue Nov 6 10:14:03 2012
@@ -39,6 +39,7 @@
<module>modules</module>
<module>jasypt</module>
<module>command</module>
+ <module>authz</module>
</modules>
</project>
Modified: karaf/branches/karaf-2.3.x/pom.xml
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/pom.xml?rev=1406082&r1=1406081&r2=1406082&view=diff
==============================================================================
--- karaf/branches/karaf-2.3.x/pom.xml (original)
+++ karaf/branches/karaf-2.3.x/pom.xml Tue Nov 6 10:14:03 2012
@@ -440,6 +440,11 @@
<version>${project.version}</version>
</dependency>
<dependency>
+ <groupId>org.apache.karaf.jaas</groupId>
+ <artifactId>org.apache.karaf.jaas.authz</artifactId>
+ <version>${project.version}</version>
+ </dependency>
+ <dependency>
<groupId>org.apache.karaf.webconsole</groupId>
<artifactId>org.apache.karaf.webconsole.admin</artifactId>
<version>${project.version}</version>
Modified: karaf/branches/karaf-2.3.x/shell/console/pom.xml
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/shell/console/pom.xml?rev=1406082&r1=1406081&r2=1406082&view=diff
==============================================================================
--- karaf/branches/karaf-2.3.x/shell/console/pom.xml (original)
+++ karaf/branches/karaf-2.3.x/shell/console/pom.xml Tue Nov 6 10:14:03 2012
@@ -58,7 +58,7 @@
</dependency>
<dependency>
<groupId>org.apache.karaf.jaas</groupId>
- <artifactId>org.apache.karaf.jaas.modules</artifactId>
+ <artifactId>org.apache.karaf.jaas.authz</artifactId>
</dependency>
<dependency>
<groupId>org.apache.karaf</groupId>
Modified: karaf/branches/karaf-2.3.x/shell/console/src/main/java/org/apache/karaf/shell/console/commands/BlueprintCommand.java
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/shell/console/src/main/java/org/apache/karaf/shell/console/commands/BlueprintCommand.java?rev=1406082&r1=1406081&r2=1406082&view=diff
==============================================================================
--- karaf/branches/karaf-2.3.x/shell/console/src/main/java/org/apache/karaf/shell/console/commands/BlueprintCommand.java (original)
+++ karaf/branches/karaf-2.3.x/shell/console/src/main/java/org/apache/karaf/shell/console/commands/BlueprintCommand.java Tue Nov 6 10:14:03 2012
@@ -18,14 +18,17 @@
package org.apache.karaf.shell.console.commands;
import java.lang.reflect.Type;
+import java.security.AccessController;
import java.util.List;
import java.util.Map;
+import javax.security.auth.Subject;
import org.apache.felix.gogo.commands.Action;
import org.apache.felix.gogo.commands.basic.AbstractCommand;
import org.apache.felix.gogo.commands.basic.ActionPreparator;
import org.apache.felix.gogo.commands.basic.DefaultActionPreparator;
import org.apache.felix.service.command.CommandSession;
+import org.apache.karaf.jaas.authz.AuthorizationService;
import org.apache.karaf.shell.console.BlueprintContainerAware;
import org.apache.karaf.shell.console.BundleContextAware;
import org.apache.karaf.shell.console.CompletableFunction;
@@ -43,6 +46,8 @@ public class
protected String actionId;
protected List<Completer> completers;
protected Map<String,Completer> optionalCompleters;
+ protected String name;
+ protected AuthorizationService authorizationService;
public void setBlueprintContainer(BlueprintContainer blueprintContainer) {
this.blueprintContainer = blueprintContainer;
@@ -72,6 +77,31 @@ public class
this.optionalCompleters = optionalCompleters;
}
+ public String getName() {
+ return name;
+ }
+
+ public void setName(String name) {
+ this.name = name;
+ }
+
+ public AuthorizationService getAuthorizationService() {
+ return authorizationService;
+ }
+
+ public void setAuthorizationService(AuthorizationService authorizationService) {
+ this.authorizationService = authorizationService;
+ }
+
+ @Override
+ public Object execute(CommandSession session, List<Object> arguments) throws Exception {
+ if (authorizationService != null) {
+ Subject subject = Subject.getSubject(AccessController.getContext());
+ authorizationService.checkPermission(subject, "command:" + name);
+ }
+ return super.execute(session, arguments);
+ }
+
@Override
protected ActionPreparator getPreparator() throws Exception {
return new BlueprintActionPreparator();
Modified: karaf/branches/karaf-2.3.x/shell/console/src/main/java/org/apache/karaf/shell/console/commands/NamespaceHandler.java
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/shell/console/src/main/java/org/apache/karaf/shell/console/commands/NamespaceHandler.java?rev=1406082&r1=1406081&r2=1406082&view=diff
==============================================================================
--- karaf/branches/karaf-2.3.x/shell/console/src/main/java/org/apache/karaf/shell/console/commands/NamespaceHandler.java (original)
+++ karaf/branches/karaf-2.3.x/shell/console/src/main/java/org/apache/karaf/shell/console/commands/NamespaceHandler.java Tue Nov 6 10:14:03 2012
@@ -20,25 +20,36 @@ package org.apache.karaf.shell.console.c
import java.net.URL;
import java.util.Arrays;
-import java.util.List;
import java.util.HashSet;
+import java.util.List;
import java.util.Set;
-import org.apache.felix.service.command.Function;
-import org.osgi.service.blueprint.reflect.*;
-import org.w3c.dom.Element;
-import org.w3c.dom.Node;
-import org.w3c.dom.NodeList;
-
import org.apache.aries.blueprint.ParserContext;
+import org.apache.aries.blueprint.PassThroughMetadata;
import org.apache.aries.blueprint.mutable.MutableBeanMetadata;
+import org.apache.aries.blueprint.mutable.MutableCollectionMetadata;
import org.apache.aries.blueprint.mutable.MutableIdRefMetadata;
+import org.apache.aries.blueprint.mutable.MutablePassThroughMetadata;
+import org.apache.aries.blueprint.mutable.MutableRefMetadata;
import org.apache.aries.blueprint.mutable.MutableServiceMetadata;
import org.apache.aries.blueprint.mutable.MutableValueMetadata;
-import org.apache.aries.blueprint.mutable.MutableRefMetadata;
-import org.apache.aries.blueprint.mutable.MutableCollectionMetadata;
+import org.apache.felix.service.command.Function;
+import org.apache.karaf.jaas.authz.AuthorizationService;
import org.apache.karaf.shell.console.CompletableFunction;
import org.osgi.service.blueprint.container.ComponentDefinitionException;
+import org.osgi.service.blueprint.reflect.BeanArgument;
+import org.osgi.service.blueprint.reflect.BeanMetadata;
+import org.osgi.service.blueprint.reflect.BeanProperty;
+import org.osgi.service.blueprint.reflect.ComponentMetadata;
+import org.osgi.service.blueprint.reflect.IdRefMetadata;
+import org.osgi.service.blueprint.reflect.MapMetadata;
+import org.osgi.service.blueprint.reflect.Metadata;
+import org.osgi.service.blueprint.reflect.NullMetadata;
+import org.osgi.service.blueprint.reflect.RefMetadata;
+import org.osgi.service.blueprint.reflect.ValueMetadata;
+import org.w3c.dom.Element;
+import org.w3c.dom.Node;
+import org.w3c.dom.NodeList;
public class NamespaceHandler implements org.apache.aries.blueprint.NamespaceHandler {
@@ -61,9 +72,20 @@ public class NamespaceHandler implements
public static final String SHELL_NAMESPACE_1_0_0 = "http://karaf.apache.org/xmlns/shell/v1.0.0";
public static final String SHELL_NAMESPACE_1_1_0 = "http://karaf.apache.org/xmlns/shell/v1.1.0";
+ public static final String AUTHORIZATION_SERVICE = "authorizationService";
private int nameCounter = 0;
+ private AuthorizationService authorizationService;
+
+ public AuthorizationService getAuthorizationService() {
+ return authorizationService;
+ }
+
+ public void setAuthorizationService(AuthorizationService authorizationService) {
+ this.authorizationService = authorizationService;
+ }
+
public URL getSchemaLocation(String namespace) {
if(SHELL_NAMESPACE_1_0_0.equals(namespace)) {
return getClass().getResource("karaf-shell-1.0.0.xsd");
@@ -123,6 +145,8 @@ public class NamespaceHandler implements
function = location;
}
+ command.addProperty(NAME, createStringValue(context, location));
+ command.addProperty(AUTHORIZATION_SERVICE, createPassThrough(context, authorizationService));
NodeList children = element.getChildNodes();
for (int i = 0; i < children.getLength(); i++) {
Node child = children.item(i);
@@ -212,6 +236,12 @@ public class NamespaceHandler implements
return value;
}
+ private PassThroughMetadata createPassThrough(ParserContext context, Object obj) {
+ MutablePassThroughMetadata value = context.createMetadata(MutablePassThroughMetadata.class);
+ value.setObject(obj);
+ return value;
+ }
+
private RefMetadata createRef(ParserContext context, String id) {
MutableRefMetadata idref = context.createMetadata(MutableRefMetadata.class);
idref.setComponentId(id);
Modified: karaf/branches/karaf-2.3.x/shell/console/src/main/resources/OSGI-INF/blueprint/shell-namespacehandler.xml
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/shell/console/src/main/resources/OSGI-INF/blueprint/shell-namespacehandler.xml?rev=1406082&r1=1406081&r2=1406082&view=diff
==============================================================================
--- karaf/branches/karaf-2.3.x/shell/console/src/main/resources/OSGI-INF/blueprint/shell-namespacehandler.xml (original)
+++ karaf/branches/karaf-2.3.x/shell/console/src/main/resources/OSGI-INF/blueprint/shell-namespacehandler.xml Tue Nov 6 10:14:03 2012
@@ -28,7 +28,11 @@
</array>
</entry>
</service-properties>
- <bean class="org.apache.karaf.shell.console.commands.NamespaceHandler"/>
+ <bean class="org.apache.karaf.shell.console.commands.NamespaceHandler">
+ <property name="authorizationService">
+ <reference interface="org.apache.karaf.jaas.authz.AuthorizationService" />
+ </property>
+ </bean>
</service>
</blueprint>
Modified: karaf/branches/karaf-2.3.x/shell/ssh/pom.xml
URL: http://svn.apache.org/viewvc/karaf/branches/karaf-2.3.x/shell/ssh/pom.xml?rev=1406082&r1=1406081&r2=1406082&view=diff
==============================================================================
--- karaf/branches/karaf-2.3.x/shell/ssh/pom.xml (original)
+++ karaf/branches/karaf-2.3.x/shell/ssh/pom.xml Tue Nov 6 10:14:03 2012
@@ -44,6 +44,11 @@
</dependency>
<dependency>
+ <groupId>org.apache.karaf.jaas</groupId>
+ <artifactId>org.apache.karaf.jaas.modules</artifactId>
+ </dependency>
+
+ <dependency>
<groupId>org.osgi</groupId>
<artifactId>org.osgi.core</artifactId>
<scope>provided</scope>