1 /*
2 jGuard is a security framework based on top of jaas (java authentication and authorization security).
3 it is written for web applications, to resolve simply, access control problems.
4 version $Name$
5 http://sourceforge.net/projects/jguard/
6
7 Copyright (C) 2004 Charles GAY
8
9 This library is free software; you can redistribute it and/or
10 modify it under the terms of the GNU Lesser General Public
11 License as published by the Free Software Foundation; either
12 version 2.1 of the License, or (at your option) any later version.
13
14 This library is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 Lesser General Public License for more details.
18
19 You should have received a copy of the GNU Lesser General Public
20 License along with this library; if not, write to the Free Software
21 Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22
23
24 jGuard project home page:
25 http://sourceforge.net/projects/jguard/
26
27 */
28 package net.sf.jguard.core.authorization.policy;
29
30 import java.security.AccessControlException;
31 import java.security.AccessController;
32 import java.security.Permission;
33 import java.security.Policy;
34 import java.security.PrivilegedActionException;
35 import java.security.PrivilegedExceptionAction;
36
37 import java.util.logging.Level;
38 import javax.security.auth.Subject;
39 import org.slf4j.Logger;
40 import org.slf4j.LoggerFactory;
41
42
43
44 /**
45 * Facade class used to bound control check to either the legacy {@link AccessController} bound to the global JVM security,
46 * or to the {@link LocalAccessController} 'isolated'.
47 * @author <a href="mailto:diabolo512@users.sourceforge.net">Charles Gay</a>
48 * @author <a href="mailto:vberetti@users.sourceforge.net">Vincent Beretti</a>
49 * @see java.security.AccessControlContext
50 * @see AccessController
51 * @see java.security.ProtectionDomain
52 */
53 public class AccessControllerUtils {
54 private static final Logger logger = LoggerFactory.getLogger(AccessControllerUtils.class.getName());
55 private static LocalAccessController accessController = null;
56
57
58 /**
59 * constructor used to check against the global (JVM scope) Policy.
60 * in this case, the localAccessCOntroller is null and check is done further with
61 * the static method checkPermission of the AccessController class from JDK.
62 */
63 public AccessControllerUtils(){
64
65 }
66
67
68 /**
69 * constructor used to check access control against a specified Policy and not
70 * the global one (JVM scope).
71 * @param policy
72 */
73 public AccessControllerUtils(Policy policy){
74 if(policy == null){
75 throw new IllegalArgumentException(" policy is null ");
76 }
77 if(accessController == null){
78 accessController = new LocalAccessController(policy) ;
79 }
80 }
81
82
83 public static boolean hasPermission(Subject subj, final Permission p){
84 try{
85 checkPermission(subj,p);
86 }catch(Exception ex){
87 return false;
88 }
89
90 return true;
91 }
92
93 /**
94 * check if the {@link Subject} has got the permission.
95 * @param subj user which try to enforce the permission
96 * @param p permission to check
97 * @throws PrivilegedActionException
98 * @throws AccessControlException when access is denied
99 */
100 public static void checkPermission(Subject subj, final Permission p) throws AccessControlException,PrivilegedActionException {
101
102 try {
103 Subject.doAs(subj, new PrivilegedExceptionAction() {
104 public Object run() {
105 if(accessController == null){
106 AccessController.checkPermission(p);
107 }else{
108 accessController.checkPermission(p);
109 }
110 // the 'null' tells the SecurityManager to consider this resource access
111 //in an isolated context, ignoring the permissions of code currently
112 //on the execution stack.
113 return null;
114 }
115 });
116
117 } catch (AccessControlException ace) {
118 if(logger.isDebugEnabled()){
119 logger.debug("AccessControlException ",ace);
120 }
121 throw ace;
122 } catch (PrivilegedActionException pae){
123 if(logger.isDebugEnabled()){
124 logger.debug("PrivilegedActionException ",pae);
125 }
126 throw pae;
127 }
128
129 if(logger.isDebugEnabled()){
130 logger.debug("user has got the permission ",p);
131 }
132 }
133
134 /**
135 * {@link LocalAccessController} returned can be <strong>null</strong> in <i>JVM</i> mode.
136 * @return
137 */
138 public static LocalAccessController getAccessController() {
139 return accessController;
140 }
141
142 /**
143 * return the {@link java.security.Policy} used to control access.
144 * it is either the current Policy in place in the JVM (<i>JVM scope</i>), or the Policy bound to the
145 * {@link LocalAccessController} bound to this AccessControllerUtils.
146 * in this case,like it is a static method, this Policy is bound to the current classloader.
147 * in a JEE context, each webapp has its own isloated classloader, so its own policy in this
148 * <i>local scope</i>.
149 * @return Policy
150 */
151 public static Policy getPolicy() {
152 if(accessController==null){
153 return Policy.getPolicy();
154 }else{
155 return accessController.getPolicy();
156 }
157 }
158
159 }