结合使用基于 Enum 的访问控制列表和 EAz 进行细粒度 Java EE 授权，第 2 部分: 了解并使用 EAz 实现

                
public class TestVirtualCampus {

	/* Define our data access object that will retrieve our ACL's.
	 * In our test the ACLDao is a mock that uses easily configured
	 * properties files to define ACL's; a production application will
	 * use a database to do the same
	 */
	ACLDao mockAclDao;
	private final static String ACL_HOLDER_PROPERTIES_LOC="org.eaz.resources.";
	
	/*
	 * Define our groups.  Groups are not Java EE constructs and are
	 * typically implemented as part of an environment-dependent
	 * registry, so consider this ours.
	 */
	public final String GROUP_CAMPUS_A_USERS="CAMPUS_A_USERS";
	public final String GROUP_CAMPUS_B_USERS="CAMPUS_B_USERS";
	public final String GROUP_CAMPUS_A_ENGRS="CAMPUS_A_ENGRS";
	public final String GROUP_CAMPUS_A_BIOLS="CAMPUS_A_BIOLS";
	public final String GROUP_CAMPUS_A_CLEANERS="CAMPUS_A_CLEANERS";
	
	/*
	 * Define our test's principal names and MockPrincipal entitites.  Our
	 * MockPrincipal class implements the java.security.Principal interface, and
	 * adds the ability to add and retrieve groups, which you'll typically find
	 * as part of an environment-specific registry.
	 */
	public final String PRINCIPAL_JANE="Jane Linnaeus";
	public final String PRINCIPAL_JIM="Jim Fermi";
	public final String PRINCIPAL_STAN="Stan the Yeti";
	public final String PRINCIPAL_KEN="Ken Lay";
	public final String PRINCIPAL_DANNY="Danny Dafoe";
	public final String PRINCIPAL_CARLA="Carla Bonheur";
	MockPrincipal jane, jim, stan, ken, danny, carla;
	
	/*
	 * Define our test ACL's, one for each space we'll probe for entry
	 */
	ACL campusA_ACL, engrBldgACL, engrBldgRoom2ACL, engrBldgSecureLab3ACL,
		biolBldgACL, biolBldgRoom5ACL, biolBldgSecureLab6ACL;

                
# This properties style file represents the ACL for the engineering building ACLHolder
# Format is groupOrPrincipal=permission
CAMPUS_A_ENGRS=PERM_ENTER
CAMPUS_A_BIOLS=PERM_ENTER
CAMPUS_A_CLEANERS=PERM_ENTER

                
@Before
public void setUp() throws Exception {
	/*
	 * Instantiate our Mock DAO and ACLHolders.  You'd implement your
	 * production DAO using a classic or Object-Relational-Mapping-based 
	 * DAO pattern.  
	 */
	mockAclDao=new ACLDao();
	
	/*
	 * ACLHolders represent parts of our Campus model that require authorization.
	 * Each is mapped to a resource file that defines its ACL.
	 */
	ACLHolder campusA = new 
ACLHolderImpl(ACL_HOLDER_PROPERTIES_LOC+"campusA");
	ACLHolder engrBldg = new 
ACLHolderImpl(ACL_HOLDER_PROPERTIES_LOC+"engrBldg");
	ACLHolder engrBldgRoom2 = new 
ACLHolderImpl(ACL_HOLDER_PROPERTIES_LOC+"engrBldgRoom2");
	ACLHolder engrBldgSecureLab3 = new 
ACLHolderImpl(ACL_HOLDER_PROPERTIES_LOC+"engrBldgSecureLab3");
	ACLHolder biolBldg = new 
ACLHolderImpl(ACL_HOLDER_PROPERTIES_LOC+"biolBldg");
	ACLHolder biolBldgRoom5 = new 
ACLHolderImpl(ACL_HOLDER_PROPERTIES_LOC+"biolBldgRoom5");
	ACLHolder biolBldgSecureLab6 = new 
ACLHolderImpl(ACL_HOLDER_PROPERTIES_LOC+"biolBldgSecureLab6");
	
	// Retrieve each ACL from the properties file persisting it
	campusA_ACL=mockAclDao.retrieveACL(campusA);
	engrBldgACL = mockAclDao.retrieveACL(engrBldg);
	engrBldgRoom2ACL=mockAclDao.retrieveACL(engrBldgRoom2);
	engrBldgSecureLab3ACL=mockAclDao.retrieveACL(engrBldgSecureLab3);
	biolBldgACL = mockAclDao.retrieveACL(biolBldg);
	biolBldgRoom5ACL=mockAclDao.retrieveACL(biolBldgRoom5);
	biolBldgSecureLab6ACL=mockAclDao.retrieveACL(biolBldgSecureLab6);
	
		
	/* 
	 * Set up our principals and their groups.  This code emulates a registry	
	*/
	
	// Jane is a Campus A Biologist
	jane = new MockPrincipal(PRINCIPAL_JANE);
	jane.addGroup(GROUP_CAMPUS_A_USERS);
	jane.addGroup(GROUP_CAMPUS_A_BIOLS);

	// Jim is a Campus A Engineer
	jim = new MockPrincipal(PRINCIPAL_JIM);
	jim.addGroup(GROUP_CAMPUS_A_USERS);
	jim.addGroup(GROUP_CAMPUS_A_ENGRS);
		
	// Stan is a Campus A Biologist
	stan = new MockPrincipal(PRINCIPAL_STAN);
	stan.addGroup(GROUP_CAMPUS_A_USERS);
	stan.addGroup(GROUP_CAMPUS_A_BIOLS);
		
	// Ken is a Campus A Building Cleaner
	ken = new MockPrincipal(PRINCIPAL_KEN);
	ken.addGroup(GROUP_CAMPUS_A_USERS);
	ken.addGroup(GROUP_CAMPUS_A_CLEANERS);
		
	// Danny is a generic Campus A user
	danny = new MockPrincipal(PRINCIPAL_DANNY);
	danny.addGroup(GROUP_CAMPUS_A_USERS);
	
	// Carla is a Campus B visiting professor
	carla = new MockPrincipal(PRINCIPAL_CARLA);
	carla.addGroup(GROUP_CAMPUS_B_USERS);
	}

                
private void assertPermitEntry(ACL aclToTest, PermissionSet reqdPerms, 
List<MockPrincipal> testCandidates) {
	try {
		for (MockPrincipal candidate: testCandidates){
			aclToTest.permit(reqdPerms, candidate);
		}
	} catch (Exception e) {
		fail("Should succeed");
	}
}
	
private void assertDenyEntry(ACL aclToTest, PermissionSet reqdPerms, 
List<MockPrincipal> testCandidates) {
	for (MockPrincipal candidate: testCandidates){
		try {
			aclToTest.permit(reqdPerms, candidate);
			fail("Should not succeed");
		} catch (Exception e) {
			// We expect an exception here
		}
	}
}

                
/**
 * Test Campus A's front gate.  We expect everyone to get in but Carla
 */
@Test public void testFrontGate(){
	PermissionSet reqdPerms = Permissions
		.getPermissionSetForAction(Permissions.AllActions.ACTION_ENTER);
	ACL aclToTest=campusA_ACL;
	MockPrincipal[] expectedPermitCandidates={jane, jim, stan, ken, danny};
	MockPrincipal[] expectedDenyCandidates={carla};
	assertPermitEntry(aclToTest, reqdPerms, Arrays.asList(expectedPermitCandidates));
	assertDenyEntry(aclToTest, reqdPerms, Arrays.asList(expectedDenyCandidates));
}

/**
 * Test the Engineering building door
 * Rules are: Engineers, Biologist and Cleaning Staff can Enter
 * 			  Generic Campus A staff cannot enter
 */
@Test public void testEngrBldgDoor(){
	PermissionSet reqdPerms = Permissions
		.getPermissionSetForAction(Permissions.AllActions.ACTION_ENTER);
	ACL aclToTest=engrBldgACL;
	MockPrincipal[] expectedPermitCandidates={jane, jim, stan, ken};
	MockPrincipal[] expectedDenyCandidates={danny, carla};
	assertPermitEntry(aclToTest, reqdPerms, Arrays.asList(expectedPermitCandidates));
	assertDenyEntry(aclToTest, reqdPerms, Arrays.asList(expectedDenyCandidates));
	}

                
public final class Permissions {

	/**
	 * The AllPermissions Enum enumerates all permissions available in the system.  
	 * Permissions are unary and individible and are not exposed beyond the 
	 * acl package
	 */
	protected static enum AllPermissions {
		PERM_ENTER,
		PERM_GRANT_ENTRY,
		PERM_REVOKE_ENTRY,
		PERM_LOCK_DOOR;
	}
	
	/**
	 * The AllActions Enum enumerates all actions in the system and provides the 
	 * set of keys for the available PermissionSets.  Since an action is the key 
	 * to a set of permissions it can represent one to many permissions.  
	 * Actions are exposed at the service layer
	 * 
	 * @author rpc
	 *
	 */
	public static enum AllActions {
		ACTION_ENTER,
		ACTION_MANAGE_ACCESS,
		ACTION_LOCK_DOOR;
	}
	
	/*
	 * These two maps hold the relationship between actions and
	 * permissions
	 */
	private static Map<AllActions, PermissionSet> NamedPermissionSets = 
		new EnumMap<AllActions, PermissionSet>(AllActions.class); 
	private static Map<PermissionSet, AllActions> PermissionSetToAction = 
		new HashMap<PermissionSet, AllActions>();

	/**
	 * GetPermissionSetForAction retrieves the PermissionSet 
	 * required to perform a specified action
	 * 
	 * @param psKey
	 * @return
	 */
	public static PermissionSet getPermissionSetForAction(AllActions psKey) {
		PermissionSet ps = NamedPermissionSets.get(psKey);
		if (ps ==null){
		  throw new RuntimeException ("No such permission as "+ psKey);
		}
		return ps;
	}
	
	public static Set<AllActions> getSecuredActions(){
		return NamedPermissionSets.keySet();
	}


	/**
	 * This static initializer performs the one-time work of relating permissions
	 * to actions. It delegates the configuration of each authorization action to 
	 * the configureAuthzAction method, passing in an Action enum to configure 
	 * and a list of permissions required to perform the action
	 */
	static {
		try {
			ArrayList<AllPermissions> reqdPerms;
			
			reqdPerms=new ArrayList<AllPermissions>();
			reqdPerms.add(AllPermissions.PERM_ENTER);
			configureAuthzAction(AllActions.ACTION_ENTER, reqdPerms);
			
			reqdPerms=new ArrayList<AllPermissions>();
			reqdPerms.add(AllPermissions.PERM_GRANT_ENTRY);
			reqdPerms.add(AllPermissions.PERM_REVOKE_ENTRY);	
			configureAuthzAction
			(AllActions.ACTION_MANAGE_ACCESS, reqdPerms);		

			reqdPerms=new ArrayList<AllPermissions>();
			reqdPerms.add(AllPermissions.PERM_LOCK_DOOR);
			configureAuthzAction(AllActions.ACTION_LOCK_DOOR, reqdPerms);
			
		} catch (Exception e) {
			throw new RuntimeException(e);
		}
		
	}

	/**
	 * Performs the work of relating an AllActions enum to a PermissionSet
	 * of permissions required to perform it
	 * 
	 * @param action
	 * @param reqdPermissions
	 */
	private static void configureAuthzAction(AllActions action, 
List<AllPermissions> reqdPermissions) {
		PermissionSet ps= new PermissionSetImpl();;
		for (AllPermissions reqdPerm: reqdPermissions){
			ps.addPermission(reqdPerm);
		}
		NamedPermissionSets.put(action, ps);
		PermissionSetToAction.put(ps, action);
	}
	
}

                
/*
 * This loop takes each permission granted to a group,
 * adds it to a PermissionSet, then adds the group and
 * its associated PermissionSet to the ACL under
 * construction
 */	
while (tokenizer.hasMoreTokens()){
	permissionSet.addPermission(Permissions.AllPermissions
	.valueOf(tokenizer.nextToken()));
}
// Add the group and its granted permission set into the ACL
acl.addPermissionSet(groupName, permissionSet);

                

/**
 * The ACL implements the process of authorization in EAz by means of permit() methods.
 */
public class ACL {
	
//	 An ACL instance secures its ACLHolder
	private ACLHolder securedResource; 
	
	/*
	 * Main internal ACL structure, mapping names to the set of permissions available
	 * to them on the ACLHolder.  Note that a name can represent
	 * either a group or a Principal
	 */
	private Map<String, PermissionSet> grants = new HashMap<String, 
	   PermissionSet>();

	/**
	 * Public constructor creating an ACL and associating it
	 * with the ACLHolder resource it secures
	 * 
	 * @param securedResource
	 */
	public ACL(ACLHolder securedResource){
		this.securedResource=securedResource;
	}
	
	/**
	 * Add assocations of names and their associated PermissionSet
	 * Could be extended to merge permissionSets
	 * 
	 * @param name
	 * @param permissionSet
	 */
	public void addPermissionSet (String name, PermissionSet permissionSet){
		grants.put(name, permissionSet);
	}

	
	
	/**
	 * This variant of permit is for implementation-independent testing of the EAZ 
	 * classes, for example in JUnit tests
	 * 
	 * @param mockPrincipal - Demonstration principal for testing, implements a
	 * 		   				  getGroups() method
	 * 		
	 * @param reqdPerms - PermissionSet of required permissions
	 * @throws PermissionViolationException
	 */
	public void permit(PermissionSet reqdPerms, MockPrincipal mockPrincipal ) throws 
	   PermissionViolationException {
		List<String> groups = new 
		ArrayList<String>(mockPrincipal.getGroups()); 
	// Create groups list from MockPrincipal groups set
		permit(reqdPerms, groups);
	}

	/**
	 * 
	 * @param reqdPerms
	 * @param singleName - convenience implementation for a single group or Principal 
	 * name
	 * @throws PermissionViolationException
	 */
	public void permit (PermissionSet reqdPerms, String singleName) throws 
	   PermissionViolationException {
		List<String> groupList = new ArrayList<String>();
		groupList.add(singleName);
		permit(reqdPerms, groupList);
	}
	
	/**
	 * @param PermissionSet reqdPerms
	 * @param List groupList
	 */
	public void permit(PermissionSet reqdPerms, List<String> nameList) throws 
	   PermissionViolationException {
		PermissionSet availablePerms=new PermissionSetImpl(), namePerms;
		for (String name: nameList){
			namePerms = grants.get(name);
			if (namePerms == null){
				continue;
			}
			availablePerms.addPermissions(namePerms.getPermissions());
			if (namePerms.hasPermissions(reqdPerms)){
				return;
			}
		}
		/* If we got here no name allowed permission, so throw the exception
		 * that indicates denied permission
		 */
		throw new PermissionViolationException (reqdPerms, availablePerms);
	}
	
	/**
	 * @param PermissionSetreqdPerms
	 */
	public void permit(PermissionSet reqdPerms) throws PermissionViolationException {
		// TODO fill in, making use of your implied implementation-dependent 
		// subject
	}

	/**
	 * @param PermissionSetreqdPerms
	 * @param ListgroupList
	 */
	public void permit(PermissionSet reqdPerms, Subject subject) throws 
	   PermissionViolationException {
		// TODO fill in, making use of an explicit implementation-dependent 
		// subject

	}
	
	/**
	 * @return the set of Groups mapped to permission sets in this ACL.  
	 */
	public Set<String> getPermittedNames() {
		return grants.keySet();
	}
	
	/**
	 * 
	 * @param name - the group to return a permission set for
	 * @return PermissionSet for the given group in the ACL or null
	 */
	public PermissionSet getPermissionSet(String name){
		return grants.get(name);
	}
	
	public ACLHolder getSecuredResource() {
		return securedResource;
	}

	public void setSecuredResource(ACLHolder theSecuredResource) {
		securedResource = theSecuredResource;
	}
	
}

                
/**
 * WASACL extends the ACL class for WebSphere-specific example implementations of the 
 * permit() method, using (6.1) WAS-specific implicit and explicit subjects as arguments
 */
package org.eaz.acl;

import java.util.Iterator;
import java.util.List;
import java.util.Set;

import org.eaz.domain.ACLHolder;


/*
 * The imports below are only for the WebSphere specific example overloaded
 * permit() methods.  You'll need to place sas.jar and wssec.jar in the classpath
 * to use the imports and example code.
 */
import com.ibm.websphere.security.WSSecurityException;
import com.ibm.websphere.security.auth.CredentialDestroyedException;
import com.ibm.websphere.security.auth.WSSubject;
import com.ibm.websphere.security.cred.WSCredential;
import javax.security.auth.Subject;
import javax.security.auth.login.CredentialExpiredException;

/**
 * @author Robert Patt-Corner, Keys Botzum
 * The WASACL extends ACL with WebSphere-specific techniques for dealing with
 * implicit and explicit subjects in the permit() method
 */
public class WASACL extends ACL {

	public WASACL(ACLHolder securedResource) {
		super(securedResource);
	}

	/**
	 * @param PermissionSet reqdPerms
	 * This is an example implementation for WebSpere V6.1, illustrating how to use
	 * the implicit WebSphere Subject to perform authorization.  Must be run in a
	 * WAS container.
	 * 
	 * Introduces a dependency on WAS 6.1's wssec.jar and sas.jar
	 */
	public void permit(PermissionSet reqdPerms) throws PermissionViolationException {
		try {
			// Get the subject in a WebSphere specific manner, then delegate
			Subject subject = WSSubject.getCallerSubject();
			permit(reqdPerms, subject);
		} catch (WSSecurityException e) {
			throw new PermissionViolationException("Unable to retrieve 
				the WebSphere caller subject", e);
		}
	}

	/**
	 * @param PermissionSet reqdPerms
	 * @param Subject explicit subject
	 * This is an example implementation for WebSphere 6.1 ilustrating how to 
	 * approach using an explicit subject to perform authorization.  
	 */
	public void permit(PermissionSet reqdPerms, Subject subject) throws 
PermissionViolationException {
		subject.getPrincipals();
		
		String username=null;
		List<String> groups=null;
		
		// Get the public credentials (should be only one) from the subject of 
		// interest 
		Set credSet = subject.getPublicCredentials(WSCredential.class);
		   if (credSet.size() != 1) {
		    throw new PermissionViolationException("Found "
		      + credSet.size() + "WSCredentals, which is not legal");
		   }

		   Iterator iter = credSet.iterator();
		   WSCredential creds = (WSCredential) iter.next();
		   
		   // Get the unique security name corresponding to the Principal
			try {
				username=creds.getUniqueSecurityName();
				groups = creds.getGroupIds();

				/* At this point you'll want to insert application-
				 * specific code to transform both the username and then 
				 * each of the groups identifiers to the format your 
				 * application uses for group names in the 
				 * grants structure
				 */ 
	        
				groups.add(username); 
				// add the Principal name to the groups
			} catch (CredentialExpiredException e) {
				throw new PermissionViolationException
				("Found expired WS credentials in ACL", e);
			} catch (CredentialDestroyedException e) {
				throw new PermissionViolationException
			   ("Found destroyed WS credentials in ACL", e);
			}
        permit (reqdPerms, groups);
	}

}