svn commit: r564543 - in /lenya/trunk/src: modules-core/ac/config/cocoon-xconf/ modules-core/ac/java/src/org/apache/lenya/ac/impl/ pubs/default/config/access-control/

Author: andreas
Date: Fri Aug 10 03:53:48 2007
New Revision: 564543

URL: http://svn.apache.org/viewvc?view=rev&rev=564543
Log:
Removed PolicyAuthorizer, moved role resolving to DefaultAccessController

Removed:
    lenya/trunk/src/modules-core/ac/java/src/org/apache/lenya/ac/impl/PolicyAuthorizer.java
Modified:
    lenya/trunk/src/modules-core/ac/config/cocoon-xconf/authorizers.xconf
    lenya/trunk/src/modules-core/ac/java/src/org/apache/lenya/ac/impl/DefaultAccessController.java
    lenya/trunk/src/pubs/default/config/access-control/access-control.xml

Modified: lenya/trunk/src/modules-core/ac/config/cocoon-xconf/authorizers.xconf
URL: http://svn.apache.org/viewvc/lenya/trunk/src/modules-core/ac/config/cocoon-xconf/authorizers.xconf?view=diff&rev=564543&r1=564542&r2=564543
==============================================================================
--- lenya/trunk/src/modules-core/ac/config/cocoon-xconf/authorizers.xconf (original)
+++ lenya/trunk/src/modules-core/ac/config/cocoon-xconf/authorizers.xconf Fri Aug 10 03:53:48 2007
@@ -16,10 +16,6 @@
   limitations under the License.
 -->
 
-<xconf xpath="/cocoon" unless="/cocoon/authorizers/component-instance[@name = 'policy']">
-  <authorizers>
-    <component-instance name="policy"
-      class="org.apache.lenya.ac.impl.PolicyAuthorizer"
-      logger="lenya.ac.authorizer.policy"/>
-  </authorizers>
+<xconf xpath="/cocoon" unless="/cocoon/authorizers">
+  <authorizers/>
 </xconf>

Modified: lenya/trunk/src/modules-core/ac/java/src/org/apache/lenya/ac/impl/DefaultAccessController.java
URL: http://svn.apache.org/viewvc/lenya/trunk/src/modules-core/ac/java/src/org/apache/lenya/ac/impl/DefaultAccessController.java?view=diff&rev=564543&r1=564542&r2=564543
==============================================================================
--- lenya/trunk/src/modules-core/ac/java/src/org/apache/lenya/ac/impl/DefaultAccessController.java (original)
+++ lenya/trunk/src/modules-core/ac/java/src/org/apache/lenya/ac/impl/DefaultAccessController.java Fri Aug 10 03:53:48 2007
@@ -19,6 +19,7 @@
 package org.apache.lenya.ac.impl;
 
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -53,10 +54,12 @@
 import org.apache.lenya.ac.Machine;
 import org.apache.lenya.ac.PolicyManager;
 import org.apache.lenya.ac.Role;
+import org.apache.lenya.util.ServletHelper;
 
 /**
  * Default access controller implementation.
- * @version $Id$
+ * @version $Id: DefaultAccessController.java 563459 2007-08-07 12:00:20Z
+ *          nettings $
  */
 public class DefaultAccessController extends AbstractLogEnabled implements AccessController,
         Configurable, Serviceable, Disposable, ItemManagerListener {
@@ -99,6 +102,8 @@
         getLogger().debug("=========================================================");
         getLogger().debug("Beginning authorization.");
 
+        resolveRoles(request);
+
         if (hasAuthorizers()) {
             Authorizer[] _authorizers = getAuthorizers();
             int i = 0;
@@ -111,12 +116,6 @@
                     getLogger().debug("Invoking authorizer [" + _authorizers[i] + "]");
                 }
 
-                if (_authorizers[i] instanceof PolicyAuthorizer) {
-                    PolicyAuthorizer authorizer = (PolicyAuthorizer) _authorizers[i];
-                    authorizer.setAccreditableManager(this.accreditableManager);
-                    authorizer.setPolicyManager(this.policyManager);
-                }
-
                 authorized = authorized && _authorizers[i].authorize(request);
 
                 if (getLogger().isDebugEnabled()) {
@@ -137,7 +136,37 @@
         return authorized;
     }
 
-    
+    protected void resolveRoles(Request request) throws AccessControlException {
+        String webappUrl = ServletHelper.getWebappURI(request);
+        Session session = request.getSession(true);
+        Identity identity = (Identity) session.getAttribute(Identity.class.getName());
+
+        Role[] roles;
+        if (identity.belongsTo(this.accreditableManager)) {
+            roles = this.policyManager.getGrantedRoles(this.accreditableManager, identity, webappUrl);
+        } else {
+            roles = new Role[0];
+            getLogger().debug(
+                    "No roles resolved for identity [" + identity
+                            + "] - belongs to wrong accreditable manager.");
+        }
+        saveRoles(request, roles);
+    }
+
+    /**
+     * Saves the roles of the current identity to the request.
+     * @param request The request.
+     * @param roles The roles.
+     */
+    protected void saveRoles(Request request, Role[] roles) {
+        String rolesString = "";
+        for (int i = 0; i < roles.length; i++) {
+            rolesString += " " + roles[i];
+        }
+        getLogger().debug("Adding roles [" + rolesString + " ] to request [" + request + "]");
+        request.setAttribute(Role.class.getName(), Arrays.asList(roles));
+    }
+
     /**
      * Configures or parameterizes a component, depending on the implementation
      * as Configurable or Parameterizable.
@@ -188,11 +217,11 @@
         if (config != null) {
             AccreditableManagerFactory factory = null;
             try {
-                factory = (AccreditableManagerFactory) this.manager.lookup(AccreditableManagerFactory.ROLE);
+                factory = (AccreditableManagerFactory) this.manager
+                        .lookup(AccreditableManagerFactory.ROLE);
                 this.accreditableManager = factory.getAccreditableManager(config);
                 this.accreditableManager.addItemManagerListener(this);
-            }
-            finally {
+            } finally {
                 if (factory != null) {
                     this.manager.release(factory);
                 }
@@ -212,7 +241,8 @@
             ConfigurationException, ParameterException {
         Configuration[] authorizerConfigurations = configuration.getChildren(AUTHORIZER_ELEMENT);
         if (authorizerConfigurations.length > 0) {
-            this.authorizerSelector = (ServiceSelector) this.manager.lookup(Authorizer.ROLE + "Selector");
+            this.authorizerSelector = (ServiceSelector) this.manager.lookup(Authorizer.ROLE
+                    + "Selector");
 
             for (int i = 0; i < authorizerConfigurations.length; i++) {
                 String type = authorizerConfigurations[i].getAttribute(TYPE_ATTRIBUTE);
@@ -247,7 +277,8 @@
             }
             this.policyManagerSelector = (ServiceSelector) this.manager.lookup(PolicyManager.ROLE
                     + "Selector");
-            this.policyManager = (PolicyManager) this.policyManagerSelector.select(policyManagerType);
+            this.policyManager = (PolicyManager) this.policyManagerSelector
+                    .select(policyManagerType);
             configureOrParameterize(this.policyManager, policyManagerConfiguration);
         }
     }
@@ -445,7 +476,7 @@
             getLogger().debug("Item was removed: [" + item + "]");
             getLogger().debug("Notifying policy manager");
         }
-        
+
         if (!(item instanceof Role)) {
             getPolicyManager().accreditableRemoved(getAccreditableManager(), (Accreditable) item);
         }

Modified: lenya/trunk/src/pubs/default/config/access-control/access-control.xml
URL: http://svn.apache.org/viewvc/lenya/trunk/src/pubs/default/config/access-control/access-control.xml?view=diff&rev=564543&r1=564542&r2=564543
==============================================================================
--- lenya/trunk/src/pubs/default/config/access-control/access-control.xml (original)
+++ lenya/trunk/src/pubs/default/config/access-control/access-control.xml Fri Aug 10 03:53:48 2007
@@ -36,8 +36,6 @@
     </policy-manager>
   </policy-manager>
   
-  <authorizer type="policy"/>
-  
   <authorizer type="usecase">
     <parameter name="configuration" value="aggregate-fallback://config/access-control/usecase-policies.xml"/>
   </authorizer>