Update of /cvsroot/openamf/openamf/src/java/org/openamf/config
In directory sc8-pr-cvs1:/tmp/cvs-serv11087/src/java/org/openamf/config
Modified Files:
ServiceMethodConfig.java ConfigDigester.java
Added Files:
ServiceMethodAccessConstraintConfig.java
Log Message:
added patch submitted by Richard Kunze
This is what Richard had to say about his patch:
Hello everyone,
I am using OpenAMF in a project where we need fine-grained access control on
the web services provided to Flash clients. I've changed OpenAMF to fit the
following requirements:
- Control over which methods in a service handler are available via AMF and
which are not
- Control over which user may access which may access what method.
A patch against the current (May 21 2003, 2:15 PM CEST) CVS is attached. The
patch consists of a unified diff containing the changes to existing classes
("openamf.diff") and Java sources for two new classes.
I have implemented the first requirement by having the AdvancedGateway check
each method call against the method configuration before passing it off to
the invoker. If no matching entry is found in the configuration, a
"java.lang.NoSuchMethodException" is thrown. In order to provide a convenient
means to enable all methods in a service without having to write method
configurations for each of them, I've introduced "*" as wildcard for an
arbitrary method name.
The second requirement is implemented in terms of the servlet security model.
I have introduced a new method-level configuration element named
"<access-constraint>" which can contain an abritrary number of "<role-name>"
elements. If an access contraint is configured for a method, calling this
method is only allowed if the user currently logged in is in one of the
security roles defined in the access constraint. Roles are checked via
javax.servlet.http.HttpServletRequest.isUserInRole(), user authentication is
delegated to the servlet engine (i.e., you define a security constraint on
the gateway servlet in web.xml to force authentication).
Here's a small example. Consider these two service classes:
public class PublicService {
? public String freeForAll() { ... }
? public String membersOnly() { ... }
? public String notAvailableInAMF() { ... }
}
public class AdminService {
? public boolean addMember(String name) { ... }
? public boolean removeMember() { ... }
}
and the corresponding service definitions from openamf-config.xml:
<service>
? <name>PublicService</name>
? <service-location>PublicService</service-location>
? <invoker-ref>Java</invoker-ref>
? <method>
? ? <name>freeForAll</name> ? ?
? </method>
? <method>
? ? <name>membersOnly</name> ? ?
? ? <access-constraint>
? ? ? ?<role-name>Member</role-name>
? ? ? ?<role-name>Administrator</role-name>
? ? </access-constraint>
? </method>
</service>
<service>
? <name>AdminService</name>
? <service-location>AdminService</service-location>
? <invoker-ref>Java</invoker-ref>
? <method>
? ? <name>*</name> ? ?
? ? <parameter><type>*</type></parameter>
? ? <access-constraint>
? ? ? ?<role-name>Administrator</role-name>
? ? </access-constraint>
? </method>
</service>
With this configuration, PublicService.freeForAll() is accessible by everyone,
PublicService.membersOnly() is only accessible if the accessing user is in
the "Member" or "Admistrator" role and is blocked for anyone else, and
PublicService.notAvailableInAMF() is not accessible at all.
In AdminService, all methods are accessible for users in the "Administrator"
role.
--- NEW FILE: ServiceMethodAccessConstraintConfig.java ---
package org.openamf.config;
/** Method access constraint configuration */
public class ServiceMethodAccessConstraintConfig {
private String roleName;
public String getRoleName() {
return roleName;
}
public void setRoleName(String roleName) {
this.roleName = roleName;
}
public String toString() {
StringBuffer sb = new StringBuffer();
sb.append("\t\t\tRoleName: ");
sb.append(getRoleName());
sb.append('\n');
return sb.toString();
}
}
Index: ServiceMethodConfig.java
===================================================================
RCS file: /cvsroot/openamf/openamf/src/java/org/openamf/config/ServiceMethodConfig.java,v
retrieving revision 1.2
retrieving revision 1.3
diff -C2 -d -r1.2 -r1.3
*** ServiceMethodConfig.java 2 May 2003 04:39:44 -0000 1.2
--- ServiceMethodConfig.java 21 May 2003 01:36:58 -0000 1.3
***************
*** 14,17 ****
--- 14,18 ----
private boolean stateBeanConfigsLoaded = false;
private ArrayList parameterConfigs = new ArrayList();
+ private ArrayList accessConstraintConfigs = new ArrayList();
private ArrayList resultFilterConfigs = new ArrayList();
private ServiceConfig serviceConfig;
***************
*** 57,60 ****
--- 58,69 ----
}
+ public Iterator getAccessConstraintConfigs() {
+ return accessConstraintConfigs.iterator();
+ }
+
+ public void addAccessConstraintConfig(ServiceMethodAccessConstraintConfig config) {
+ accessConstraintConfigs.add(config);
+ }
+
public Iterator getResultFilterConfigs() {
if (getServiceConfig() == null) {
***************
*** 119,122 ****
--- 128,137 ----
}
+ sb.append("\t-----------------\n");
+ sb.append("\tACCESS CONSTRAINTS:\n");
+ sb.append("\t-----------------\n");
+ for (Iterator i = getAccessConstraintConfigs(); i.hasNext();) {
+ sb.append(i.next());
+ }
return sb.toString();
}
Index: ConfigDigester.java
===================================================================
RCS file: /cvsroot/openamf/openamf/src/java/org/openamf/config/ConfigDigester.java,v
retrieving revision 1.8
retrieving revision 1.9
diff -C2 -d -r1.8 -r1.9
*** ConfigDigester.java 2 May 2003 04:39:44 -0000 1.8
--- ConfigDigester.java 21 May 2003 01:36:58 -0000 1.9
***************
*** 14,17 ****
--- 14,19 ----
private static final String METHOD_PARAM_PATH =
METHOD_PATH + "/parameter";
+ private static final String METHOD_ACCESS_CONSTRAINT_PATH =
+ METHOD_PATH + "/access-constraint/role-name";
private static final String RESULT_FILTER_PATH =
METHOD_PATH + "/result-filter";
***************
*** 90,93 ****
--- 92,104 ----
"org.openamf.config.ServiceMethodParameterConfig");
addCallMethod(METHOD_PARAM_PATH + "/type", "setType", 0);
+
+ addObjectCreate(
+ METHOD_ACCESS_CONSTRAINT_PATH,
+ ServiceMethodAccessConstraintConfig.class);
+ addSetNext(
+ METHOD_ACCESS_CONSTRAINT_PATH,
+ "addAccessConstraintConfig",
+ "org.openamf.config.ServiceMethodAccessConstraintConfig");
+ addCallMethod(METHOD_ACCESS_CONSTRAINT_PATH, "setRoleName", 0);
}
-------------------------------------------------------
This SF.net email is sponsored by: ObjectStore.
If flattening out C++ or Java code to make your application fit in a
relational database is painful, don't do it! Check out ObjectStore.
Now part of Progress Software. http://www.objectstore.net/sourceforge
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.