openamf/src/java/org/openamf/invoker AccessDeniedException.java,NONE,1.1

Update of /cvsroot/openamf/openamf/src/java/org/openamf/invoker
In directory sc8-pr-cvs1:/tmp/cvs-serv11087/src/java/org/openamf/invoker

Added Files:
	AccessDeniedException.java 
Log Message:
added patch submitted by Richard Kunze






This is what Richard had to say about his patch:

Hello everyone,

I am using OpenAMF in a project where we need fine-grained access control on 
the web services provided to Flash clients. I've changed OpenAMF to fit the 
following requirements:

- Control over which methods in a service handler are available via AMF and 
which are not
- Control over which user may access which may access what method.

A patch against the current (May 21 2003, 2:15 PM CEST) CVS is attached. The 
patch consists of a unified diff containing the changes to existing classes 
("openamf.diff") and Java sources for two new classes.

I have implemented the first requirement by having the AdvancedGateway check 
each method call against the method configuration before passing it off to 
the invoker. If no matching entry is found in the configuration, a 
"java.lang.NoSuchMethodException" is thrown. In order to provide a convenient 
means to enable all methods in a service without having to write method 
configurations for each of them, I've introduced "*" as wildcard for an 
arbitrary method name.

The second requirement is implemented in terms of the servlet security model. 
I have introduced a new method-level configuration element named 
"<access-constraint>" which can contain an abritrary number of "<role-name>" 
elements. If an access contraint is configured for a method, calling this 
method is only allowed if the user currently logged in is in one of the 
security roles defined in the access constraint. Roles are checked via 
javax.servlet.http.HttpServletRequest.isUserInRole(), user authentication is 
delegated to the servlet engine (i.e., you define a security constraint on 
the gateway servlet in web.xml to force authentication).

Here's a small example. Consider these two service classes:

public class PublicService {
? public String freeForAll() { ... }
? public String membersOnly() { ... }
? public String notAvailableInAMF() { ... }
}

public class AdminService {
? public boolean addMember(String name) { ... }
? public boolean removeMember() { ... }
}


and the corresponding service definitions from openamf-config.xml:

<service>
? <name>PublicService</name>
? <service-location>PublicService</service-location>
? <invoker-ref>Java</invoker-ref>
? <method>
? ? <name>freeForAll</name> ? ?
? </method>
? <method>
? ? <name>membersOnly</name> ? ?
? ? <access-constraint>
? ? ? ?<role-name>Member</role-name>
? ? ? ?<role-name>Administrator</role-name>
? ? </access-constraint>
? </method>
</service>

<service>
? <name>AdminService</name>
? <service-location>AdminService</service-location>
? <invoker-ref>Java</invoker-ref>
? <method>
? ? <name>*</name> ? ?
? ? <parameter><type>*</type></parameter>
? ? <access-constraint>
? ? ? ?<role-name>Administrator</role-name>
? ? </access-constraint>
? </method>
</service>

With this configuration, PublicService.freeForAll() is accessible by everyone, 
PublicService.membersOnly() is only accessible if the accessing user is in 
the "Member" or "Admistrator" role and is blocked for anyone else, and 
PublicService.notAvailableInAMF() is not accessible at all.

In AdminService, all methods are accessible for users in the "Administrator" 
role.



--- NEW FILE: AccessDeniedException.java ---
package org.openamf.invoker;

/**
 * Exception class for indicationg that a service may not be accessed.
 * @author Richard Kunze
 */
public class AccessDeniedException extends Exception {
	
	public AccessDeniedException() {
		super();
	}

	public AccessDeniedException(String message) {
		super(message);
	}

	public AccessDeniedException(String message, Throwable cause) {
		super(message, cause);
	}

	public AccessDeniedException(Throwable cause) {
		super(cause);
	}

}




-------------------------------------------------------
This SF.net email is sponsored by: ObjectStore.
If flattening out C++ or Java code to make your application fit in a
relational database is painful, don't do it! Check out ObjectStore.
Now part of Progress Software. http://www.objectstore.net/sourceforge