From d89f36b67ea1d838a78523538a24e044518f3587 Mon Sep 17 00:00:00 2001
From: mcentner <mcentner@8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4>
Date: Tue, 26 Jan 2010 16:22:56 +0000
Subject: MOCCA 1.2.11 with SHA-2 enabled.

git-svn-id: https://joinup.ec.europa.eu/svn/mocca/branches/mocca-1.2.11-sha2@599 8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4
---
 .../accesscontroller/SecurityManagerFacade.java    | 118 +++++++++++++++++++++
 1 file changed, 118 insertions(+)
 create mode 100644 mocca-1.2.11/bkucommon/src/main/java/at/gv/egiz/bku/accesscontroller/SecurityManagerFacade.java

(limited to 'mocca-1.2.11/bkucommon/src/main/java/at/gv/egiz/bku/accesscontroller/SecurityManagerFacade.java')

diff --git a/mocca-1.2.11/bkucommon/src/main/java/at/gv/egiz/bku/accesscontroller/SecurityManagerFacade.java b/mocca-1.2.11/bkucommon/src/main/java/at/gv/egiz/bku/accesscontroller/SecurityManagerFacade.java
new file mode 100644
index 00000000..482d3ecb
--- /dev/null
+++ b/mocca-1.2.11/bkucommon/src/main/java/at/gv/egiz/bku/accesscontroller/SecurityManagerFacade.java
@@ -0,0 +1,118 @@
+/*
+* Copyright 2008 Federal Chancellery Austria and
+* Graz University of Technology
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egiz.bku.accesscontroller;
+
+import java.io.InputStream;
+
+import javax.xml.bind.JAXBException;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import at.gv.egiz.bku.slcommands.SLCommand;
+import at.gv.egiz.bku.slcommands.SLSourceContext;
+import at.gv.egiz.bku.slcommands.SLTargetContext;
+
+/**
+ * Facade for the access controller
+ */
+public class SecurityManagerFacade {
+
+	private static Log log = LogFactory.getLog(SecurityManagerFacade.class);
+
+	private boolean allowUnmatched = false;
+	private ChainChecker inputFilter = null;
+	private ChainChecker outputFilter = null;
+	
+	public boolean mayInvokeCommand(SLCommand cmd, SLSourceContext ctx) {
+		if (inputFilter != null) {
+			AuthenticationClass ac = AuthenticationClassifier.getAuthenticationClass(
+					ctx.isSourceIsDataURL(), ctx.getSourceUrl(), ctx
+							.getSourceCertificate());
+			AccessCheckerContext acc = new AccessCheckerContext(cmd, ac, ctx
+					.getSourceUrl().toString());
+			try {
+				ChainResult cr = inputFilter.check(acc);
+				if (cr.matchFound()) {
+					if (cr.getAction() == Action.ALLOW) {
+						return true;
+					} else {
+						return false;
+					}
+				} else {
+					return allowUnmatched;
+				}
+			} catch (Exception e) {
+				log.error(e);
+				return false;
+			}
+		} else {
+			log.warn("No input chain defined");
+			return allowUnmatched;
+		}
+	}
+
+	public boolean maySendResult(SLCommand cmd, SLTargetContext ctx) {
+		if (outputFilter != null) {
+			AuthenticationClass ac = AuthenticationClassifier.getAuthenticationClass(
+					ctx.isTargetIsDataURL(), ctx.getTargetUrl(), ctx
+							.getTargetCertificate());
+			AccessCheckerContext acc = new AccessCheckerContext(cmd, ac, ctx
+					.getTargetUrl().toString());
+			try {
+				ChainResult cr = outputFilter.check(acc);
+				if (cr.matchFound()) {
+					if (cr.getAction() == Action.ALLOW) {
+						return true;
+					} else {
+						return false;
+					}
+				} else {
+					return allowUnmatched;
+				}
+			} catch (Exception e) {
+				log.error(e);
+				return false;
+			}
+		} else {
+			log.warn("No output chain defined");
+			return allowUnmatched;
+		}
+	}
+
+	/**
+	 * Default policy if not match was found
+	 * 
+	 * @param allow
+	 */
+	public void setAllowUnmatched(boolean allow) {
+		this.allowUnmatched = allow;
+	}
+
+	public void init(InputStream is) {
+		inputFilter = null;
+		outputFilter = null;
+		AccessControllerFactory fab = AccessControllerFactory.getInstance();
+		try {
+			fab.init(is);
+		} catch (JAXBException e) {
+			log.error(e);
+		}
+		inputFilter = fab.getChainChecker(AccessControllerFactory.INPUT_CHAIN);
+		outputFilter = fab.getChainChecker(AccessControllerFactory.OUTPUT_CHAIN);
+	}
+}
-- 
cgit v1.2.3