org.xdi.oxauth.uma.service.UmaExpressionService クラス

org.xdi.oxauth.uma.service.UmaExpressionService 連携図

公開メンバ関数
boolean	isExpressionValid (String expression)
void	evaluate (Map< UmaScriptByScope, UmaAuthorizationContext > scriptMap, List< UmaPermission > permissions)

非公開メンバ関数
boolean	evaluateByScopes (Map< UmaScriptByScope, UmaAuthorizationContext > scriptMap)
void	evaluateScopeExpression (Map< UmaScriptByScope, UmaAuthorizationContext > scriptMap, UmaPermission permission, UmaResource resource)
void	removeFalseScopesFromPermission (UmaPermission permission, List< String > dataScopes, Map< String, String > scopeIdToDnMap, List< Boolean > evaluatedResults)

静的非公開メンバ関数
static Map< String, String >	scopeIdToDnMap (Map< UmaScriptByScope, UmaAuthorizationContext > scriptMap, List< String > scriptDNs)
static Map< UmaScriptByScope, UmaAuthorizationContext >	filterByScopeDns (Map< UmaScriptByScope, UmaAuthorizationContext > scriptMap, List< String > scopeDNs)
static Map< UmaScriptByScope, UmaAuthorizationContext >	filterByScopeId (Map< UmaScriptByScope, UmaAuthorizationContext > scriptMap, String scopeId)

非公開変数類
Logger	log
ExternalUmaRptPolicyService	policyService
ErrorResponseFactory	errorResponseFactory
UmaResourceService	resourceService
UmaPermissionService	permissionService

詳解

著者

yuriyz

関数詳解

evaluate()

void org.xdi.oxauth.uma.service.UmaExpressionService.evaluate ( Map< UmaScriptByScope, UmaAuthorizationContext >  scriptMap, List< UmaPermission >  permissions  )

inline

                                                                                                                    {
        for (UmaPermission permission : permissions) {
            UmaResource resource = resourceService.getResourceById(permission.getResourceId());
            if (StringHelper.isNotEmpty(resource.getScopeExpression())) {
                evaluateScopeExpression(scriptMap, permission, resource);
            } else {
                if (!evaluateByScopes(filterByScopeDns(scriptMap, permission.getScopeDns()))) {
                    log.trace("Regular evaluation returns false, access FORBIDDEN.");
                    throw new UmaWebException(Response.Status.FORBIDDEN, errorResponseFactory, UmaErrorResponseType.FORBIDDEN_BY_POLICY);
                }
            }
        }
    }

evaluateByScopes()

boolean org.xdi.oxauth.uma.service.UmaExpressionService.evaluateByScopes ( Map< UmaScriptByScope, UmaAuthorizationContext >  scriptMap )

inlineprivate

                                                                                               {
        for (Map.Entry<UmaScriptByScope, UmaAuthorizationContext> entry : scriptMap.entrySet()) {
            final boolean result = policyService.authorize(entry.getKey().getScript(), entry.getValue());
            log.trace("Policy script inum: '{}' result: '{}'", entry.getKey().getScript().getInum(), result);
            if (!result) {
                log.trace("Stop authorization scriptMap execution, current script returns false, script inum: " + entry.getKey().getScript().getInum() + ", scope: " + entry.getKey().getScope());
                return false;
            }
        }
        return true;
    }

evaluateScopeExpression()

void org.xdi.oxauth.uma.service.UmaExpressionService.evaluateScopeExpression ( Map< UmaScriptByScope, UmaAuthorizationContext >  scriptMap, UmaPermission  permission, UmaResource  resource  )

inlineprivate

                                                                                                                                                   {
        String scopeExpression = resource.getScopeExpression();
        JsonLogicNode node = JsonLogicNodeParser.parseNode(scopeExpression);
        if (node != null) {
            log.trace("Evaluating scope expression ...");

            // validate scopes, all must be present
            List<String> dataScopes = node.getDataCopy();
            Map<String, String> scopeIdToDnMap = scopeIdToDnMap(scriptMap, permission.getScopeDns());
            if (dataScopes.size() == scopeIdToDnMap.size()) {
                try {
                    List<Boolean> evaluatedResults = new ArrayList<Boolean>();
                    for (String scopeId : dataScopes) {
                        log.trace("Evaluating scope result for scope: " + scopeId + " ...");
                        boolean b = evaluateByScopes(filterByScopeDns(scriptMap, Lists.newArrayList(scopeIdToDnMap.get(scopeId))));
                        log.trace("Evaluated scope result: " + b + ", scope: " + scopeId);
                        evaluatedResults.add(b);
                    }

                    String rule = node.getRule().toString();
                    final boolean result;
                    if (evaluatedResults.isEmpty()) {
                        result = JsonLogic.apply(rule);
                    } else {
                        result = JsonLogic.apply(rule, Util.asJsonSilently(evaluatedResults));
                    }

                    log.trace("JsonLogic evaluation result: " + result + ", rule: " + rule + ", data:" + Util.asJsonSilently(evaluatedResults));
                    if (result) {
                        // access granted at this point but we have to remove scopes from permissions for which we got 'false' result
                        removeFalseScopesFromPermission(permission, dataScopes, scopeIdToDnMap, evaluatedResults);
                        return; // expression returned true;
                    }
                } catch (Exception e) {
                    log.error("Failed to evaluate jsonlogic expression. Expression: " + scopeExpression + ", resourceDn: " + resource.getDn());
                }
            } else {
                log.error("Scope size in JsonLogic object 'data' and in permission differs which is forbidden. Node data: " + node +
                        ", permissionDns: " + permission.getScopeDns() + ", result scopeIds: " + scopeIdToDnMap);
            }
        } else {
            log.error("Failed to parse JsonLogic object, invalid expression: " + scopeExpression);
        }
        throw new UmaWebException(Response.Status.FORBIDDEN, errorResponseFactory, UmaErrorResponseType.FORBIDDEN_BY_POLICY);
    }

filterByScopeDns()

static Map<UmaScriptByScope, UmaAuthorizationContext> org.xdi.oxauth.uma.service.UmaExpressionService.filterByScopeDns ( Map< UmaScriptByScope, UmaAuthorizationContext >  scriptMap, List< String >  scopeDNs  )

inlinestaticprivate

                                                                                                                                                                    {
        Map<UmaScriptByScope, UmaAuthorizationContext> result = new HashMap<UmaScriptByScope, UmaAuthorizationContext>();
        for (Map.Entry<UmaScriptByScope, UmaAuthorizationContext> entry : scriptMap.entrySet()) {
            if (scopeDNs.contains(entry.getKey().getScope().getDn())) {
                result.put(entry.getKey(), entry.getValue());
            }
        }
        return result;
    }

filterByScopeId()

static Map<UmaScriptByScope, UmaAuthorizationContext> org.xdi.oxauth.uma.service.UmaExpressionService.filterByScopeId ( Map< UmaScriptByScope, UmaAuthorizationContext >  scriptMap, String  scopeId  )

inlinestaticprivate

                                                                                                                                                            {
        Map<UmaScriptByScope, UmaAuthorizationContext> result = new HashMap<UmaScriptByScope, UmaAuthorizationContext>();
        for (Map.Entry<UmaScriptByScope, UmaAuthorizationContext> entry : scriptMap.entrySet()) {
            if (entry.getKey().getScope().getId().equals(scopeId)) {
                result.put(entry.getKey(), entry.getValue());
            }
        }
        return result;
    }

isExpressionValid()

boolean org.xdi.oxauth.uma.service.UmaExpressionService.isExpressionValid ( String  expression )

inline

                                                        {
        return JsonLogicNodeParser.isNodeValid(expression);
    }

removeFalseScopesFromPermission()

void org.xdi.oxauth.uma.service.UmaExpressionService.removeFalseScopesFromPermission ( UmaPermission  permission, List< String >  dataScopes, Map< String, String >  scopeIdToDnMap, List< Boolean >  evaluatedResults  )

inlineprivate

                                                                                                                                                                        {
        if (!evaluatedResults.isEmpty() && permission.getScopeDns() != null) {

            List<String> newPermissionScopes = new ArrayList<String>(permission.getScopeDns());

            for (int i = 0; i < evaluatedResults.size(); i++) {
                if (!evaluatedResults.get(i)) {
                    String dnToRemove = scopeIdToDnMap.get(dataScopes.get(i));
                    newPermissionScopes.remove(dnToRemove);
                }
            }

            if (newPermissionScopes.size() < permission.getScopeDns().size()) {
                permission.setScopeDns(newPermissionScopes);

                permissionService.mergeSilently(permission);
            }
        }
    }

scopeIdToDnMap()

static Map<String, String> org.xdi.oxauth.uma.service.UmaExpressionService.scopeIdToDnMap ( Map< UmaScriptByScope, UmaAuthorizationContext >  scriptMap, List< String >  scriptDNs  )

inlinestaticprivate

                                                                                                                                        {
        Map<String, String> result = new HashMap<String, String>();
        for (Map.Entry<UmaScriptByScope, UmaAuthorizationContext> entry : scriptMap.entrySet()) {
            if (scriptDNs.contains(entry.getKey().getScope().getDn())) {
                result.put(entry.getKey().getScope().getId(), entry.getKey().getScope().getDn());
            }
        }
        return result;
    }

メンバ詳解

errorResponseFactory

ErrorResponseFactory org.xdi.oxauth.uma.service.UmaExpressionService.errorResponseFactory

private

log

Logger org.xdi.oxauth.uma.service.UmaExpressionService.log

private

permissionService

UmaPermissionService org.xdi.oxauth.uma.service.UmaExpressionService.permissionService

private

policyService

ExternalUmaRptPolicyService org.xdi.oxauth.uma.service.UmaExpressionService.policyService

private

resourceService

UmaResourceService org.xdi.oxauth.uma.service.UmaExpressionService.resourceService

private

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/OpenId/gluu/src/oxAuth/Server/src/main/java/org/xdi/oxauth/uma/service/UmaExpressionService.java