1 package org.saf.struts.util;
2
3 import org.apache.commons.logging.Log;
4 import org.apache.commons.logging.LogFactory;
5
6 import org.saf.struts.bean.AuthorizationDefinition;
7 import org.saf.struts.config.StrutsAuthorizationConfig;
8 import org.saf.struts.exception.SafAuthorizationException;
9
10 import java.util.HashSet;
11 import java.util.Map;
12 import java.util.Set;
13
14 import javax.servlet.ServletException;
15 import javax.servlet.http.HttpServletRequest;
16 import javax.servlet.http.HttpSession;
17
18
19 /***
20 * Utilities method which can be used in various struts applications to control
21 * the authorization flow.
22 *
23 * @author Wim Tobback
24 * @version 1.0
25 *
26 * @since 1.0
27 */
28 public class SafUtils {
29 private final static Log log = LogFactory.getLog(SafUtils.class);
30
31 /***
32 * Sets the authorization definition of the principal in a struts
33 * application.
34 *
35 * @param request The Http request we are processing.
36 * @param defId The definition id of the authorization definition.
37 *
38 * @throws ServletException Occurs when an error has been thrown while
39 * trying to set the authorization definition.
40 */
41 public static void setAuthorizationDefinition(HttpServletRequest request,
42 String defId) throws ServletException {
43 SafContext context = SafContext.getInstance();
44 StrutsAuthorizationConfig config = context.getConfig();
45
46 if (config == null) {
47 log.error("Struts authorization framework not correctly loaded");
48 throw new ServletException(
49 "Struts authorization framework not correctly loaded");
50 }
51
52 Map authorizationDefinitionMap = config.getAuthorizationDefinitionMap();
53 AuthorizationDefinition authDef = (AuthorizationDefinition) authorizationDefinitionMap.get(defId);
54
55 if (authDef == null) {
56 log.error(
57 "AuthorizationDefinition not found in the configuration file");
58 throw new ServletException(
59 "AuthorizationDefinition not found in the configuration file");
60 }
61
62 HttpSession session = request.getSession();
63 session.setAttribute(Globals.SAF_AUTHORIZATION_DEFINITION_KEY, authDef);
64 }
65
66 /***
67 * Sets the authorization definition of the principal in a struts
68 * application.
69 *
70 * @param request The Http request we are processing.
71 * @param definition The AuthorizationDefinition DTO.
72 *
73 * @throws ServletException Occurs when an error has been thrown while
74 * trying to set the authorization definition.
75 */
76 public static void setAuthorizationDefinition(HttpServletRequest request,
77 AuthorizationDefinition definition) throws ServletException {
78 SafContext context = SafContext.getInstance();
79 StrutsAuthorizationConfig config = context.getConfig();
80
81 if (config == null) {
82 log.error("Struts authorization framework not correctly loaded");
83 throw new ServletException(
84 "Struts authorization framework not correctly loaded");
85 }
86
87 if (definition == null) {
88 log.error("Passed a null object for the AuthorizationDefinition");
89 throw new ServletException(
90 "Passed a null object for the AuthorizationDefinition");
91 }
92
93 Map authorizationDefinitionMap = config.getAuthorizationDefinitionMap();
94 AuthorizationDefinition authDef = (AuthorizationDefinition) authorizationDefinitionMap.get(definition.getRefId());
95
96 if (authDef == null) {
97 log.error(
98 "AuthorizationDefinition not found in the configuration file");
99 throw new ServletException(
100 "AuthorizationDefinition not found in the configuration file");
101 }
102
103 HttpSession session = request.getSession();
104 session.setAttribute(Globals.SAF_AUTHORIZATION_DEFINITION_KEY, authDef);
105 }
106
107 /***
108 * Returns the authorization definition of the principal store in the
109 * session scope.
110 *
111 * @param request The Http request we are processing.
112 *
113 * @return The AuthorizationDefinition DTO stored in the session scope.
114 *
115 * @throws ServletException Occurs when an error has been thrown while
116 * trying to retrieve the AuthorizationDefinition.
117 */
118 public static AuthorizationDefinition getAuthorizationDefinition(
119 HttpServletRequest request) throws ServletException {
120 HttpSession session = request.getSession();
121 AuthorizationDefinition authDef = (AuthorizationDefinition) session.getAttribute(Globals.SAF_AUTHORIZATION_DEFINITION_KEY);
122
123 return authDef;
124 }
125
126 /***
127 * Return a Map containing all the AuthorizationDefinition defined in the
128 * saf config file.
129 *
130 * @return Map The Map containing the AuthorizationDefintions defined in
131 * the saf config file.
132 *
133 * @throws ServletException Occurs when an error has been thrown while
134 * trying to retrieve all the AuthorizationDefinition DTO's.
135 */
136 public static Map getAuthorizationDefinitionMap() throws ServletException {
137 SafContext context = SafContext.getInstance();
138 StrutsAuthorizationConfig config = context.getConfig();
139
140 if (config == null) {
141 log.error("Struts authorization framework not correctly loaded");
142 throw new ServletException(
143 "Struts authorization framework not correctly loaded");
144 }
145
146 return config.getAuthorizationDefinitionMap();
147 }
148
149 /***
150 * Checks if the user is authorized or not.
151 *
152 * @param request The Http request we are processing.
153 * @param defId The definition id of the authorization definition.
154 *
155 * @return true if the user is authorized, otherwise false will be
156 * returned.
157 *
158 * @throws SafAuthorizationException Occurs when an error has been thrown
159 * while trying to check if the user is authorized.
160 */
161 public static boolean isAuthorized(HttpServletRequest request, String defId)
162 throws SafAuthorizationException {
163 boolean authorized = false;
164 SafContext context = SafContext.getInstance();
165 StrutsAuthorizationConfig config = context.getConfig();
166
167 if (defId == null) {
168 throw new SafAuthorizationException(
169 "No authorization definition specified");
170 }
171
172 Map authorizationDefinitionMap = config.getAuthorizationDefinitionMap();
173 AuthorizationDefinition definedAuthorizationDefinition = (AuthorizationDefinition) authorizationDefinitionMap.get(defId);
174
175 if (definedAuthorizationDefinition == null) {
176 throw new SafAuthorizationException(
177 "No authorization definition found for defId : " + defId);
178 }
179
180 try {
181 AuthorizationDefinition userAuthorizationDefinition = SafUtils.getAuthorizationDefinition(request);
182
183 if (userAuthorizationDefinition == null) {
184 throw new SafAuthorizationException(
185 "No authorization definition found for user");
186 }
187
188 Set definedAuthorizationDefinitionList = new HashSet(definedAuthorizationDefinition.getDefinitionMap()
189 .values());
190 Set userAuthorizationDefinitionList = new HashSet(userAuthorizationDefinition.getDefinitionMap()
191 .values());
192 authorized = userAuthorizationDefinitionList.containsAll(definedAuthorizationDefinitionList);
193 } catch (ServletException e) {
194 throw new SafAuthorizationException(e);
195 }
196
197 return authorized;
198 }
199 }