@Test public void testAuditInvoked() { User user1 = new User.Builder().identifier("user-id-1").identity("user-1").build(); AccessPolicy policy1 = new AccessPolicy.Builder() .identifier("policy-id-1") .resource("resource1") .action(RequestAction.READ) .addUser(user1.getIdentifier()) .build(); Set<AccessPolicy> policies = new LinkedHashSet<>(); policies.add(policy1); Set<User> users = new LinkedHashSet<>(); users.add(user1); final MockPolicyBasedAuthorizer mockAuthorizer = new MockPolicyBasedAuthorizer(new HashSet<>(), users, policies); AuthorizerConfigurationContext context = Mockito.mock(AuthorizerConfigurationContext.class); Authorizer authorizer = AuthorizerFactory.installIntegrityChecks(mockAuthorizer); authorizer.onConfigured(context); assertTrue(authorizer instanceof AuthorizationAuditor); final AuthorizationRequest accessAttempt = new AuthorizationRequest.Builder() .resource(new MockResource("resource1", "Resource 1")) .identity("user-1") .action(RequestAction.READ) .accessAttempt(true) .anonymous(false) .build(); final AuthorizationResult accessAttemptResult = authorizer.authorize(accessAttempt); assertTrue(Result.Approved.equals(accessAttemptResult.getResult())); assertTrue(mockAuthorizer.isAudited(accessAttempt)); final AuthorizationRequest nonAccessAttempt = new AuthorizationRequest.Builder() .resource(new MockResource("resource1", "Resource 1")) .identity("user-1") .accessAttempt(false) .action(RequestAction.READ) .anonymous(false) .build(); final AuthorizationResult nonAccessAttempResult = authorizer.authorize(nonAccessAttempt); assertTrue(Result.Approved.equals(nonAccessAttempResult.getResult())); assertFalse(mockAuthorizer.isAudited(nonAccessAttempt)); }
public static Authorizer installIntegrityChecks(final Authorizer baseAuthorizer) { Authorizer authorizer; if (baseAuthorizer instanceof ManagedAuthorizer) { final ManagedAuthorizer baseManagedAuthorizer = (ManagedAuthorizer) baseAuthorizer; authorizer = new ManagedAuthorizer() { @Override public String getFingerprint() throws AuthorizationAccessException { return baseManagedAuthorizer.getFingerprint(); } @Override public void inheritFingerprint(String fingerprint) throws AuthorizationAccessException { baseManagedAuthorizer.inheritFingerprint(fingerprint); } @Override public void checkInheritability(String proposedFingerprint) throws AuthorizationAccessException, UninheritableAuthorizationsException { baseManagedAuthorizer.checkInheritability(proposedFingerprint); } @Override public AccessPolicyProvider getAccessPolicyProvider() { final AccessPolicyProvider baseAccessPolicyProvider = baseManagedAuthorizer.getAccessPolicyProvider(); if (baseAccessPolicyProvider instanceof ConfigurableAccessPolicyProvider) { final ConfigurableAccessPolicyProvider baseConfigurableAccessPolicyProvider = (ConfigurableAccessPolicyProvider) baseAccessPolicyProvider; return new ConfigurableAccessPolicyProvider() { @Override public String getFingerprint() throws AuthorizationAccessException { return baseConfigurableAccessPolicyProvider.getFingerprint(); } @Override public void inheritFingerprint(String fingerprint) throws AuthorizationAccessException { baseConfigurableAccessPolicyProvider.inheritFingerprint(fingerprint); } @Override public void checkInheritability(String proposedFingerprint) throws AuthorizationAccessException, UninheritableAuthorizationsException { baseConfigurableAccessPolicyProvider.checkInheritability(proposedFingerprint); } @Override public AccessPolicy addAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException { if (policyExists(baseConfigurableAccessPolicyProvider, accessPolicy)) { throw new IllegalStateException(String.format("Found multiple policies for '%s' with '%s'.", accessPolicy.getResource(), accessPolicy.getAction())); } return baseConfigurableAccessPolicyProvider.addAccessPolicy(accessPolicy); } @Override public boolean isConfigurable(AccessPolicy accessPolicy) { return baseConfigurableAccessPolicyProvider.isConfigurable(accessPolicy); } @Override public AccessPolicy updateAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException { if (!baseConfigurableAccessPolicyProvider.isConfigurable(accessPolicy)) { throw new IllegalArgumentException("The specified access policy is not support modification."); } return baseConfigurableAccessPolicyProvider.updateAccessPolicy(accessPolicy); } @Override public AccessPolicy deleteAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException { if (!baseConfigurableAccessPolicyProvider.isConfigurable(accessPolicy)) { throw new IllegalArgumentException("The specified access policy is not support modification."); } return baseConfigurableAccessPolicyProvider.deleteAccessPolicy(accessPolicy); } @Override public Set<AccessPolicy> getAccessPolicies() throws AuthorizationAccessException { return baseConfigurableAccessPolicyProvider.getAccessPolicies(); } @Override public AccessPolicy getAccessPolicy(String identifier) throws AuthorizationAccessException { return baseConfigurableAccessPolicyProvider.getAccessPolicy(identifier); } @Override public AccessPolicy getAccessPolicy(String resourceIdentifier, RequestAction action) throws AuthorizationAccessException { return baseConfigurableAccessPolicyProvider.getAccessPolicy(resourceIdentifier, action); } @Override public UserGroupProvider getUserGroupProvider() { final UserGroupProvider baseUserGroupProvider = baseConfigurableAccessPolicyProvider.getUserGroupProvider(); if (baseUserGroupProvider instanceof ConfigurableUserGroupProvider) { final ConfigurableUserGroupProvider baseConfigurableUserGroupProvider = (ConfigurableUserGroupProvider) baseUserGroupProvider; return new ConfigurableUserGroupProvider() { @Override public String getFingerprint() throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getFingerprint(); } @Override public void inheritFingerprint(String fingerprint) throws AuthorizationAccessException { baseConfigurableUserGroupProvider.inheritFingerprint(fingerprint); } @Override public void checkInheritability(String proposedFingerprint) throws AuthorizationAccessException, UninheritableAuthorizationsException { baseConfigurableUserGroupProvider.checkInheritability(proposedFingerprint); } @Override public User addUser(User user) throws AuthorizationAccessException { if (tenantExists(baseConfigurableUserGroupProvider, user.getIdentifier(), user.getIdentity())) { throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", user.getIdentity())); } return baseConfigurableUserGroupProvider.addUser(user); } @Override public boolean isConfigurable(User user) { return baseConfigurableUserGroupProvider.isConfigurable(user); } @Override public User updateUser(User user) throws AuthorizationAccessException { if (tenantExists(baseConfigurableUserGroupProvider, user.getIdentifier(), user.getIdentity())) { throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", user.getIdentity())); } if (!baseConfigurableUserGroupProvider.isConfigurable(user)) { throw new IllegalArgumentException("The specified user does not support modification."); } return baseConfigurableUserGroupProvider.updateUser(user); } @Override public User deleteUser(User user) throws AuthorizationAccessException { if (!baseConfigurableUserGroupProvider.isConfigurable(user)) { throw new IllegalArgumentException("The specified user does not support modification."); } return baseConfigurableUserGroupProvider.deleteUser(user); } @Override public Group addGroup(Group group) throws AuthorizationAccessException { if (tenantExists(baseConfigurableUserGroupProvider, group.getIdentifier(), group.getName())) { throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", group.getName())); } if (!allGroupUsersExist(baseConfigurableUserGroupProvider, group)) { throw new IllegalStateException(String.format("Cannot create group '%s' with users that don't exist.", group.getName())); } return baseConfigurableUserGroupProvider.addGroup(group); } @Override public boolean isConfigurable(Group group) { return baseConfigurableUserGroupProvider.isConfigurable(group); } @Override public Group updateGroup(Group group) throws AuthorizationAccessException { if (tenantExists(baseConfigurableUserGroupProvider, group.getIdentifier(), group.getName())) { throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", group.getName())); } if (!allGroupUsersExist(baseConfigurableUserGroupProvider, group)) { throw new IllegalStateException(String.format("Cannot update group '%s' to add users that don't exist.", group.getName())); } if (!baseConfigurableUserGroupProvider.isConfigurable(group)) { throw new IllegalArgumentException("The specified group does not support modification."); } return baseConfigurableUserGroupProvider.updateGroup(group); } @Override public Group deleteGroup(Group group) throws AuthorizationAccessException { if (!baseConfigurableUserGroupProvider.isConfigurable(group)) { throw new IllegalArgumentException("The specified group does not support modification."); } return baseConfigurableUserGroupProvider.deleteGroup(group); } @Override public Set<User> getUsers() throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getUsers(); } @Override public User getUser(String identifier) throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getUser(identifier); } @Override public User getUserByIdentity(String identity) throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getUserByIdentity(identity); } @Override public Set<Group> getGroups() throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getGroups(); } @Override public Group getGroup(String identifier) throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getGroup(identifier); } @Override public UserAndGroups getUserAndGroups(String identity) throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getUserAndGroups(identity); } @Override public void initialize(UserGroupProviderInitializationContext initializationContext) throws AuthorizerCreationException { baseConfigurableUserGroupProvider.initialize(initializationContext); } @Override public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { baseConfigurableUserGroupProvider.onConfigured(configurationContext); } @Override public void preDestruction() throws AuthorizerDestructionException { baseConfigurableUserGroupProvider.preDestruction(); } }; } else { return baseUserGroupProvider; } } @Override public void initialize(AccessPolicyProviderInitializationContext initializationContext) throws AuthorizerCreationException { baseConfigurableAccessPolicyProvider.initialize(initializationContext); } @Override public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { baseConfigurableAccessPolicyProvider.onConfigured(configurationContext); } @Override public void preDestruction() throws AuthorizerDestructionException { baseConfigurableAccessPolicyProvider.preDestruction(); } }; } else { return baseAccessPolicyProvider; } } @Override public AuthorizationResult authorize(AuthorizationRequest request) throws AuthorizationAccessException { final AuthorizationResult result = baseAuthorizer.authorize(request); audit(baseAuthorizer, request, result); return result; } @Override public void initialize(AuthorizerInitializationContext initializationContext) throws AuthorizerCreationException { baseManagedAuthorizer.initialize(initializationContext); } @Override public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { baseManagedAuthorizer.onConfigured(configurationContext); final AccessPolicyProvider accessPolicyProvider = baseManagedAuthorizer.getAccessPolicyProvider(); final UserGroupProvider userGroupProvider = accessPolicyProvider.getUserGroupProvider(); for (AccessPolicy accessPolicy : accessPolicyProvider.getAccessPolicies()) { if (policyExists(accessPolicyProvider, accessPolicy)) { throw new AuthorizerCreationException(String.format("Found multiple policies for '%s' with '%s'.", accessPolicy.getResource(), accessPolicy.getAction())); } } for (User user : userGroupProvider.getUsers()) { if (tenantExists(userGroupProvider, user.getIdentifier(), user.getIdentity())) { throw new AuthorizerCreationException(String.format("Found multiple users/user groups with identity '%s'.", user.getIdentity())); } } for (Group group : userGroupProvider.getGroups()) { if (tenantExists(userGroupProvider, group.getIdentifier(), group.getName())) { throw new AuthorizerCreationException(String.format("Found multiple users/user groups with name '%s'.", group.getName())); } } } @Override public void preDestruction() throws AuthorizerDestructionException { baseManagedAuthorizer.preDestruction(); } }; } else { authorizer = new Authorizer() { @Override public AuthorizationResult authorize(AuthorizationRequest request) throws AuthorizationAccessException { final AuthorizationResult result = baseAuthorizer.authorize(request); audit(baseAuthorizer, request, result); return result; } @Override public void initialize(AuthorizerInitializationContext initializationContext) throws AuthorizerCreationException { baseAuthorizer.initialize(initializationContext); } @Override public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { baseAuthorizer.onConfigured(configurationContext); } @Override public void preDestruction() throws AuthorizerDestructionException { baseAuthorizer.preDestruction(); } }; } if (baseAuthorizer instanceof AuthorizationAuditor) { final AuthorizationAuditorInvocationHandler invocationHandler = new AuthorizationAuditorInvocationHandler(authorizer, (AuthorizationAuditor) baseAuthorizer); final List<Class<?>> interfaceList = ClassUtils.getAllInterfaces(authorizer.getClass()); interfaceList.add(AuthorizationAuditor.class); final Class<?>[] interfaces = interfaceList.toArray(new Class<?>[interfaceList.size()]); authorizer = (Authorizer) Proxy.newProxyInstance(authorizer.getClass().getClassLoader(), interfaces, invocationHandler); } return authorizer; }
AuthorizerFactory { public static Authorizer installIntegrityChecks(final Authorizer baseAuthorizer) { Authorizer authorizer; if (baseAuthorizer instanceof ManagedAuthorizer) { final ManagedAuthorizer baseManagedAuthorizer = (ManagedAuthorizer) baseAuthorizer; authorizer = new ManagedAuthorizer() { @Override public String getFingerprint() throws AuthorizationAccessException { return baseManagedAuthorizer.getFingerprint(); } @Override public void inheritFingerprint(String fingerprint) throws AuthorizationAccessException { baseManagedAuthorizer.inheritFingerprint(fingerprint); } @Override public void checkInheritability(String proposedFingerprint) throws AuthorizationAccessException, UninheritableAuthorizationsException { baseManagedAuthorizer.checkInheritability(proposedFingerprint); } @Override public AccessPolicyProvider getAccessPolicyProvider() { final AccessPolicyProvider baseAccessPolicyProvider = baseManagedAuthorizer.getAccessPolicyProvider(); if (baseAccessPolicyProvider instanceof ConfigurableAccessPolicyProvider) { final ConfigurableAccessPolicyProvider baseConfigurableAccessPolicyProvider = (ConfigurableAccessPolicyProvider) baseAccessPolicyProvider; return new ConfigurableAccessPolicyProvider() { @Override public String getFingerprint() throws AuthorizationAccessException { return baseConfigurableAccessPolicyProvider.getFingerprint(); } @Override public void inheritFingerprint(String fingerprint) throws AuthorizationAccessException { baseConfigurableAccessPolicyProvider.inheritFingerprint(fingerprint); } @Override public void checkInheritability(String proposedFingerprint) throws AuthorizationAccessException, UninheritableAuthorizationsException { baseConfigurableAccessPolicyProvider.checkInheritability(proposedFingerprint); } @Override public AccessPolicy addAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException { if (policyExists(baseConfigurableAccessPolicyProvider, accessPolicy)) { throw new IllegalStateException(String.format("Found multiple policies for '%s' with '%s'.", accessPolicy.getResource(), accessPolicy.getAction())); } return baseConfigurableAccessPolicyProvider.addAccessPolicy(accessPolicy); } @Override public boolean isConfigurable(AccessPolicy accessPolicy) { return baseConfigurableAccessPolicyProvider.isConfigurable(accessPolicy); } @Override public AccessPolicy updateAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException { if (!baseConfigurableAccessPolicyProvider.isConfigurable(accessPolicy)) { throw new IllegalArgumentException("The specified access policy is not support modification."); } return baseConfigurableAccessPolicyProvider.updateAccessPolicy(accessPolicy); } @Override public AccessPolicy deleteAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException { if (!baseConfigurableAccessPolicyProvider.isConfigurable(accessPolicy)) { throw new IllegalArgumentException("The specified access policy is not support modification."); } return baseConfigurableAccessPolicyProvider.deleteAccessPolicy(accessPolicy); } @Override public Set<AccessPolicy> getAccessPolicies() throws AuthorizationAccessException { return baseConfigurableAccessPolicyProvider.getAccessPolicies(); } @Override public AccessPolicy getAccessPolicy(String identifier) throws AuthorizationAccessException { return baseConfigurableAccessPolicyProvider.getAccessPolicy(identifier); } @Override public AccessPolicy getAccessPolicy(String resourceIdentifier, RequestAction action) throws AuthorizationAccessException { return baseConfigurableAccessPolicyProvider.getAccessPolicy(resourceIdentifier, action); } @Override public UserGroupProvider getUserGroupProvider() { final UserGroupProvider baseUserGroupProvider = baseConfigurableAccessPolicyProvider.getUserGroupProvider(); if (baseUserGroupProvider instanceof ConfigurableUserGroupProvider) { final ConfigurableUserGroupProvider baseConfigurableUserGroupProvider = (ConfigurableUserGroupProvider) baseUserGroupProvider; return new ConfigurableUserGroupProvider() { @Override public String getFingerprint() throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getFingerprint(); } @Override public void inheritFingerprint(String fingerprint) throws AuthorizationAccessException { baseConfigurableUserGroupProvider.inheritFingerprint(fingerprint); } @Override public void checkInheritability(String proposedFingerprint) throws AuthorizationAccessException, UninheritableAuthorizationsException { baseConfigurableUserGroupProvider.checkInheritability(proposedFingerprint); } @Override public User addUser(User user) throws AuthorizationAccessException { if (tenantExists(baseConfigurableUserGroupProvider, user.getIdentifier(), user.getIdentity())) { throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", user.getIdentity())); } return baseConfigurableUserGroupProvider.addUser(user); } @Override public boolean isConfigurable(User user) { return baseConfigurableUserGroupProvider.isConfigurable(user); } @Override public User updateUser(User user) throws AuthorizationAccessException { if (tenantExists(baseConfigurableUserGroupProvider, user.getIdentifier(), user.getIdentity())) { throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", user.getIdentity())); } if (!baseConfigurableUserGroupProvider.isConfigurable(user)) { throw new IllegalArgumentException("The specified user does not support modification."); } return baseConfigurableUserGroupProvider.updateUser(user); } @Override public User deleteUser(User user) throws AuthorizationAccessException { if (!baseConfigurableUserGroupProvider.isConfigurable(user)) { throw new IllegalArgumentException("The specified user does not support modification."); } return baseConfigurableUserGroupProvider.deleteUser(user); } @Override public Group addGroup(Group group) throws AuthorizationAccessException { if (tenantExists(baseConfigurableUserGroupProvider, group.getIdentifier(), group.getName())) { throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", group.getName())); } if (!allGroupUsersExist(baseConfigurableUserGroupProvider, group)) { throw new IllegalStateException(String.format("Cannot create group '%s' with users that don't exist.", group.getName())); } return baseConfigurableUserGroupProvider.addGroup(group); } @Override public boolean isConfigurable(Group group) { return baseConfigurableUserGroupProvider.isConfigurable(group); } @Override public Group updateGroup(Group group) throws AuthorizationAccessException { if (tenantExists(baseConfigurableUserGroupProvider, group.getIdentifier(), group.getName())) { throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", group.getName())); } if (!allGroupUsersExist(baseConfigurableUserGroupProvider, group)) { throw new IllegalStateException(String.format("Cannot update group '%s' to add users that don't exist.", group.getName())); } if (!baseConfigurableUserGroupProvider.isConfigurable(group)) { throw new IllegalArgumentException("The specified group does not support modification."); } return baseConfigurableUserGroupProvider.updateGroup(group); } @Override public Group deleteGroup(Group group) throws AuthorizationAccessException { if (!baseConfigurableUserGroupProvider.isConfigurable(group)) { throw new IllegalArgumentException("The specified group does not support modification."); } return baseConfigurableUserGroupProvider.deleteGroup(group); } @Override public Set<User> getUsers() throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getUsers(); } @Override public User getUser(String identifier) throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getUser(identifier); } @Override public User getUserByIdentity(String identity) throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getUserByIdentity(identity); } @Override public Set<Group> getGroups() throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getGroups(); } @Override public Group getGroup(String identifier) throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getGroup(identifier); } @Override public UserAndGroups getUserAndGroups(String identity) throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getUserAndGroups(identity); } @Override public void initialize(UserGroupProviderInitializationContext initializationContext) throws AuthorizerCreationException { baseConfigurableUserGroupProvider.initialize(initializationContext); } @Override public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { baseConfigurableUserGroupProvider.onConfigured(configurationContext); } @Override public void preDestruction() throws AuthorizerDestructionException { baseConfigurableUserGroupProvider.preDestruction(); } }; } else { return baseUserGroupProvider; } } @Override public void initialize(AccessPolicyProviderInitializationContext initializationContext) throws AuthorizerCreationException { baseConfigurableAccessPolicyProvider.initialize(initializationContext); } @Override public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { baseConfigurableAccessPolicyProvider.onConfigured(configurationContext); } @Override public void preDestruction() throws AuthorizerDestructionException { baseConfigurableAccessPolicyProvider.preDestruction(); } }; } else { return baseAccessPolicyProvider; } } @Override public AuthorizationResult authorize(AuthorizationRequest request) throws AuthorizationAccessException { final AuthorizationResult result = baseAuthorizer.authorize(request); audit(baseAuthorizer, request, result); return result; } @Override public void initialize(AuthorizerInitializationContext initializationContext) throws AuthorizerCreationException { baseManagedAuthorizer.initialize(initializationContext); } @Override public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { baseManagedAuthorizer.onConfigured(configurationContext); final AccessPolicyProvider accessPolicyProvider = baseManagedAuthorizer.getAccessPolicyProvider(); final UserGroupProvider userGroupProvider = accessPolicyProvider.getUserGroupProvider(); for (AccessPolicy accessPolicy : accessPolicyProvider.getAccessPolicies()) { if (policyExists(accessPolicyProvider, accessPolicy)) { throw new AuthorizerCreationException(String.format("Found multiple policies for '%s' with '%s'.", accessPolicy.getResource(), accessPolicy.getAction())); } } for (User user : userGroupProvider.getUsers()) { if (tenantExists(userGroupProvider, user.getIdentifier(), user.getIdentity())) { throw new AuthorizerCreationException(String.format("Found multiple users/user groups with identity '%s'.", user.getIdentity())); } } for (Group group : userGroupProvider.getGroups()) { if (tenantExists(userGroupProvider, group.getIdentifier(), group.getName())) { throw new AuthorizerCreationException(String.format("Found multiple users/user groups with name '%s'.", group.getName())); } } } @Override public void preDestruction() throws AuthorizerDestructionException { baseManagedAuthorizer.preDestruction(); } }; } else { authorizer = new Authorizer() { @Override public AuthorizationResult authorize(AuthorizationRequest request) throws AuthorizationAccessException { final AuthorizationResult result = baseAuthorizer.authorize(request); audit(baseAuthorizer, request, result); return result; } @Override public void initialize(AuthorizerInitializationContext initializationContext) throws AuthorizerCreationException { baseAuthorizer.initialize(initializationContext); } @Override public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { baseAuthorizer.onConfigured(configurationContext); } @Override public void preDestruction() throws AuthorizerDestructionException { baseAuthorizer.preDestruction(); } }; } if (baseAuthorizer instanceof AuthorizationAuditor) { final AuthorizationAuditorInvocationHandler invocationHandler = new AuthorizationAuditorInvocationHandler(authorizer, (AuthorizationAuditor) baseAuthorizer); final List<Class<?>> interfaceList = ClassUtils.getAllInterfaces(authorizer.getClass()); interfaceList.add(AuthorizationAuditor.class); final Class<?>[] interfaces = interfaceList.toArray(new Class<?>[interfaceList.size()]); authorizer = (Authorizer) Proxy.newProxyInstance(authorizer.getClass().getClassLoader(), interfaces, invocationHandler); } return authorizer; } }
AuthorizerFactory { public static Authorizer installIntegrityChecks(final Authorizer baseAuthorizer) { Authorizer authorizer; if (baseAuthorizer instanceof ManagedAuthorizer) { final ManagedAuthorizer baseManagedAuthorizer = (ManagedAuthorizer) baseAuthorizer; authorizer = new ManagedAuthorizer() { @Override public String getFingerprint() throws AuthorizationAccessException { return baseManagedAuthorizer.getFingerprint(); } @Override public void inheritFingerprint(String fingerprint) throws AuthorizationAccessException { baseManagedAuthorizer.inheritFingerprint(fingerprint); } @Override public void checkInheritability(String proposedFingerprint) throws AuthorizationAccessException, UninheritableAuthorizationsException { baseManagedAuthorizer.checkInheritability(proposedFingerprint); } @Override public AccessPolicyProvider getAccessPolicyProvider() { final AccessPolicyProvider baseAccessPolicyProvider = baseManagedAuthorizer.getAccessPolicyProvider(); if (baseAccessPolicyProvider instanceof ConfigurableAccessPolicyProvider) { final ConfigurableAccessPolicyProvider baseConfigurableAccessPolicyProvider = (ConfigurableAccessPolicyProvider) baseAccessPolicyProvider; return new ConfigurableAccessPolicyProvider() { @Override public String getFingerprint() throws AuthorizationAccessException { return baseConfigurableAccessPolicyProvider.getFingerprint(); } @Override public void inheritFingerprint(String fingerprint) throws AuthorizationAccessException { baseConfigurableAccessPolicyProvider.inheritFingerprint(fingerprint); } @Override public void checkInheritability(String proposedFingerprint) throws AuthorizationAccessException, UninheritableAuthorizationsException { baseConfigurableAccessPolicyProvider.checkInheritability(proposedFingerprint); } @Override public AccessPolicy addAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException { if (policyExists(baseConfigurableAccessPolicyProvider, accessPolicy)) { throw new IllegalStateException(String.format("Found multiple policies for '%s' with '%s'.", accessPolicy.getResource(), accessPolicy.getAction())); } return baseConfigurableAccessPolicyProvider.addAccessPolicy(accessPolicy); } @Override public boolean isConfigurable(AccessPolicy accessPolicy) { return baseConfigurableAccessPolicyProvider.isConfigurable(accessPolicy); } @Override public AccessPolicy updateAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException { if (!baseConfigurableAccessPolicyProvider.isConfigurable(accessPolicy)) { throw new IllegalArgumentException("The specified access policy is not support modification."); } return baseConfigurableAccessPolicyProvider.updateAccessPolicy(accessPolicy); } @Override public AccessPolicy deleteAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException { if (!baseConfigurableAccessPolicyProvider.isConfigurable(accessPolicy)) { throw new IllegalArgumentException("The specified access policy is not support modification."); } return baseConfigurableAccessPolicyProvider.deleteAccessPolicy(accessPolicy); } @Override public Set<AccessPolicy> getAccessPolicies() throws AuthorizationAccessException { return baseConfigurableAccessPolicyProvider.getAccessPolicies(); } @Override public AccessPolicy getAccessPolicy(String identifier) throws AuthorizationAccessException { return baseConfigurableAccessPolicyProvider.getAccessPolicy(identifier); } @Override public AccessPolicy getAccessPolicy(String resourceIdentifier, RequestAction action) throws AuthorizationAccessException { return baseConfigurableAccessPolicyProvider.getAccessPolicy(resourceIdentifier, action); } @Override public UserGroupProvider getUserGroupProvider() { final UserGroupProvider baseUserGroupProvider = baseConfigurableAccessPolicyProvider.getUserGroupProvider(); if (baseUserGroupProvider instanceof ConfigurableUserGroupProvider) { final ConfigurableUserGroupProvider baseConfigurableUserGroupProvider = (ConfigurableUserGroupProvider) baseUserGroupProvider; return new ConfigurableUserGroupProvider() { @Override public String getFingerprint() throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getFingerprint(); } @Override public void inheritFingerprint(String fingerprint) throws AuthorizationAccessException { baseConfigurableUserGroupProvider.inheritFingerprint(fingerprint); } @Override public void checkInheritability(String proposedFingerprint) throws AuthorizationAccessException, UninheritableAuthorizationsException { baseConfigurableUserGroupProvider.checkInheritability(proposedFingerprint); } @Override public User addUser(User user) throws AuthorizationAccessException { if (tenantExists(baseConfigurableUserGroupProvider, user.getIdentifier(), user.getIdentity())) { throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", user.getIdentity())); } return baseConfigurableUserGroupProvider.addUser(user); } @Override public boolean isConfigurable(User user) { return baseConfigurableUserGroupProvider.isConfigurable(user); } @Override public User updateUser(User user) throws AuthorizationAccessException { if (tenantExists(baseConfigurableUserGroupProvider, user.getIdentifier(), user.getIdentity())) { throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", user.getIdentity())); } if (!baseConfigurableUserGroupProvider.isConfigurable(user)) { throw new IllegalArgumentException("The specified user does not support modification."); } return baseConfigurableUserGroupProvider.updateUser(user); } @Override public User deleteUser(User user) throws AuthorizationAccessException { if (!baseConfigurableUserGroupProvider.isConfigurable(user)) { throw new IllegalArgumentException("The specified user does not support modification."); } return baseConfigurableUserGroupProvider.deleteUser(user); } @Override public Group addGroup(Group group) throws AuthorizationAccessException { if (tenantExists(baseConfigurableUserGroupProvider, group.getIdentifier(), group.getName())) { throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", group.getName())); } if (!allGroupUsersExist(baseConfigurableUserGroupProvider, group)) { throw new IllegalStateException(String.format("Cannot create group '%s' with users that don't exist.", group.getName())); } return baseConfigurableUserGroupProvider.addGroup(group); } @Override public boolean isConfigurable(Group group) { return baseConfigurableUserGroupProvider.isConfigurable(group); } @Override public Group updateGroup(Group group) throws AuthorizationAccessException { if (tenantExists(baseConfigurableUserGroupProvider, group.getIdentifier(), group.getName())) { throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", group.getName())); } if (!allGroupUsersExist(baseConfigurableUserGroupProvider, group)) { throw new IllegalStateException(String.format("Cannot update group '%s' to add users that don't exist.", group.getName())); } if (!baseConfigurableUserGroupProvider.isConfigurable(group)) { throw new IllegalArgumentException("The specified group does not support modification."); } return baseConfigurableUserGroupProvider.updateGroup(group); } @Override public Group deleteGroup(Group group) throws AuthorizationAccessException { if (!baseConfigurableUserGroupProvider.isConfigurable(group)) { throw new IllegalArgumentException("The specified group does not support modification."); } return baseConfigurableUserGroupProvider.deleteGroup(group); } @Override public Set<User> getUsers() throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getUsers(); } @Override public User getUser(String identifier) throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getUser(identifier); } @Override public User getUserByIdentity(String identity) throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getUserByIdentity(identity); } @Override public Set<Group> getGroups() throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getGroups(); } @Override public Group getGroup(String identifier) throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getGroup(identifier); } @Override public UserAndGroups getUserAndGroups(String identity) throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getUserAndGroups(identity); } @Override public void initialize(UserGroupProviderInitializationContext initializationContext) throws AuthorizerCreationException { baseConfigurableUserGroupProvider.initialize(initializationContext); } @Override public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { baseConfigurableUserGroupProvider.onConfigured(configurationContext); } @Override public void preDestruction() throws AuthorizerDestructionException { baseConfigurableUserGroupProvider.preDestruction(); } }; } else { return baseUserGroupProvider; } } @Override public void initialize(AccessPolicyProviderInitializationContext initializationContext) throws AuthorizerCreationException { baseConfigurableAccessPolicyProvider.initialize(initializationContext); } @Override public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { baseConfigurableAccessPolicyProvider.onConfigured(configurationContext); } @Override public void preDestruction() throws AuthorizerDestructionException { baseConfigurableAccessPolicyProvider.preDestruction(); } }; } else { return baseAccessPolicyProvider; } } @Override public AuthorizationResult authorize(AuthorizationRequest request) throws AuthorizationAccessException { final AuthorizationResult result = baseAuthorizer.authorize(request); audit(baseAuthorizer, request, result); return result; } @Override public void initialize(AuthorizerInitializationContext initializationContext) throws AuthorizerCreationException { baseManagedAuthorizer.initialize(initializationContext); } @Override public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { baseManagedAuthorizer.onConfigured(configurationContext); final AccessPolicyProvider accessPolicyProvider = baseManagedAuthorizer.getAccessPolicyProvider(); final UserGroupProvider userGroupProvider = accessPolicyProvider.getUserGroupProvider(); for (AccessPolicy accessPolicy : accessPolicyProvider.getAccessPolicies()) { if (policyExists(accessPolicyProvider, accessPolicy)) { throw new AuthorizerCreationException(String.format("Found multiple policies for '%s' with '%s'.", accessPolicy.getResource(), accessPolicy.getAction())); } } for (User user : userGroupProvider.getUsers()) { if (tenantExists(userGroupProvider, user.getIdentifier(), user.getIdentity())) { throw new AuthorizerCreationException(String.format("Found multiple users/user groups with identity '%s'.", user.getIdentity())); } } for (Group group : userGroupProvider.getGroups()) { if (tenantExists(userGroupProvider, group.getIdentifier(), group.getName())) { throw new AuthorizerCreationException(String.format("Found multiple users/user groups with name '%s'.", group.getName())); } } } @Override public void preDestruction() throws AuthorizerDestructionException { baseManagedAuthorizer.preDestruction(); } }; } else { authorizer = new Authorizer() { @Override public AuthorizationResult authorize(AuthorizationRequest request) throws AuthorizationAccessException { final AuthorizationResult result = baseAuthorizer.authorize(request); audit(baseAuthorizer, request, result); return result; } @Override public void initialize(AuthorizerInitializationContext initializationContext) throws AuthorizerCreationException { baseAuthorizer.initialize(initializationContext); } @Override public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { baseAuthorizer.onConfigured(configurationContext); } @Override public void preDestruction() throws AuthorizerDestructionException { baseAuthorizer.preDestruction(); } }; } if (baseAuthorizer instanceof AuthorizationAuditor) { final AuthorizationAuditorInvocationHandler invocationHandler = new AuthorizationAuditorInvocationHandler(authorizer, (AuthorizationAuditor) baseAuthorizer); final List<Class<?>> interfaceList = ClassUtils.getAllInterfaces(authorizer.getClass()); interfaceList.add(AuthorizationAuditor.class); final Class<?>[] interfaces = interfaceList.toArray(new Class<?>[interfaceList.size()]); authorizer = (Authorizer) Proxy.newProxyInstance(authorizer.getClass().getClassLoader(), interfaces, invocationHandler); } return authorizer; } private  AuthorizerFactory(); }
AuthorizerFactory { public static Authorizer installIntegrityChecks(final Authorizer baseAuthorizer) { Authorizer authorizer; if (baseAuthorizer instanceof ManagedAuthorizer) { final ManagedAuthorizer baseManagedAuthorizer = (ManagedAuthorizer) baseAuthorizer; authorizer = new ManagedAuthorizer() { @Override public String getFingerprint() throws AuthorizationAccessException { return baseManagedAuthorizer.getFingerprint(); } @Override public void inheritFingerprint(String fingerprint) throws AuthorizationAccessException { baseManagedAuthorizer.inheritFingerprint(fingerprint); } @Override public void checkInheritability(String proposedFingerprint) throws AuthorizationAccessException, UninheritableAuthorizationsException { baseManagedAuthorizer.checkInheritability(proposedFingerprint); } @Override public AccessPolicyProvider getAccessPolicyProvider() { final AccessPolicyProvider baseAccessPolicyProvider = baseManagedAuthorizer.getAccessPolicyProvider(); if (baseAccessPolicyProvider instanceof ConfigurableAccessPolicyProvider) { final ConfigurableAccessPolicyProvider baseConfigurableAccessPolicyProvider = (ConfigurableAccessPolicyProvider) baseAccessPolicyProvider; return new ConfigurableAccessPolicyProvider() { @Override public String getFingerprint() throws AuthorizationAccessException { return baseConfigurableAccessPolicyProvider.getFingerprint(); } @Override public void inheritFingerprint(String fingerprint) throws AuthorizationAccessException { baseConfigurableAccessPolicyProvider.inheritFingerprint(fingerprint); } @Override public void checkInheritability(String proposedFingerprint) throws AuthorizationAccessException, UninheritableAuthorizationsException { baseConfigurableAccessPolicyProvider.checkInheritability(proposedFingerprint); } @Override public AccessPolicy addAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException { if (policyExists(baseConfigurableAccessPolicyProvider, accessPolicy)) { throw new IllegalStateException(String.format("Found multiple policies for '%s' with '%s'.", accessPolicy.getResource(), accessPolicy.getAction())); } return baseConfigurableAccessPolicyProvider.addAccessPolicy(accessPolicy); } @Override public boolean isConfigurable(AccessPolicy accessPolicy) { return baseConfigurableAccessPolicyProvider.isConfigurable(accessPolicy); } @Override public AccessPolicy updateAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException { if (!baseConfigurableAccessPolicyProvider.isConfigurable(accessPolicy)) { throw new IllegalArgumentException("The specified access policy is not support modification."); } return baseConfigurableAccessPolicyProvider.updateAccessPolicy(accessPolicy); } @Override public AccessPolicy deleteAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException { if (!baseConfigurableAccessPolicyProvider.isConfigurable(accessPolicy)) { throw new IllegalArgumentException("The specified access policy is not support modification."); } return baseConfigurableAccessPolicyProvider.deleteAccessPolicy(accessPolicy); } @Override public Set<AccessPolicy> getAccessPolicies() throws AuthorizationAccessException { return baseConfigurableAccessPolicyProvider.getAccessPolicies(); } @Override public AccessPolicy getAccessPolicy(String identifier) throws AuthorizationAccessException { return baseConfigurableAccessPolicyProvider.getAccessPolicy(identifier); } @Override public AccessPolicy getAccessPolicy(String resourceIdentifier, RequestAction action) throws AuthorizationAccessException { return baseConfigurableAccessPolicyProvider.getAccessPolicy(resourceIdentifier, action); } @Override public UserGroupProvider getUserGroupProvider() { final UserGroupProvider baseUserGroupProvider = baseConfigurableAccessPolicyProvider.getUserGroupProvider(); if (baseUserGroupProvider instanceof ConfigurableUserGroupProvider) { final ConfigurableUserGroupProvider baseConfigurableUserGroupProvider = (ConfigurableUserGroupProvider) baseUserGroupProvider; return new ConfigurableUserGroupProvider() { @Override public String getFingerprint() throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getFingerprint(); } @Override public void inheritFingerprint(String fingerprint) throws AuthorizationAccessException { baseConfigurableUserGroupProvider.inheritFingerprint(fingerprint); } @Override public void checkInheritability(String proposedFingerprint) throws AuthorizationAccessException, UninheritableAuthorizationsException { baseConfigurableUserGroupProvider.checkInheritability(proposedFingerprint); } @Override public User addUser(User user) throws AuthorizationAccessException { if (tenantExists(baseConfigurableUserGroupProvider, user.getIdentifier(), user.getIdentity())) { throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", user.getIdentity())); } return baseConfigurableUserGroupProvider.addUser(user); } @Override public boolean isConfigurable(User user) { return baseConfigurableUserGroupProvider.isConfigurable(user); } @Override public User updateUser(User user) throws AuthorizationAccessException { if (tenantExists(baseConfigurableUserGroupProvider, user.getIdentifier(), user.getIdentity())) { throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", user.getIdentity())); } if (!baseConfigurableUserGroupProvider.isConfigurable(user)) { throw new IllegalArgumentException("The specified user does not support modification."); } return baseConfigurableUserGroupProvider.updateUser(user); } @Override public User deleteUser(User user) throws AuthorizationAccessException { if (!baseConfigurableUserGroupProvider.isConfigurable(user)) { throw new IllegalArgumentException("The specified user does not support modification."); } return baseConfigurableUserGroupProvider.deleteUser(user); } @Override public Group addGroup(Group group) throws AuthorizationAccessException { if (tenantExists(baseConfigurableUserGroupProvider, group.getIdentifier(), group.getName())) { throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", group.getName())); } if (!allGroupUsersExist(baseConfigurableUserGroupProvider, group)) { throw new IllegalStateException(String.format("Cannot create group '%s' with users that don't exist.", group.getName())); } return baseConfigurableUserGroupProvider.addGroup(group); } @Override public boolean isConfigurable(Group group) { return baseConfigurableUserGroupProvider.isConfigurable(group); } @Override public Group updateGroup(Group group) throws AuthorizationAccessException { if (tenantExists(baseConfigurableUserGroupProvider, group.getIdentifier(), group.getName())) { throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", group.getName())); } if (!allGroupUsersExist(baseConfigurableUserGroupProvider, group)) { throw new IllegalStateException(String.format("Cannot update group '%s' to add users that don't exist.", group.getName())); } if (!baseConfigurableUserGroupProvider.isConfigurable(group)) { throw new IllegalArgumentException("The specified group does not support modification."); } return baseConfigurableUserGroupProvider.updateGroup(group); } @Override public Group deleteGroup(Group group) throws AuthorizationAccessException { if (!baseConfigurableUserGroupProvider.isConfigurable(group)) { throw new IllegalArgumentException("The specified group does not support modification."); } return baseConfigurableUserGroupProvider.deleteGroup(group); } @Override public Set<User> getUsers() throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getUsers(); } @Override public User getUser(String identifier) throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getUser(identifier); } @Override public User getUserByIdentity(String identity) throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getUserByIdentity(identity); } @Override public Set<Group> getGroups() throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getGroups(); } @Override public Group getGroup(String identifier) throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getGroup(identifier); } @Override public UserAndGroups getUserAndGroups(String identity) throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getUserAndGroups(identity); } @Override public void initialize(UserGroupProviderInitializationContext initializationContext) throws AuthorizerCreationException { baseConfigurableUserGroupProvider.initialize(initializationContext); } @Override public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { baseConfigurableUserGroupProvider.onConfigured(configurationContext); } @Override public void preDestruction() throws AuthorizerDestructionException { baseConfigurableUserGroupProvider.preDestruction(); } }; } else { return baseUserGroupProvider; } } @Override public void initialize(AccessPolicyProviderInitializationContext initializationContext) throws AuthorizerCreationException { baseConfigurableAccessPolicyProvider.initialize(initializationContext); } @Override public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { baseConfigurableAccessPolicyProvider.onConfigured(configurationContext); } @Override public void preDestruction() throws AuthorizerDestructionException { baseConfigurableAccessPolicyProvider.preDestruction(); } }; } else { return baseAccessPolicyProvider; } } @Override public AuthorizationResult authorize(AuthorizationRequest request) throws AuthorizationAccessException { final AuthorizationResult result = baseAuthorizer.authorize(request); audit(baseAuthorizer, request, result); return result; } @Override public void initialize(AuthorizerInitializationContext initializationContext) throws AuthorizerCreationException { baseManagedAuthorizer.initialize(initializationContext); } @Override public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { baseManagedAuthorizer.onConfigured(configurationContext); final AccessPolicyProvider accessPolicyProvider = baseManagedAuthorizer.getAccessPolicyProvider(); final UserGroupProvider userGroupProvider = accessPolicyProvider.getUserGroupProvider(); for (AccessPolicy accessPolicy : accessPolicyProvider.getAccessPolicies()) { if (policyExists(accessPolicyProvider, accessPolicy)) { throw new AuthorizerCreationException(String.format("Found multiple policies for '%s' with '%s'.", accessPolicy.getResource(), accessPolicy.getAction())); } } for (User user : userGroupProvider.getUsers()) { if (tenantExists(userGroupProvider, user.getIdentifier(), user.getIdentity())) { throw new AuthorizerCreationException(String.format("Found multiple users/user groups with identity '%s'.", user.getIdentity())); } } for (Group group : userGroupProvider.getGroups()) { if (tenantExists(userGroupProvider, group.getIdentifier(), group.getName())) { throw new AuthorizerCreationException(String.format("Found multiple users/user groups with name '%s'.", group.getName())); } } } @Override public void preDestruction() throws AuthorizerDestructionException { baseManagedAuthorizer.preDestruction(); } }; } else { authorizer = new Authorizer() { @Override public AuthorizationResult authorize(AuthorizationRequest request) throws AuthorizationAccessException { final AuthorizationResult result = baseAuthorizer.authorize(request); audit(baseAuthorizer, request, result); return result; } @Override public void initialize(AuthorizerInitializationContext initializationContext) throws AuthorizerCreationException { baseAuthorizer.initialize(initializationContext); } @Override public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { baseAuthorizer.onConfigured(configurationContext); } @Override public void preDestruction() throws AuthorizerDestructionException { baseAuthorizer.preDestruction(); } }; } if (baseAuthorizer instanceof AuthorizationAuditor) { final AuthorizationAuditorInvocationHandler invocationHandler = new AuthorizationAuditorInvocationHandler(authorizer, (AuthorizationAuditor) baseAuthorizer); final List<Class<?>> interfaceList = ClassUtils.getAllInterfaces(authorizer.getClass()); interfaceList.add(AuthorizationAuditor.class); final Class<?>[] interfaces = interfaceList.toArray(new Class<?>[interfaceList.size()]); authorizer = (Authorizer) Proxy.newProxyInstance(authorizer.getClass().getClassLoader(), interfaces, invocationHandler); } return authorizer; } private  AuthorizerFactory(); static Authorizer installIntegrityChecks(final Authorizer baseAuthorizer); static Authorizer withNarLoader(final Authorizer baseAuthorizer, final ClassLoader classLoader); }
AuthorizerFactory { public static Authorizer installIntegrityChecks(final Authorizer baseAuthorizer) { Authorizer authorizer; if (baseAuthorizer instanceof ManagedAuthorizer) { final ManagedAuthorizer baseManagedAuthorizer = (ManagedAuthorizer) baseAuthorizer; authorizer = new ManagedAuthorizer() { @Override public String getFingerprint() throws AuthorizationAccessException { return baseManagedAuthorizer.getFingerprint(); } @Override public void inheritFingerprint(String fingerprint) throws AuthorizationAccessException { baseManagedAuthorizer.inheritFingerprint(fingerprint); } @Override public void checkInheritability(String proposedFingerprint) throws AuthorizationAccessException, UninheritableAuthorizationsException { baseManagedAuthorizer.checkInheritability(proposedFingerprint); } @Override public AccessPolicyProvider getAccessPolicyProvider() { final AccessPolicyProvider baseAccessPolicyProvider = baseManagedAuthorizer.getAccessPolicyProvider(); if (baseAccessPolicyProvider instanceof ConfigurableAccessPolicyProvider) { final ConfigurableAccessPolicyProvider baseConfigurableAccessPolicyProvider = (ConfigurableAccessPolicyProvider) baseAccessPolicyProvider; return new ConfigurableAccessPolicyProvider() { @Override public String getFingerprint() throws AuthorizationAccessException { return baseConfigurableAccessPolicyProvider.getFingerprint(); } @Override public void inheritFingerprint(String fingerprint) throws AuthorizationAccessException { baseConfigurableAccessPolicyProvider.inheritFingerprint(fingerprint); } @Override public void checkInheritability(String proposedFingerprint) throws AuthorizationAccessException, UninheritableAuthorizationsException { baseConfigurableAccessPolicyProvider.checkInheritability(proposedFingerprint); } @Override public AccessPolicy addAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException { if (policyExists(baseConfigurableAccessPolicyProvider, accessPolicy)) { throw new IllegalStateException(String.format("Found multiple policies for '%s' with '%s'.", accessPolicy.getResource(), accessPolicy.getAction())); } return baseConfigurableAccessPolicyProvider.addAccessPolicy(accessPolicy); } @Override public boolean isConfigurable(AccessPolicy accessPolicy) { return baseConfigurableAccessPolicyProvider.isConfigurable(accessPolicy); } @Override public AccessPolicy updateAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException { if (!baseConfigurableAccessPolicyProvider.isConfigurable(accessPolicy)) { throw new IllegalArgumentException("The specified access policy is not support modification."); } return baseConfigurableAccessPolicyProvider.updateAccessPolicy(accessPolicy); } @Override public AccessPolicy deleteAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException { if (!baseConfigurableAccessPolicyProvider.isConfigurable(accessPolicy)) { throw new IllegalArgumentException("The specified access policy is not support modification."); } return baseConfigurableAccessPolicyProvider.deleteAccessPolicy(accessPolicy); } @Override public Set<AccessPolicy> getAccessPolicies() throws AuthorizationAccessException { return baseConfigurableAccessPolicyProvider.getAccessPolicies(); } @Override public AccessPolicy getAccessPolicy(String identifier) throws AuthorizationAccessException { return baseConfigurableAccessPolicyProvider.getAccessPolicy(identifier); } @Override public AccessPolicy getAccessPolicy(String resourceIdentifier, RequestAction action) throws AuthorizationAccessException { return baseConfigurableAccessPolicyProvider.getAccessPolicy(resourceIdentifier, action); } @Override public UserGroupProvider getUserGroupProvider() { final UserGroupProvider baseUserGroupProvider = baseConfigurableAccessPolicyProvider.getUserGroupProvider(); if (baseUserGroupProvider instanceof ConfigurableUserGroupProvider) { final ConfigurableUserGroupProvider baseConfigurableUserGroupProvider = (ConfigurableUserGroupProvider) baseUserGroupProvider; return new ConfigurableUserGroupProvider() { @Override public String getFingerprint() throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getFingerprint(); } @Override public void inheritFingerprint(String fingerprint) throws AuthorizationAccessException { baseConfigurableUserGroupProvider.inheritFingerprint(fingerprint); } @Override public void checkInheritability(String proposedFingerprint) throws AuthorizationAccessException, UninheritableAuthorizationsException { baseConfigurableUserGroupProvider.checkInheritability(proposedFingerprint); } @Override public User addUser(User user) throws AuthorizationAccessException { if (tenantExists(baseConfigurableUserGroupProvider, user.getIdentifier(), user.getIdentity())) { throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", user.getIdentity())); } return baseConfigurableUserGroupProvider.addUser(user); } @Override public boolean isConfigurable(User user) { return baseConfigurableUserGroupProvider.isConfigurable(user); } @Override public User updateUser(User user) throws AuthorizationAccessException { if (tenantExists(baseConfigurableUserGroupProvider, user.getIdentifier(), user.getIdentity())) { throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", user.getIdentity())); } if (!baseConfigurableUserGroupProvider.isConfigurable(user)) { throw new IllegalArgumentException("The specified user does not support modification."); } return baseConfigurableUserGroupProvider.updateUser(user); } @Override public User deleteUser(User user) throws AuthorizationAccessException { if (!baseConfigurableUserGroupProvider.isConfigurable(user)) { throw new IllegalArgumentException("The specified user does not support modification."); } return baseConfigurableUserGroupProvider.deleteUser(user); } @Override public Group addGroup(Group group) throws AuthorizationAccessException { if (tenantExists(baseConfigurableUserGroupProvider, group.getIdentifier(), group.getName())) { throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", group.getName())); } if (!allGroupUsersExist(baseConfigurableUserGroupProvider, group)) { throw new IllegalStateException(String.format("Cannot create group '%s' with users that don't exist.", group.getName())); } return baseConfigurableUserGroupProvider.addGroup(group); } @Override public boolean isConfigurable(Group group) { return baseConfigurableUserGroupProvider.isConfigurable(group); } @Override public Group updateGroup(Group group) throws AuthorizationAccessException { if (tenantExists(baseConfigurableUserGroupProvider, group.getIdentifier(), group.getName())) { throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", group.getName())); } if (!allGroupUsersExist(baseConfigurableUserGroupProvider, group)) { throw new IllegalStateException(String.format("Cannot update group '%s' to add users that don't exist.", group.getName())); } if (!baseConfigurableUserGroupProvider.isConfigurable(group)) { throw new IllegalArgumentException("The specified group does not support modification."); } return baseConfigurableUserGroupProvider.updateGroup(group); } @Override public Group deleteGroup(Group group) throws AuthorizationAccessException { if (!baseConfigurableUserGroupProvider.isConfigurable(group)) { throw new IllegalArgumentException("The specified group does not support modification."); } return baseConfigurableUserGroupProvider.deleteGroup(group); } @Override public Set<User> getUsers() throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getUsers(); } @Override public User getUser(String identifier) throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getUser(identifier); } @Override public User getUserByIdentity(String identity) throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getUserByIdentity(identity); } @Override public Set<Group> getGroups() throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getGroups(); } @Override public Group getGroup(String identifier) throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getGroup(identifier); } @Override public UserAndGroups getUserAndGroups(String identity) throws AuthorizationAccessException { return baseConfigurableUserGroupProvider.getUserAndGroups(identity); } @Override public void initialize(UserGroupProviderInitializationContext initializationContext) throws AuthorizerCreationException { baseConfigurableUserGroupProvider.initialize(initializationContext); } @Override public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { baseConfigurableUserGroupProvider.onConfigured(configurationContext); } @Override public void preDestruction() throws AuthorizerDestructionException { baseConfigurableUserGroupProvider.preDestruction(); } }; } else { return baseUserGroupProvider; } } @Override public void initialize(AccessPolicyProviderInitializationContext initializationContext) throws AuthorizerCreationException { baseConfigurableAccessPolicyProvider.initialize(initializationContext); } @Override public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { baseConfigurableAccessPolicyProvider.onConfigured(configurationContext); } @Override public void preDestruction() throws AuthorizerDestructionException { baseConfigurableAccessPolicyProvider.preDestruction(); } }; } else { return baseAccessPolicyProvider; } } @Override public AuthorizationResult authorize(AuthorizationRequest request) throws AuthorizationAccessException { final AuthorizationResult result = baseAuthorizer.authorize(request); audit(baseAuthorizer, request, result); return result; } @Override public void initialize(AuthorizerInitializationContext initializationContext) throws AuthorizerCreationException { baseManagedAuthorizer.initialize(initializationContext); } @Override public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { baseManagedAuthorizer.onConfigured(configurationContext); final AccessPolicyProvider accessPolicyProvider = baseManagedAuthorizer.getAccessPolicyProvider(); final UserGroupProvider userGroupProvider = accessPolicyProvider.getUserGroupProvider(); for (AccessPolicy accessPolicy : accessPolicyProvider.getAccessPolicies()) { if (policyExists(accessPolicyProvider, accessPolicy)) { throw new AuthorizerCreationException(String.format("Found multiple policies for '%s' with '%s'.", accessPolicy.getResource(), accessPolicy.getAction())); } } for (User user : userGroupProvider.getUsers()) { if (tenantExists(userGroupProvider, user.getIdentifier(), user.getIdentity())) { throw new AuthorizerCreationException(String.format("Found multiple users/user groups with identity '%s'.", user.getIdentity())); } } for (Group group : userGroupProvider.getGroups()) { if (tenantExists(userGroupProvider, group.getIdentifier(), group.getName())) { throw new AuthorizerCreationException(String.format("Found multiple users/user groups with name '%s'.", group.getName())); } } } @Override public void preDestruction() throws AuthorizerDestructionException { baseManagedAuthorizer.preDestruction(); } }; } else { authorizer = new Authorizer() { @Override public AuthorizationResult authorize(AuthorizationRequest request) throws AuthorizationAccessException { final AuthorizationResult result = baseAuthorizer.authorize(request); audit(baseAuthorizer, request, result); return result; } @Override public void initialize(AuthorizerInitializationContext initializationContext) throws AuthorizerCreationException { baseAuthorizer.initialize(initializationContext); } @Override public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { baseAuthorizer.onConfigured(configurationContext); } @Override public void preDestruction() throws AuthorizerDestructionException { baseAuthorizer.preDestruction(); } }; } if (baseAuthorizer instanceof AuthorizationAuditor) { final AuthorizationAuditorInvocationHandler invocationHandler = new AuthorizationAuditorInvocationHandler(authorizer, (AuthorizationAuditor) baseAuthorizer); final List<Class<?>> interfaceList = ClassUtils.getAllInterfaces(authorizer.getClass()); interfaceList.add(AuthorizationAuditor.class); final Class<?>[] interfaces = interfaceList.toArray(new Class<?>[interfaceList.size()]); authorizer = (Authorizer) Proxy.newProxyInstance(authorizer.getClass().getClassLoader(), interfaces, invocationHandler); } return authorizer; } private  AuthorizerFactory(); static Authorizer installIntegrityChecks(final Authorizer baseAuthorizer); static Authorizer withNarLoader(final Authorizer baseAuthorizer, final ClassLoader classLoader);  }