Skip to content

Commit 13a3810

Browse files
author
Chris Schmidt
committed
Finished AccessController
1 parent 7273377 commit 13a3810

7 files changed

Lines changed: 123 additions & 8 deletions

File tree

‎src/main/java/org/owasp/esapi/core/accesscontrol/AccessControlContext.java‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
package org.owasp.esapi.core.accesscontrol;
2+
3+
/**
4+
* The AccessControlContext is a marker interface that is passed in to {@link AccessController#isAuthorized(ManagedResource, AccessControlContext)}
5+
* and {@link AccessController#assertAuthorized(ManagedResource, AccessControlContext)} methods to provide the context of
6+
* an access control check to the {@link AccessController} implementation. Adding context to an access control request
7+
* allows the implementation to perform more complex access control decisions.
8+
* <p/>
9+
* For data level access control this can be something as simple as a object containing the requested function on the
10+
* provided data such as:
11+
* <pre>
12+
* public class ManagedDataOperation implements AccessControlContext {
13+
* public static enum Permission { CREATE, READ, UPDATE, DELETE }
14+
*
15+
* private Permission permission;
16+
*
17+
* public ManagedDataOperation(Permission permission) {
18+
* this.permission = permission;
19+
* }
20+
*
21+
* public Permission getPermission() {
22+
* return this.permission;
23+
* }
24+
* }
25+
* </pre>
26+
* For more complex access control decisions this could contain any number of variables that are used to make an
27+
* access control decision.
28+
*/
29+
public interface AccessControlContext {
30+
}

‎src/main/java/org/owasp/esapi/core/accesscontrol/AccessController.java‎

Lines changed: 23 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
*
1717
* <pre>
1818
* try {
19-
* ESAPI.accessController().assertAuthorized("businessFunction", runtimeData);
19+
* ESAPI.accessController().assertAuthorized(new ManagedFunction("adminFunction"), runtimeData);
2020
* // execute BUSINESS_FUNCTION
2121
* } catch (AccessControlException ace) {
2222
* ... attack in progress
@@ -30,12 +30,22 @@
3030
* repeated in both the business logic and data layers.
3131
*
3232
* <pre>
33-
* &lt;% if ( ESAPI.accessController().isAuthorized( "businessFunction", runtimeData ) ) { %&gt;
33+
* &lt;% if ( ESAPI.accessController().isAuthorized(new ManagedFunction("adminFunction"), runtimeData ) ) { %&gt;
3434
* &lt;a href=&quot;/doAdminFunction&quot;&gt;ADMIN&lt;/a&gt;
3535
* &lt;% } else { %&gt;
3636
* &lt;a href=&quot;/doNormalFunction&quot;&gt;NORMAL&lt;/a&gt;
3737
* &lt;% } %&gt;
3838
* </pre>
39+
* <p/>
40+
* You can also perform access control checks directly on data resources if implemented.
41+
* <pre>
42+
* %&lt; if ( accessController.isAuthorized(userRecord, new ManagedResourceContext( Permissions.EDIT ) ) ) { %&gt;
43+
* &lt;a href=&quot;/editUserRecord?userRecord=%&lt;= userRecord.getResourceIdentifier() %&gt;&quot;&gt;Edit&lt;/a&gt;
44+
* %&lt; } %&gt;
45+
* </pre>
46+
* <i>Note: The above example assumes that the resource identifier is a non-direct access to the resource in question.
47+
* For more information on Direct Object References see <a href="https://www.owasp.org/index.php/Top_10_2013-A4-Insecure_Direct_Object_References">A4 - Insecure Direct Object References</a>
48+
* from the OWASP Top-Ten</i>
3949
*
4050
* @author Mike H. Fauzy ([email protected]) ESAPI v1.6-
4151
* @author Jeff Williams ([email protected]) ESAPI v0-1.5
@@ -51,11 +61,13 @@ public interface AccessController {
5161
* Typically, assertAuthorized should be used to enforce permissions on the
5262
* server.
5363
*
54-
* @param key
55-
* @param runtimeParameter
64+
* @param resource The resource that is being accessed.
65+
* @param context The runtime context of the request
66+
* @param <T> Implementation type of {@link ManagedResource}
67+
* @param <R> Implementation type of {@link AccessControlContext}
5668
* @return
5769
*/
58-
public boolean isAuthorized(Object key, Object runtimeParameter);
70+
public <T extends ManagedResource,R extends AccessControlContext> boolean isAuthorized(T resource, R context);
5971

6072
/**
6173
* Developers should call {@code assertAuthorized} to enforce privileged access to
@@ -64,9 +76,12 @@ public interface AccessController {
6476
* be integrated into the application framework so that it is called
6577
* automatically.
6678
*
67-
* @param key
68-
* @param runtimeParameter
79+
* @param resource The resource that is being accessed
80+
* @param context The runtime context of the request
81+
* @param <T> Implementation type of {@link ManagedResource}
82+
* @param <R> Implementation type of {@link AccessControlContext}
83+
* @throws AccessControlException if access is denied
6984
*/
70-
public void assertAuthorized(Object key, Object runtimeParameter) throws AccessControlException;
85+
public <T extends ManagedResource,R extends AccessControlContext> void assertAuthorized(T resource, R context) throws AccessControlException;
7186

7287
}

‎src/main/java/org/owasp/esapi/core/accesscontrol/ManagedResource.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
package org.owasp.esapi.core.accesscontrol;
2+
3+
import java.io.Serializable;
4+
5+
/**
6+
*
7+
*/
8+
public interface ManagedResource<T extends Serializable> {
9+
T getResourceIdentifier();
10+
}

‎src/main/java/org/owasp/esapi/core/authentication/Authentication.java‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
package org.owasp.esapi.core.authentication;
2+
3+
import java.io.Serializable;
4+
import java.security.Principal;
5+
6+
/**
7+
* Authentication represents the Authentication Context for the current request. It is meant to serve as an abstraction
8+
* layer between the authentication mechanism and the application. If the request has not been authenticated yet, this
9+
* interface will represent the credentials for the {@link Authenticator} to use for authenticating identity. If the
10+
* request has already been authenticated, this interface will represent the authenticated context providing a bridge
11+
* between the authentication mechanism and the {@link User} representation for the application.
12+
*
13+
* @param <CT> The type for the implmentation of {@link Credential}
14+
* @param <PT> The type for the implemenation of the {@link Principal}
15+
*/
16+
public interface Authentication<CT extends Credential, PT extends Serializable> extends Principal {
17+
<T extends User> T getUser();
18+
CT getCredential();
19+
PT getPrincipal();
20+
}

‎src/main/java/org/owasp/esapi/core/authentication/Authenticator.java‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
package org.owasp.esapi.core.authentication;
2+
3+
/**
4+
* The Authenticator interface defines a set of methods for generating and
5+
* handling account credentials and session identifiers. The goal of this
6+
* interface is to encourage developers to protect credentials from disclosure
7+
* to the maximum extent possible.
8+
* <P>
9+
* The goal is to minimize the responsibility of the developer for
10+
* authentication.
11+
*
12+
* @author Jeff Williams (jeff.williams .at. aspectsecurity.com) <a href="http://www.aspectsecurity.com">Aspect Security</a>
13+
* @author Chris Schmidt ([email protected])
14+
* @since June 1, 2007
15+
*/
16+
public interface Authenticator {
17+
18+
}

‎src/main/java/org/owasp/esapi/core/authentication/Credential.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
package org.owasp.esapi.core.authentication;
2+
3+
public interface Credential {
4+
}

‎src/main/java/org/owasp/esapi/core/authentication/User.java‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
package org.owasp.esapi.core.authentication;
2+
3+
import java.io.Serializable;
4+
import java.util.Date;
5+
6+
public interface User extends Serializable {
7+
boolean isEnabled();
8+
Date getExpiration();
9+
10+
// Failed Login Information
11+
int getFailedLoginCount();
12+
Date getLastFailedLoginDate();
13+
String getLastFailedLoginHost();
14+
15+
// Successful Login Information
16+
Date getLastLoginDate();
17+
String getLastLoginHost();
18+
}

0 commit comments

Comments
 (0)