Skip to content

Commit bf601fb

Browse files
committed
Merge branch 'release/20.1.0'
2 parents 887c020 + 688ccef commit bf601fb

File tree

10 files changed

+525
-447
lines changed

10 files changed

+525
-447
lines changed

ADOPTERS.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66
* [Thales](https://www.thalesgroup.com)
77
* [Secure Dimensions GmbH](https://github.com/securedimensions/authzforce-geoxacml-basic)
88
* [FABRIC](https://whatisfabric.net/)
9-
* [DRIVER+](http://driver-project.eu/)
10-
* [Sealed GRID](https://www.sgrid.eu)
9+
* EU-funded research and innovation projects
10+
* [DRIVER+](http://driver-project.eu/)
11+
* [Sealed GRID](https://www.sgrid.eu)
12+
* [COG-LO](http://www.cog-lo.eu/)
1113

CHANGELOG.md

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,19 @@ All notable changes to this project are documented in this file following the [K
66
- Issues reported on [OW2's GitLab](https://gitlab.ow2.org/authzforce/core/issues) are referenced in the form of `[GL-N]`, where N is the issue number.
77

88

9+
## 21.1.0
10+
### Fixed
11+
- Fix CVE-2020-36518 affecting jackson dependency
12+
13+
### Changed
14+
- Upgrade authzforce-ce-core-pdp-api to 21.2.0
15+
16+
- New `XMLUtils.SAXBasedXmlnsFilteringParser` class constructor parameter - XML namespace prefix-to-URI mappings - to help fix the issue authzforce/server#66 .
17+
18+
### Added
19+
- New `PdpEngineConfiguration` class constructor parameter - XML namespace prefix-to-URI mappings - to help fix the issue authzforce/server#66 .
20+
21+
922
## 20.0.0
1023
### Added
1124
- New feature: XPath variables in AttributeSelectors' and `xPathExpression` `AttributeValues`s' XPath expressions can now be defined by XACML VariableDefinitions (variable name used as XACML VariableId), which means XACML Variables can be used as XPath variables there.
@@ -359,7 +372,7 @@ XACML 3.0, and adapting to the PDP engine API; also provides automatic conversio
359372
- Aded BaseStaticRefPolicyProviderModule class as convenient base class for implementing static Policy Provider (StaticRefPolicyProviderModule) implementations
360373

361374
### Added
362-
- [PolicyProvider implementation](pdp-testutils/src/main/java/org/ow2/authzforce/core/pdp/testutil/ext/MongoDBRefPolicyProviderModule.java) for testing and documentation purposes, using MongoDB as policy database system and Jongo as client library, with [JUnit test class](pdp-testutils/src/test/java/org/ow2/authzforce/core/pdp/testutil/test/MongoDBRefPolicyProviderModuleTest.java) showing how to use it.
375+
- [PolicyProvider implementation](pdp-testutils/src/main/java/org/ow2/authzforce/core/pdp/testutil/ext/MongoDbPolicyProvider.java) for testing and documentation purposes, using MongoDB as policy database system and Jongo as client library, with [JUnit test class](pdp-testutils/src/test/java/org/ow2/authzforce/core/pdp/testutil/test/MongoDbPolicyProviderTest.java) showing how to use it.
363376

364377

365378
## 8.0.0
@@ -580,7 +593,7 @@ XACML 3.0, and adapting to the PDP engine API; also provides automatic conversio
580593

581594
### Fixed
582595
- Issues reported by PMD and findbugs
583-
- Fixed issues in [XACML 3.0 conformance tests](https://lists.oasis-open.org/archives/xacml-comment/201404/msg00001.html) published by AT&T on XACML mailing list in March 2014, see [README](pdp-testutils/src/test/resources/conformance/xacml-3.0-from-2.0-ct\README.md).
596+
- Fixed issues in [XACML 3.0 conformance tests](https://lists.oasis-open.org/archives/xacml-comment/201404/msg00001.html) published by AT&T on XACML mailing list in March 2014, see [README](pdp-testutils/src/test/resources/conformance/xacml-3.0-from-2.0-ct/README.md).
584597
- In logical `OR`, `AND` and `N-OF` functions, an Indeterminate argument results in Indeterminate result.
585598
1. FIX for OR function: If at least one True argument, return True regardless of Indeterminate arguments; else (no True) if there is at least one Indeterminate, return Indeterminate, return Indeterminate; else (no True/Indeterminate -> all false) return false
586599
1. FIX for AND function: If at least one False argument, return False regardless of Indeterminate arguments; else (no False) if there is at least one Indeterminate, return Indeterminate, return Indeterminate; else (no False/Indeterminate -> all true) return true

README.md

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ AuthzForce Core may be used in the following ways:
6262
## Limitations
6363

6464
### XACML 2.0 support and migrating to XACML 3.0
65-
As mentioned in the Features section, we do not support XACML 2.0 but only XACML 3.0, and we strongly recommend you migrate to XACML 3.0 as XACML 2.0 has become obsolete. In order to help you in the migration from XACML 2.0 to 3.0, we provide a way to migrate all your XACML 2.0 policies to XACML 3.0 automatically by applying the XSLT stylesheets in the [migration](migration folder). First download the stylesheets `xacml2To3Policy.xsl` and `xacml3-policy-c14n.xsl` from that folder, then apply them to your XACML 2.0 policy files using any XSLT engine supporting XSLT 2.0. For example, using [SAXON-HE 9.x or later](https://www.saxonica.com/download/java.xml), you may do it as follows:
65+
As mentioned in the Features section, we do not support XACML 2.0 but only XACML 3.0, and we strongly recommend you migrate to XACML 3.0 as XACML 2.0 has become obsolete. In order to help you in the migration from XACML 2.0 to 3.0, we provide a way to migrate all your XACML 2.0 policies to XACML 3.0 automatically by applying the XSLT stylesheets in the [migration folder](migration). First download the stylesheets `xacml2To3Policy.xsl` and `xacml3-policy-c14n.xsl` from that folder, then apply them to your XACML 2.0 policy files using any XSLT engine supporting XSLT 2.0. For example, using [SAXON-HE 9.x or later](https://www.saxonica.com/download/java.xml), you may do it as follows:
6666

6767
```shell
6868
$ XACML_20_POLICY_FILE="policy.xml"
@@ -116,6 +116,12 @@ $ ./authzforce-ce-core-pdp-cli-14.0.0.jar -t XACML_JSON pdp.xml IIA001/Request.j
116116

117117
For more info, run it without parameters, and you'll get detailed information on usage.
118118

119+
For **troubleshooting**, you can increase the log level of the logger(s) in the Logback configuration file `logback.xml` to `INFO` or `DEBUG`, esp. the logger named `org.ow2.authzforce`. Then run the CLI as follows:
120+
121+
```shell
122+
$ java -jar -Dlogback.configurationFile=./logback.xml authzforce-ce-core-pdp-cli-14.0.0.jar pdp.xml IIA001/Request.xml
123+
```
124+
119125
#### Java API
120126
You can either build AuthzForce PDP library from the source code after cloning this git repository, or use the latest release from Maven Central with this information:
121127
* groupId: `org.ow2.authzforce`;
@@ -290,6 +296,8 @@ Same example but without AuthzForce optimizations:
290296
$ java -jar Saxon-HE-10.3.jar authzforce_optimized=false -xsl:spif-utils/spif2xacml-for-xpath-2.0.xsl -s:spif-utils/ACME-SPIF-example.xml -o:/tmp/ACME-XACML-policy.xml
291297
```
292298

299+
In both cases, **the generated XACML policy makes use of `AttributeSelectors`**, so make sure your XACML engine supports those. In the case of AuthzForce, you need to set `xPathEnabled="true"` in the PDP configuration (`pdp.xml`) to enable support for `AttributeSelectors`, like in the [XacmlVariableUsedAsXPathVariable test](pdp-testutils/src/test/resources/custom/XacmlVariableUsedAsXPathVariable).
300+
293301
## Support
294302

295303
You should use [AuthzForce users' mailing list](https://mail.ow2.org/wws/info/authzforce-users) as first contact for any communication about AuthzForce: question, feature request, notification, potential issue (unconfirmed), etc.

pdp-cli/pom.xml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<parent>
44
<groupId>org.ow2.authzforce</groupId>
55
<artifactId>authzforce-ce-core</artifactId>
6-
<version>20.0.0</version>
6+
<version>20.1.0</version>
77
<relativePath>../pom.xml</relativePath>
88
</parent>
99
<artifactId>authzforce-ce-core-pdp-cli</artifactId>
@@ -30,12 +30,12 @@
3030
<dependency>
3131
<groupId>org.ow2.authzforce</groupId>
3232
<artifactId>authzforce-ce-core-pdp-engine</artifactId>
33-
<version>20.0.0</version>
33+
<version>20.1.0</version>
3434
</dependency>
3535
<dependency>
3636
<groupId>org.ow2.authzforce</groupId>
3737
<artifactId>authzforce-ce-core-pdp-io-xacml-json</artifactId>
38-
<version>20.0.0</version>
38+
<version>20.1.0</version>
3939
</dependency>
4040
<dependency>
4141
<groupId>org.testng</groupId>
@@ -49,7 +49,7 @@
4949
<dependency>
5050
<groupId>org.ow2.authzforce</groupId>
5151
<artifactId>authzforce-ce-core-pdp-testutils</artifactId>
52-
<version>20.0.0</version>
52+
<version>20.1.0</version>
5353
<scope>test</scope>
5454
</dependency>
5555
</dependencies>

pdp-engine/pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<parent>
44
<groupId>org.ow2.authzforce</groupId>
55
<artifactId>authzforce-ce-core</artifactId>
6-
<version>20.0.0</version>
6+
<version>20.1.0</version>
77
<relativePath>../pom.xml</relativePath>
88
</parent>
99
<artifactId>authzforce-ce-core-pdp-engine</artifactId>

pdp-engine/src/main/java/org/ow2/authzforce/core/pdp/impl/PdpEngineConfiguration.java

Lines changed: 37 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@
3939
import org.ow2.authzforce.core.xmlns.pdp.Pdp;
4040
import org.ow2.authzforce.core.xmlns.pdp.StdEnvAttributeProviderDescriptor;
4141
import org.ow2.authzforce.core.xmlns.pdp.TopLevelPolicyElementRef;
42+
import org.ow2.authzforce.xacml.Xacml3JaxbHelper;
4243
import org.ow2.authzforce.xacml.identifiers.XacmlDatatypeId;
4344
import org.ow2.authzforce.xmlns.pdp.ext.AbstractAttributeProvider;
4445
import org.ow2.authzforce.xmlns.pdp.ext.AbstractDecisionCache;
@@ -48,6 +49,7 @@
4849
import org.springframework.util.ResourceUtils;
4950

5051
import javax.xml.bind.JAXBException;
52+
import javax.xml.bind.Unmarshaller;
5153
import javax.xml.transform.Source;
5254
import javax.xml.transform.stream.StreamSource;
5355
import java.io.Closeable;
@@ -214,6 +216,21 @@ public void close() throws IOException
214216

215217
}
216218

219+
private static final class XmlnsFilteringParserFactoryWithDefaultXmlnsContext implements XmlnsFilteringParserFactory {
220+
221+
private final ImmutableMap<String, String> defaultXmlnsPrefixToUriMap;
222+
private XmlnsFilteringParserFactoryWithDefaultXmlnsContext(final Map<String, String> defaultXmlnsPrefixToUriMap) {
223+
this.defaultXmlnsPrefixToUriMap = ImmutableMap.copyOf(defaultXmlnsPrefixToUriMap);
224+
}
225+
226+
@Override
227+
public XmlUtils.XmlnsFilteringParser getInstance() throws JAXBException
228+
{
229+
final Unmarshaller unmarshaller = Xacml3JaxbHelper.createXacml3Unmarshaller();
230+
return new XmlUtils.SAXBasedXmlnsFilteringParser(unmarshaller, defaultXmlnsPrefixToUriMap);
231+
}
232+
}
233+
217234
private static final IllegalArgumentException ILLEGAL_ROOT_POLICY_REF_CONFIG_EXCEPTION = new IllegalArgumentException(
218235
"Configuration parameter 'rootPolicyRef' is undefined and 'policyProvider' does not provide any candidate root policy. Please define 'rootPolicyRef' parameter or modify the Policy Provider to return a candidate root policy.");
219236

@@ -304,12 +321,13 @@ private static <JAXB_CONF extends AbstractDecisionCache> DecisionCache newDecisi
304321
* (JAXB-bound) PDP configuration
305322
* @param envProps
306323
* PDP configuration environment properties (e.g. PARENT_DIR)
324+
* @param xpathNamespaceContexts XPath namespace prefix-to-URI mappings to be used for namespace-aware evaluation of XPath expressions, e.g. AttributeSelectors' Paths. Empty if none or if XPath support is disabled by configuration.
307325
* @throws java.lang.IllegalArgumentException
308326
* invalid PDP configuration
309327
* @throws java.io.IOException
310328
* if any error occurred closing already created {@link Closeable} modules (policy Providers, attribute Providers, decision cache)
311329
*/
312-
public PdpEngineConfiguration(final Pdp pdpJaxbConf, final EnvironmentProperties envProps) throws IllegalArgumentException, IOException
330+
public PdpEngineConfiguration(final Pdp pdpJaxbConf, final EnvironmentProperties envProps, final Map<String, String> xpathNamespaceContexts) throws IllegalArgumentException, IOException
313331
{
314332
/*
315333
* Enable support for XPath expressions, XPath functions, etc.
@@ -434,7 +452,7 @@ public PdpEngineConfiguration(final Pdp pdpJaxbConf, final EnvironmentProperties
434452
/*
435453
* XACML element (Policies, etc.) parser factory
436454
*/
437-
final XmlnsFilteringParserFactory xacmlParserFactory = XacmlJaxbParsingUtils.getXacmlParserFactory(enableXPath);
455+
final XmlnsFilteringParserFactory xacmlParserFactory = enableXPath && (xpathNamespaceContexts != null && !xpathNamespaceContexts.isEmpty())? new XmlnsFilteringParserFactoryWithDefaultXmlnsContext(xpathNamespaceContexts): XacmlJaxbParsingUtils.getXacmlParserFactory(enableXPath);
438456

439457
/*
440458
* Strict Attribute Issuer match
@@ -632,6 +650,23 @@ else if (mutableCombinedPolicyProvider instanceof CloseableStaticPolicyProvider
632650

633651
}
634652

653+
/**
654+
* Constructs configuration from PDP XML-schema-derived JAXB model (usually 'unmarshaled' from XML configuration file)
655+
*
656+
* @param pdpJaxbConf
657+
* (JAXB-bound) PDP configuration
658+
* @param envProps
659+
* PDP configuration environment properties (e.g. PARENT_DIR)
660+
* @throws java.lang.IllegalArgumentException
661+
* invalid PDP configuration
662+
* @throws java.io.IOException
663+
* if any error occurred closing already created {@link Closeable} modules (policy Providers, attribute Providers, decision cache)
664+
*/
665+
public PdpEngineConfiguration(final Pdp pdpJaxbConf, final EnvironmentProperties envProps) throws IllegalArgumentException, IOException
666+
{
667+
this(pdpJaxbConf, envProps, Map.of());
668+
}
669+
635670
private static PdpEngineConfiguration getInstance(final Source confXmlSrc, final PdpModelHandler modelHandler, final EnvironmentProperties envProps) throws IOException, IllegalArgumentException
636671
{
637672
assert confXmlSrc != null && modelHandler != null;

pdp-engine/src/main/java/org/ow2/authzforce/core/pdp/impl/policy/PolicyEvaluators.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1829,7 +1829,7 @@ private static abstract class PolicySetElementEvaluatorFactory<INSTANCE extends
18291829
private PolicySetElementEvaluatorFactory(final PrimaryPolicyMetadata policyMetadata, final ExpressionFactory expressionFactory, final CombiningAlgRegistry combiningAlgorithmRegistry, final Optional<DefaultsType> policyDefaults, final Optional<XPathCompilerProxy> parentDefaultXPathCompiler,
18301830
final Map<String, String> namespacePrefixToUriMap)
18311831
{
1832-
assert policyMetadata != null && combiningAlgorithmRegistry != null;
1832+
assert policyMetadata != null && combiningAlgorithmRegistry != null && expressionFactory != null;
18331833
this.policyMetadata = policyMetadata;
18341834
this.expressionFactory = expressionFactory;
18351835
this.combiningAlgorithmRegistry = combiningAlgorithmRegistry;

pdp-io-xacml-json/pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<parent>
44
<groupId>org.ow2.authzforce</groupId>
55
<artifactId>authzforce-ce-core</artifactId>
6-
<version>20.0.0</version>
6+
<version>20.1.0</version>
77
<relativePath>../pom.xml</relativePath>
88
</parent>
99
<artifactId>authzforce-ce-core-pdp-io-xacml-json</artifactId>

0 commit comments

Comments
 (0)