-
Notifications
You must be signed in to change notification settings - Fork 244
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
16 changed files
with
730 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
58 changes: 58 additions & 0 deletions
58
...ore/src/main/java/org/eclipse/edc/iam/identitytrust/core/IatpScopeExtractorExtension.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| /* | ||
| * Copyright (c) 2023 Bayerische Motoren Werke Aktiengesellschaft (BMW AG) | ||
| * | ||
| * This program and the accompanying materials are made available under the | ||
| * terms of the Apache License, Version 2.0 which is available at | ||
| * https://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * Contributors: | ||
| * Bayerische Motoren Werke Aktiengesellschaft (BMW AG) - initial API and implementation | ||
| * | ||
| */ | ||
|
|
||
| package org.eclipse.edc.iam.identitytrust.core; | ||
|
|
||
| import org.eclipse.edc.iam.identitytrust.core.scope.IatpScopeExtractorFunction; | ||
| import org.eclipse.edc.identitytrust.scope.CredentialScopeExtractorRegistry; | ||
| import org.eclipse.edc.policy.engine.spi.PolicyEngine; | ||
| import org.eclipse.edc.runtime.metamodel.annotation.Extension; | ||
| import org.eclipse.edc.runtime.metamodel.annotation.Inject; | ||
| import org.eclipse.edc.spi.monitor.Monitor; | ||
| import org.eclipse.edc.spi.system.ServiceExtension; | ||
| import org.eclipse.edc.spi.system.ServiceExtensionContext; | ||
|
|
||
| import static org.eclipse.edc.iam.identitytrust.core.IatpScopeExtractorExtension.NAME; | ||
|
|
||
| @Extension(NAME) | ||
| public class IatpScopeExtractorExtension implements ServiceExtension { | ||
|
|
||
| public static final String NAME = "IATP scope extractor extension"; | ||
|
|
||
| public static final String CATALOG_REQUEST_SCOPE = "request.catalog"; | ||
| public static final String NEGOTIATION_REQUEST_SCOPE = "request.contract.negotiation"; | ||
| public static final String TRANSFER_PROCESS_REQUEST_SCOPE = "request.transfer.process"; | ||
|
|
||
| @Inject | ||
| private PolicyEngine policyEngine; | ||
|
|
||
| @Inject | ||
| private CredentialScopeExtractorRegistry scopeMapperRegistry; | ||
|
|
||
| @Inject | ||
| private Monitor monitor; | ||
|
|
||
| @Override | ||
| public String name() { | ||
| return NAME; | ||
| } | ||
|
|
||
| @Override | ||
| public void initialize(ServiceExtensionContext context) { | ||
| var contextMappingFunction = new IatpScopeExtractorFunction(scopeMapperRegistry, monitor); | ||
| policyEngine.registerPreValidator(CATALOG_REQUEST_SCOPE, contextMappingFunction); | ||
| policyEngine.registerPreValidator(NEGOTIATION_REQUEST_SCOPE, contextMappingFunction); | ||
| policyEngine.registerPreValidator(TRANSFER_PROCESS_REQUEST_SCOPE, contextMappingFunction); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
54 changes: 54 additions & 0 deletions
54
...rc/main/java/org/eclipse/edc/iam/identitytrust/core/scope/IatpScopeExtractorFunction.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| /* | ||
| * Copyright (c) 2023 Bayerische Motoren Werke Aktiengesellschaft (BMW AG) | ||
| * | ||
| * This program and the accompanying materials are made available under the | ||
| * terms of the Apache License, Version 2.0 which is available at | ||
| * https://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * Contributors: | ||
| * Bayerische Motoren Werke Aktiengesellschaft (BMW AG) - initial API and implementation | ||
| * | ||
| */ | ||
|
|
||
| package org.eclipse.edc.iam.identitytrust.core.scope; | ||
|
|
||
| import org.eclipse.edc.identitytrust.scope.CredentialScopeExtractorRegistry; | ||
| import org.eclipse.edc.policy.engine.spi.PolicyContext; | ||
| import org.eclipse.edc.policy.model.Policy; | ||
| import org.eclipse.edc.spi.EdcException; | ||
| import org.eclipse.edc.spi.iam.TokenParameters; | ||
| import org.eclipse.edc.spi.monitor.Monitor; | ||
|
|
||
| import java.util.function.BiFunction; | ||
|
|
||
| import static java.lang.String.format; | ||
|
|
||
| public class IatpScopeExtractorFunction implements BiFunction<Policy, PolicyContext, Boolean> { | ||
|
|
||
| private final CredentialScopeExtractorRegistry registry; | ||
| private final Monitor monitor; | ||
|
|
||
| public IatpScopeExtractorFunction(CredentialScopeExtractorRegistry registry, Monitor monitor) { | ||
| this.registry = registry; | ||
| this.monitor = monitor; | ||
| } | ||
|
|
||
| @Override | ||
| public Boolean apply(Policy policy, PolicyContext context) { | ||
| var params = context.getContextData(TokenParameters.Builder.class); | ||
| if (params == null) { | ||
| throw new EdcException(format("%s not set in policy context", TokenParameters.Builder.class.getName())); | ||
| } | ||
| var results = registry.extractScopes(policy, context).map(scopes -> String.join(" ", scopes)); | ||
|
|
||
| if (results.succeeded()) { | ||
| params.scope(results.getContent()); | ||
| return true; | ||
| } else { | ||
| monitor.warning("Failed to map credentials to scopes for policy"); | ||
| return false; | ||
| } | ||
| } | ||
| } |
44 changes: 44 additions & 0 deletions
44
...rc/main/java/org/eclipse/edc/iam/identitytrust/core/scope/IatpScopeExtractorRegistry.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| /* | ||
| * Copyright (c) 2023 Bayerische Motoren Werke Aktiengesellschaft (BMW AG) | ||
| * | ||
| * This program and the accompanying materials are made available under the | ||
| * terms of the Apache License, Version 2.0 which is available at | ||
| * https://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * Contributors: | ||
| * Bayerische Motoren Werke Aktiengesellschaft (BMW AG) - initial API and implementation | ||
| * | ||
| */ | ||
|
|
||
| package org.eclipse.edc.iam.identitytrust.core.scope; | ||
|
|
||
| import org.eclipse.edc.identitytrust.scope.CredentialScopeExtractor; | ||
| import org.eclipse.edc.identitytrust.scope.CredentialScopeExtractorRegistry; | ||
| import org.eclipse.edc.policy.engine.spi.PolicyContext; | ||
| import org.eclipse.edc.policy.model.Policy; | ||
| import org.eclipse.edc.spi.result.Result; | ||
|
|
||
| import java.util.ArrayList; | ||
| import java.util.List; | ||
|
|
||
| public class IatpScopeExtractorRegistry implements CredentialScopeExtractorRegistry { | ||
| private final List<CredentialScopeExtractor> extractors = new ArrayList<>(); | ||
|
|
||
| @Override | ||
| public void registerScopeExtractor(CredentialScopeExtractor extractor) { | ||
| extractors.add(extractor); | ||
| } | ||
|
|
||
| @Override | ||
| public Result<List<String>> extractScopes(Policy policy, PolicyContext policyContext) { | ||
| var visitor = new IatpScopeExtractorVisitor(extractors, policyContext); | ||
| var policies = policy.accept(visitor); | ||
| if (policyContext.hasProblems()) { | ||
| return Result.failure(policyContext.getProblems()); | ||
| } | ||
| return Result.success(policies); | ||
| } | ||
|
|
||
| } |
122 changes: 122 additions & 0 deletions
122
...src/main/java/org/eclipse/edc/iam/identitytrust/core/scope/IatpScopeExtractorVisitor.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,122 @@ | ||
| /* | ||
| * Copyright (c) 2023 Bayerische Motoren Werke Aktiengesellschaft (BMW AG) | ||
| * | ||
| * This program and the accompanying materials are made available under the | ||
| * terms of the Apache License, Version 2.0 which is available at | ||
| * https://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * Contributors: | ||
| * Bayerische Motoren Werke Aktiengesellschaft (BMW AG) - initial API and implementation | ||
| * | ||
| */ | ||
|
|
||
| package org.eclipse.edc.iam.identitytrust.core.scope; | ||
|
|
||
| import org.eclipse.edc.identitytrust.scope.CredentialScopeExtractor; | ||
| import org.eclipse.edc.policy.engine.spi.PolicyContext; | ||
| import org.eclipse.edc.policy.model.AndConstraint; | ||
| import org.eclipse.edc.policy.model.AtomicConstraint; | ||
| import org.eclipse.edc.policy.model.Constraint; | ||
| import org.eclipse.edc.policy.model.Duty; | ||
| import org.eclipse.edc.policy.model.Expression; | ||
| import org.eclipse.edc.policy.model.LiteralExpression; | ||
| import org.eclipse.edc.policy.model.MultiplicityConstraint; | ||
| import org.eclipse.edc.policy.model.OrConstraint; | ||
| import org.eclipse.edc.policy.model.Permission; | ||
| import org.eclipse.edc.policy.model.Policy; | ||
| import org.eclipse.edc.policy.model.Prohibition; | ||
| import org.eclipse.edc.policy.model.Rule; | ||
| import org.eclipse.edc.policy.model.XoneConstraint; | ||
|
|
||
| import java.util.ArrayList; | ||
| import java.util.Collection; | ||
| import java.util.List; | ||
| import java.util.stream.Collectors; | ||
|
|
||
| public class IatpScopeExtractorVisitor implements Policy.Visitor<List<String>>, Rule.Visitor<List<String>>, Constraint.Visitor<List<String>>, Expression.Visitor<Object> { | ||
| private final List<CredentialScopeExtractor> mappers; | ||
| private final PolicyContext policyContext; | ||
|
|
||
| public IatpScopeExtractorVisitor(List<CredentialScopeExtractor> mappers, PolicyContext policyContext) { | ||
| this.mappers = mappers; | ||
| this.policyContext = policyContext; | ||
| } | ||
|
|
||
| @Override | ||
| public List<String> visitAndConstraint(AndConstraint andConstraint) { | ||
| return visitMultiplicityConstraint(andConstraint); | ||
| } | ||
|
|
||
| @Override | ||
| public List<String> visitOrConstraint(OrConstraint orConstraint) { | ||
| return visitMultiplicityConstraint(orConstraint); | ||
| } | ||
|
|
||
| @Override | ||
| public List<String> visitXoneConstraint(XoneConstraint constraint) { | ||
| return visitMultiplicityConstraint(constraint); | ||
| } | ||
|
|
||
| @Override | ||
| public List<String> visitAtomicConstraint(AtomicConstraint constraint) { | ||
| var rightValue = constraint.getRightExpression().accept(this); | ||
| var leftRawValue = constraint.getLeftExpression().accept(this); | ||
|
|
||
| return mappers.stream() | ||
| .map(mapper -> mapper.extractScopes(leftRawValue, constraint.getOperator(), rightValue, policyContext)) | ||
| .flatMap(Collection::stream) | ||
| .collect(Collectors.toList()); | ||
|
|
||
| } | ||
|
|
||
| @Override | ||
| public Object visitLiteralExpression(LiteralExpression expression) { | ||
| return expression.getValue(); | ||
| } | ||
|
|
||
| @Override | ||
| public List<String> visitPolicy(Policy policy) { | ||
| var scopes = new ArrayList<String>(); | ||
| policy.getPermissions().forEach(permission -> scopes.addAll(permission.accept(this))); | ||
| policy.getProhibitions().forEach(prohibition -> scopes.addAll(prohibition.accept(this))); | ||
| policy.getObligations().forEach(duty -> scopes.addAll(duty.accept(this))); | ||
| return scopes; | ||
| } | ||
|
|
||
| @Override | ||
| public List<String> visitPermission(Permission policy) { | ||
| var scopes = policy.getDuties().stream() | ||
| .map(duty -> duty.accept(this)) | ||
| .flatMap(Collection::stream) | ||
| .collect(Collectors.toList()); | ||
|
|
||
| scopes.addAll(visitRule(policy)); | ||
| return scopes; | ||
| } | ||
|
|
||
| @Override | ||
| public List<String> visitProhibition(Prohibition policy) { | ||
| return visitRule(policy); | ||
| } | ||
|
|
||
| @Override | ||
| public List<String> visitDuty(Duty policy) { | ||
| return visitRule(policy); | ||
| } | ||
|
|
||
| private List<String> visitRule(Rule rule) { | ||
| return rule.getConstraints().stream() | ||
| .map(constraint -> constraint.accept(this)) | ||
| .flatMap(Collection::stream) | ||
| .collect(Collectors.toList()); | ||
| } | ||
|
|
||
| private List<String> visitMultiplicityConstraint(MultiplicityConstraint multiplicityConstraint) { | ||
| return multiplicityConstraint.getConstraints().stream() | ||
| .map(constraint -> constraint.accept(this)) | ||
| .flatMap(Collection::stream) | ||
| .collect(Collectors.toList()); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.