Skip to content

Commit c4a4a51

Browse files
cdangercdanger
committed
- Fixed OW2-28, OW2-29, OW2-30, OW2-32
- Changed parent project version: 5.1.0 -> 7.0.0 - Changed dependency versions: - core version: 8.0.0 -> 10.0.0 -> changed PDP configuration XSD version: 5.0.0 -> 6.0.0 (requestFilter/resultFilter replaced with inoutProcChain/requestPreproc|resultPostproc) - core-pap-api version: 6.4.0 -> 9.0.0, pap-dao-flat-file version: 8.1.0 -> 9.0.0 - rest-api-model: 5.4.0 -> 5.6.0 providing XACML JSON Profile compliance (application/xacml+xml and application/xacml+json media types now supported), and new '/version' resource providing product metadata - Added new JNDI environment properties: org.ow2.authzforce.domains.enableXacmlJsonProfile (true iff JSON-Profile support is enabled on PDPs), org.ow2.authzforce.webapp.publishedEndpointUrl (base address in WADL), org.ow2.authzforce.webapp.jsonKeysWithArrays (comma-separated list of JSON keys with values serialized to arrays always), org.ow2.authzforce.webapp.noNamespaceInJsonOutput (true iff namespaces dropped in JSON output), org.ow2.authzforce.webapp.jsonKeysToXmlAttributes (comma-separated list of keys of JSON objects to be deserialized as XML attributes), org.ow2.authzforce.webapp.xmlAttributesToJsonLikeElements (org.ow2.authzforce.webapp.xmlAttributesToJsonLikeElements) - New configuration file for configuring CXF/JAX-RS JSON Provider's inTransformElements property (http://cxf.apache.org/docs/jax-rs-data-bindings.html#JAX-RSDataBindings-CustomizingJAXBXMLandJSONinputandoutput): json-to-xml-map.properties - New /version resource implementation class (ProductMetadataResourceImpl) providing product name/version/release date, server uptime and API doc URL) based on file 'org.ow2.authzforce.server.product.properties' auto-filled by Maven build - Moved generic JAX-RS extensions (ExceptionMapper, ContainerRequestFilter...) to new separate authzforce-ce-jaxrs-utils project - Applied new naming conventions for Java classes with acronyms (only first letter is uppercase) - Renamed JsonJaxrsProvider class to JSONProvider - JSON schema validation base on XSD for application/json provider (JSONProvider) - Added JSON Profile support using org.json API: new JsonRiCxfJaxrsProvider as JAX-RS/CXF Provider supporting security properties restricting the size of JSON strings, max number of JSON keys/items in a JSON object/array, max JSON object depth
1 parent 84eca6e commit c4a4a51

File tree

182 files changed

+5729
-4447
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

182 files changed

+5729
-4447
lines changed

‎dist/pom.xml

-5
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,6 @@
1111
<packaging>jar</packaging>
1212
<name>${project.groupId}:${project.artifactId}</name>
1313
<description>AuthZForce CE server distribution (zip and deb)</description>
14-
<properties>
15-
<productName>${project.parent.artifactId}</productName>
16-
<productMaintainer>Thales Services SAS</productMaintainer>
17-
</properties>
1814
<url>https://github.com/authzforce/server/dist</url>
1915
<scm>
2016
<connection>scm:git:${git.url.base}.git</connection>
@@ -82,7 +78,6 @@
8278
<plugin>
8379
<groupId>org.apache.maven.plugins</groupId>
8480
<artifactId>maven-resources-plugin</artifactId>
85-
<version>3.0.1</version>
8681
<executions>
8782
<execution>
8883
<phase>process-sources</phase>

‎dist/src/conf/domain.tmpl/pdp.xml

+12-21
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,13 @@
1-
<pdp
2-
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3-
xmlns="http://authzforce.github.io/core/xmlns/pdp/5.0"
4-
xmlns:pap-dao="http://authzforce.github.io/pap-dao-flat-file/xmlns/pdp-ext/3.6"
5-
version="5.0.0"
6-
maxVariableRefDepth="10"
7-
maxPolicyRefDepth="10"
8-
strictAttributeIssuerMatch="false"
9-
requestFilter="urn:ow2:authzforce:feature:pdp:request-filter:default-lax">
10-
<!-- Replace with requestFilter = "urn:ow2:authzforce:feature:pdp:request-filter:multiple:repeated-attribute-categories-lax" for Multiple Decision Profile support. -->
11-
<!-- You may customize this PDP configuration except 'rootPolicyProvider' and 'refPolicyProvider' elements. -->
12-
<!-- policyLocation must start with ${PARENT_DIR}/ and end with: /*SUFFIX (* is expanded to base64url(policyId)/policyVersion) -->
13-
<refPolicyProvider
14-
id="refPolicyProvider"
15-
xsi:type="pap-dao:StaticFlatFileDAORefPolicyProvider"
16-
policyLocationPattern="${PARENT_DIR}/policies/*.xml" />
17-
<rootPolicyProvider
18-
id="rootPolicyProvider"
19-
xsi:type="StaticRefBasedRootPolicyProvider">
20-
<policyRef>root</policyRef>
21-
</rootPolicyProvider>
1+
<pdp xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://authzforce.github.io/core/xmlns/pdp/6.0" xmlns:pap-dao="http://authzforce.github.io/pap-dao-flat-file/xmlns/pdp-ext/3.6"
2+
version="6.0.0" maxVariableRefDepth="10" maxPolicyRefDepth="10" strictAttributeIssuerMatch="false">
3+
<!-- You may customize this PDP configuration except 'rootPolicyProvider' and 'refPolicyProvider' elements. -->
4+
<!-- policyLocation must start with ${PARENT_DIR}/ and end with: /*SUFFIX (* is expanded to base64url(policyId)/policyVersion) -->
5+
<refPolicyProvider id="refPolicyProvider" xsi:type="pap-dao:StaticFlatFileDAORefPolicyProvider" policyLocationPattern="${PARENT_DIR}/policies/*.xml" />
6+
<rootPolicyProvider id="rootPolicyProvider" xsi:type="StaticRefBasedRootPolicyProvider">
7+
<policyRef>root</policyRef>
8+
</rootPolicyProvider>
9+
<ioProcChain>
10+
<!-- Replace requestPreproc value with "urn:ow2:authzforce:feature:pdp:request-preproc:xacml-xml:multiple:repeated-attribute-categories-lax" for Multiple Decision Profile support. -->
11+
<requestPreproc>urn:ow2:authzforce:feature:pdp:request-preproc:xacml-xml:default-lax</requestPreproc>
12+
</ioProcChain>
2213
</pdp>

‎dist/src/conf/json-to-xml-map.properties

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Configuration of JSON-key-to-XML-element mapping in JSON message body reader, as defined by CXF inTransformElements property:
2+
# More info: http://cxf.apache.org/docs/jax-rs-data-bindings.html#JAX-RSDataBindings-CustomizingJAXBXMLandJSONinputandoutput
3+
#
4+
# WARNING: remember to escape ':' in keys (namespaces). More info: https://docs.oracle.com/javase/8/docs/api/java/util/Properties.html#load-java.io.Reader-
5+
# JSONkeyX={xmlNamespaceY}elementNameZ
6+
7+
# Example used for AuthzForce Manager GUI
8+
#domainProperties={http://authzforce.github.io/rest-api-model/xmlns/authz/5}domainProperties
9+
#pdpPropertiesUpdate={http://authzforce.github.io/rest-api-model/xmlns/authz/5}pdpPropertiesUpdate
10+
#rootPolicyRefExpression={http://authzforce.github.io/rest-api-model/xmlns/authz/5}rootPolicyRefExpression
11+
#feature={http://authzforce.github.io/rest-api-model/xmlns/authz/5}feature
12+
#description="{http://authzforce.github.io/rest-api-model/xmlns/authz/5}description
13+
#*={urn:oasis:names:tc:xacml:3.0:core:schema:wd-17}*

‎dist/src/conf/logback.xml

-3
Original file line numberDiff line numberDiff line change
@@ -60,9 +60,6 @@
6060
<!-- <appender-ref ref="access"/> -->
6161
<!-- </logger> -->
6262

63-
<logger name="com.sun.xacml" additivity="false" level="WARN">
64-
<appender-ref ref="error" />
65-
</logger>
6663
<logger name="org.ow2.authzforce" additivity="false" level="WARN">
6764
<appender-ref ref="error" />
6865
</logger>

‎dist/src/conf/xmlns-to-json-key-prefix-map.properties

+15-15
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
1-
# Java Properties configuring the mapping from XML namespace URIs used in AuthzForce API model to the name prefixes used in JSON payloads.
2-
# For example, if we have the mapping "urn:example:com:mynamespace = myns", then some XML element
3-
# <someElement xmlns="urn:example:com:mynamespace" ... />
4-
# ...becomes in JSON:
5-
# { "myns:someElement" : ... }
6-
#
7-
# Format:
8-
# namespace1=prefix1
9-
# namespace2=prefix2
10-
# ...
11-
# WARNING: remember to escape ':' in namespaces. More info: https://docs.oracle.com/javase/8/docs/api/java/util/Properties.html#load-java.io.Reader-
12-
urn\:oasis\:names\:tc\:xacml\:3.0\:core\:schema\:wd-17 = xacml
13-
http\://www.w3.org/2005/Atom = atom
14-
http\://authzforce.github.io/rest-api-model/xmlns/authz/5 = az
15-
http\://authzforce.github.io/core/xmlns/test/3 = test
1+
# Java Properties configuring the mapping from XML namespace URIs used in AuthzForce API model to the name prefixes used in JSON payloads.
2+
# For example, if we have the mapping "urn:example:com:mynamespace = myns", then some XML element
3+
# <someElement xmlns="urn:example:com:mynamespace" ... />
4+
# ...becomes in JSON:
5+
# { "myns:someElement" : ... }
6+
#
7+
# Format:
8+
# namespace1=prefix1
9+
# namespace2=prefix2
10+
# ...
11+
# WARNING: remember to escape ':' in namespaces. More info: https://docs.oracle.com/javase/8/docs/api/java/util/Properties.html#load-java.io.Reader-
12+
urn\:oasis\:names\:tc\:xacml\:3.0\:core\:schema\:wd-17 =
13+
http\://www.w3.org/2005/Atom = atom
14+
http\://authzforce.github.io/rest-api-model/xmlns/authz/5 = az
15+
http\://authzforce.github.io/core/xmlns/test/3 = test

‎dist/src/data/domains/A0bdIbmGEeWhFwcKrC9gSQ/pdp.xml

+18-19
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,20 @@
11
<pdp
2-
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3-
xmlns="http://authzforce.github.io/core/xmlns/pdp/5.0"
4-
xmlns:pap-dao="http://authzforce.github.io/pap-dao-flat-file/xmlns/pdp-ext/3.6"
5-
version="5.0.0"
6-
maxPolicyRefDepth="10"
7-
strictAttributeIssuerMatch="false"
8-
requestFilter="urn:ow2:authzforce:feature:pdp:request-filter:default-lax">
9-
<!-- Replace with requestFilter = "urn:ow2:authzforce:feature:pdp:request-filter:multiple:repeated-attribute-categories-lax" for Multiple Decision Profile support. -->
10-
<!-- You may customize this PDP configuration except 'rootPolicyProvider' and 'refPolicyProvider' elements. -->
11-
<!-- policyLocation must start with ${PARENT_DIR}/ and end with: /*SUFFIX (* is expanded to base64url(policyId)/policyVersion) -->
12-
<refPolicyProvider
13-
id="refPolicyProvider"
14-
xsi:type="pap-dao:StaticFlatFileDAORefPolicyProvider"
15-
policyLocationPattern="${PARENT_DIR}/policies/*.xml" />
16-
<rootPolicyProvider
17-
id="rootPolicyProvider"
18-
xsi:type="StaticRefBasedRootPolicyProvider">
19-
<policyRef>root</policyRef>
20-
</rootPolicyProvider>
2+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xmlns="http://authzforce.github.io/core/xmlns/pdp/6.0"
4+
xmlns:pap-dao="http://authzforce.github.io/pap-dao-flat-file/xmlns/pdp-ext/3.6"
5+
version="6.0.0"
6+
maxVariableRefDepth="10"
7+
maxPolicyRefDepth="10"
8+
strictAttributeIssuerMatch="false">
9+
<!-- You may customize this PDP configuration except 'rootPolicyProvider' and 'refPolicyProvider' elements. -->
10+
<!-- policyLocation must start with ${PARENT_DIR}/ and end with: /*SUFFIX (* is expanded to base64url(policyId)/policyVersion) -->
11+
<refPolicyProvider
12+
id="refPolicyProvider"
13+
xsi:type="pap-dao:StaticFlatFileDAORefPolicyProvider"
14+
policyLocationPattern="${PARENT_DIR}/policies/*.xml" />
15+
<rootPolicyProvider
16+
id="rootPolicyProvider"
17+
xsi:type="StaticRefBasedRootPolicyProvider">
18+
<policyRef>root</policyRef>
19+
</rootPolicyProvider>
2120
</pdp>

‎dist/src/debian/changelog

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
authzforce-ce-server (${project.version}) trusty; urgency=low
1+
authzforce-ce-server (${project.version}) xenial; urgency=low
22
* See https://github.com/authzforce/server/blob/release-${project.version}/CHANGELOG.md
33
-- Thales Services <http://www.thalesgroup.com> ${debian.changelog.timestamp}

‎dist/src/webapp-context.xml

+35-26
Original file line numberDiff line numberDiff line change
@@ -2,31 +2,40 @@
22
<!-- Context used by Tomcat -->
33
<Context path="/authzforce-ce" docBase="/opt/${productName}/webapp">
44

5-
<!-- Override <context-param>s in web.xml -->
6-
<Parameter name="logbackConfigLocation" description="Logging configuration file"
7-
value="file:/opt/${productName}/conf/logback.xml" override="false" />
8-
9-
<Parameter name="spring.profiles.active" description="application profiles: '+fastinfoset' to enable FastInfoset support, '-fastinfoset' to disable FastInfoset support"
10-
value="-fastinfoset" override="false" />
11-
12-
<!-- Override <env-entry>s in web.xml -->
13-
<Environment name="org.ow2.authzforce.config.dir" value="file:/opt/${productName}/conf"
14-
type="java.lang.String" override="false"
15-
description="Configuration directory path that may contain \${...} placeholders, to be resolved as system properties: e.g. \${user.dir}. Default values can be supplied using the ':' separator between key and value (see org.springframework.util.SystemPropertyUtils class)" />
16-
17-
<Environment name="org.ow2.authzforce.data.dir" value="file:/opt/${productName}/data"
18-
type="java.lang.String" override="false"
19-
description="Data (e.g. data of domains created and managed by the API) directory path that may contain \${...} placeholders, to be resolved as system properties: e.g. \${user.dir}. Default values can be supplied using the ':' separator between key and value (see org.springframework.util.SystemPropertyUtils class)" />
20-
21-
<Environment name="org.ow2.authzforce.uuid.gen.randomMulticastAddressBased"
22-
value="false" type="java.lang.Boolean" override="false"
23-
description="UUID generator option for domain IDs, set to true if and only if Authzforce deployed in dev environment that is disconnected from the network, i.e. no 'real' Ethernet address to use, set this JNDI variable to 'true' to initialize the UUID (variant 1) generator with a random multicast address instead." />
24-
25-
<Environment name="org.ow2.authzforce.domains.sync.interval"
26-
value="0" type="java.lang.Integer" override="false"
27-
description="Domains folder-to-memory synchronization interval (seconds); value 0 disables this feature." />
28-
29-
<Environment name="org.ow2.authzforce.domains.enablePdpOnly"
30-
value="false" type="java.lang.Boolean" override="false"
5+
<!-- Override <context-param>s in web.xml -->
6+
<Parameter name="logbackConfigLocation" description="Logging configuration file" value="file:/opt/${productName}/conf/logback.xml" override="false" />
7+
8+
<Parameter name="spring.profiles.active" description="application profiles: '+fastinfoset' to enable FastInfoset support, '-fastinfoset' to disable FastInfoset support" value="-fastinfoset"
9+
override="false" />
10+
11+
<!-- <env-entry>s in web.xml do not override entries below iff override=false. -->
12+
<Environment name="org.ow2.authzforce.config.dir" value="file:/opt/${productName}/conf" type="java.lang.String" override="false"
13+
description="Configuration directory path that may contain \${...} placeholders, to be resolved as system properties: e.g. \${user.dir}. Default values can be supplied using the ':' separator between key and value (see org.springframework.util.SystemPropertyUtils class)" />
14+
15+
<Environment name="org.ow2.authzforce.data.dir" value="file:/opt/${productName}/data" type="java.lang.String" override="false"
16+
description="Data (e.g. data of domains created and managed by the API) directory path that may contain \${...} placeholders, to be resolved as system properties: e.g. \${user.dir}. Default values can be supplied using the ':' separator between key and value (see org.springframework.util.SystemPropertyUtils class)" />
17+
18+
<Environment name="org.ow2.authzforce.uuid.gen.randomMulticastAddressBased" value="false" type="java.lang.Boolean" override="false"
19+
description="UUID generator option for domain IDs, set to true if and only if Authzforce deployed in dev environment that is disconnected from the network, i.e. no 'real' Ethernet address to use, set this JNDI variable to 'true' to initialize the UUID (variant 1) generator with a random multicast address instead." />
20+
21+
<Environment name="org.ow2.authzforce.domains.sync.interval" value="0" type="java.lang.Integer" override="false"
22+
description="Domains folder-to-memory synchronization interval (seconds); value 0 disables this feature." />
23+
24+
<Environment name="org.ow2.authzforce.domains.enablePdpOnly" value="false" type="java.lang.Boolean" override="false"
3125
description="Enable PDP only, i.e. disable all PAP (or other administration) features iff true" />
26+
27+
<Environment name="org.ow2.authzforce.domains.enableXacmlJsonProfile" value="false" type="java.lang.Boolean" override="false"
28+
description="Enable support for JSON Profile of XACML 3.0 on domains' PDP endpoints iff true" />
29+
30+
<!-- <Environment name="org.ow2.authzforce.webapp.publishedEndpointUrl" value="http://localhost:8080" type="java.lang.Boolean" override="false" description="Base address specified in the auto-generated
31+
WADL. This parameter allows setting the public URL that may not be the same as the URL the service is deployed on. (For example, the service is behind a proxy of some sort)." /> -->
32+
33+
<!-- <Environment name="org.ow2.authzforce.webapp.jsonKeysWithArrays" type="java.lang.String" override="false" description="Comma-separated list of JSON keys with values to be always serialized to JSON
34+
arrays (even if single-valued). More info: http://cxf.apache.org/docs/jax-rs-data-bindings.html#JAX-RSDataBindings-DealingwithJettisonarrayserializationissues (serializeAsArray always true but no effect
35+
if this property undefined or has empty value). The example here works for AuthzForce Manager GUI" value="link,PolicySet,PolicySetIdReference,Policy,PolicyIdReference,Rule,VariableDefinition,AnyOf,AllOf,Match,ObligationExpressions,AdviceExpressions,Obligations,AssociatedAdvice"
36+
/> -->
37+
38+
<Environment name="org.ow2.authzforce.webapp.noNamespaceInJsonOutput" value="false" type="java.lang.Boolean" override="false"
39+
description="Whether to drop all XML namespaces (JSON key prefixes) from JSON output in XML-to-JSON translation. Enable this for AuthzForce Manager GUI." />
40+
3241
</Context>

‎owasp-dependency-check-suppression.xml

+5-2
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,12 @@
22
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.1.xsd">
33
<suppress>
44
<notes><![CDATA[
5-
file name: mailapi-1.5.6.jar
5+
file name: mailapi-1.5.6.jar,
6+
false positive reported: https://github.com/jeremylong/DependencyCheck/issues/912
67
]]></notes>
7-
<gav regex="true">^com\.sun\.mail:mailapi:.*$</gav>
8+
<cpe>cpe:/a:mail_project:mail</cpe>
9+
<cpe>cpe:/a:sun:javamail</cpe>
810
<cve>CVE-2007-6059</cve>
11+
<cve>CVE-2015-9097</cve>
912
</suppress>
1013
</suppressions>

‎pom.xml

+6-4
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<parent>
55
<groupId>org.ow2.authzforce</groupId>
66
<artifactId>authzforce-ce-parent</artifactId>
7-
<version>5.1.0</version>
7+
<version>7.0.0</version>
88
</parent>
99
<artifactId>authzforce-ce-server</artifactId>
1010
<!-- FIWARE Versioning + Version must be equal or higher than 'authzforce-ce-rest-api-model' dependency in 'rest-service' module -->
@@ -15,10 +15,12 @@
1515
<url>${project.url}</url>
1616
<properties>
1717
<git.url.base>https://github.com/authzforce/server</git.url.base>
18-
<authzforce-ce-core.version>8.0.0</authzforce-ce-core.version>
19-
<authzforce-ce-core-pap-api.version>6.4.0</authzforce-ce-core-pap-api.version>
18+
<authzforce-ce-core.version>10.0.0</authzforce-ce-core.version>
19+
<authzforce-ce-core-pap-api.version>9.0.0</authzforce-ce-core-pap-api.version>
2020
<!-- Version must be compatible with authzforce-ce-core and authzforce-ce-core-pap-api versions above. -->
21-
<authzforce-ce-pap-dao-flat-file.version>8.1.0</authzforce-ce-pap-dao-flat-file.version>
21+
<authzforce-ce-pap-dao-flat-file.version>9.0.0</authzforce-ce-pap-dao-flat-file.version>
22+
<productName>AuthzForce CE Server</productName>
23+
<productMaintainer>Thales Services SAS</productMaintainer>
2224
</properties>
2325
<scm>
2426
<connection>scm:git:${git.url.base}.git</connection>

‎release.description.tmpl.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,4 @@
55

66
Docker image available on [Docker Hub](https://hub.docker.com/r/fiware/authzforce-ce-server/tags/).
77

8-
Documentation available [online](http://authzforce-ce-fiware.readthedocs.io/en/release-M.m.P/) and as downloadable [HTML](https://media.readthedocs.org/htmlzip/authzforce-ce-fiware/release-M.m.P/authzforce-ce-fiware.zip) and [PDF](https://media.readthedocs.org/pdf/authzforce-ce-fiware/release-M.m.P/authzforce-ce-fiware.pdf).
8+
Documentation available [online](http://authzforce-ce-fiware.readthedocs.io/en/release-M.m.P/) and as downloadable [HTML](https://media.readthedocs.org/htmlzip/authzforce-ce-fiware/release-M.m.P/authzforce-ce-fiware.zip) and [PDF](https://media.readthedocs.org/pdf/authzforce-ce-fiware/release-M.m.P/authzforce-ce-fiware.pdf).

‎rest-service/owasp-dependency-check-suppression.xml

+5-2
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,12 @@
22
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.1.xsd">
33
<suppress>
44
<notes><![CDATA[
5-
file name: mailapi-1.5.6.jar
5+
file name: mailapi-1.5.6.jar,
6+
false positive reported: https://github.com/jeremylong/DependencyCheck/issues/912
67
]]></notes>
7-
<gav regex="true">^com\.sun\.mail:mailapi:.*$</gav>
8+
<cpe>cpe:/a:mail_project:mail</cpe>
9+
<cpe>cpe:/a:sun:javamail</cpe>
810
<cve>CVE-2007-6059</cve>
11+
<cve>CVE-2015-9097</cve>
912
</suppress>
1013
</suppressions>

0 commit comments

Comments
 (0)