source: java/net/deterlab/abac/CredentialFactory.java @ 8f53997

package net.deterlab.abac;

import java.io.*;
import java.util.*;
import java.lang.reflect.*;


/**
 * A class for parsing and generating Credentials inside a Context.  All
 * credential parsing should use a credential factory inside a context uses a
 * CredentialFactory.
 * @author <a href="http://abac.deterlab.net">ISI ABAC team</a>
 * @version 1.4
 */
public class CredentialFactory implements Cloneable {
    protected List<CredentialFactorySpecialization> spec;

    /**
     * The xmlparsing routines helpfully close input streams when they
     * successfully parse a document from one.  It's possible for a correctly
     * parsed XML document to need to be reparsed by later specialization, for
     * example because the XML was fine, but it was the wrong type of
     * credential.  This makes the close operation a NOOP.
     */
    static protected class UnclosableBufferedInputStream extends 
        BufferedInputStream {
            public UnclosableBufferedInputStream(InputStream is) {
                super(is);
            }
            public UnclosableBufferedInputStream(InputStream is, int s) {
                super(is, s);
            }

            public void close() throws IOException { }
    };
    /** The classes understood by the default CredentialFactory (in order) */
    static public String[] defNames = new String[] {
        "net.deterlab.abac.GENICredential",
        "net.deterlab.abac.X509Credential",
        "net.deterlab.abac.GENIPrivCredential",
    };

    /** Maximum credential size that can be rewound for reparsing */
    public static final int maxSize = 50 * 1024;

    /**
     * Create a Credential Factory that parses the default type(s)
     * @throws ABACException if the object cannot be created
     */
    public CredentialFactory() throws ABACException {
        spec = new ArrayList<CredentialFactorySpecialization>();
        for ( String name: defNames) 
            registerClass(name);
    }

    /**
     * Create a Credential Factory that parses the given type(s).  Each String
     * should be the binary name for a class that exports a static
     * getCredentialParser method that returns a CredentialParser for the
     * class.
     * @param names a Collection of Strings naming the classes to parse
     * @throws ABACException if the object cannot be created
     */
    public CredentialFactory(Collection<String> names) throws ABACException {
        spec = new ArrayList<CredentialFactorySpecialization>();
        for (String n : names ) 
            registerClass(n);
    }

    /**
     * Create a Credential Factory that parses the given type(s).  Each String
     * should be the binary name for a class that exports a static
     * getCredentialParser method that returns a CredentialParser for the
     * class.
     * @param names an Array of Strings naming the classes to parse
     * @throws ABACException if the object cannot be created
     */
    public CredentialFactory(String[] names) throws ABACException {
        spec = new ArrayList<CredentialFactorySpecialization>();
        for (String n : names ) 
            registerClass(n);
    }

    /**
     * Create a Credential Factory that is a clone of the given
     * CredentialFactory.
     * @param cf the CredentialFactory to copy
     * @throws ABACException if the object cannot be created
     */
    public CredentialFactory(CredentialFactory cf) throws ABACException {
        this();

        spec = new ArrayList<CredentialFactorySpecialization>();

        for ( int i = 0; i < spec.size(); i++) 
            spec.add(cf.spec.get(i));
    }

    /**
     * Make a copy of this CredentialFactory
     * @return a CredentialFactory, a copy of this one
     */
    public Object clone() throws CloneNotSupportedException {
        CredentialFactory cf = null;
        try {
            cf = new CredentialFactory(this);
        }
        catch (ABACException ae) {
            return null;
        }
        return cf;
    }


    /**
     * Parse an input stream using each possible credential format and the
     * available identities for validation.  Return the credentials found or
     * throw an ABACException with the problem.  It wraps the input stream in a
     * BufferedInputStream in order to retry is a parser fails.  Credentials
     * larger than maxSize will nor be able to be reparsed.
     * @param is an InputStream to parse
     * @param ids a Collection of Identities for validation
     * @return an Array of Credentials parsed
     * @throws CertInvalidException if the stream is unparsable
     * @throws MissingIssuerException if none of the Identities can validate the
     * @throws BadSignatureException if the signature check fails
     */
    public Credential[] parseCredential(InputStream is, 
            Collection<Identity> ids) throws ABACException {
        Credential[] rv = null;
        ABACException err = null;
        UnclosableBufferedInputStream bs = 
            new UnclosableBufferedInputStream(is, maxSize);

        bs.mark(maxSize);
        for (CredentialFactorySpecialization c : spec ) {
            try {
                rv = c.parseCredential(bs, ids);
                break;
            }
            catch (ABACException e ) {
                err = e;
                rv = null;
            }
            try {
                if (spec.size() > 1) bs.reset(); 
            }
            catch (IOException ie) { 
                break;
            }
        }

        if ( rv != null ) 
            return rv;
        else 
            throw (err != null) ? err :
                new ABACException("null exception and failed construction??");
    }


    /**
     * Parse a File using each possible credential format and the
     * available identities for validation.  Return the credentials found or
     * throw an ABACException with the problem.  Calls the InputStream version
     * internally.
     * @param f a File to parse
     * @param ids a Collection of Identities for validation
     * @return an Array of Credentials parsed
     * @throws CertInvalidException if the stream is unparsable
     * @throws MissingIssuerException if none of the Identities can validate the
     * @throws BadSignatureException if the signature check fails
     */
    public Credential[] parseCredential(File f, 
            Collection<Identity> ids) throws ABACException {
        try {
            return parseCredential(new FileInputStream(f), ids);
        }
        catch (FileNotFoundException e) {
            throw new CertInvalidException(e.getMessage(), e);
        }
    }
    /**
     * Parse a file named fn using each possible credential format and the
     * available identities for validation.  Return the credentials found or
     * throw an ABACException with the problem.  Calls the InputStream version
     * internally.
     * @param fn a String holding the filename to parse
     * @param ids a Collection of Identities for validation
     * @return an Array of Credentials parsed
     * @throws CertInvalidException if the stream is unparsable
     * @throws MissingIssuerException if none of the Identities can validate the
     * @throws BadSignatureException if the signature check fails
     */
    public Credential[] parseCredential(String fn, 
            Collection<Identity> ids) throws ABACException {
        return parseCredential(new File(fn), ids);
    }

    /**
     * Return a credential from the first class registered in
     * the factory.
     * @param head a Role, the head of the encoded ABAC statement
     * @param tail a Role, the tail of the decoded ABAC statement
     * @return a Credential encoding that ABAC statement
     */
    public Credential generateCredential(Role head, Role tail) {
        if (spec.isEmpty()) return null;
        return spec.get(0).generateCredential(head, tail);
    }

    /**
     * Add the named class to the list of usable specializations.  The class
     * passed in must have a static getCredentialFactorySpecialization() method
     * that returns a CredentialFactorySpecialization to use.
     * @param name a String containing the binary name of the class to register
     * @throws ABACException if there is a problem.  The cause field of this
     * exception is set to the classloading exception, if any.
     */
    public void registerClass(String name)
        throws ABACException {
        CredentialFactorySpecialization cs = null;

        try {
            /* <?> doesn't guarantee much, but shuts the compiler up */
            Class<?> c =  Class.forName(name);
            Method m = c.getMethod("getCredentialFactorySpecialization");

            cs = (CredentialFactorySpecialization) m.invoke(null);
        }
        catch (Exception e) {
            throw new ABACException("Could not register credential type" + 
                    e.getMessage(), e);
        }

        spec.add(cs);
    }
}