| <?xml version="1.0" encoding="UTF-8"?> |
| <!-- |
| Licensed to the Apache Software Foundation (ASF) under one |
| or more contributor license agreements. See the NOTICE file |
| distributed with this work for additional information |
| regarding copyright ownership. The ASF licenses this file |
| to you under the Apache License, Version 2.0 (the |
| "License"); you may not use this file except in compliance |
| with the License. You may obtain a copy of the License at |
| |
| http://www.apache.org/licenses/LICENSE-2.0 |
| |
| Unless required by applicable law or agreed to in writing, |
| software distributed under the License is distributed on an |
| "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| KIND, either express or implied. See the License for the |
| specific language governing permissions and limitations |
| under the License. |
| --> |
| <project basedir="." default="all" name="Apache Fortress Rest Server Sample ARBAC Policy"> |
| <taskdef classname="org.apache.directory.fortress.core.ant.FortressAntTask" name="FortressAdmin" > |
| <classpath path="${java.class.path}"/> |
| </taskdef> |
| |
| <target name="all"> |
| <FortressAdmin> |
| |
| <!-- This test demo user here will have all of the required roles to pass the security checks when calling the Apache Fortress REST services during integration testing. --> |
| <!-- In actual practice, you would establish a much stricter security policy, limiting users to only the sets of services, data needed to complete their jobs. --> |
| <adduser> |
| <user userId="demoUser4" password="password" description="Demo Test User 4" ou="demousrs1" cn="Demo User" sn="User4"/> |
| </adduser> |
| |
| <!-- Assign the test user to the role that passes all RBAC checks for testing. --> |
| <adduserrole> |
| <userrole userId="demoUser4" name="fortress-rest-power-user" /> |
| </adduserrole> |
| |
| <addrole> |
| <!-- This role is checked by the servlet container using JavaEE security. All callers must be assigned this role |
| plus at least one more of the interceptor roles from below --> |
| <role name="fortress-rest-user" description="This is JavaEE role required to call Fortress Rest server"/> |
| |
| <!-- These roles are checked by the FortressInterceptor authorization annotation inside FortressServiceImpl class. --> |
| |
| <!-- Users assigned the fortress-rest-super-user role will gain access to services. |
| This is hard-wired in the FortressServiceImpl policy--> |
| <role name="fortress-rest-super-user" description="This role is accepted by all of the Fortress Rest services"/> |
| |
| <!-- Users assigned to the fortress-power-user role will gain access to all services. |
| This is via inheritance relationship with all of the other service roles--> |
| <role name="fortress-rest-power-user" description="This role inherits all of the other Fortress Rest services roles"/> |
| <role name="fortress-rest-access-user" description="This role gains access to the Fortress Rest Access Mgr services"/> |
| <role name="fortress-rest-admin-user" description="This role gains access to the Fortress Rest Admin Mgr services"/> |
| <role name="fortress-rest-review-user" description="This role gains access to the Fortress Rest Delegated Access services"/> |
| <role name="fortress-rest-delaccess-user" description="This role gains access to the Fortress Rest Delegatged Admin services"/> |
| <role name="fortress-rest-deladmin-user" description="This role gains access to the Fortress Rest Delegated Admin services"/> |
| <role name="fortress-rest-delreview-user" description="This role gains access to the Fortress Rest Delegated Review services"/> |
| <role name="fortress-rest-pwmgr-user" description="This role gains access to the Fortress Rest Password Policy Mgr services"/> |
| <role name="fortress-rest-audit-user" description="This role gains access to the Fortress Rest Audit Mgr services"/> |
| <role name="fortress-rest-config-user" description="This role gains access to the Fortress Rest Config Mgr services"/> |
| </addrole> |
| |
| <addroleinheritance> |
| <!-- Users assigned fortress-rest-power-user role will inherit each of the following roles. --> |
| <relationship child="fortress-rest-power-user" parent="fortress-rest-user"/> |
| <relationship child="fortress-rest-power-user" parent="fortress-rest-access-user"/> |
| <relationship child="fortress-rest-power-user" parent="fortress-rest-admin-user"/> |
| <relationship child="fortress-rest-power-user" parent="fortress-rest-review-user"/> |
| <relationship child="fortress-rest-power-user" parent="fortress-rest-delaccess-user"/> |
| <relationship child="fortress-rest-power-user" parent="fortress-rest-deladmin-user"/> |
| <relationship child="fortress-rest-power-user" parent="fortress-rest-delreview-user"/> |
| <relationship child="fortress-rest-power-user" parent="fortress-rest-pwmgr-user"/> |
| <relationship child="fortress-rest-power-user" parent="fortress-rest-audit-user"/> |
| <relationship child="fortress-rest-power-user" parent="fortress-rest-config-user"/> |
| </addroleinheritance> |
| |
| <!-- Begin ARBAC Delegated Admin Data: --> |
| <addorgunit> |
| <orgunit name="demousrs1" typeName="USER" description="Test User Org 1 for User on Tomcat Calendar App"/> |
| </addorgunit> |
| |
| </FortressAdmin> |
| </target> |
| </project> |