source: TI12-security/trunk/NDGSecurity/python/ndg_security_common/ndg/security/common/authz/xacml/policy.py @ 6734

"""NDG Security Policy type definition

NERC DataGrid Project
"""
__author__ = "P J Kershaw"
__date__ = "24/02/10"
__copyright__ = "(C) 2010 Science and Technology Facilities Council"
__contact__ = "Philip.Kershaw@stfc.ac.uk"
__license__ = "BSD - see LICENSE file in top-level directory"
__contact__ = "Philip.Kershaw@stfc.ac.uk"
__revision__ = "$Id: $"
from ndg.security.common.utils import TypedList
from ndg.security.common.authz.xacml import PolicyComponent
from ndg.security.common.authz.xacml.target import Target
from ndg.security.common.authz.xacml.rule import Rule
from ndg.security.common.authz.xacml.obligation import Obligation


class PolicyParseError(Exception):
    """Error reading policy attributes from file"""


class InvalidPolicyXmlNsError(PolicyParseError):
    """Invalid XML namespace for policy document"""

'''    
    <xs:complexType name="PolicyType">
        <xs:sequence>
            <xs:element ref="xacml:Description" minOccurs="0"/>
            <xs:element ref="xacml:PolicyDefaults" minOccurs="0"/>
            <xs:element ref="xacml:CombinerParameters" minOccurs="0"/>
            <xs:element ref="xacml:Target"/>
            <xs:choice maxOccurs="unbounded">
                <xs:element ref="xacml:CombinerParameters" minOccurs="0"/>
                <xs:element ref="xacml:RuleCombinerParameters" minOccurs="0"/>
                <xs:element ref="xacml:VariableDefinition"/>
                <xs:element ref="xacml:Rule"/>
            </xs:choice>
            <xs:element ref="xacml:Obligations" minOccurs="0"/>
        </xs:sequence>
        <xs:attribute name="PolicyId" type="xs:anyURI" use="required"/>
        <xs:attribute name="Version" type="xacml:VersionType" default="1.0"/>
        <xs:attribute name="RuleCombiningAlgId" type="xs:anyURI" use="required"/>
    </xs:complexType> 
''' 

class Policy(PolicyComponent):
    """NDG MSI Policy.""" 
    DEFAULT_XACML_VERSION = "1.0"
    ELEMENT_LOCAL_NAME = "Policy"
    POLICY_ID_ATTRIB_NAME = "PolicyId"
    RULE_COMBINING_ALG_ID_ATTRIB_NAME = "RuleCombiningAlgId"
    VERSION_ATTRIB_NAME = "Version"

    DESCRIPTION_LOCAL_NAME = "Description"
    POLICY_DEFAULTS_LOCAL_NAME = "PolicyDefaults"
    COMBINER_PARAMETERS_LOCAL_NAME = "CombinerParameters"
    RULE_COMBINER_PARAMETERS_LOCAL_NAME = "RuleCombinerParameters"
    OBLIGATIONS_LOCAL_NAME = "Obligations"
    
    # Plan to support permit overrides in a future release
    RULE_COMBINING_ALG_IDS = (
#    "urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:permit-overrides",
    "urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides",
    )
    __slots__ = (
        '__policyId',
        '__version',
        '__ruleCombiningAlgId',
        '__description',
        '__policyDefaults',
        '__target',
        '__attr',
        '__obligations'
    )
    
    def __init__(self):
        super(Policy, self).__init__()
        self.__policyId = None
        self.__version = None
        self.__ruleCombiningAlgId = None
        self.__description = None
        self.__target = None
        
        # Attr should eventually allow a choice of Rule, CombinerParameter, 
        # RuleCombinerParameter and VariableDefinition but only Rule type is 
        # currently supported
        self.__attr = TypedList(Rule)
        
        self.__obligations = TypedList(Obligation)

    def _getPolicyId(self):
        return self.__policyId

    def _setPolicyId(self, value):
        if not isinstance(value, basestring):
            raise TypeError('Expecting string type for "policyId" '
                            'attribute; got %r' % type(value))
            
        self.__policyId = value

    policyId = property(_getPolicyId, _setPolicyId, None, "Policy Id")

    def _getVersion(self):
        return self.__version

    def _setVersion(self, value):
        if not isinstance(value, basestring):
            raise TypeError('Expecting string type for "version" '
                            'attribute; got %r' % type(value))
            
        self.__version = value

    version = property(_getVersion, _setVersion, None, "Policy Version")

    def _getRuleCombiningAlgId(self):
        return self.__ruleCombiningAlgId

    def _setRuleCombiningAlgId(self, value):
        if not isinstance(value, basestring):
            raise TypeError('Expecting string type for "ruleCombiningAlgId" '
                            'attribute; got %r' % type(value))
            
        if value not in Policy.RULE_COMBINING_ALG_IDS:
            raise AttributeError('%r rule combining algorithm is invalid.  '
                                 'Only these algorithms are currently '
                                 'supported %r' % 
                                 (value, Policy.RULE_COMBINING_ALG_IDS))
        self.__ruleCombiningAlgId = value

    ruleCombiningAlgId = property(_getRuleCombiningAlgId, 
                                  _setRuleCombiningAlgId, None, 
                                  doc="Rule Combining Algorithm Id")


    @property
    def combinerParameters(self):
        raise NotImplementedError()
    
    @property
    def ruleCombinerParameters(self):
        raise NotImplementedError()
    
    @property
    def variableDefinitions(self):
        raise NotImplementedError()
    
    @property
    def rules(self):
        return self.__attr
    
    @property
    def obligations(self):
        return self.__obligations 

    def _getTarget(self):
        return self.__target

    def _setTarget(self, value):
        if not isinstance(value, Target):
            raise TypeError('Expecting Target for "target" '
                            'attribute; got %r' % type(value))
        self.__target = value

    target = property(_getTarget, _setTarget, doc="list of Policy targets")

    def _getDescription(self):
        return self.__description

    def _setDescription(self, value):
        if not isinstance(value, basestring):
            raise TypeError('Expecting string type for "description" '
                            'attribute; got %r' % type(value))
        self.__description = value

    description = property(_getDescription, _setDescription, 
                           doc="Policy Description text")
   
    def parse(self):
        """Parse the policy file set in policyFilePath attribute
        """
        elem = ElementTree.parse(self.policyFilePath)
        root = elem.getroot()
        
        self.xmlns = QName.getNs(root.tag)
        if not self.isValidXmlns:
            raise InvalidPolicyXmlNsError("Namespace %r is recognised; valid "
                                          "namespaces are: %r" %
                                          (self.xmlns, Policy.XMLNS))
            
        for elem in root:
            localName = QName.getLocalPart(elem.tag)
            if localName == Policy.DESCRIPTION_LOCALNAME:
                self.description = elem.text.strip()
                
            elif localName == Policy.TARGET_LOCALNAME:
                self.targets.append(Target.Parse(elem))
                
            else:
                raise PolicyParseError("Invalid policy attribute: %s" % 
                                        localName)
                
    @classmethod
    def Parse(cls, policyFilePath):
        policy = cls(policyFilePath=policyFilePath)
        policy.parse()
        return policy