public class SigningPolicyParser extends Object
eacl ::= {eacl_entry}
eacl_entry ::= {access_identity} pos_rights {restriction}
{pos_rights {restriction}} | {access_identity} neg_rights
access_identity ::= access_identity_type def_authority value
access_identity_type ::= "access_id_HOST" | "access_id_USER" |
"access_id_GROUP" | "access_id_CA" | "access_id_APPLICATION" |
"access_id_ANYBODY"
pos_rights ::= "pos_rights" def_authority value
{"pos_rights" def_authority value}
neg_rights ::= "neg_rights" def_authority value
{"neg_rights" def_authority value}
restriction ::= condition_type def_authority value
condition_type ::= alphanumeric_string
def_authority ::= alphanumeric_string
value ::= alphanumeric_string
This class take a signing policy file as input and parses it to extract the policy that is enforced. Only the following policy is enforced: access_id_CA with defining authority as X509 with CA DN as value. Any positive rights following it with globus as defining authority and value CA:sign. Lastly, restriction "cond_subjects" with globus as defining authority and the DNs the CA is authorized to sign. restrictions are assumed to start with cond_. Order of rights matter, so the first occurance of CA:Sign with allowedDNs is used and rest of the policy is ignored.
For a given signing policy file, only policy with the particular CA's DN is parsed.
subject names may include the following wildcard characters: * Matches zero or any number of characters. ? Matches any single character.
All subject names should be in Globus format, with slashes and should NOT be revered.
The allowed DN patterns are returned as a vector of java.util.regexp.Pattern. The BCNF grammar that uses wildcard (*) and single character (?) are replaced with the regexp grammar needed by the Pattern class.
Modifier and Type | Field and Description |
---|---|
static String |
ACCESS_ID_CA |
static String |
ACCESS_ID_PREFIX |
static String |
CONDITION_PREFIX |
static String |
CONDITION_SUBJECT |
static String |
DEF_AUTH_GLOBUS |
static String |
DEF_AUTH_X509 |
static String |
NEG_RIGHTS |
static String |
POS_RIGHTS |
static String |
SINGLE_CHAR |
static String |
SINGLE_PATTERN |
static String |
VALUE_CA_SIGN |
static String |
WILDCARD |
static String |
WILDCARD_PATTERN |
Constructor and Description |
---|
SigningPolicyParser() |
Modifier and Type | Method and Description |
---|---|
static Pattern |
getPattern(String patternStr)
Method that takes a pattern string as described in the signing policy
file with * for zero or many characters and ? for single character, and
converts it into java.util.regexp.Pattern object.
|
Map<X500Principal,SigningPolicy> |
parse(Reader reader)
Parses input stream to extract signing policy defined for CA with the
specified DN.
|
Map<X500Principal,SigningPolicy> |
parse(String fileName)
Parses the file to extract signing policy defined for CA with the
specified DN.
|
public static final String ACCESS_ID_PREFIX
public static final String ACCESS_ID_CA
public static final String DEF_AUTH_X509
public static final String DEF_AUTH_GLOBUS
public static final String POS_RIGHTS
public static final String NEG_RIGHTS
public static final String CONDITION_PREFIX
public static final String CONDITION_SUBJECT
public static final String VALUE_CA_SIGN
public static final String SINGLE_CHAR
public static final String WILDCARD
public static final String SINGLE_PATTERN
public static final String WILDCARD_PATTERN
public Map<X500Principal,SigningPolicy> parse(String fileName) throws FileNotFoundException, SigningPolicyException
fileName
- Name of the signing policy fileSigningPolicyException
- Any errors with parsing the signing policy file.FileNotFoundException
- If the signing policy file does not exist.public Map<X500Principal,SigningPolicy> parse(Reader reader) throws SigningPolicyException
reader
- Reader to any input stream to get the signing policy
information.SigningPolicyException
- Any errors with parsing the signing policy.public static Pattern getPattern(String patternStr)
patternStr
- Pattern string as described in the signing policy file
with for zero or many characters and ? for single
characterCopyright © 2017. All rights reserved.