Uploaded image for project: 'PicketBox '
  1. PicketBox
  2. SECURITY-561

JBossResponseContext getResult strips multiple obligations from the evaluation response.

    XMLWordPrintable

Details

    • Hide

      Create a policy that results in multiple obligations getting applied. Upon receiving the response, view the obligations, only the last evaluated obligation will remain.

      Show
      Create a policy that results in multiple obligations getting applied. Upon receiving the response, view the obligations, only the last evaluated obligation will remain.
    • Low

    Description

      The getResult() method in JBossResponseContext prevents multiple Obligations from getting returned to the PEP. The code block:
      //Obligations
      Set<Obligation> obligationsSet = result.getObligations();
      if(obligationsSet != null)
      {
      for(Obligation obl:obligationsSet)

      { ObligationType obType = new ObligationType(); obType.setObligationId(obl.getId().toASCIIString()); obType.setFulfillOn(EffectType.fromValue(Result.DECISIONS[obl.getFulfillOn()])); ObligationsType obligationsType = new ObligationsType(); obligationsType.getObligation().add(obType); resultType.setObligations(obligationsType); }

      }

      Causes the obligations to constantly get overwritten with the last one read in.
      --> resultType.setObligations(obligationsType)

      To fix, do something more like:
      // Obligations
      Set<Obligation> obligationsSet = result.getObligations();
      if (obligationsSet != null && obligationsSet.size() > 0) {
      ObligationsType obligationsType = new ObligationsType();
      for (Obligation obl : obligationsSet)

      { ObligationType obType = new ObligationType(); obType.setObligationId(obl.getId().toASCIIString()); obType.setFulfillOn(EffectType.fromValue(Result.DECISIONS[obl.getFulfillOn()])); obligationsType.getObligation().add(obType); }


      resultType.setObligations(obligationsType);
      }

      Attachments

        Activity

          People

            anil.saldhana Anil Saldanha (Inactive)
            bkrisler_jira Brian Krisler (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: