ws-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Daniel Kulp (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (NEETHI-15) Problem in policy intersection caused by error in PolicyIntersector.compatiblePolicies method
Date Fri, 27 Sep 2013 19:23:02 GMT

    [ https://issues.apache.org/jira/browse/NEETHI-15?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13780285#comment-13780285
] 

Daniel Kulp commented on NEETHI-15:
-----------------------------------

intersect1.xml and intersect2.xml have no relation to the inputPolicy as far as I can tell.
  

With your change, I get:

{code:xml}
<wsp:Policy xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
	<wsp:ExactlyOne>
		<wsp:All>
			<sp:SignedParts>
         		<sp:Body/>
         		<sp:Header Namespace="http://schemas.xmlsoap.org/ws/2004/08/addressing"/>
       		</sp:SignedParts>
       		<sp:EncryptedParts>
         		<sp:Body/>
       		</sp:EncryptedParts>
       		<sp:SignedParts/>
       		<sp:EncryptedParts>
         		<sp:Body/>
       		</sp:EncryptedParts>
      	</wsp:All>
    </wsp:ExactlyOne>
</wsp:Policy>
{code}

Is that what you are expecting?
                
> Problem in policy intersection caused by error in PolicyIntersector.compatiblePolicies
method
> ---------------------------------------------------------------------------------------------
>
>                 Key: NEETHI-15
>                 URL: https://issues.apache.org/jira/browse/NEETHI-15
>             Project: Neethi
>          Issue Type: Bug
>    Affects Versions: 3.0.2
>            Reporter: Jörn Schneider
>              Labels: patch
>         Attachments: inputPolicy1.xml, inputPolicy2.xml, intersect1.xml, intersect2.xml
>
>
> Playing around with policy intersection I recognized an unexpected result of getting
an empty policy back even though the two intersected policies do have a common compatible
policy assertion alternative. 
> As examples I was using the first example from chapter 4.5 Policy Intersection http://www.w3.org/TR/ws-policy/#Policy_Intersection.

> Using Neethi the intersected policy returned an empty policy as result even though Alternative
A2 from input Policy P1 and Alternative A3 from input Policy P2 are compatible alternatives.
> What I did was reading the policies from XML file (policies attached) and just intersecting
them:
> Policy inputPolicy1 = readPolicy("inputPolicy1.xml");
> Policy inputPolicy2 = readPolicy("inputPolicy2.xml");
> Policy intersectionP1_P2 = inputPolicy1.intersect(inputPolicy2, false);    
>  
> I also recognized that changing order while intersecting the policies returned the expected
result:
> Policy intersectionP2_P1 = inputPolicy2.intersect(inputPolicy1, false);
> The difference was caused by the result of 'compatiblePolicies' method call used in line
189 of method PolicyIntersector.intersect. The call compatiblePolicies(inputPolicy1, inputPolicy2)
is returning false the reversed call compatiblePolicies(inputPolicy2, inputPolicy1) returns
true.
> In addition I also tried the intersection example from the following web page
> http://www.ibm.com/developerworks/webservices/tutorials/ws-understand-web-services5/section5.html
> I also attached intersect1.xml and intersect2.xml for convenience.
> Here always an empty policy was returned by the intersection call independent of the
order the incoming policies were used. A closer look to the implementation of
> method 'PolicyIntersector.compatiblePolicies' revealed the reason.
> The return false; statement on line 178 in the outer while loop:
>     public boolean compatiblePolicies(Policy p1, Policy p2) {       
>         Iterator<List<Assertion>> i1 = p1.getAlternatives();
>         while (i1.hasNext()) {
>             List<Assertion> alt1 = i1.next();
>             Iterator<List<Assertion>> i2 = p2.getAlternatives();
>             if (!i2.hasNext() && alt1.isEmpty()) {
>                 return true;
>             }
>             while (i2.hasNext()) {                
>                 List<Assertion> alt2 = i2.next();
>                 if (compatibleAlternatives(alt1, alt2)) {
>                     return true;                    
>                 }
>             }             
>             return false;
>         }        
>         return true;
>     }
>  
> The 'return false;' statement inside the outer while loop has the effect that only the
first alternative of Policy p1 is evaluated against all alternatives from Policy p2.
>  
> My correction proposal is to remove the return statement on line 178 and change the return
statement on line 180 to return false instead of true. With this changes 'compatiblePolicies'
should return true only if compatible alternatives are found in p1 and p2 and false otherwise.
>     public boolean compatiblePolicies(Policy p1, Policy p2) {       
>         Iterator<List<Assertion>> i1 = p1.getAlternatives();
>         while (i1.hasNext()) {
>             List<Assertion> alt1 = i1.next();
>             Iterator<List<Assertion>> i2 = p2.getAlternatives();
>             if (!i2.hasNext() && alt1.isEmpty()) {
>                 return true;
>             }
>             while (i2.hasNext()) {                
>                 List<Assertion> alt2 = i2.next();
>                 if (compatibleAlternatives(alt1, alt2)) {
>                     return true;                    
>                 }
>             }             
>         }        
>         return false;
>     }

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org


Mime
View raw message