/*
 * Copyright (c) Members of the EGEE Collaboration. 2012.
 * See http://www.eu-egee.org/partners/ for details on the copyright holders.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 * $Id$
 */
package demo;

import org.glite.authz.common.model.Action;
import org.glite.authz.common.model.Request;
import org.glite.authz.common.model.Resource;
import org.glite.authz.common.model.Response;
import org.glite.authz.common.model.Result;
import org.glite.authz.common.model.Subject;
import org.glite.authz.pep.client.PEPClient;
import org.glite.authz.pep.client.PEPClientException;
import org.glite.authz.pep.client.config.PEPClientConfiguration;
import org.glite.authz.pep.client.config.PEPClientConfigurationException;
import org.glite.authz.pep.profile.AuthorizationProfile;
import org.glite.authz.pep.profile.CommonXACMLAuthorizationProfile;

/**
 * ArgusPEPClient
 * <p>
 * Example using the EMI Common XACML Authorization Profile:
 * https://twiki.cern.ch/twiki/bin/view/EMI/CommonXACMLProfileV1_1
 * <p>
 * The XACML Subject, identifying the user, contains only the user DN.
 * <p>
 * 
 * @author Valery Tschopp &lt;valery.tschopp&#64;switch.ch&gt;
 */
public class ArgusPEPClient_EMI {

    /**
     * @param args
     */
    public static void main(String[] args) {

        // //////////////////////////////////
        // Argus PEP daemon endpoint
        String endpoint= "https://chaos.switch.ch:8154/authz";

        // //////////////////////////////////
        // trust and key material for the HTTPS/TLS communication
        // with the Argus PEP daemon
        String cadirname= "/etc/grid-security/certificates";
        String hostcert= "/etc/grid-security/hostcert.pem";
        String hostkey= "/etc/grid-security/hostkey.pem";
        String keypasswd= "MANDATORY_random_string_if_key_not_encrypted";

        // //////////////////////////////////
        // create PEP client config
        PEPClientConfiguration config= new PEPClientConfiguration();

        try {
            // set the PEP Server endpoint
            config.addPEPDaemonEndpoint(endpoint);
            // set the trust material (IGTF bundle)
            config.setTrustMaterial(cadirname);

            // set the key material (HTTPS client authentication)
            config.setKeyMaterial(hostcert, hostkey, keypasswd);

        } catch (PEPClientConfigurationException e) {
            System.err.println(e.getMessage());
            e.printStackTrace();
            System.exit(1);
        }

        // //////////////////////////////////
        // create the PEP client
        PEPClient pep= null;
        try {
            pep= new PEPClient(config);
        } catch (PEPClientException e) {
            System.err.println(e.getMessage());
            e.printStackTrace();
            System.exit(2);
        }

        // /////////////////////////////////
        // EMI example (NO USER MAPPING) //
        // get the correct XACML profile to construct the XACML request
        // (factory)
        AuthorizationProfile profile= CommonXACMLAuthorizationProfile.getInstance();

        // create a XACML Subject with a subject-id attribute (X500Name format)
        String subjectId= "CN=Valery Tschopp,O=SWITCH,C=ch";
        Subject subject= profile.createSubjectId(subjectId);

        // create a XACML resource
        String resourceId= "test-emi";
        Resource resource= profile.createResourceId(resourceId);

        // create a XACML action
        String actionId= "test";
        Action action= profile.createActionId(actionId);

        // create a XACML request
        Request request= profile.createRequest(subject, resource, action);

        System.out.println("---Request---");
        System.out.println(request);

        // //////////////////////////////////
        // submit the authorization request

        Response response= null;
        try {
            response= pep.authorize(request);
        } catch (PEPClientException e) {
            System.err.println(e.getMessage());
            e.printStackTrace();
            System.exit(5);
        }

        System.out.println("---Response---");
        System.out.println(response);

        // //////////////////////////////////
        // check the response result and status
        for (Result result : response.getResults()) {
            System.out.println("---Decision---");
            System.out.println(result.getDecisionString());
            int decision= result.getDecision();
            if (decision != Result.DECISION_PERMIT) {
                System.out.println("ENFORCE AUTHZ: User SHALL be denied access!!!!");
            }
        }

        System.out.println("------");

    }

}