@@ -4,6 +4,40 @@ All notable changes to this project are documented in this file following the [K
Issues reported on [GitHub](https://github.com/authzforce/server/issues) are referenced in the form of `[GH-N]`, where N is the issue number. Issues reported on [OW2](https://jira.ow2.org/browse/AUTHZFORCE/) are mentioned in the form of `[OW2-N]`, where N is the issue number.
## 10.0.0
### Changed
- Upgraded AuthzForce Parent: 8.0.0:
- Upgraded to Java 11 support (Java 8 no longer supported)
- Upgraded dependencies:
- authzforce-ce-rest-api-model: 6.0.0
- authzforce-ce-jaxrs-utils: 2.0.1
- authzforce-ce-core-pdp-engine: 17.1.0
- authzforce-ce-core-pdp-io-xacml-json: 17.1.0
- authzforce-ce-core-pap-api: 11.0.0
- authzforce-ce-pap-dao-flat-file: 13.0.0
- authzforce-ce-core-pdp-api: 18.0.1
- authzforce-ce-xacml-json-model: 3.0.2
- Jakarta RESTful Web Services: 2.1.6
- JAXB (Jakarta XML Binding): 2.3.3
- Apache CXF v3.4.1
- Spring Boot Starter 2.3.5
- Spring Core: 5.2.10
- jettison: 1.4.1
- org.json:json: v20190722
- org.everit.json.schema: 1.12.1
- SLF4J API: 1.7.30
### Added
- GH-61: JSON Object support in XACML/JSON Requests/Responses (as defined by JSON Profile of XACML), allowing custom XACML datatypes with JSON object structures.
- Support for validation of XACML/JSON requests (JSON Profile) with custom JSON schema stored in configuration directory, using new webapp environment property (e.g. specified in Tomcat webapp context) `org.ow2.authzforce.domains.xacmlJsonSchemaRelativePath` to be specified in `/etc/tomcat9/<Engine>/<Host>/authzforce-ce.xml` (more info in [webapp-context.xml](dist/src/webapp-context.xml) )
### Fixed
- GH-62: duplicate declaration of namespace prefix now allowed
- CVE on jackson-databind -> v2.9.10.8
- CVE-2018-8088 affecting slf4j
## 9.0.1
### Fixed
- Tomcat startup error after Debian package install
...
...
@@ -31,7 +65,7 @@ Issues reported on [GitHub](https://github.com/authzforce/server/issues) are ref
- authzforce-ce-pap-dao-flat-file: 12.0.0
### Fixed
-#46: bad PolicySets pushed to the /pap/policies endpoint are still saved on server side even if a HTTP 400 Bad Request is returned.
-GH-46: bad PolicySets pushed to the /pap/policies endpoint are still saved on server side even if a HTTP 400 Bad Request is returned.
- Issues with XACML/JSON responses (XACML JSON Profile)
@@ -67,6 +67,7 @@ applications, AuthzForce also provides a PDP engine as a Java library in
validation;
- DoS mitigation: JSON parser variant checking max JSON string size,
max number of JSON keys/array items and max JSON object depth.
-[GeoXACML 1.0.1](http://portal.opengeospatial.org/files/?artifact_id=42734). Supported as third-party extension from [Secure Dimensions](https://github.com/securedimensions/authzforce-geoxacml-basic)
- Experimental support for:
-[XACML Data Loss Prevention / Network Access Control (DLP/NAC) Profile Version 1.0](http://docs.oasis-open.org/xacml/xacml-3.0-dlp-nac/v1.0/xacml-3.0-dlp-nac-v1.0.html):
only `dnsName-value` datatype and `dnsName-value-equal` function are
...
...
@@ -147,10 +148,10 @@ More information in the previous section.
- Conformance with
[REST Profile of XACML v3.0 Version 1.0](http://docs.oasis-open.org/xacml/xacml-rest/v1.0/xacml-rest-v1.0.html)
- Supported data formats, aka content types:
-`application/xml`: XML based on API schema;
-`application/fastinfoset`: [Fast Infoset](http://www.itu.int/en/ITU-T/asn1/Pages/Fast-Infoset.aspx) based on API's XML schema;
-`application/json`: JSON based on API's XMLschema with a generic XML-to-JSON mapping convention
-`application/xacml+xml`: XACML content only, as defined by [RFC 7061](https://tools.ietf.org/html/rfc7061)
-`application/xml`: XML based on API schema;
-`application/fastinfoset`: [Fast Infoset](http://www.itu.int/en/ITU-T/asn1/Pages/Fast-Infoset.aspx) based on API's XML schema;
-`application/json`: JSON based on API's XMLschema with a generic XML-to-JSON mapping convention
-`application/xacml+xml`: XACML content only, as defined by [RFC 7061](https://tools.ietf.org/html/rfc7061)
-`application/xacml+json`: JSON format for XACML Request/Response on PDP only, as defined by [XACML v3.0 - JSON Profile Version 1.0](http://docs.oasis-open.org/xacml/xacml-json-http/v1.0/xacml-json-http-v1.0.html)
- Defined in standard
[Web Application Description Language and XML schema](https://github.com/authzforce/rest-api-model/tree/develop/src/main/resources)
...
...
@@ -249,7 +250,7 @@ forwards the request to the web service implementation if the decision is
Permit, else rejects it. For more information, see the Javadoc of
This image of a minimal AuthzForce Server runtime is intended to work together with [Identity Manager - Keyrock](http://catalogue.fiware.org/enablers/identity-management-keyrock) and [PEP Proxy Wilma](http://catalogue.fiware.org/enablers/pep-proxy-wilma) generic enabler.
## Image contents
- OpenJDK JRE 8;
- Tomcat 9;
- AuthzForce Server CE (version matching the Docker image tag).
## Usage
This image gives you a minimal installation for testing purposes. The AuthzForce Installation and Administration guide on [readthedocs.org](https://readthedocs.org/projects/authzforce-ce-fiware/versions/)(select the version matching the Docker image tag, then **AuthzForce - Installation and Administration Guide**) provides you a better approach for using it in a production environment. This installation guide also gives instructions to install from .deb package (instead of Docker), which is the recommended way for Ubuntu hosts.
Create a container using `authzforce/server` image by doing (replace the first *8080* after *-p* with whatever network port you want to use on the host to access the AuthzForce Server, e.g. 80; and *release-9.0.0* with the current Docker image tag that you are using):
```
docker run -d -p 8080:8080 --name <container-name> fiware/authzforce-ce-server:release-9.0.0
```
As stands in the AuthzForce Installation and administration guide on [readthedocs.org](https://readthedocs.org/projects/authzforce-ce-fiware/versions/)(select the version matching the Docker image tag, then **AuthzForce - Installation and Administration Guide**) you can:
***User and Role Management Setup && Domain Role Assignment**
These tasks are now delegated to the [Identity Manager - Keyrock](http://catalogue.fiware.org/enablers/identity-management-keyrock) enabler. Here you can find how to use the interface for that purpose: [How to manage AuthzForce in Fiware](https://www.fiware.org/devguides/handling-authorization-and-access-control-to-apis/how-to-manage-access-control-in-fiware/).
## User feedback
### Documentation
All the information regarding the Dockerfile is hosted publicly on [Github](https://github.com/authzforce/server/tree/master/src/docker).
### Issues
If you find any issue with this image, feel free to report at [Github issue tracking system](https://github.com/authzforce/server/issues).
## AuthzForce Server CE - Minimal Docker image
This image of a minimal AuthzForce Server runtime is intended to work together with [Identity Manager - Keyrock](http://catalogue.fiware.org/enablers/identity-management-keyrock) and [PEP Proxy Wilma](http://catalogue.fiware.org/enablers/pep-proxy-wilma) generic enabler.
## Image contents
- OpenJDK JRE 8;
- Tomcat 9 (since AuthzForce Server v9.0.1, else Tomcat 8 for older versions);
- AuthzForce Server CE (version matching the Docker image tag).
## Usage
This image gives you a minimal installation for testing purposes. The AuthzForce Installation and Administration guide on [readthedocs.org](https://readthedocs.org/projects/authzforce-ce-fiware/versions/)(select the version matching the Docker image tag, then **AuthzForce - Installation and Administration Guide**) provides you a better approach for using it in a production environment. This installation guide also gives instructions to install from .deb package (instead of Docker), which is the recommended way for Ubuntu hosts.
Create a container using `authzforce/server` image by doing (replace the first *8080* after *-p* with whatever network port you want to use on the host to access the AuthzForce Server, e.g. 80; and *release-9.0.1* with the current Docker image tag that you are using):
```
docker run -d -p 8080:8080 --name <container-name> authzforce/server:release-9.0.1
```
As stands in the AuthzForce Installation and administration guide on [readthedocs.org](https://readthedocs.org/projects/authzforce-ce-fiware/versions/)(select the version matching the Docker image tag, then **AuthzForce - Installation and Administration Guide**) you can:
***User and Role Management Setup && Domain Role Assignment**
These tasks are now delegated to the [Identity Manager - Keyrock](http://catalogue.fiware.org/enablers/identity-management-keyrock) enabler. Here you can find how to use the interface for that purpose: [How to manage AuthzForce in Fiware](https://www.fiware.org/devguides/handling-authorization-and-access-control-to-apis/how-to-manage-access-control-in-fiware/).
## User feedback
### Documentation
All the information regarding the Dockerfile is hosted publicly on [Github](https://github.com/authzforce/server/tree/master/src/docker).
### Issues
If you find any issue with this image, feel free to report at [Github issue tracking system](https://github.com/authzforce/server/issues).
description="Path to JSON schema file for XACML JSON Profile's Request validation, relative to ${org.ow2.authzforce.config.dir} (if undefined/empty value, the Request.schema.json file from authzforce-ce-xacml-json-model project is used by default)"/>
<!-- <Environment name="org.ow2.authzforce.webapp.publishedEndpointUrl" value="http://localhost:8080" type="java.lang.String" override="false" description="Base address specified in the auto-generated
WADL. This parameter allows setting the public URL that may not be the same as the URL the service is deployed on. (For example, the service is behind a proxy of some sort)." /> -->
<!-- <Environment name="org.ow2.authzforce.webapp.jsonKeysWithArrays" type="java.lang.String" override="false" description="Comma-separated list of JSON keys with values to be always serialized to JSON
