Repository navigation
Add optional PAP change listener configurable via JNDI - #75
Open
mikfaretta wants to merge 1 commit into
Open
mikfaretta wants to merge 1 commit into
mikfaretta wants to merge 1 commit into
Conversation
Notify listeners after successful policy/version changes, PDP and attribute-provider configuration updates, and domain deletion. Support external listener implementations without new dependencies or changes to PDP evaluation and policy persistence. Add configuration documentation and unit/integration tests.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #74 .
Adds an optional server-level PAP change listener, following the
maintainers' feedback on hook locations and listener configuration.
Changes
deletions, PDP configuration changes (including root-policy changes),
attribute-provider configuration changes, and domain deletion.
PolicyVersionResourceImpl, passing the listener through
DomainsResourceImpl.
configured through the JNDI property
org.ow2.authzforce.rest.service.PapChangeListener.class.
The listener is optional and disabled by default. No new library
dependencies or changes to PDP evaluation or policy persistence
are introduced.
Callback semantics and scope
Callbacks run synchronously after successful PAP operations.
Listener RuntimeExceptions are logged without changing the successful
outcome of the PAP operation.
Notifications are best effort: they are not atomic with policy
persistence and do not provide durable delivery or ordering guarantees.
Direct filesystem changes are not covered.
Broker integration, persistent event queues, asynchronous publishing
and consumer reconciliation remain outside this PR.
Validation
Validation was performed before cherry-picking onto the latest develop:
coverage and listener configuration tests.
The three failures occurred in the addDomain tests of:
These failures were reproduced on the unmodified baseline in the
Windows environment. Logs showed HTTP 404 responses and invalid
Windows file URI handling during JSON schema initialization.
Validation used offline Maven dependencies. The online dependency
vulnerability check was skipped.
The cherry-pick conflict in dist/src/webapp-context.xml was resolved
by retaining develop's removal of the duplicate
xacmlJsonSchemaRelativePath property and preserving the new listener
configuration. The test suite has not been rerun after this resolution.