IIOPRootDefinition.java

/*
 * Copyright The WildFly Authors
 * SPDX-License-Identifier: Apache-2.0
 */

package org.wildfly.iiop.openjdk;

import static org.wildfly.iiop.openjdk.Capabilities.LEGACY_SECURITY;

import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
import java.util.List;

import org.jboss.as.controller.AttributeDefinition;
import org.jboss.as.controller.ModelVersion;
import org.jboss.as.controller.OperationContext;
import org.jboss.as.controller.OperationFailedException;
import org.jboss.as.controller.PersistentResourceDefinition;
import org.jboss.as.controller.PropertiesAttributeDefinition;
import org.jboss.as.controller.ReloadRequiredRemoveStepHandler;
import org.jboss.as.controller.ReloadRequiredWriteAttributeHandler;
import org.jboss.as.controller.SimpleAttributeDefinitionBuilder;
import org.jboss.as.controller.SimpleResourceDefinition;
import org.jboss.as.controller.access.constraint.SensitivityClassification;
import org.jboss.as.controller.access.management.SensitiveTargetAccessConstraintDefinition;
import org.jboss.as.controller.capability.RuntimeCapability;
import org.jboss.as.controller.operations.validation.EnumValidator;
import org.jboss.as.controller.operations.validation.IntRangeValidator;
import org.jboss.as.controller.operations.validation.ParameterValidator;
import org.jboss.as.controller.operations.validation.StringLengthValidator;
import org.jboss.as.controller.registry.AttributeAccess;
import org.jboss.as.controller.registry.ManagementResourceRegistration;
import org.jboss.as.controller.registry.Resource;
import org.jboss.dmr.ModelNode;
import org.jboss.dmr.ModelType;
import org.omg.CORBA.ORB;

/**
 * @author <a href="mailto:tadamski@redhat.com">Tomasz Adamski</a>
 */
class IIOPRootDefinition extends PersistentResourceDefinition {

    static final RuntimeCapability<Void> IIOP_CAPABILITY = RuntimeCapability.Builder.of(Capabilities.IIOP_CAPABILITY, false, ORB.class).build();

    static final ModelNode NONE = new ModelNode("none");

    static final ParameterValidator SSL_CONFIG_VALIDATOR = EnumValidator.create(SSLConfigValue.class);

    static final StringLengthValidator LENGTH_VALIDATOR = new StringLengthValidator(1, Integer.MAX_VALUE, true, false);

    static final SensitivityClassification IIOP_SECURITY = new SensitivityClassification(IIOPExtension.SUBSYSTEM_NAME,
            "iiop-security", false, false, true);

    static final SensitiveTargetAccessConstraintDefinition IIOP_SECURITY_DEF = new SensitiveTargetAccessConstraintDefinition(
            IIOP_SECURITY);

    static final ParameterValidator VALIDATOR = EnumValidator.create(IORTransportConfigValues.class);

    //ORB attributes

    protected static final AttributeDefinition PERSISTENT_SERVER_ID = new SimpleAttributeDefinitionBuilder(
            Constants.ORB_PERSISTENT_SERVER_ID, ModelType.STRING, true).setAttributeGroup(Constants.ORB)
            .setDefaultValue(new ModelNode().set("1")).setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES).build();

    protected static final AttributeDefinition GIOP_VERSION = new SimpleAttributeDefinitionBuilder(Constants.ORB_GIOP_VERSION,
            ModelType.STRING, true).setAttributeGroup(Constants.ORB).setDefaultValue(new ModelNode().set("1.2"))
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES).setAllowExpression(true).build();

    protected static final AttributeDefinition SOCKET_BINDING = new SimpleAttributeDefinitionBuilder(
            Constants.ORB_SOCKET_BINDING, ModelType.STRING, true).setAttributeGroup(Constants.ORB)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .addAccessConstraint(SensitiveTargetAccessConstraintDefinition.SOCKET_BINDING_REF).build();

    protected static final AttributeDefinition SSL_SOCKET_BINDING = new SimpleAttributeDefinitionBuilder(
            Constants.ORB_SSL_SOCKET_BINDING, ModelType.STRING, true).setAttributeGroup(Constants.ORB)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .addAccessConstraint(SensitiveTargetAccessConstraintDefinition.SOCKET_BINDING_REF).build();

    //TCP attributes
    protected static final AttributeDefinition HIGH_WATER_MARK = new SimpleAttributeDefinitionBuilder(
            Constants.TCP_HIGH_WATER_MARK, ModelType.INT, true).setAttributeGroup(Constants.ORB_TCP)
            .setValidator(new IntRangeValidator(0, Integer.MAX_VALUE, true, false))
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES).setAllowExpression(true).build();

    protected static final AttributeDefinition NUMBER_TO_RECLAIM = new SimpleAttributeDefinitionBuilder(
            Constants.TCP_NUMBER_TO_RECLAIM, ModelType.INT, true).setAttributeGroup(Constants.ORB_TCP)
            .setValidator(new IntRangeValidator(0, Integer.MAX_VALUE, true, false))
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES).setAllowExpression(true).build();

    //initializer attributes
    protected static final AttributeDefinition SECURITY = new SimpleAttributeDefinitionBuilder(
            Constants.ORB_INIT_SECURITY, ModelType.STRING, true)
            .setAttributeGroup(Constants.ORB_INIT)
            .setDefaultValue(NONE)
            .setValidator(EnumValidator.create(SecurityAllowedValues.class))
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES).setAllowExpression(true)
            .addAccessConstraint(IIOP_SECURITY_DEF).build();

    protected static final AttributeDefinition AUTHENTICATION_CONTEXT = new SimpleAttributeDefinitionBuilder(
            Constants.ORB_INIT_AUTH_CONTEXT, ModelType.STRING, true)
            .setAttributeGroup(Constants.ORB_INIT)
            .setValidator(LENGTH_VALIDATOR)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setAllowExpression(true)
            .setCapabilityReference(Capabilities.AUTH_CONTEXT_CAPABILITY, IIOP_CAPABILITY)
            .addAccessConstraint(IIOP_SECURITY_DEF).build();

    protected static final AttributeDefinition TRANSACTIONS = new SimpleAttributeDefinitionBuilder(
            Constants.ORB_INIT_TRANSACTIONS, ModelType.STRING, true)
            .setAttributeGroup(Constants.ORB_INIT)
            .setDefaultValue(NONE)
            .setValidator(EnumValidator.create(TransactionsAllowedValues.class))
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES).setAllowExpression(true).build();

    //Naming attributes
    protected static final AttributeDefinition ROOT_CONTEXT = new SimpleAttributeDefinitionBuilder(
            Constants.NAMING_ROOT_CONTEXT, ModelType.STRING, true)
            .setAttributeGroup(Constants.NAMING)
            .setDefaultValue(new ModelNode(Constants.ROOT_CONTEXT_INIT_REF))
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setAllowExpression(true)
            .build();

    protected static final AttributeDefinition EXPORT_CORBALOC = new SimpleAttributeDefinitionBuilder(
            Constants.NAMING_EXPORT_CORBALOC, ModelType.BOOLEAN, true)
            .setAttributeGroup(Constants.NAMING)
            .setDefaultValue(ModelNode.TRUE)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setAllowExpression(true)
            .build();

    //Security attributes
    public static final AttributeDefinition SUPPORT_SSL = new SimpleAttributeDefinitionBuilder(
            Constants.SECURITY_SUPPORT_SSL, ModelType.BOOLEAN, true)
            .setAttributeGroup(Constants.SECURITY)
            .setDefaultValue(ModelNode.FALSE)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setAllowExpression(true)
            .addAccessConstraint(IIOP_SECURITY_DEF)
            .build();

    public static final AttributeDefinition SECURITY_DOMAIN = new SimpleAttributeDefinitionBuilder(
            Constants.SECURITY_SECURITY_DOMAIN, ModelType.STRING, true)
            .setAttributeGroup(Constants.SECURITY)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setValidator(LENGTH_VALIDATOR)
            .addAccessConstraint(SensitiveTargetAccessConstraintDefinition.SECURITY_DOMAIN_REF)
            .addAccessConstraint(IIOP_SECURITY_DEF)
            .setAlternatives(Constants.SERVER_SSL_CONTEXT, Constants.CLIENT_SSL_CONTEXT)
            .setCapabilityReference(Capabilities.LEGACY_SECURITY_DOMAIN_CAPABILITY, IIOP_CAPABILITY)
            .setDeprecated(ModelVersion.create(3))
            .build();

    public static final AttributeDefinition SERVER_SSL_CONTEXT = new SimpleAttributeDefinitionBuilder(
            Constants.SERVER_SSL_CONTEXT, ModelType.STRING, true)
            .setAttributeGroup(Constants.SECURITY)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .addAccessConstraint(IIOP_SECURITY_DEF)
            .setValidator(LENGTH_VALIDATOR)
            .setAlternatives(Constants.SECURITY_SECURITY_DOMAIN)
            .setRequires(Constants.CLIENT_SSL_CONTEXT)
            .setCapabilityReference(Capabilities.SSL_CONTEXT_CAPABILITY, IIOP_CAPABILITY)
            .build();

    public static final AttributeDefinition CLIENT_SSL_CONTEXT = new SimpleAttributeDefinitionBuilder(
            Constants.CLIENT_SSL_CONTEXT, ModelType.STRING, true)
            .setAttributeGroup(Constants.SECURITY)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .addAccessConstraint(IIOP_SECURITY_DEF)
            .setValidator(LENGTH_VALIDATOR)
            .setAlternatives(Constants.SECURITY_SECURITY_DOMAIN)
            .setRequires(Constants.SERVER_SSL_CONTEXT)
            .setCapabilityReference(Capabilities.SSL_CONTEXT_CAPABILITY, IIOP_CAPABILITY)
            .build();

    @Deprecated
    public static final AttributeDefinition ADD_COMPONENT_INTERCEPTOR = new SimpleAttributeDefinitionBuilder(
            Constants.SECURITY_ADD_COMP_VIA_INTERCEPTOR, ModelType.BOOLEAN, true)
            .setDeprecated(IIOPExtension.VERSION_1)
            .setAttributeGroup(Constants.SECURITY)
            .setDefaultValue(ModelNode.TRUE)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setAllowExpression(true)
            .addAccessConstraint(IIOP_SECURITY_DEF)
            .setDeprecated(IIOPExtension.VERSION_1)
            .build();

    @Deprecated
    public static final AttributeDefinition CLIENT_SUPPORTS = new SimpleAttributeDefinitionBuilder(
            Constants.SECURITY_CLIENT_SUPPORTS, ModelType.STRING, true)
            .setDeprecated(IIOPExtension.VERSION_1)
            .setAttributeGroup(Constants.SECURITY)
            .setDefaultValue(new ModelNode().set(SSLConfigValue.MUTUALAUTH.toString()))
            .setValidator(SSL_CONFIG_VALIDATOR)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setAllowExpression(true)
            .addAccessConstraint(IIOP_SECURITY_DEF)
            .setDeprecated(IIOPExtension.VERSION_1)
            .build();

    @Deprecated
    public static final AttributeDefinition CLIENT_REQUIRES = new SimpleAttributeDefinitionBuilder(
            Constants.SECURITY_CLIENT_REQUIRES, ModelType.STRING, true)
            .setDeprecated(IIOPExtension.VERSION_1)
            .setAttributeGroup(Constants.SECURITY)
            .setDefaultValue(new ModelNode().set(SSLConfigValue.NONE.toString()))
            .setValidator(SSL_CONFIG_VALIDATOR)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setAllowExpression(true)
            .addAccessConstraint(IIOP_SECURITY_DEF)
            .setDeprecated(IIOPExtension.VERSION_1)
            .build();

    @Deprecated
    public static final AttributeDefinition SERVER_SUPPORTS = new SimpleAttributeDefinitionBuilder(
            Constants.SECURITY_SERVER_SUPPORTS, ModelType.STRING, true)
            .setDeprecated(IIOPExtension.VERSION_1)
            .setAttributeGroup(Constants.SECURITY)
            .setDefaultValue(new ModelNode().set(SSLConfigValue.MUTUALAUTH.toString()))
            .setValidator(SSL_CONFIG_VALIDATOR)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setAllowExpression(true)
            .addAccessConstraint(IIOP_SECURITY_DEF)
            .setDeprecated(IIOPExtension.VERSION_1)
            .build();

    @Deprecated
    public static final AttributeDefinition SERVER_REQUIRES = new SimpleAttributeDefinitionBuilder(
            Constants.SECURITY_SERVER_REQUIRES, ModelType.STRING, true)
            .setDeprecated(IIOPExtension.VERSION_1)
            .setAttributeGroup(Constants.SECURITY)
            .setDefaultValue(new ModelNode().set(SSLConfigValue.NONE.toString()))
            .setValidator(SSL_CONFIG_VALIDATOR)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setAllowExpression(true)
            .addAccessConstraint(IIOP_SECURITY_DEF)
            .setDeprecated(IIOPExtension.VERSION_1)
            .build();

    public static final AttributeDefinition CLIENT_REQUIRES_SSL = new SimpleAttributeDefinitionBuilder(
            Constants.SECURITY_CLIENT_REQUIRES_SSL, ModelType.BOOLEAN, true)
            .setAttributeGroup(Constants.SECURITY)
            .setDefaultValue(new ModelNode().set(Boolean.FALSE))
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setAllowExpression(true)
            .addAccessConstraint(IIOP_SECURITY_DEF)
            .build();

    public static final AttributeDefinition SERVER_REQUIRES_SSL = new SimpleAttributeDefinitionBuilder(
            Constants.SECURITY_SERVER_REQUIRES_SSL, ModelType.BOOLEAN, true)
            .setAttributeGroup(Constants.SECURITY)
            .setDefaultValue(new ModelNode().set(Boolean.FALSE))
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setAllowExpression(true)
            .addAccessConstraint(IIOP_SECURITY_DEF)
            .build();

    public static final AttributeDefinition INTEROP_IONA = new SimpleAttributeDefinitionBuilder(
            Constants.INTEROP_IONA, ModelType.BOOLEAN, true)
            .setAttributeGroup(Constants.INTEROP)
            .setDefaultValue(ModelNode.FALSE)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setAllowExpression(true)
            .build();


    protected static final PropertiesAttributeDefinition PROPERTIES = new PropertiesAttributeDefinition.Builder(
            Constants.PROPERTIES, true)
            .setAllowExpression(true)
            .setRestartAllServices()
            .build();

    //ior transport config attributes
    @Deprecated
    protected static final AttributeDefinition INTEGRITY = new SimpleAttributeDefinitionBuilder(
            Constants.IOR_TRANSPORT_INTEGRITY, ModelType.STRING, true)
            .setAttributeGroup(Constants.IOR_TRANSPORT_CONFIG)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setValidator(VALIDATOR)
            .setAllowExpression(true)
            .setDeprecated(IIOPExtension.VERSION_1)
            .build();

    @Deprecated
    protected static final AttributeDefinition CONFIDENTIALITY = new SimpleAttributeDefinitionBuilder(
            Constants.IOR_TRANSPORT_CONFIDENTIALITY, ModelType.STRING, true)
            .setAttributeGroup(Constants.IOR_TRANSPORT_CONFIG)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setValidator(VALIDATOR)
            .setAllowExpression(true)
            .setDeprecated(IIOPExtension.VERSION_1)
            .build();

    @Deprecated
    protected static final AttributeDefinition TRUST_IN_TARGET = new SimpleAttributeDefinitionBuilder(
            Constants.IOR_TRANSPORT_TRUST_IN_TARGET, ModelType.STRING, true)
            .setAttributeGroup(Constants.IOR_TRANSPORT_CONFIG)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setValidator(new EnumValidator<>(IORTransportConfigValues.class,
                    IORTransportConfigValues.NONE, IORTransportConfigValues.SUPPORTED))
            .setAllowExpression(true)
            .setDeprecated(IIOPExtension.VERSION_1)
            .build();

    @Deprecated
    protected static final AttributeDefinition TRUST_IN_CLIENT = new SimpleAttributeDefinitionBuilder(
            Constants.IOR_TRANSPORT_TRUST_IN_CLIENT, ModelType.STRING, true)
            .setAttributeGroup(Constants.IOR_TRANSPORT_CONFIG)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setValidator(VALIDATOR)
            .setAllowExpression(true)
            .setDeprecated(IIOPExtension.VERSION_1)
            .build();

    @Deprecated
    protected static final AttributeDefinition DETECT_REPLAY = new SimpleAttributeDefinitionBuilder(
            Constants.IOR_TRANSPORT_DETECT_REPLAY, ModelType.STRING, true)
            .setAttributeGroup(Constants.IOR_TRANSPORT_CONFIG)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setValidator(VALIDATOR)
            .setAllowExpression(true)
            .setDeprecated(IIOPExtension.VERSION_1)
            .build();

    @Deprecated
    protected static final AttributeDefinition DETECT_MISORDERING = new SimpleAttributeDefinitionBuilder(
            Constants.IOR_TRANSPORT_DETECT_MISORDERING, ModelType.STRING, true)
            .setAttributeGroup(Constants.IOR_TRANSPORT_CONFIG)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setValidator(VALIDATOR)
            .setAllowExpression(true)
            .setDeprecated(IIOPExtension.VERSION_1)
            .build();

    //ior as context attributes
    protected static final AttributeDefinition AUTH_METHOD = new SimpleAttributeDefinitionBuilder(
            Constants.IOR_AS_CONTEXT_AUTH_METHOD, ModelType.STRING, true)
            .setAttributeGroup(Constants.IOR_AS_CONTEXT)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setDefaultValue(new ModelNode(AuthMethodValues.USERNAME_PASSWORD.toString()))
            .setValidator(EnumValidator.create(AuthMethodValues.class))
            .setAllowExpression(true)
            .build();

    protected static final AttributeDefinition REALM = new SimpleAttributeDefinitionBuilder(
            Constants.IOR_AS_CONTEXT_REALM, ModelType.STRING, true)
            .setAttributeGroup(Constants.IOR_AS_CONTEXT)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setAccessConstraints(SensitiveTargetAccessConstraintDefinition.SECURITY_REALM_REF)
            .setAllowExpression(true)
            .setDeprecated(ModelVersion.create(3))
            .build();

    protected static final AttributeDefinition REQUIRED = new SimpleAttributeDefinitionBuilder(
            Constants.IOR_AS_CONTEXT_REQUIRED, ModelType.BOOLEAN, true)
            .setAttributeGroup(Constants.IOR_AS_CONTEXT)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setDefaultValue(ModelNode.FALSE)
            .setAllowExpression(true)
            .build();


    //ior sas context attributes
    protected static final AttributeDefinition CALLER_PROPAGATION = new SimpleAttributeDefinitionBuilder(
            Constants.IOR_SAS_CONTEXT_CALLER_PROPAGATION, ModelType.STRING, true)
            .setAttributeGroup(Constants.IOR_SAS_CONTEXT)
            .setFlags(AttributeAccess.Flag.RESTART_ALL_SERVICES)
            .setDefaultValue(NONE)
            .setValidator(EnumValidator.create(CallerPropagationValues.class))
            .setAllowExpression(true)
            .build();

    // list that contains ORB attribute definitions
    static final List<AttributeDefinition> ORB_ATTRIBUTES = Arrays.asList(PERSISTENT_SERVER_ID, GIOP_VERSION, SOCKET_BINDING,
            SSL_SOCKET_BINDING);

    // list that contains initializers attribute definitions
    static final List<AttributeDefinition> INITIALIZERS_ATTRIBUTES = Arrays.asList(SECURITY, AUTHENTICATION_CONTEXT, TRANSACTIONS);

    // list that contains naming attributes definitions
    static final List<AttributeDefinition> NAMING_ATTRIBUTES = Arrays.asList(ROOT_CONTEXT, EXPORT_CORBALOC);

    // list that contains security attributes definitions
    static final List<AttributeDefinition> SECURITY_ATTRIBUTES = Arrays.asList(SUPPORT_SSL, SECURITY_DOMAIN,
            SERVER_SSL_CONTEXT, CLIENT_SSL_CONTEXT, SERVER_REQUIRES_SSL, CLIENT_REQUIRES_SSL,
            ADD_COMPONENT_INTERCEPTOR, CLIENT_SUPPORTS, CLIENT_REQUIRES, SERVER_SUPPORTS, SERVER_REQUIRES);

    // list that contains interoperability attributes definitions
    static final List<AttributeDefinition> INTEROP_ATTRIBUTES = Arrays.asList(INTEROP_IONA);

    //list that contains tcp attributes definitions
    protected static final List<AttributeDefinition> TCP_ATTRIBUTES = Arrays.asList(HIGH_WATER_MARK,
            NUMBER_TO_RECLAIM);

    //list that contains ior sas attributes definitions
    static final List<AttributeDefinition> IOR_SAS_ATTRIBUTES = Arrays.asList(CALLER_PROPAGATION);

    //list that contains ior as attributes definitions
    static final List<AttributeDefinition> IOR_AS_ATTRIBUTES = Arrays.asList(AUTH_METHOD, REALM, REQUIRED);

    //list that contains ior transport config attributes definitions
    static final List<AttributeDefinition> IOR_TRANSPORT_CONFIG_ATTRIBUTES = Arrays.asList(INTEGRITY, CONFIDENTIALITY, TRUST_IN_TARGET,
            TRUST_IN_CLIENT, DETECT_REPLAY, DETECT_MISORDERING);

    static final List<AttributeDefinition> CONFIG_ATTRIBUTES = new ArrayList<>();
    static final List<AttributeDefinition> IOR_ATTRIBUTES = new ArrayList<>();
    static final List<AttributeDefinition> ALL_ATTRIBUTES = new ArrayList<>();
    static {
        CONFIG_ATTRIBUTES.addAll(ORB_ATTRIBUTES);
        CONFIG_ATTRIBUTES.addAll(TCP_ATTRIBUTES);
        CONFIG_ATTRIBUTES.addAll(INITIALIZERS_ATTRIBUTES);
        CONFIG_ATTRIBUTES.addAll(NAMING_ATTRIBUTES);
        CONFIG_ATTRIBUTES.addAll(SECURITY_ATTRIBUTES);
        CONFIG_ATTRIBUTES.addAll(INTEROP_ATTRIBUTES);
        CONFIG_ATTRIBUTES.add(PROPERTIES);

        IOR_ATTRIBUTES.addAll(IOR_TRANSPORT_CONFIG_ATTRIBUTES);
        IOR_ATTRIBUTES.addAll(IOR_AS_ATTRIBUTES);
        IOR_ATTRIBUTES.addAll(IOR_SAS_ATTRIBUTES);

        ALL_ATTRIBUTES.addAll(CONFIG_ATTRIBUTES);
        ALL_ATTRIBUTES.addAll(IOR_ATTRIBUTES);
    }

    IIOPRootDefinition() {
        super(new SimpleResourceDefinition.Parameters(IIOPExtension.PATH_SUBSYSTEM, IIOPExtension.SUBSYSTEM_RESOLVER)
                .setAddHandler(new IIOPSubsystemAdd(ALL_ATTRIBUTES))
                .setRemoveHandler(new ReloadRequiredRemoveStepHandler() {

                    @Override
                    protected void recordCapabilitiesAndRequirements(OperationContext context, ModelNode operation,
                            Resource resource) throws OperationFailedException {
                        super.recordCapabilitiesAndRequirements(context, operation, resource);
                        ModelNode model = resource.getModel();
                        String security = IIOPRootDefinition.SECURITY.resolveModelAttribute(context, model).asStringOrNull();
                        if (SecurityAllowedValues.IDENTITY.toString().equals(security) || SecurityAllowedValues.CLIENT.toString().equals(security)) {
                            context.deregisterCapabilityRequirement(LEGACY_SECURITY, Capabilities.IIOP_CAPABILITY, Constants.ORB_INIT_SECURITY);
                        }
                    }

                })
                .addCapabilities(IIOP_CAPABILITY));
    }



    @Override
    public void registerAttributes(ManagementResourceRegistration resourceRegistration) {
        ReloadRequiredWriteAttributeHandler handler = new ReloadRequiredWriteAttributeHandler(ALL_ATTRIBUTES) {
            @Override
            protected void recordCapabilitiesAndRequirements(OperationContext context, AttributeDefinition attributeDefinition,
                    ModelNode newValue, ModelNode oldValue) {

                if (attributeDefinition != SECURITY) {
                    super.recordCapabilitiesAndRequirements(context, attributeDefinition, newValue, oldValue);
                    return;
                }

                boolean oldIsLegacy;
                boolean newIsLegacy;
                try {
                    // For historic reasons this attribute supports expressions so resolution is required.
                    oldIsLegacy = SecurityAllowedValues.IDENTITY.toString().equals(IIOPRootDefinition.SECURITY.resolveValue(context, oldValue).asStringOrNull())
                            || SecurityAllowedValues.CLIENT.toString().equals(IIOPRootDefinition.SECURITY.resolveValue(context, oldValue).asStringOrNull());
                    newIsLegacy = SecurityAllowedValues.IDENTITY.toString().equals(IIOPRootDefinition.SECURITY.resolveValue(context, newValue).asStringOrNull())
                            || SecurityAllowedValues.CLIENT.toString().equals(IIOPRootDefinition.SECURITY.resolveValue(context, newValue).asStringOrNull());
                } catch (OperationFailedException e) {
                    throw new RuntimeException(e);
                }

                if (oldIsLegacy && !newIsLegacy) {
                    // Capability was registered but no longer required.
                    context.deregisterCapabilityRequirement(LEGACY_SECURITY, Capabilities.IIOP_CAPABILITY, Constants.ORB_INIT_SECURITY);
                } else if (!oldIsLegacy && newIsLegacy) {
                    // Capability wasn't required but now is.
                    context.registerAdditionalCapabilityRequirement(LEGACY_SECURITY, LEGACY_SECURITY, LEGACY_SECURITY);
                }
                // Other permutations mean no change in requirement.
            }
        };

        for (AttributeDefinition attr : ALL_ATTRIBUTES) {
            resourceRegistration.registerReadWriteAttribute(attr, null, handler);
        }
    }

    @Override
    public Collection<AttributeDefinition> getAttributes() {
        return ALL_ATTRIBUTES;
    }

    private enum AuthMethodValues {

        NONE("none"), USERNAME_PASSWORD("username_password");

        private String name;

        AuthMethodValues(String name) {
            this.name = name;
        }

        @Override
        public String toString() {
            return this.name;
        }
    }

    private enum CallerPropagationValues {

        NONE("none"), SUPPORTED("supported");

        private String name;

        CallerPropagationValues(String name) {
            this.name = name;
        }

        @Override
        public String toString() {
            return this.name;
        }
    }

    private enum IORTransportConfigValues {

        NONE("none"), SUPPORTED("supported"), REQUIRED("required");

        private String name;

        IORTransportConfigValues(String name) {
            this.name = name;
        }

        @Override
        public String toString() {
            return this.name;
        }
    }

}