Class ACLProviderImpl
- java.lang.Object
-
- org.jboss.security.acl.ACLProviderImpl
-
- All Implemented Interfaces:
ACLProvider
- Direct Known Subclasses:
RoleBasedACLProviderImpl
public class ACLProviderImpl extends Object implements ACLProvider
This class is the standard
ACLProvider
implementation. The access control decisions are based on the name of the specified identity (that is, it assumes that entries in an ACL are keyed by the name of the identity and not by other attributes, like the its roles).- Author:
- Stefan Guilhen
-
-
Field Summary
Fields Modifier and Type Field Description protected ACLPersistenceStrategy
strategy
persistence strategy used to retrieve the ACLs
-
Constructor Summary
Constructors Constructor Description ACLProviderImpl()
-
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description protected void
fillEntitlements(Set<EntitlementEntry> entitlements, Resource resource, String identityName, ACLPermission permission)
Helper method that populates theentitlements
collection as it traverses through the resources.<T> Set<T>
getEntitlements(Class<T> clazz, Resource resource, Identity identity)
For a given Resource and an Identity, return all the entitlements Eg: A portal page can consist of say 10 components such as windows, subpages etc.protected ACLPermission
getInitialPermissions(Resource resource, String identityName)
This method retrieves the permissions the specified identity has over the specified resource.ACLPersistenceStrategy
getPersistenceStrategy()
Obtains theACLPersistenceStrategy
associated with this provider.void
initialize(Map<String,Object> sharedState, Map<String,Object> options)
Initialize the providerboolean
isAccessGranted(Resource resource, Identity identity, ACLPermission permission)
Checks if the given identity has the permissions needed to access the specified resource.protected Class<?>
loadClass(String name)
Loads the specified class using aPrivilegedExceptionAction
.void
setPersistenceStrategy(ACLPersistenceStrategy persistenceStrategy)
Sets the persistence strategy to be used by this provider.boolean
tearDown()
Give an opportunity for the provider to finalize the operations
-
-
-
Field Detail
-
strategy
protected ACLPersistenceStrategy strategy
persistence strategy used to retrieve the ACLs
-
-
Method Detail
-
initialize
public void initialize(Map<String,Object> sharedState, Map<String,Object> options)
Description copied from interface:ACLProvider
Initialize the provider- Specified by:
initialize
in interfaceACLProvider
- Parameters:
sharedState
- Shared Stateoptions
- Options
-
getEntitlements
public <T> Set<T> getEntitlements(Class<T> clazz, Resource resource, Identity identity) throws AuthorizationException
Description copied from interface:ACLProvider
For a given Resource and an Identity, return all the entitlements Eg: A portal page can consist of say 10 components such as windows, subpages etc. Now the Portal page can be the resource and for a given identity, the entitlements would be the subset of these 10 components to which the identity has access
- Specified by:
getEntitlements
in interfaceACLProvider
- Returns:
- Throws:
AuthorizationException
-
fillEntitlements
protected void fillEntitlements(Set<EntitlementEntry> entitlements, Resource resource, String identityName, ACLPermission permission)
Helper method that populates the
entitlements
collection as it traverses through the resources. The resources are visited using a depth-first search algorithm, and when each node is visited one of the following happens:-
an ACL for the resource is located and there is an entry for the identity - the permissions assigned to the
identity are used to construct the
EntitlementEntry
object and this object is added to the collection. The method is then called recursively for each one of the resource's children passing the permissions that were extracted from the ACL.-
an ACL for the resource is found, but there is no entry for the identity - this means the identity doesn't have
any permissions regarding the specified resource. Thus, no
EntitlementEntry
object is constructed and the method simply returns. No child resources are processed as it is assumed that the identity doesn't have the right to do anything in the resource's subtree.-
no ACL is found - this means that the resource itself is not protected by any ACL. We assume that if a parent
resource has an ACL, then the permissions assigned to the parent's ACL should be used.
- Parameters:
entitlements
- a reference for the collection ofEntitlementEntry
objects that is being constructed.resource
- theResource
being visited.identityName
- aString
representing the identity for which the entitlements are being built.permission
- theACLPermission
to be used in case no ACL is found for the resource being visited.
-
getInitialPermissions
protected ACLPermission getInitialPermissions(Resource resource, String identityName)
This method retrieves the permissions the specified identity has over the specified resource. It starts by looking for the resource's ACL. If one is found and if the ACL has entry for the identity, the respective permissions are returned. If no entry is found, we assume the identity hasn't been assigned any permissions and
null
is returned.If the resource doesn't have an associated ACL, we start looking for an ACL in the parent resource recursively, until an ACL is located or until no parent resource is found. In the first case, the algorithm described above is used to return the identity's permissions. In the latter case, we return all permissions (lack of an ACL means that the resource is not protected and the user should be granted all permissions).
- Parameters:
resource
- theResource
for which we want to discover the permissions that have been assigned to the specified identity.identityName
- aString
representing the identity for which we want to discover the permissions regarding the specified resource.- Returns:
- an
ACLPermission
containing the permissions that have been assigned to the identity with respect to the specified resource, ornull
if the identity has no permissions at all.
-
getPersistenceStrategy
public ACLPersistenceStrategy getPersistenceStrategy()
Description copied from interface:ACLProvider
Obtains the
ACLPersistenceStrategy
associated with this provider.- Specified by:
getPersistenceStrategy
in interfaceACLProvider
- Returns:
- a reference to the
ACLPersistenceStrategy
used by this provider.
-
setPersistenceStrategy
public void setPersistenceStrategy(ACLPersistenceStrategy persistenceStrategy)
Description copied from interface:ACLProvider
Sets the persistence strategy to be used by this provider.
- Specified by:
setPersistenceStrategy
in interfaceACLProvider
- Parameters:
persistenceStrategy
- a reference to theACLPersistenceStrategy
to be used.
-
isAccessGranted
public boolean isAccessGranted(Resource resource, Identity identity, ACLPermission permission) throws AuthorizationException
Description copied from interface:ACLProvider
Checks if the given identity has the permissions needed to access the specified resource. This involves finding the
ACL
associated with the resource and consulting theACL
to determine if access should be granted or not to the identity.- Specified by:
isAccessGranted
in interfaceACLProvider
- Parameters:
resource
- theResource
being accessed.identity
- theIdentity
trying to access the resource.permission
- the permissions needed to access the resource.- Returns:
true
if the identity has enough permissions to access the resource;false
otherwise.- Throws:
AuthorizationException
- if noACL
can be found for the specified resource.
-
tearDown
public boolean tearDown()
Description copied from interface:ACLProvider
Give an opportunity for the provider to finalize the operations- Specified by:
tearDown
in interfaceACLProvider
- Returns:
-
loadClass
protected Class<?> loadClass(String name) throws PrivilegedActionException
Loads the specified class using a
PrivilegedExceptionAction
.- Parameters:
name
- aString
containing the fully-qualified name of the class to be loaded.- Returns:
- a reference to the loaded
Class
. - Throws:
PrivilegedActionException
- if an error occurs while loading the specified class.
-
-