Class AAclAuthz

  • All Implemented Interfaces:
    IAuthzManager
    Direct Known Subclasses:
    BasicAclAuthz, DirAclAuthz

    public abstract class AAclAuthz
    extends java.lang.Object
    implements IAuthzManager
    An abstract class represents an authorization manager that governs the access of internal resources such as servlets. It parses in the ACLs associated with each protected resources, and provides protected method checkPermission for code that needs to verify access before performing actions.

    Here is a sample resourceACLS for a resource

       certServer.UsrGrpAdminServlet:
           execute:
               deny (execute) user="tempAdmin";
               allow (execute) group="Administrators";
     
    To perform permission checking, code call authz mgr authorize() method to verify access. See AuthzMgr for calling example.

    default "evaluators" are used to evaluate the "group=.." or "user=.." rules. See evaluator for more info

    Version:
    $Revision$, $Date$
    See Also:
    ACL Files
    • Field Summary

      Fields 
      Modifier and Type Field Description
      protected static java.lang.String ACLS_ATTR  
      static org.slf4j.Logger logger  
      protected static java.lang.String[] mConfigParams  
      protected static java.util.Vector<java.lang.String> mExtendedPluginInfo  
      protected static java.lang.String PROP_CLASS  
      protected static java.lang.String PROP_EVAL  
      protected static java.lang.String PROP_IMPL  
    • Constructor Summary

      Constructors 
      Constructor Description
      AAclAuthz()
      Constructor
    • Method Summary

      All Methods Static Methods Instance Methods Abstract Methods Concrete Methods 
      Modifier and Type Method Description
      void accessInit​(java.lang.String accessInfo)
      accessInit is for servlets who want to initialize their own authorization information before full operation.
      java.util.Enumeration<IAccessEvaluator> aclEvaluatorElements()
      gets an enumeration of access evaluators
      java.util.Enumeration<IACL> aclResElements()
      gets an enumeration of resources
      void addACLs​(java.lang.String resACLs)
      Parse ACL resource attributes, then update the ACLs memory store This is intended to be used if storing ACLs on ldap is not desired, and the caller is expected to call this method to add resource and acl info into acls memory store.
      AuthzToken authorize​(IAuthToken authToken, java.lang.String expression)  
      AuthzToken authorize​(IAuthToken authToken, java.lang.String resource, java.lang.String operation)
      check the authorization permission for the user associated with authToken on operation Example: For example, if UsrGrpAdminServlet needs to authorize the caller it would do be done in the following fashion: try { authzTok = mAuthz.authorize( "DirAclAuthz", authToken, RES_GROUP, "read"); } catch (EBaseException e) { logger.warn("authorize call: " + e.getMessage(), e); }
      protected boolean checkAllowEntries​(IAuthToken authToken, java.lang.Iterable<java.lang.String> nodes, java.lang.String perm)  
      protected void checkDenyEntries​(IAuthToken authToken, java.lang.Iterable<java.lang.String> nodes, java.lang.String perm)
      throw EACLsException if a deny entry is matched
      void checkPermission​(IAuthToken authToken, java.lang.String name, java.lang.String perm)
      Checks if the permission is granted or denied with id from authtoken gotten from authentication that precedes authorization.
      protected void checkPermission​(java.lang.String name, java.lang.String perm)
      Checks if the permission is granted or denied in the current execution context.
      boolean evaluateACLs​(IAuthToken authToken, java.lang.String exp)  
      java.util.Hashtable<java.lang.String,​IAccessEvaluator> getAccessEvaluators()
      gets the access evaluators
      IACL getACL​(java.lang.String target)
      Get individual ACL entry for the given name of entry.
      java.util.Enumeration<IACL> getACLs()
      Get ACL entries
      java.lang.String[] getConfigParams()
      Returns a list of configuration parameter names.
      AuthzManagerConfig getConfigStore()
      Returns the configuration store used by this Authz mgr
      protected java.lang.Iterable<ACLEntry> getEntries​(ACLEntry.Type entryType, java.lang.Iterable<java.lang.String> nodes, java.lang.String operation)  
      java.lang.String[] getExtendedPluginInfo​(java.util.Locale locale)  
      java.lang.String getImplName()
      gets the plugin name of this authorization manager.
      java.lang.String getName()
      gets the name of this authorization manager instance
      java.util.Vector<java.lang.String> getNodes​(java.lang.String resourceID)  
      static AAclAuthz.EvaluationOrder getOrder()  
      protected java.util.Enumeration<java.lang.String> getTargetNames()  
      void init​(java.lang.String name, java.lang.String implName, AuthzManagerConfig config)
      Initializes
      boolean isTypeUnique​(java.lang.String type)
      is this resource name unique
      void registerEvaluator​(java.lang.String type, IAccessEvaluator evaluator)
      Registers new handler for the given attribute type in the expressions.
      abstract void shutdown()
      graceful shutdown
      void updateACLs​(java.lang.String id, java.lang.String rights, java.lang.String strACLs, java.lang.String desc)
      This one only updates the memory.
      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
    • Field Detail

      • logger

        public static org.slf4j.Logger logger
      • mExtendedPluginInfo

        protected static java.util.Vector<java.lang.String> mExtendedPluginInfo
      • mConfigParams

        protected static java.lang.String[] mConfigParams
    • Constructor Detail

      • AAclAuthz

        public AAclAuthz()
        Constructor
    • Method Detail

      • init

        public void init​(java.lang.String name,
                         java.lang.String implName,
                         AuthzManagerConfig config)
                  throws EBaseException
        Initializes
        Specified by:
        init in interface IAuthzManager
        Parameters:
        name - The name of this authorization manager instance.
        implName - The name of the authorization manager plugin.
        config - The configuration store for this authorization manager.
        Throws:
        EBaseException - If an initialization error occurred.
      • getName

        public java.lang.String getName()
        gets the name of this authorization manager instance
        Specified by:
        getName in interface IAuthzManager
        Returns:
        String the name of this authorization manager.
      • getImplName

        public java.lang.String getImplName()
        gets the plugin name of this authorization manager.
        Specified by:
        getImplName in interface IAuthzManager
        Returns:
        The name of the authorization manager plugin.
      • addACLs

        public void addACLs​(java.lang.String resACLs)
                     throws EBaseException
        Parse ACL resource attributes, then update the ACLs memory store This is intended to be used if storing ACLs on ldap is not desired, and the caller is expected to call this method to add resource and acl info into acls memory store. The resACLs format should conform to the following: Example: resTurnKnob:left,right:allow(left) group="lefties":door knobs for lefties
        Parameters:
        resACLs - same format as the resourceACLs attribute
        Throws:
        EBaseException - parsing error from parseACL
      • accessInit

        public void accessInit​(java.lang.String accessInfo)
                        throws EBaseException
        Description copied from interface: IAuthzManager
        accessInit is for servlets who want to initialize their own authorization information before full operation. It is supposed to be called from the authzMgrAccessInit() method of the AuthzSubsystem.

        The accessInfo format is determined by each individual authzmgr. For example, for BasicAclAuthz, The accessInfo is the resACLs, whose format should conform to the following: Example: resTurnKnob:left,right:allow(left) group="lefties":door knobs for lefties

        Specified by:
        accessInit in interface IAuthzManager
        Parameters:
        accessInfo - the access info string in the format specified in the authorization manager
        Throws:
        EBaseException - error parsing the accessInfo
      • getACL

        public IACL getACL​(java.lang.String target)
        Description copied from interface: IAuthzManager
        Get individual ACL entry for the given name of entry.
        Specified by:
        getACL in interface IAuthzManager
        Parameters:
        target - The name of the ACL entry
        Returns:
        The ACL entry.
      • getTargetNames

        protected java.util.Enumeration<java.lang.String> getTargetNames()
      • getACLs

        public java.util.Enumeration<IACL> getACLs()
        Description copied from interface: IAuthzManager
        Get ACL entries
        Specified by:
        getACLs in interface IAuthzManager
        Returns:
        enumeration of ACL entries.
      • getConfigStore

        public AuthzManagerConfig getConfigStore()
        Returns the configuration store used by this Authz mgr
        Specified by:
        getConfigStore in interface IAuthzManager
        Returns:
        The configuration store of this authorization manager.
      • getExtendedPluginInfo

        public java.lang.String[] getExtendedPluginInfo​(java.util.Locale locale)
      • getConfigParams

        public java.lang.String[] getConfigParams()
        Returns a list of configuration parameter names. The list is passed to the configuration console so instances of this implementation can be configured through the console.
        Specified by:
        getConfigParams in interface IAuthzManager
        Returns:
        String array of configuration parameter names.
      • shutdown

        public abstract void shutdown()
        graceful shutdown
        Specified by:
        shutdown in interface IAuthzManager
      • registerEvaluator

        public void registerEvaluator​(java.lang.String type,
                                      IAccessEvaluator evaluator)
        Registers new handler for the given attribute type in the expressions.
        Specified by:
        registerEvaluator in interface IAuthzManager
        Parameters:
        type - Type of evaluator
        evaluator - Value of evaluator
      • checkPermission

        protected void checkPermission​(java.lang.String name,
                                       java.lang.String perm)
                                throws EACLsException
        Checks if the permission is granted or denied in the current execution context. If the code is marked as privileged, this methods will simply return.

        note that if a resource does not exist in the aclResources entry, but a higher level node exist, it will still be evaluated. The highest level node's acl determines the permission. If the higher level node doesn't contain any acl information, then it's passed down to the lower node. If a node has no aci in its resourceACLs, then it's considered passed.

        example: certServer.common.users, if failed permission check for "certServer", then it's considered failed, and there is no need to continue the check. If passed permission check for "certServer", then it's considered passed, and no need to continue the check. If certServer contains no aci then "certServer.common" will be checked for permission instead. If down to the leaf level, the node still contains no aci, then it's considered passed. If at the leaf level, no such resource exist, or no acis, it's considered passed.

        If there are multiple aci's for a resource, ALL aci's will be checked, and only if all passed permission checks, will the eventual access be granted.

        Parameters:
        name - resource name
        perm - permission requested
        Throws:
        EACLsException - access permission denied
      • checkPermission

        public void checkPermission​(IAuthToken authToken,
                                    java.lang.String name,
                                    java.lang.String perm)
                             throws EACLsException
        Checks if the permission is granted or denied with id from authtoken gotten from authentication that precedes authorization. If the code is marked as privileged, this methods will simply return.

        note that if a resource does not exist in the aclResources entry, but a higher level node exist, it will still be evaluated. The highest level node's acl determines the permission. If the higher level node doesn't contain any acl information, then it's passed down to the lower node. If a node has no aci in its resourceACLs, then it's considered passed.

        example: certServer.common.users, if failed permission check for "certServer", then it's considered failed, and there is no need to continue the check. If passed permission check for "certServer", then it's considered passed, and no need to continue the check. If certServer contains no aci then "certServer.common" will be checked for permission instead. If down to the leaf level, the node still contains no aci, then it's considered passed. If at the leaf level, no such resource exist, or no acis, it's considered passed.

        If there are multiple aci's for a resource, ALL aci's will be checked, and only if all passed permission checks, will the eventual access be granted.

        Parameters:
        authToken - authentication token gotten from authentication
        name - resource name
        perm - permission requested
        Throws:
        EACLsException - access permission denied
      • checkAllowEntries

        protected boolean checkAllowEntries​(IAuthToken authToken,
                                            java.lang.Iterable<java.lang.String> nodes,
                                            java.lang.String perm)
      • checkDenyEntries

        protected void checkDenyEntries​(IAuthToken authToken,
                                        java.lang.Iterable<java.lang.String> nodes,
                                        java.lang.String perm)
                                 throws EACLsException
        throw EACLsException if a deny entry is matched
        Throws:
        EACLsException
      • getEntries

        protected java.lang.Iterable<ACLEntry> getEntries​(ACLEntry.Type entryType,
                                                          java.lang.Iterable<java.lang.String> nodes,
                                                          java.lang.String operation)
      • getNodes

        public java.util.Vector<java.lang.String> getNodes​(java.lang.String resourceID)
      • updateACLs

        public void updateACLs​(java.lang.String id,
                               java.lang.String rights,
                               java.lang.String strACLs,
                               java.lang.String desc)
                        throws EACLsException
        This one only updates the memory. Classes extend this class should also update to a permanent storage
        Specified by:
        updateACLs in interface IAuthzManager
        Parameters:
        id - The name of the ACL entry (ie, resource id)
        rights - The allowable rights for this resource
        strACLs - The value of the ACL entry
        desc - The description for this resource
        Throws:
        EACLsException - when update fails.
      • aclResElements

        public java.util.Enumeration<IACL> aclResElements()
        gets an enumeration of resources
        Returns:
        an enumeration of resources contained in the ACL table
      • getAccessEvaluators

        public java.util.Hashtable<java.lang.String,​IAccessEvaluator> getAccessEvaluators()
        gets the access evaluators
        Specified by:
        getAccessEvaluators in interface IAuthzManager
        Returns:
        handle to the access evaluators table
      • isTypeUnique

        public boolean isTypeUnique​(java.lang.String type)
        is this resource name unique
        Returns:
        true if unique; false otherwise
      • authorize

        public AuthzToken authorize​(IAuthToken authToken,
                                    java.lang.String resource,
                                    java.lang.String operation)
                             throws EAuthzInternalError,
                                    EAuthzAccessDenied
        check the authorization permission for the user associated with authToken on operation Example: For example, if UsrGrpAdminServlet needs to authorize the caller it would do be done in the following fashion: try { authzTok = mAuthz.authorize( "DirAclAuthz", authToken, RES_GROUP, "read"); } catch (EBaseException e) { logger.warn("authorize call: " + e.getMessage(), e); }
        Specified by:
        authorize in interface IAuthzManager
        Parameters:
        authToken - the authToken associated with a user
        resource - - the protected resource name
        operation - - the protected resource operation name
        Returns:
        authzToken
        Throws:
        EAuthzAccessDenied - If access was denied
        EAuthzInternalError - If an internal error occurred.
      • evaluateACLs

        public boolean evaluateACLs​(IAuthToken authToken,
                                    java.lang.String exp)