Class DirAclAuthz

java.lang.Object

com.netscape.cms.authorization.AAclAuthz

com.netscape.cms.authorization.DirAclAuthz

All Implemented Interfaces:

IExtendedPluginInfo, IAuthzManager

public class DirAclAuthz
extends AAclAuthz
implements IExtendedPluginInfo

A class for ldap acls based authorization manager The ldap server used for acls is the cms internal ldap db.

Version:

$Revision$, $Date$

Nested Class Summary

Nested classes/interfaces inherited from class AAclAuthz

AAclAuthz.EvaluationOrder

Modifier and Type	Class	Description
static enum	AAclAuthz.EvaluationOrder

Field Summary

Fields

Modifier and Type	Field	Description
static org.slf4j.Logger	logger
protected static final String	PROP_SEARCHBASE

Fields inherited from class AAclAuthz

ACLS_ATTR, mConfigParams, mExtendedPluginInfo, PROP_CLASS, PROP_EVAL, PROP_IMPL

Modifier and Type	Field	Description
protected static final String	ACLS_ATTR
protected static String[]	mConfigParams
protected static Vector<String>	mExtendedPluginInfo
protected static final String	PROP_CLASS
protected static final String	PROP_EVAL
protected static final String	PROP_IMPL

Fields inherited from interface IExtendedPluginInfo

HELP_TEXT, HELP_TOKEN

Modifier and Type	Field	Description
static final String	HELP_TEXT
static final String	HELP_TOKEN

Constructor Summary

Constructors

Constructor	Description
DirAclAuthz()	Default constructor

Method Summary

Modifier and Type	Method	Description
protected void	flushResourceACLs()	updates resourceACLs to ldap.
protected netscape.ldap.LDAPConnection	getConn()
void	init(String name, String implName, AuthzManagerConfig config)	Initializes
protected void	returnConn(netscape.ldap.LDAPConnection conn)
void	shutdown()	graceful shutdown
void	updateACLs(String id, String rights, String strACLs, String desc)	update acls.

Methods inherited from class AAclAuthz

accessInit, aclEvaluatorElements, aclResElements, addACLs, authorize, authorize, checkAllowEntries, checkDenyEntries, checkPermission, checkPermission, evaluateACLs, getAccessEvaluators, getACL, getACLs, getConfigParams, getConfigStore, getEntries, getExtendedPluginInfo, getImplName, getName, getNodes, getOrder, getTargetNames, isTypeUnique, registerEvaluator

Modifier and Type	Method	Description
void	accessInit(String accessInfo)	accessInit is for servlets who want to initialize their own authorization information before full operation.
Enumeration<IAccessEvaluator>	aclEvaluatorElements()	gets an enumeration of access evaluators
Enumeration<IACL>	aclResElements()	gets an enumeration of resources
void	addACLs(String resACLs)	Parse ACL resource attributes, then update the ACLs memory store This is intended to be used if storing ACLs on ldap is not desired, and the caller is expected to call this method to add resource and acl info into acls memory store.
AuthzToken	authorize(IAuthToken authToken, String expression)
AuthzToken	authorize(IAuthToken authToken, String resource, String operation)	check the authorization permission for the user associated with authToken on operation Example: For example, if UsrGrpAdminServlet needs to authorize the caller it would do be done in the following fashion: try { authzTok = mAuthz.authorize( "DirAclAuthz", authToken, RES_GROUP, "read"); } catch (EBaseException e) { logger.warn("authorize call: " + e.getMessage(), e); }
protected boolean	checkAllowEntries(IAuthToken authToken, Iterable<String> nodes, String perm)
protected void	checkDenyEntries(IAuthToken authToken, Iterable<String> nodes, String perm)	throw EACLsException if a deny entry is matched
void	checkPermission(IAuthToken authToken, String name, String perm)	Checks if the permission is granted or denied with id from authtoken gotten from authentication that precedes authorization.
protected void	checkPermission(String name, String perm)	Checks if the permission is granted or denied in the current execution context.
boolean	evaluateACLs(IAuthToken authToken, String exp)
Hashtable<String, IAccessEvaluator>	getAccessEvaluators()	gets the access evaluators
IACL	getACL(String target)	Get individual ACL entry for the given name of entry.
Enumeration<IACL>	getACLs()	Get ACL entries
String[]	getConfigParams()	Returns a list of configuration parameter names.
AuthzManagerConfig	getConfigStore()	Returns the configuration store used by this Authz mgr
protected Iterable<ACLEntry>	getEntries(ACLEntry.Type entryType, Iterable<String> nodes, String operation)
String[]	getExtendedPluginInfo(Locale locale)
String	getImplName()	gets the plugin name of this authorization manager.
String	getName()	gets the name of this authorization manager instance
Vector<String>	getNodes(String resourceID)
static AAclAuthz.EvaluationOrder	getOrder()
protected Enumeration<String>	getTargetNames()
boolean	isTypeUnique(String type)	is this resource name unique
void	registerEvaluator(String type, IAccessEvaluator evaluator)	Registers new handler for the given attribute type in the expressions.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface IExtendedPluginInfo

getExtendedPluginInfo

Modifier and Type	Method	Description
String[]	getExtendedPluginInfo(Locale locale)	This method returns an array of strings.

Field Details

logger

public static org.slf4j.Logger logger

PROP_SEARCHBASE

protected static final String PROP_SEARCHBASE

See Also:

• Constant Field Values

Constructor Details

DirAclAuthz

public DirAclAuthz()

Default constructor

Method Details

init

public void init(String name,
 String implName,
 AuthzManagerConfig config)
          throws EBaseException

Description copied from class: AAclAuthz

Initializes

Specified by:

init in interface IAuthzManager

Overrides:

init in class AAclAuthz

Parameters:

name - The name of this authorization manager instance.

implName - The name of the authorization manager plugin.

config - The configuration store for this authorization manager.

Throws:

EBaseException - If an initialization error occurred.

updateACLs

public void updateACLs(String id,
 String rights,
 String strACLs,
 String desc)
                throws EACLsException

update acls. when memory update is done, flush to ldap.

Currently, it is possible that when the memory is updated successfully, and the ldap isn't, the memory upates lingers. The result is that the changes will only be done on ldap at the next update, or when the system shuts down, another flush will be attempted.

Specified by:

updateACLs in interface IAuthzManager

Overrides:

updateACLs in class AAclAuthz

Parameters:

id - is the resource id

rights - The allowable rights for this resource

strACLs - has the same format as a resourceACLs entry acis on the ldap server

desc - The description for this resource

Throws:

EACLsException - when update fails.

flushResourceACLs

protected void flushResourceACLs()
                          throws EACLsException

updates resourceACLs to ldap.

Throws:

EACLsException

getConn

protected netscape.ldap.LDAPConnection getConn()
                                        throws ELdapException

Throws:

ELdapException

returnConn

protected void returnConn(netscape.ldap.LDAPConnection conn)
                   throws ELdapException

Throws:

ELdapException

shutdown

public void shutdown()

graceful shutdown

Specified by:

shutdown in interface IAuthzManager

Specified by:

shutdown in class AAclAuthz