public class ACDFEngine extends Object
This engine simply filters the collection of tuples using the following
ACITupleFilter
s sequentially:
RelatedUserClassFilter
RelatedProtectedItemFilter
MaxValueCountFilter
MaxImmSubFilter
RestrictedByFilter
MicroOperationFilter
HighestPrecedenceFilter
MostSpecificUserClassFilter
MostSpecificProtectedItemFilter
Operation is determined to be permitted if and only if there is at least one tuple left and all of them grants the access. (18.8.4. X.501)
Modifier and Type | Field and Description |
---|---|
static Collection<String> |
USER_LOOKUP_BYPASS |
Constructor and Description |
---|
ACDFEngine(org.apache.directory.shared.ldap.schema.registries.OidRegistry oidRegistry,
org.apache.directory.shared.ldap.schema.SchemaManager schemaManager)
Creates a new instance.
|
Modifier and Type | Method and Description |
---|---|
void |
checkPermission(org.apache.directory.shared.ldap.schema.SchemaManager schemaManager,
OperationContext opContext,
Collection<org.apache.directory.shared.ldap.name.DN> userGroupNames,
org.apache.directory.shared.ldap.name.DN username,
org.apache.directory.shared.ldap.constants.AuthenticationLevel authenticationLevel,
org.apache.directory.shared.ldap.name.DN entryName,
String attrId,
org.apache.directory.shared.ldap.entry.Value<?> attrValue,
Collection<org.apache.directory.shared.ldap.aci.MicroOperation> microOperations,
Collection<org.apache.directory.shared.ldap.aci.ACITuple> aciTuples,
org.apache.directory.shared.ldap.entry.ServerEntry entry,
org.apache.directory.shared.ldap.entry.ServerEntry entryView)
Checks the user with the specified name can access the specified resource
(entry, attribute type, or attribute value) and throws
LdapNoPermissionException
if the user doesn't have any permission to perform the specified grants. |
boolean |
hasPermission(org.apache.directory.shared.ldap.schema.SchemaManager schemaManager,
OperationContext opContext,
Collection<org.apache.directory.shared.ldap.name.DN> userGroupNames,
org.apache.directory.shared.ldap.name.DN userName,
org.apache.directory.shared.ldap.constants.AuthenticationLevel authenticationLevel,
org.apache.directory.shared.ldap.name.DN entryName,
String attrId,
org.apache.directory.shared.ldap.entry.Value<?> attrValue,
Collection<org.apache.directory.shared.ldap.aci.MicroOperation> microOperations,
Collection<org.apache.directory.shared.ldap.aci.ACITuple> aciTuples,
org.apache.directory.shared.ldap.entry.ServerEntry entry,
org.apache.directory.shared.ldap.entry.ServerEntry entryView)
Returns true if the user with the specified name can access the specified resource
(entry, attribute type, or attribute value) and throws
LdapNoPermissionException
if the user doesn't have any permission to perform the specified grants. |
public static final Collection<String> USER_LOOKUP_BYPASS
public ACDFEngine(org.apache.directory.shared.ldap.schema.registries.OidRegistry oidRegistry, org.apache.directory.shared.ldap.schema.SchemaManager schemaManager) throws NamingException
oidRegistry
- an OID registry to be used by internal componentsattrTypeRegistry
- an attribute type registry to be used by internal componentsNamingException
- if failed to initialize internal componentspublic void checkPermission(org.apache.directory.shared.ldap.schema.SchemaManager schemaManager, OperationContext opContext, Collection<org.apache.directory.shared.ldap.name.DN> userGroupNames, org.apache.directory.shared.ldap.name.DN username, org.apache.directory.shared.ldap.constants.AuthenticationLevel authenticationLevel, org.apache.directory.shared.ldap.name.DN entryName, String attrId, org.apache.directory.shared.ldap.entry.Value<?> attrValue, Collection<org.apache.directory.shared.ldap.aci.MicroOperation> microOperations, Collection<org.apache.directory.shared.ldap.aci.ACITuple> aciTuples, org.apache.directory.shared.ldap.entry.ServerEntry entry, org.apache.directory.shared.ldap.entry.ServerEntry entryView) throws Exception
LdapNoPermissionException
if the user doesn't have any permission to perform the specified grants.proxy
- the proxy to the partition nexususerGroupNames
- the collection of the group DNs the user who is trying to access the resource belongsusername
- the DN of the user who is trying to access the resourceentryName
- the DN of the entry the user is trying to accessattrId
- the attribute type of the attribute the user is trying to access.
null if the user is not accessing a specific attribute type.attrValue
- the attribute value of the attribute the user is trying to access.
null if the user is not accessing a specific attribute value.microOperations
- the MicroOperation
s to performaciTuples
- ACITuple
s translated from ACIItem
s in the subtree entriesentryView
- in case of a Modify operation, view of the entry being modified as if the modification permitted and completedNamingException
- if failed to evaluate ACI itemsException
public boolean hasPermission(org.apache.directory.shared.ldap.schema.SchemaManager schemaManager, OperationContext opContext, Collection<org.apache.directory.shared.ldap.name.DN> userGroupNames, org.apache.directory.shared.ldap.name.DN userName, org.apache.directory.shared.ldap.constants.AuthenticationLevel authenticationLevel, org.apache.directory.shared.ldap.name.DN entryName, String attrId, org.apache.directory.shared.ldap.entry.Value<?> attrValue, Collection<org.apache.directory.shared.ldap.aci.MicroOperation> microOperations, Collection<org.apache.directory.shared.ldap.aci.ACITuple> aciTuples, org.apache.directory.shared.ldap.entry.ServerEntry entry, org.apache.directory.shared.ldap.entry.ServerEntry entryView) throws Exception
LdapNoPermissionException
if the user doesn't have any permission to perform the specified grants.proxy
- the proxy to the partition nexususerGroupNames
- the collection of the group DNs the user who is trying to access the resource belongsuserName
- the DN of the user who is trying to access the resourceentryName
- the DN of the entry the user is trying to accessattrId
- the attribute type of the attribute the user is trying to access.
null if the user is not accessing a specific attribute type.attrValue
- the attribute value of the attribute the user is trying to access.
null if the user is not accessing a specific attribute value.microOperations
- the MicroOperation
s to performaciTuples
- ACITuple
s translated from ACIItem
s in the subtree entriesentryView
- in case of a Modify operation, view of the entry being modified as if the modification permitted and completedException
Copyright © 2003–2014 The Apache Software Foundation. All rights reserved.