Modifier and Type | Field and Description |
---|---|
static org.acegisecurity.acls.sid.Sid |
ANONYMOUS
Sid that represents the anonymous unauthenticated users. |
static String |
ANONYMOUS_USERNAME
The username for the anonymous user
|
protected static org.acegisecurity.acls.sid.Sid[] |
AUTOMATIC_SIDS |
static org.acegisecurity.acls.sid.Sid |
EVERYONE
Special
Sid that represents "everyone", even including anonymous users. |
static org.acegisecurity.Authentication |
SYSTEM
Sid that represents the Hudson itself. |
static String |
SYSTEM_USERNAME
The username for the system user
|
Constructor and Description |
---|
ACL() |
Modifier and Type | Method and Description |
---|---|
void |
checkCreatePermission(ItemGroup c,
TopLevelItemDescriptor d)
Checks if the current security principal has the permission to create top level items within the specified
item group.
|
void |
checkPermission(Permission p)
Checks if the current security principal has this permission.
|
boolean |
hasCreatePermission(org.acegisecurity.Authentication a,
ItemGroup c,
TopLevelItemDescriptor d)
Checks if the given principal has the permission to create top level items within the specified item group.
|
abstract boolean |
hasPermission(org.acegisecurity.Authentication a,
Permission permission)
Checks if the given principle has the given permission.
|
boolean |
hasPermission(Permission p)
Checks if the current security principal has this permission.
|
static org.acegisecurity.context.SecurityContext |
impersonate(org.acegisecurity.Authentication auth)
Changes the
Authentication associated with the current thread
to the specified one, and returns the previous security context. |
static <V,T extends Exception> |
impersonate(org.acegisecurity.Authentication auth,
hudson.remoting.Callable<V,T> body)
Safer variant of
impersonate(Authentication) that does not require a finally-block. |
static void |
impersonate(org.acegisecurity.Authentication auth,
Runnable body)
Safer variant of
impersonate(Authentication) that does not require a finally-block. |
public static final org.acegisecurity.acls.sid.Sid EVERYONE
Sid
that represents "everyone", even including anonymous users.
This doesn't need to be included in Authentication.getAuthorities()
,
but ACL
is responsible for checking it nontheless, as if it was the
last entry in the granted authority.
@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class) public static final String ANONYMOUS_USERNAME
public static final org.acegisecurity.acls.sid.Sid ANONYMOUS
Sid
that represents the anonymous unauthenticated users.
HudsonFilter
sets this up, so this sid remains the same
regardless of the current SecurityRealm
in use.
protected static final org.acegisecurity.acls.sid.Sid[] AUTOMATIC_SIDS
@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class) public static final String SYSTEM_USERNAME
public static final org.acegisecurity.Authentication SYSTEM
Sid
that represents the Hudson itself.
This is used when Hudson is performing computation for itself, instead of acting on behalf of an user, such as doing builds.
public final void checkPermission(@Nonnull Permission p)
This is just a convenience function.
org.acegisecurity.AccessDeniedException
- if the user doesn't have the permission.public final boolean hasPermission(@Nonnull Permission p)
public abstract boolean hasPermission(@Nonnull org.acegisecurity.Authentication a, @Nonnull Permission permission)
Note that SYSTEM
can be passed in as the authentication parameter,
in which case you should probably just assume it has every permission.
public final void checkCreatePermission(@Nonnull ItemGroup c, @Nonnull TopLevelItemDescriptor d)
This is just a convenience function.
c
- the container of the item.d
- the descriptor of the item to be created.org.acegisecurity.AccessDeniedException
- if the user doesn't have the permission.public boolean hasCreatePermission(@Nonnull org.acegisecurity.Authentication a, @Nonnull ItemGroup c, @Nonnull TopLevelItemDescriptor d)
Note that SYSTEM
can be passed in as the authentication parameter,
in which case you should probably just assume it can create anything anywhere.
a
- the principal.c
- the container of the item.d
- the descriptor of the item to be created.@Nonnull public static org.acegisecurity.context.SecurityContext impersonate(@Nonnull org.acegisecurity.Authentication auth)
Authentication
associated with the current thread
to the specified one, and returns the previous security context.
When the impersonation is over, be sure to restore the previous authentication
via SecurityContextHolder.setContext(returnValueFromThisMethod)
;
or just use impersonate(Authentication,Runnable)
.
We need to create a new SecurityContext
instead of SecurityContext.setAuthentication(Authentication)
because the same SecurityContext
object is reused for all the concurrent requests from the same session.
public static void impersonate(@Nonnull org.acegisecurity.Authentication auth, @Nonnull Runnable body)
impersonate(Authentication)
that does not require a finally-block.auth
- authentication, such as SYSTEM
body
- an action to run with this alternate authentication in effectpublic static <V,T extends Exception> V impersonate(org.acegisecurity.Authentication auth, hudson.remoting.Callable<V,T> body) throws T extends Exception
impersonate(Authentication)
that does not require a finally-block.auth
- authentication, such as SYSTEM
body
- an action to run with this alternate authentication in effect (try NotReallyRoleSensitiveCallable
)T extends Exception
Copyright © 2015. All rights reserved.