/*
- * Copyright 2005 the original author or authors.
+ * Copyright 2005-2010 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
- */
-
+ */
package org.wamblee.security.authorization;
+import org.apache.log4j.Logger;
+
+import org.wamblee.persistence.AbstractPersistent;
import static org.wamblee.security.authorization.AuthorizationResult.DENIED;
import static org.wamblee.security.authorization.AuthorizationResult.GRANTED;
import static org.wamblee.security.authorization.AuthorizationResult.UNDECIDED;
import static org.wamblee.security.authorization.AuthorizationResult.UNSUPPORTED_RESOURCE;
-import org.apache.log4j.Logger;
-import org.wamblee.persistence.AbstractPersistent;
import org.wamblee.usermgt.User;
/**
- * Utility base class for implementation of authentication rules based on the
+ * Utility base class for implementation of authentication rules based on the
* <ul>
- * <li> The path of the resource. To obtain the path of a resource, subclasses
- * must implement {@link #getResourcePath(Object)}.
- * Whether a path is appropriate is determined by a
- * {@link org.wamblee.security.authorization.PathCondition}.
- * </li>
- * <li> The user identity with which the resource is accessed.
- * Whether a user is appropriate is determined by
- * a {@link org.wamblee.security.authorization.UserCondition}.
- * </li>
- * <li> The operation that is requested.
- * Whether the operation is appropriate is determined by a
- * {@link org.wamblee.security.authorization.OperationCondition}.
- * </li>
+ * <li>The path of the resource. To obtain the path of a resource, subclasses
+ * must implement {@link #getResourcePath(Object)}. Whether a path is
+ * appropriate is determined by a
+ * {@link org.wamblee.security.authorization.PathCondition}.</li>
+ * <li>The user identity with which the resource is accessed. Whether a user is
+ * appropriate is determined by a
+ * {@link org.wamblee.security.authorization.UserCondition}.</li>
+ * <li>The operation that is requested. Whether the operation is appropriate is
+ * determined by a {@link org.wamblee.security.authorization.OperationCondition}
+ * .</li>
* </ul>
- *
* In case all three conditions match, the condition returns the configured
- * result passed at construction (GRANTED or DENIED). If the resource is not
- * of the specified type, the result is UNSUPPORTED_RESOURCE, otherwise, the
- * result is UNDECIDED.
+ * result passed at construction (GRANTED or DENIED). If the resource is not of
+ * the specified type, the result is UNSUPPORTED_RESOURCE, otherwise, the result
+ * is UNDECIDED.
*/
-public abstract class UrlAuthorizationRule extends AbstractPersistent implements AuthorizationRule {
-
- private static final Logger LOGGER = Logger.getLogger(UrlAuthorizationRule.class);
+public abstract class UrlAuthorizationRule extends AbstractPersistent implements
+ AuthorizationRule {
+ private static final Logger LOGGER = Logger
+ .getLogger(UrlAuthorizationRule.class);
/**
- * Result that the rule will return in case there is a match.
+ * Result that the rule will return in case there is a match.
*/
- private AuthorizationResult _result;
+ private AuthorizationResult result;
/**
- * A condition which specifies which users the rule is for.
+ * A condition which specifies which users the rule is for.
*/
- private UserCondition _userCondition;
+ private UserCondition userCondition;
/**
- * Path the rule applies for.
+ * Path the rule applies for.
*/
- private PathCondition _pathCondition;
+ private PathCondition pathCondition;
/**
- * Resource class that the rule applies for.
+ * Resource class that the rule applies for.
*/
- private Class _resourceClass;
-
+ private Class resourceClass;
+
/**
- * Operation that this rule is for.
+ * Operation that this rule is for.
*/
- private OperationCondition _operationCondition;
+ private OperationCondition operationCondition;
/**
- * Constructs an authorization rule.
- * IF the group and path match, then the provided result will be returned.
- * @param aResult Result of the authorization when the path and group match.
- * @param aUserCondition Condition to match users.
- * @param aPathCondition Condition to match paths with.
- * @param aResourceClass Supported resource class this is for.
- * @param aOperationCondition Condition to match the operation with.
+ * Constructs an authorization rule. IF the group and path match, then the
+ * provided result will be returned.
+ *
+ * @param aResult
+ * Result of the authorization when the path and group match.
+ * @param aUserCondition
+ * Condition to match users.
+ * @param aPathCondition
+ * Condition to match paths with.
+ * @param aResourceClass
+ * Supported resource class this is for.
+ * @param aOperationCondition
+ * Condition to match the operation with.
*/
- protected UrlAuthorizationRule(AuthorizationResult aResult, UserCondition aUserCondition,
- PathCondition aPathCondition, Class aResourceClass, OperationCondition aOperationCondition) {
- if ( !aResult.equals(GRANTED) && !aResult.equals(DENIED)) {
- throw new IllegalArgumentException("Only GRANTED or DENIED may be used: " + aResult);
+ protected UrlAuthorizationRule(AuthorizationResult aResult,
+ UserCondition aUserCondition, PathCondition aPathCondition,
+ Class aResourceClass, OperationCondition aOperationCondition) {
+ if (!aResult.equals(GRANTED) && !aResult.equals(DENIED)) {
+ throw new IllegalArgumentException(
+ "Only GRANTED or DENIED may be used: " + aResult);
}
- _result = aResult;
- _userCondition = aUserCondition;
- _pathCondition = aPathCondition;
- _resourceClass = aResourceClass;
- _operationCondition = aOperationCondition;
+
+ result = aResult;
+ userCondition = aUserCondition;
+ pathCondition = aPathCondition;
+ resourceClass = aResourceClass;
+ operationCondition = aOperationCondition;
}
-
+
/**
- * For OR mapping.
- *
+ * For OR mapping.
+ *
*/
- protected UrlAuthorizationRule(Class aResourceClass) {
- _result = null;
- _userCondition = null;
- _pathCondition = null;
- _resourceClass = aResourceClass;
- _operationCondition = null;
+ protected UrlAuthorizationRule(Class aResourceClass) {
+ result = null;
+ userCondition = null;
+ pathCondition = null;
+ resourceClass = aResourceClass;
+ operationCondition = null;
}
-
+
/**
- * For OR mapping.
- *
+ * For OR mapping.
+ *
*/
- protected UrlAuthorizationRule() {
- _result = null;
- _userCondition = null;
- _pathCondition = null;
- _resourceClass = null;
- _operationCondition = null;
+ protected UrlAuthorizationRule() {
+ result = null;
+ userCondition = null;
+ pathCondition = null;
+ resourceClass = null;
+ operationCondition = null;
}
-
/*
* (non-Javadoc)
*
- * @see org.wamblee.security.authorization.AuthorizationRule#getSupportedTypes()
+ * @see
+ * org.wamblee.security.authorization.AuthorizationRule#getSupportedTypes()
*/
public Class[] getSupportedTypes() {
- return new Class[] { _resourceClass };
+ return new Class[] { resourceClass };
}
/*
* (non-Javadoc)
*
- * @see org.wamblee.security.authorization.AuthorizationRule#isAllowed(java.lang.Object,
- * org.wamblee.security.authorization.Operation)
+ * @see
+ * org.wamblee.security.authorization.AuthorizationRule#isAllowed(java.lang
+ * .Object, org.wamblee.security.authorization.Operation)
*/
- public AuthorizationResult isAllowed(Object aResource, Operation anOperation, User aUser) {
- if ( ! _resourceClass.isInstance(aResource)) {
- return UNSUPPORTED_RESOURCE;
+ public AuthorizationResult isAllowed(Object aResource,
+ Operation aOperation, User aUser) {
+ if (!resourceClass.isInstance(aResource)) {
+ return UNSUPPORTED_RESOURCE;
}
+
String path = getResourcePath(aResource);
- return isAllowed(path, anOperation, aUser);
+
+ return isAllowed(path, aOperation, aUser);
}
-
+
/**
- * Determines if the operation is allowed on the resource.
- * @param aPath Path of the resource.
- * @param aOperation Operation to be done.
- * @param aUser Currently logged in user or null if no user is logged in.
- * @return Authorization result,
+ * Determines if the operation is allowed on the resource.
+ *
+ * @param aPath
+ * Path of the resource.
+ * @param aOperation
+ * Operation to be done.
+ * @param aUser
+ * Currently logged in user or null if no user is logged in.
+ *
+ * @return Authorization result,
*/
- protected AuthorizationResult isAllowed(String aPath, Operation aOperation, User aUser) {
- if ( ! _pathCondition.matches(aPath) ) {
+ protected AuthorizationResult isAllowed(String aPath, Operation aOperation,
+ User aUser) {
+ if (!pathCondition.matches(aPath)) {
return UNDECIDED;
}
- if ( !_operationCondition.matches(aOperation) ) {
- return UNDECIDED;
+
+ if (!operationCondition.matches(aOperation)) {
+ return UNDECIDED;
}
- if ( !_userCondition.matches(aUser)) {
+
+ if (!userCondition.matches(aUser)) {
return UNDECIDED;
}
- return _result;
+
+ return result;
}
/**
- * Gets the path of the resource.
- * @param aResource Resource, guaranteed to be an instance of
- * {@link #_resourceClass}.
- * @return Path of the resource.
+ * Gets the path of the resource.
+ *
+ * @param aResource
+ * Resource, guaranteed to be an instance of
+ * {@link #resourceClass}.
+ *
+ * @return Path of the resource.
*/
protected abstract String getResourcePath(Object aResource);
-
- /* (non-Javadoc)
+
+ /*
+ * (non-Javadoc)
+ *
* @see java.lang.Object#toString()
*/
@Override
public String toString() {
- return "UrlAUthorizationRule(result = " + _result +
- ", pathCondition = " + _pathCondition +
- ", userCondition = " + _userCondition +
- ", resourceClass = " + _resourceClass + ")";
+ return "UrlAUthorizationRule(result = " + result +
+ ", pathCondition = " + pathCondition + ", userCondition = " +
+ userCondition + ", resourceClass = " + resourceClass + ")";
}
-
+
/**
- * Gets the authorization result for OR mapping.
- * @return Result.
+ * Gets the authorization result for OR mapping.
+ *
+ * @return Result.
*/
protected String getAuthorizationResultString() {
- if ( _result == null ) {
- return null;
+ if (result == null) {
+ return null;
}
- return _result.toString();
+
+ return result.toString();
}
-
+
/**
- * Sets the authorization result, for OR mapping.
- * @param aResult Result.
+ * Sets the authorization result, for OR mapping.
+ *
+ * @param aResult
+ * Result.
*/
protected void setAuthorizationResultString(String aResult) {
- _result = AuthorizationResult.valueOf(aResult);
+ result = AuthorizationResult.valueOf(aResult);
}
-
+
protected String getResourceClassName() {
- if ( _resourceClass == null ) {
+ if (resourceClass == null) {
return "";
}
- return _resourceClass.getName();
+
+ return resourceClass.getName();
}
-
- protected void setResourceClassName(String aResourceClass) {
+
+ protected void setResourceClassName(String aResourceClass) {
try {
- _resourceClass = Class.forName(aResourceClass);
+ resourceClass = Class.forName(aResourceClass);
} catch (ClassNotFoundException e) {
- LOGGER.error("Cannot find resource class '" + aResourceClass + "'", e);
- throw new IllegalArgumentException(e.getMessage(), e);
+ LOGGER.error("Cannot find resource class '" + aResourceClass + "'",
+ e);
+ throw new IllegalArgumentException(e.getMessage(), e);
}
}
/**
- * @return Returns the _operationCondition.
+ *
+ * @return Returns the operationCondition.
*/
public OperationCondition getOperationCondition() {
- return _operationCondition;
+ return operationCondition;
}
/**
- * @param aOperationCondition The _operationCondition to set.
+ *
+ * @param aOperationCondition
+ * The operationCondition to set.
*/
protected void setOperationCondition(OperationCondition aOperationCondition) {
- _operationCondition = aOperationCondition;
+ operationCondition = aOperationCondition;
}
/**
- * @return Returns the _pathCondition.
+ *
+ * @return Returns the pathCondition.
*/
public PathCondition getPathCondition() {
- return _pathCondition;
+ return pathCondition;
}
/**
- * @param aPathCondition The _pathCondition to set.
+ *
+ * @param aPathCondition
+ * The pathCondition to set.
*/
protected void setPathCondition(PathCondition aPathCondition) {
- _pathCondition = aPathCondition;
+ pathCondition = aPathCondition;
}
/**
- * @return Returns the _userCondition.
+ *
+ * @return Returns the userCondition.
*/
public UserCondition getUserCondition() {
- return _userCondition;
+ return userCondition;
}
/**
- * @param aUserCondition The _userCondition to set.
+ *
+ * @param aUserCondition
+ * The userCondition to set.
*/
protected void setUserCondition(UserCondition aUserCondition) {
- _userCondition = aUserCondition;
+ userCondition = aUserCondition;
}
}