ddf.security.pdp.realm

Class AuthzRealm

java.lang.Object

org.apache.shiro.realm.CachingRealm

org.apache.shiro.realm.AuthenticatingRealm

org.apache.shiro.realm.AuthorizingRealm

ddf.security.service.impl.AbstractAuthorizingRealm

ddf.security.pdp.realm.AuthzRealm

All Implemented Interfaces:

org.apache.shiro.authc.LogoutAware, org.apache.shiro.authz.Authorizer, org.apache.shiro.authz.permission.PermissionResolverAware, org.apache.shiro.authz.permission.RolePermissionResolverAware, org.apache.shiro.cache.CacheManagerAware, org.apache.shiro.realm.Realm, org.apache.shiro.util.Initializable, org.apache.shiro.util.Nameable

public class AuthzRealm
extends AbstractAuthorizingRealm

This simple Authz AbstractAuthorizingRealm provides the ability to check permissions without making calls out to an external PDP. Permission objects are checked against each other to ensure that the subject permissions imply the resource permissions.

Author:

tustisos

Field Summary

Fields inherited from class ddf.security.service.impl.AbstractAuthorizingRealm

metacardExpansionServices, userExpansionServices

Constructor Summary

Constructors

Constructor and Description
AuthzRealm(String dirPath, Parser parser)

Method Summary

Modifier and Type	Method and Description
void	addPolicyExtension(PolicyExtension policyExtension)
protected org.apache.shiro.authc.AuthenticationInfo	doGetAuthenticationInfo(org.apache.shiro.authc.AuthenticationToken token)
org.apache.shiro.authz.AuthorizationInfo	getAuthorizationInfo(org.apache.shiro.subject.PrincipalCollection principals) Returns an account's authorization-specific information for the specified principals, or null if no account could be found.
protected Collection<org.apache.shiro.authz.Permission>	getPermissions(org.apache.shiro.authz.AuthorizationInfo authorizationInfo) Returns a collection of Permission objects that the AuthorizationInfo object of a Subject is asserting.
boolean[]	isPermitted(org.apache.shiro.subject.PrincipalCollection subjectPrincipal, List<org.apache.shiro.authz.Permission> permissions) Checks if the corresponding Subject/user implies the given Permissions and returns a boolean array indicating which permissions are implied.
boolean	isPermitted(org.apache.shiro.subject.PrincipalCollection subjectPrincipal, org.apache.shiro.authz.Permission permission) Returns true if the corresponding subject/user is permitted to perform an action or access a resource summarized by the specified permission.
void	removePolicyExtension(PolicyExtension policyExtension)
void	setEnvironmentAttributes(List<String> environmentAttributes)
void	setMatchAllMappings(List<String> list) Sets the mappings used by the "match all" evaluation to determine if this user should be authorized to access requested data.
void	setMatchOneMappings(List<String> list) Sets the mappings used by the "match one" evaluation to determine if this user should be authorized to access requested data.
void	setPolicyExtensions(List<PolicyExtension> policyExtensions) Sets list of policy extension objects

Methods inherited from class ddf.security.service.impl.AbstractAuthorizingRealm

addMetacardExpansion, addMetacardExpansion, addUserExpansion, addUserExpansion, doGetAuthorizationInfo, expandPermissions, removeMetacardExpansion, removeUserExpansion

Methods inherited from class org.apache.shiro.realm.AuthorizingRealm

afterCacheManagerSet, checkPermission, checkPermission, checkPermission, checkPermissions, checkPermissions, checkPermissions, checkRole, checkRole, checkRoles, checkRoles, checkRoles, clearCachedAuthorizationInfo, doClearCache, getAuthorizationCache, getAuthorizationCacheKey, getAuthorizationCacheName, getPermissionResolver, getRolePermissionResolver, hasAllRoles, hasRole, hasRole, hasRoles, hasRoles, isAuthorizationCachingEnabled, isPermitted, isPermitted, isPermitted, isPermitted, isPermittedAll, isPermittedAll, isPermittedAll, onInit, setAuthorizationCache, setAuthorizationCacheName, setAuthorizationCachingEnabled, setName, setPermissionResolver, setRolePermissionResolver

Methods inherited from class org.apache.shiro.realm.AuthenticatingRealm

assertCredentialsMatch, clearCachedAuthenticationInfo, getAuthenticationCache, getAuthenticationCacheKey, getAuthenticationCacheKey, getAuthenticationCacheName, getAuthenticationInfo, getAuthenticationTokenClass, getCredentialsMatcher, init, isAuthenticationCachingEnabled, isAuthenticationCachingEnabled, setAuthenticationCache, setAuthenticationCacheName, setAuthenticationCachingEnabled, setAuthenticationTokenClass, setCredentialsMatcher, supports

Methods inherited from class org.apache.shiro.realm.CachingRealm

clearCache, getAvailablePrincipal, getCacheManager, getName, isCachingEnabled, onLogout, setCacheManager, setCachingEnabled

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apache.shiro.util.Initializable

init

Constructor Detail

AuthzRealm

public AuthzRealm(String dirPath,
                  Parser parser)
           throws PdpException

Throws:

PdpException

Method Detail

doGetAuthenticationInfo

protected org.apache.shiro.authc.AuthenticationInfo doGetAuthenticationInfo(org.apache.shiro.authc.AuthenticationToken token)
                                                                     throws org.apache.shiro.authc.AuthenticationException

Specified by:

doGetAuthenticationInfo in class org.apache.shiro.realm.AuthenticatingRealm

Throws:

org.apache.shiro.authc.AuthenticationException

getAuthorizationInfo

public org.apache.shiro.authz.AuthorizationInfo getAuthorizationInfo(org.apache.shiro.subject.PrincipalCollection principals)

Returns an account's authorization-specific information for the specified principals, or null if no account could be found. The resulting AuthorizationInfo object is used by the other method implementations in this class to automatically perform access control checks for the corresponding Subject.

This implementation obtains the actual AuthorizationInfo object from the subclass's implementation of doGetAuthorizationInfo, and then caches it for efficient reuse if caching is enabled (see below).

Invocations of this method should be thought of as completely orthogonal to acquiring authenticationInfo , since either could occur in any order.

For example, in "Remember Me" scenarios, the user identity is remembered (and assumed) for their current session and an authentication attempt during that session might never occur. But because their identity would be remembered, that is sufficient enough information to call this method to execute any necessary authorization checks. For this reason, authentication and authorization should be loosely coupled and not depend on each other.

Caching

The AuthorizationInfo values returned from this method are cached for efficient reuse if caching is enabled. Caching is enabled automatically when an authorizationCache instance has been explicitly configured, or if a cacheManager has been configured, which will be used to lazily create the authorizationCache as needed.

If caching is enabled, the authorization cache will be checked first and if found, will return the cached AuthorizationInfo immediately. If caching is disabled, or there is a cache miss, the authorization info will be looked up from the underlying data store via the AbstractAuthorizingRealm.doGetAuthorizationInfo(org.apache.shiro.subject.PrincipalCollection) method, which must be implemented by subclasses.

Changed Data

If caching is enabled and if any authorization data for an account is changed at runtime, such as adding or removing roles and/or permissions, the subclass implementation should clear the cached AuthorizationInfo for that account via the clearCachedAuthorizationInfo method. This ensures that the next call to getAuthorizationInfo(PrincipalCollection) will acquire the account's fresh authorization data, where it will then be cached for efficient reuse. This ensures that stale authorization data will not be reused.

Overrides:

getAuthorizationInfo in class org.apache.shiro.realm.AuthorizingRealm

Parameters:

principals - the corresponding Subject's identifying principals with which to look up the Subject's AuthorizationInfo.

Returns:

the authorization information for the account associated with the specified principals, or null if no account could be found.

isPermitted

public boolean isPermitted(org.apache.shiro.subject.PrincipalCollection subjectPrincipal,
                           org.apache.shiro.authz.Permission permission)

Returns true if the corresponding subject/user is permitted to perform an action or access a resource summarized by the specified permission.

More specifically, this method determines if any Permissions associated with the subject imply the specified permission.

Specified by:

isPermitted in interface org.apache.shiro.authz.Authorizer

Overrides:

isPermitted in class org.apache.shiro.realm.AuthorizingRealm

Parameters:

subjectPrincipal - the application-specific subject/user identifier.

permission - the permission that is being checked.

Returns:

true if the corresponding Subject/user is permitted, false otherwise.

isPermitted

public boolean[] isPermitted(org.apache.shiro.subject.PrincipalCollection subjectPrincipal,
                             List<org.apache.shiro.authz.Permission> permissions)

Checks if the corresponding Subject/user implies the given Permissions and returns a boolean array indicating which permissions are implied.

More specifically, this method should determine if each Permission in the array is implied by permissions already associated with the subject.

This is primarily a performance-enhancing method to help reduce the number of isPermitted(org.apache.shiro.subject.PrincipalCollection, org.apache.shiro.authz.Permission) invocations over the wire in client/server systems.

Specified by:

isPermitted in interface org.apache.shiro.authz.Authorizer

Overrides:

isPermitted in class org.apache.shiro.realm.AuthorizingRealm

Parameters:

subjectPrincipal - the application-specific subject/user identifier.

permissions - the permissions that are being checked.

Returns:

an array of booleans whose indices correspond to the index of the permissions in the given list. A true value at an index indicates the user is permitted for for the associated Permission object in the list. A false value at an index indicates otherwise.

getPermissions

protected Collection<org.apache.shiro.authz.Permission> getPermissions(org.apache.shiro.authz.AuthorizationInfo authorizationInfo)

Returns a collection of Permission objects that the AuthorizationInfo object of a Subject is asserting.

Overrides:

getPermissions in class org.apache.shiro.realm.AuthorizingRealm

Parameters:

authorizationInfo - the application-specific subject/user identifier.

Returns:

collection of Permissions.

setPolicyExtensions

public void setPolicyExtensions(List<PolicyExtension> policyExtensions)

Sets list of policy extension objects

Parameters:

policyExtensions -

addPolicyExtension

public void addPolicyExtension(PolicyExtension policyExtension)

removePolicyExtension

public void removePolicyExtension(PolicyExtension policyExtension)

setMatchAllMappings

public void setMatchAllMappings(List<String> list)

Sets the mappings used by the "match all" evaluation to determine if this user should be authorized to access requested data.

Each string is of the format: subjectAttrName=metacardAttrName
where metacardAttrName is the name of an attribute in the metacard and subjectAttrName is the name of the corresponding attribute in the user credentials.
It is the values corresponding to each of these attributes that will be evaluated against each other when determining if authorization should be allowed.

Parameters:

list - List of Strings that define mappings between metadata attributes and user attributes

setMatchOneMappings

public void setMatchOneMappings(List<String> list)

Sets the mappings used by the "match one" evaluation to determine if this user should be authorized to access requested data.

Each string is of the format: subjectAttrName=metacardAttrName
where metacardAttrName is the name of an attribute in the metacard and subjectAttrName is the name of the corresponding attribute in the user credentials.
It is the values corresponding to each of these attributes that will be evaluated against each other when determining if authorization should be allowed.

Parameters:

list - List of Strings that define mappings between metadata attributes and user attributes

setEnvironmentAttributes

public void setEnvironmentAttributes(List<String> environmentAttributes)