ddf.security.policy.extension

Interface PolicyExtension

All Known Implementing Classes:

AdminConfigPolicy, WorkspacePolicyExtension

public interface PolicyExtension

This code is experimental. While this interface is functional and tested, it may change or be removed in a future version of the library.

Extends the policy of the Java PDP realm. These objects can provide additional policy information that cannot be captured through the standard match-all or match-one scenarios.

Method Summary

Modifier and Type	Method and Description
KeyValueCollectionPermission	isPermittedMatchAll(CollectionPermission subjectAllCollection, KeyValueCollectionPermission matchAllCollection, KeyValueCollectionPermission allPermissionsCollection) This method should return any permissions that it was unable to imply.
KeyValueCollectionPermission	isPermittedMatchOne(CollectionPermission subjectAllCollection, KeyValueCollectionPermission matchOneCollection, KeyValueCollectionPermission allPermissionsCollection) This method should return any permissions that it was unable to imply.

Method Detail

isPermittedMatchAll

KeyValueCollectionPermission isPermittedMatchAll(CollectionPermission subjectAllCollection,
                                                 KeyValueCollectionPermission matchAllCollection,
                                                 KeyValueCollectionPermission allPermissionsCollection)

This method should return any permissions that it was unable to imply. That should include any permissions that the method does not understand. For example: if 10 match all permissions are passed into the method and 2 of those permissions can be implied, then the method should return the remaining 8 match all permissions.

Warning: not returning any permissions from this method will immediately grant access to every request and bypass the rest of the PDP.

Parameters:

subjectAllCollection - Subject permissions

matchAllCollection - Match all permissions

allPermissionsCollection - Reference list of all permissions

Returns:

KeyValueCollectionPermission - set of permissions that can not be implied by this extension

isPermittedMatchOne

KeyValueCollectionPermission isPermittedMatchOne(CollectionPermission subjectAllCollection,
                                                 KeyValueCollectionPermission matchOneCollection,
                                                 KeyValueCollectionPermission allPermissionsCollection)

This method should return any permissions that it was unable to imply. That should include any permissions that the method does not understand. For example: if 10 match one permissions are passed into the method and 2 of those permissions can be implied, then the method should return the remaining 8 match one permissions.

Warning: not returning any permissions from this method will immediately grant access to every request and bypass the rest of the PDP.

Parameters:

subjectAllCollection - Subject permissions

matchOneCollection - Match one permissions

allPermissionsCollection - Reference list of all permissions

Returns:

KeyValueCollectionPermission - set of permissions that can not be implied by this extension