com.acciente.oacc

Class AccessControlContextProxy

java.lang.Object

com.acciente.oacc.AccessControlContextProxy

All Implemented Interfaces:

AccessControlContext

public class AccessControlContextProxy
extends Object
implements AccessControlContext

AccessControlContextProxy

This class is intended to be used as a proxy on an instance of the class that implements AccessControlContext to restrict access to the methods defined in the AccessControlContextProxy interface.

Field Summary

Fields inherited from interface com.acciente.oacc.AccessControlContext

SYSTEM_DOMAIN, SYSTEM_RESOURCE_CLASS

Constructor Summary

Constructors

Constructor and Description
AccessControlContextProxy()

Method Summary

Methods

Modifier and Type	Method and Description
void	assertGlobalResourcePermission(String resourceClassName, ResourcePermission resourcePermission) Checks if the current session resource has the specified global resource permission on the specified resource class in the session resource's domain.
void	assertGlobalResourcePermission(String resourceClassName, ResourcePermission resourcePermission, String domainName) Checks if the current session resource has the specified global resource permission on the specified resource class in the specified domain.
void	assertPostCreateResourcePermission(String resourceClassName, ResourcePermission resourcePermission) Checks if the current session resource would receive the specified permission on an object of the specified class in the session resource's domain, if were to create such an object.
void	assertPostCreateResourcePermission(String resourceClassName, ResourcePermission resourcePermission, String domainName) Checks if the current session resource would receive the specified permission on an object of the specified class in the specified domain, if were to create such an object.
void	assertResourcePermission(Resource accessedResource, ResourcePermission resourcePermission) Checks if the current session resource has the specified resource permission to the specified accessed resource.
void	assertResourcePermission(Resource accessorResource, Resource accessedResource, ResourcePermission resourcePermission) Checks if the specified accessor resource has the specified resource permission to the specified accessed resource.
void	authenticate(Resource resource, String password) Authenticates this security session.
Resource	createAuthenticatableResource(String resourceClassName, String password) Creates a new authenticatable resource in the same domain as the session resource.
Resource	createAuthenticatableResource(String resourceClassName, String domainName, String password) Creates a new authenticatable resource within the specified domain.
void	createDomain(String domainName) Creates a new domain (at the root level of the domain hierarchy).
void	createDomain(String domainName, String parentDomainName) Creates a new domain under the specified parent domain.
Resource	createResource(String resourceClassName) Creates a new resource class in the same domain as this session resource.
Resource	createResource(String resourceClassName, String domainName) Creates a new resource class within the specified domain.
void	createResourceClass(String resourceClassName, boolean authenticatable, boolean unuthenticatedCreateAllowed) Creates a new resource class.
void	createResourcePermission(String resourceClassName, String permissionName) Creates a new resource permission that may be applied to objects of the specified resource class.
Set<Resource>	getAccessorResourcesByResourcePermission(Resource accessedResource, String resourceClassName, ResourcePermission resourcePermission) Returns a set of resources that have the specified permission to the specified accessed resource.
Resource	getAuthenticatedResource() Returns the resource that is currently authenticated in this session.
Set<String>	getDomainDescendants(String domainName) Returns the domains which are descendants of the specified domain.
String	getDomainNameByResource(Resource resource) Returns the domain to which the specified resource belongs.
Set<DomainCreatePermission>	getEffectiveDomainCreatePermissions(Resource accessorResource) Gets all effective domain create permissions the specified accessor resource has, both directly and inherited (from other resources).
Set<DomainPermission>	getEffectiveDomainPermissions(Resource accessorResource, String domainName) Gets all effective domain permissions the accessor resource has to the specified domain.
Map<String,Set<DomainPermission>>	getEffectiveDomainPermissionsMap(Resource accessorResource) Gets all effective domain permissions the accessor resource has to any domain, mapped by domain name.
Set<ResourcePermission>	getEffectiveGlobalResourcePermissions(Resource accessorResource, String resourceClassName) Gets the effective global resource permissions the specified accessor resource has to the resources of the specified resource class in the current session resource's domain.
Set<ResourcePermission>	getEffectiveGlobalResourcePermissions(Resource accessorResource, String resourceClassName, String domainName) Gets the effective global resource permissions the specified accessor resource has to the resources of the specified resource class in the specified domain.
Map<String,Map<String,Set<ResourcePermission>>>	getEffectiveGlobalResourcePermissionsMap(Resource accessorResource) Gets all effective global resource permissions the specified accessor resource has to the resources of the any resource class in any domain, mapped by domain name and resource class name.
Set<ResourceCreatePermission>	getEffectiveResourceCreatePermissions(Resource accessorResource, String resourceClassName) Gets all effective resource create permissions the accessor resource has to the specified resource class in the the current session resource's domain (which effectively define the resource permissions the accessor resource will receive directly, if it created a resource of the specified resource class in the current session resource's domain).
Set<ResourceCreatePermission>	getEffectiveResourceCreatePermissions(Resource accessorResource, String resourceClassName, String domainName) Gets all effective resource create permissions the accessor resource has to the specified resource class in the specified domain (which effectively define the resource permissions the accessor resource will receive directly, if it created a resource of the specified resource class in the specified domain).
Map<String,Map<String,Set<ResourceCreatePermission>>>	getEffectiveResourceCreatePermissionsMap(Resource accessorResource) Gets all effective resource create permissions the accessor resource has to any resource class in any domain, mapped by domain name and resource class name.
Set<ResourcePermission>	getEffectiveResourcePermissions(Resource accessorResource, Resource accessedResource) Gets the effective resource permissions that the specified accessor resource has to the specified accessed resource both directly and inherited, but does not take into account any global resource permissions.
ResourceClassInfo	getResourceClassInfo(String resourceClassName) Returns information about the specified resource class.
ResourceClassInfo	getResourceClassInfoByResource(Resource resource) Returns information about the resource class to which the specified resource belongs.
List<String>	getResourceClassNames() Returns the list of names of all resource classes defined in the system
List<String>	getResourcePermissionNames(String resourceClassName) Returns the list of all resource permission names defined for the specified resource class name
Set<Resource>	getResourcesByResourcePermission(Resource accessorResource, String resourceClassName, ResourcePermission resourcePermission) Returns a set of resources (of the specified resource class) on which the specified accessor resource has the specified permission, regardless of domain.
Set<Resource>	getResourcesByResourcePermission(Resource accessorResource, String resourceClassName, ResourcePermission resourcePermission, String domainName) Returns a set of resources (of the specified resource class) on which the specified accessor resource has the specified permission, within the specified domain or within any descendant domains.
Set<Resource>	getResourcesByResourcePermission(String resourceClassName, ResourcePermission resourcePermission) Returns a set of resources (of the specified resource class) on which the current session resource has the specified permission.
Set<Resource>	getResourcesByResourcePermission(String resourceClassName, ResourcePermission resourcePermission, String domainName) Returns a set of resources (of the specified resource class) on which the current session resource has the specified permission, within the specified domain or within any descendant domains.
Resource	getSessionResource() Returns the session resource, that is, the resource whose security credentials are associated with this session.
void	impersonate(Resource resource) Switches the security credentials of this session to those of the specified resource.
void	setAuthenticatedResourcePassword(String newPassword) Sets the password of the currently authenticated resource Note that this method uses the credentials of the originally authenticated resource, and not those of any currently impersonated resource.
void	setDomainCreatePermissions(Resource accessorResource, Set<DomainCreatePermission> domainCreatePermissions) Sets the domain permissions the specified accessor resource will receive if it created a domain.
void	setDomainPermissions(Resource accessorResource, String domainName, Set<DomainPermission> domainPermissions) Sets the direct domain permissions the specified accessor resource has on the specified domain.
void	setGlobalResourcePermissions(Resource accessorResource, String resourceClassName, Set<ResourcePermission> resourcePermissions) Sets the global resource permissions a resource has on any resource of the specified resource class in the current session resource's domain.
void	setGlobalResourcePermissions(Resource accessorResource, String resourceClassName, Set<ResourcePermission> resourcePermissions, String domainName) Sets the global resource permissions a resource has on any resource of the specified resource class in the specified domain.
void	setResourceCreatePermissions(Resource accessorResource, String resourceClassName, Set<ResourceCreatePermission> resourceCreatePermissions) Sets the resource permissions the specified accessor resource will receive directly, if it created a resource of the specified resource class in the current session resource's domain.
void	setResourceCreatePermissions(Resource accessorResource, String resourceClassName, Set<ResourceCreatePermission> resourceCreatePermissions, String domainName) Sets the resource permissions the specified accessor resource will receive directly, if it created a resource of the specified resource class in the specified domain.
void	setResourcePassword(Resource resource, AuthenticationProvider authenticationProvider, String newPassword) Sets the password of the specified authenticatable resource (= a resource of a resource class that has been defined with the isAuthenticatable flag set) by means of an alternate specified authentication provider to this session.
void	setResourcePassword(Resource resource, String newPassword) Sets the password of the specified authenticatable resource (= a resource of a resource class that has been defined with the isAuthenticatable flag set).
void	setResourcePermissions(Resource accessorResource, Resource accessedResource, Set<ResourcePermission> resourcePermissions) Sets the specified resource permissions that the specified accessor resource has to the specified accessed resource directly, that is not via inheritance or globally.
void	unauthenticate() Logs out of this session, to be specific, disassociates any security credentials from this session.
void	unimpersonate() Unimpersonates the currently impersonated resource.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AccessControlContextProxy

public AccessControlContextProxy()

Method Detail

authenticate

public void authenticate(Resource resource,
                String password)
                  throws AccessControlException

Description copied from interface: AccessControlContext

Authenticates this security session.

The security credentials for this session will be those of the specified and authenticated resource.

Note: Unless a session is authenticated, all attempts to call any other methods (except authenticate) will fail.

Specified by:

authenticate in interface AccessControlContext

Parameters:

resource - the resource to be authenticated

password - the password associated with the resource

Throws:

AccessControlException - if an error occurs

unauthenticate

public void unauthenticate()
                    throws AccessControlException

Description copied from interface: AccessControlContext

Logs out of this session, to be specific, disassociates any security credentials from this session.

Specified by:

unauthenticate in interface AccessControlContext

Throws:

AccessControlException - if no resource is currently authenticated, or if an error occurs

impersonate

public void impersonate(Resource resource)
                 throws AccessControlException

Description copied from interface: AccessControlContext

Switches the security credentials of this session to those of the specified resource.

The currently authenticated resource has to have IMPERSONATE permissions to the specified resource.

Note that this method itself will use the credentials of the originally authenticated resource, and not those of any currently impersonated resource.

Specified by:

impersonate in interface AccessControlContext

Parameters:

resource - the resource to be impersonated

Throws:

AccessControlException - if an error occurs

unimpersonate

public void unimpersonate()
                   throws AccessControlException

Description copied from interface: AccessControlContext

Unimpersonates the currently impersonated resource.

Restores the session to the credentials of the authenticated resource.

If no resource is currently being impersonated, this call has no effect.

Specified by:

unimpersonate in interface AccessControlContext

Throws:

AccessControlException - if an error occurs

setAuthenticatedResourcePassword

public void setAuthenticatedResourcePassword(String newPassword)
                                      throws AccessControlException

Description copied from interface: AccessControlContext

Sets the password of the currently authenticated resource

Note that this method uses the credentials of the originally authenticated resource, and not those of any currently impersonated resource.

Specified by:

setAuthenticatedResourcePassword in interface AccessControlContext

Parameters:

newPassword - a new password for the currently authenticated resource

Throws:

AccessControlException - if an error occurs

setResourcePassword

public void setResourcePassword(Resource resource,
                       String newPassword)
                         throws AccessControlException

Description copied from interface: AccessControlContext

Sets the password of the specified authenticatable resource (= a resource of a resource class that has been defined with the isAuthenticatable flag set).

One of the following has to be true for this method to succeed:

• the specified resource has to either be the currently authenticated resource or
• the currently authenticated resource has to have SUPER-USER permission on the domain that contains the specified resource or
• the currently authenticated resource has to have RESET-PASSWORD permission on the specified resource.

Note that this method uses the credentials of the originally authenticated resource, and not those of any currently impersonated resource.

Specified by:

setResourcePassword in interface AccessControlContext

Parameters:

resource - the resource for which the password should be changed. The resource for which the password is to be changed must be the current auth resource, or the current auth resource must have SUPER-USER permissions to the domain containing the resource whose password is to be changed or must have RESET-PASSWORD permissions to the resource whose password is to be changed, otherwise an exception is thrown.

newPassword - the new password for the resource

Throws:

AccessControlException - if an error occurs

assertPostCreateResourcePermission

public void assertPostCreateResourcePermission(String resourceClassName,
                                      ResourcePermission resourcePermission)
                                        throws AccessControlException

Description copied from interface: AccessControlContext

Checks if the current session resource would receive the specified permission on an object of the specified class in the session resource's domain, if were to create such an object. The method takes into account any resource create permissions and global resource permissions of the session resource.

Specified by:

assertPostCreateResourcePermission in interface AccessControlContext

Parameters:

resourceClassName - a string resource class name

resourcePermission - the permission to be checked

Throws:

AccessControlException - if the session resource would not receive the specified permission after creating a resource of the specified class in the current session domain, or if an error occurs

assertPostCreateResourcePermission

public void assertPostCreateResourcePermission(String resourceClassName,
                                      ResourcePermission resourcePermission,
                                      String domainName)
                                        throws AccessControlException

Description copied from interface: AccessControlContext

Checks if the current session resource would receive the specified permission on an object of the specified class in the specified domain, if were to create such an object. The method takes into account any resource create permissions and global resource permissions of the session resource.

Specified by:

assertPostCreateResourcePermission in interface AccessControlContext

Parameters:

resourceClassName - a string resource class name

resourcePermission - the permission to be checked

domainName - the domain in which the permission should be checked

Throws:

AccessControlException - if the session resource would not receive the specified permission after creating a resource of the specified class in the specified domain, or if an error occurs

assertGlobalResourcePermission

public void assertGlobalResourcePermission(String resourceClassName,
                                  ResourcePermission resourcePermission)
                                    throws AccessControlException

Description copied from interface: AccessControlContext

Checks if the current session resource has the specified global resource permission on the specified resource class in the session resource's domain. This method takes into account any global permissions that the session resource may have.

Specified by:

assertGlobalResourcePermission in interface AccessControlContext

Parameters:

resourceClassName - a string resource class name

resourcePermission - the permission to be checked

Throws:

AccessControlException - if the session resource does not have the specified global permission, or if an error occurs

assertGlobalResourcePermission

public void assertGlobalResourcePermission(String resourceClassName,
                                  ResourcePermission resourcePermission,
                                  String domainName)
                                    throws AccessControlException

Description copied from interface: AccessControlContext

Checks if the current session resource has the specified global resource permission on the specified resource class in the specified domain. This method takes into account any global permissions that the session resource may have.

Specified by:

assertGlobalResourcePermission in interface AccessControlContext

Parameters:

resourceClassName - a string resource class name

resourcePermission - the permission to be checked

domainName - the domain in which the permission should be checked

Throws:

AccessControlException - if the session resource does not have the specified global permission, or if an error occurs

assertResourcePermission

public void assertResourcePermission(Resource accessedResource,
                            ResourcePermission resourcePermission)
                              throws AccessControlException

Description copied from interface: AccessControlContext

Checks if the current session resource has the specified resource permission to the specified accessed resource. This method takes into account direct, inherited and global permissions of the session resource.

Specified by:

assertResourcePermission in interface AccessControlContext

Parameters:

accessedResource - the resource on which access is being checked

resourcePermission - the permission to be checked

Throws:

AccessControlException - if the session resource does not have the specified permission, or if an error occurs

assertResourcePermission

public void assertResourcePermission(Resource accessorResource,
                            Resource accessedResource,
                            ResourcePermission resourcePermission)
                              throws AccessControlException

Description copied from interface: AccessControlContext

Checks if the specified accessor resource has the specified resource permission to the specified accessed resource. This method takes into account direct, inherited and global permissions of accessor resource.

Specified by:

assertResourcePermission in interface AccessControlContext

Parameters:

accessorResource - the resource requesting the access

accessedResource - the resource on which access is being requested

resourcePermission - the permission to be checked

Throws:

AccessControlException - if the accessor resource does not have the specified permission, or if an error occurs

getDomainNameByResource

public String getDomainNameByResource(Resource resource)
                               throws AccessControlException

Description copied from interface: AccessControlContext

Returns the domain to which the specified resource belongs.

Specified by:

getDomainNameByResource in interface AccessControlContext

Parameters:

resource - the resource for which to retrieve the domain name

Returns:

a string domain name

Throws:

AccessControlException - if an error occurs

getDomainDescendants

public Set<String> getDomainDescendants(String domainName)
                                 throws AccessControlException

Description copied from interface: AccessControlContext

Returns the domains which are descendants of the specified domain. The returned set includes the specified domain; in other words, a domain is considered its own descendant

Specified by:

getDomainDescendants in interface AccessControlContext

Parameters:

domainName - a domain name for which to retrieve the descendants

Returns:

a set of unique string domain names, including the domain queried about

Throws:

AccessControlException - if an error occurs

getResourceClassInfo

public ResourceClassInfo getResourceClassInfo(String resourceClassName)
                                       throws AccessControlException

Description copied from interface: AccessControlContext

Returns information about the specified resource class.

Specified by:

getResourceClassInfo in interface AccessControlContext

Parameters:

resourceClassName - a string resource class name about which to retrieve information

Returns:

a ResourceClassInfo object containing information about the resource class

Throws:

AccessControlException - if an error occurs

getResourceClassInfoByResource

public ResourceClassInfo getResourceClassInfoByResource(Resource resource)
                                                 throws AccessControlException

Description copied from interface: AccessControlContext

Returns information about the resource class to which the specified resource belongs.

Specified by:

getResourceClassInfoByResource in interface AccessControlContext

Parameters:

resource - a resource about whose resource class to retrieve information

Returns:

returns a ResourceClassInfo object containing information about the resource class of the specified resource

Throws:

AccessControlException - if an error occurs

getResourcesByResourcePermission

public Set<Resource> getResourcesByResourcePermission(String resourceClassName,
                                             ResourcePermission resourcePermission)
                                               throws AccessControlException

Description copied from interface: AccessControlContext

Returns a set of resources (of the specified resource class) on which the current session resource has the specified permission.

The method takes into account direct, inherited and global permissions, as well as resources that are reachable as a result of SUPER-USER permissions.

Specified by:

getResourcesByResourcePermission in interface AccessControlContext

Parameters:

resourceClassName - a string resource class name

resourcePermission - the permission to check

Returns:

a set of resources

Throws:

AccessControlException - if an error occurs

getResourcesByResourcePermission

public Set<Resource> getResourcesByResourcePermission(Resource accessorResource,
                                             String resourceClassName,
                                             ResourcePermission resourcePermission)
                                               throws AccessControlException

Description copied from interface: AccessControlContext

Returns a set of resources (of the specified resource class) on which the specified accessor resource has the specified permission, regardless of domain.

The method takes into account direct, inherited and global permissions, as well as resources that are reachable as a result of SUPER-USER permissions.

Specified by:

getResourcesByResourcePermission in interface AccessControlContext

Parameters:

accessorResource - the resource relative to which the set of accessible resources is computed

resourceClassName - a string resource class name

resourcePermission - the permission to check

Returns:

a set of resources

Throws:

AccessControlException - if an error occurs

getResourcesByResourcePermission

public Set<Resource> getResourcesByResourcePermission(String resourceClassName,
                                             ResourcePermission resourcePermission,
                                             String domainName)
                                               throws AccessControlException

Description copied from interface: AccessControlContext

Returns a set of resources (of the specified resource class) on which the current session resource has the specified permission, within the specified domain or within any descendant domains.

The method takes into account direct, inherited and global permissions, as well as resources that are reachable as a result of SUPER-USER permissions.

Specified by:

getResourcesByResourcePermission in interface AccessControlContext

Parameters:

resourceClassName - a string resource class name

resourcePermission - the permission to check

domainName - a domain name

Returns:

a set of resources

Throws:

AccessControlException - if an error occurs

getResourcesByResourcePermission

public Set<Resource> getResourcesByResourcePermission(Resource accessorResource,
                                             String resourceClassName,
                                             ResourcePermission resourcePermission,
                                             String domainName)
                                               throws AccessControlException

Description copied from interface: AccessControlContext

Returns a set of resources (of the specified resource class) on which the specified accessor resource has the specified permission, within the specified domain or within any descendant domains.

The method takes into account direct, inherited and global permissions, as well as resources that are reachable as a result of SUPER-USER permissions.

Specified by:

getResourcesByResourcePermission in interface AccessControlContext

Parameters:

accessorResource - the resource relative to which the set of accessible resources is computed

resourceClassName - a string resource class name

resourcePermission - the permission to check

domainName - a domain name

Returns:

a set of resources

Throws:

AccessControlException - if an error occurs

getAccessorResourcesByResourcePermission

public Set<Resource> getAccessorResourcesByResourcePermission(Resource accessedResource,
                                                     String resourceClassName,
                                                     ResourcePermission resourcePermission)
                                                       throws AccessControlException

Description copied from interface: AccessControlContext

Returns a set of resources that have the specified permission to the specified accessed resource.

This method works in the reverse direction of the AccessControlContext.getResourcesByResourcePermission(java.lang.String, com.acciente.oacc.ResourcePermission) method, but unlike getResourcesByResourcePermission it only takes into account direct permissions. In other words, this method ignores accessors that can reach the specified accessed resource via inherited permissions, global permissions and SUPER-USER privileges.

Specified by:

getAccessorResourcesByResourcePermission in interface AccessControlContext

Parameters:

accessedResource - the resource relative to which accessor resources are sought

resourceClassName - a string resource class name

resourcePermission - the permission to check

Returns:

a set of resources

Throws:

AccessControlException - if an error occurs

getAuthenticatedResource

public Resource getAuthenticatedResource()
                                  throws AccessControlException

Description copied from interface: AccessControlContext

Returns the resource that is currently authenticated in this session.

Specified by:

getAuthenticatedResource in interface AccessControlContext

Returns:

a resource

Throws:

AccessControlException - if no resource is authenticated

getSessionResource

public Resource getSessionResource()
                            throws AccessControlException

Description copied from interface: AccessControlContext

Returns the session resource, that is, the resource whose security credentials are associated with this session.

The session resource is the same as the authenticated resource, unless another resource is being impersonated.

Specified by:

getSessionResource in interface AccessControlContext

Returns:

a resource

Throws:

AccessControlException - if no resource is authenticated

setResourcePassword

public void setResourcePassword(Resource resource,
                       AuthenticationProvider authenticationProvider,
                       String newPassword)
                         throws AccessControlException

Description copied from interface: AccessControlContext

Sets the password of the specified authenticatable resource (= a resource of a resource class that has been defined with the isAuthenticatable flag set) by means of an alternate specified authentication provider to this session.

Note that this method requires this session to be unauthenticated.

This method is provided to allow for certain use cases, like a "forgotten password" reset, when a resource representing a "user" can not authenticate to this session. The specified alternate authentication provider provides a callback via the isAuthenticated method that allows this session to temporarily authenticate, for purposes of resetting the specified resource's password.

Specified by:

setResourcePassword in interface AccessControlContext

Parameters:

resource - the resource for which the password should be changed.

authenticationProvider - a callback that allows OACC to hook into the alternate authentication mechanism used to clear the password reset.

newPassword - the new password for the resource

Throws:

AccessControlException - if an error occurs

createResourceClass

public void createResourceClass(String resourceClassName,
                       boolean authenticatable,
                       boolean unuthenticatedCreateAllowed)
                         throws AccessControlException

Description copied from interface: AccessControlContext

Creates a new resource class.

Note that creating a resource is only allowed when this session is authenticated with the system-resource (resourceId=0)

Specified by:

createResourceClass in interface AccessControlContext

Parameters:

resourceClassName - a string resource class name

authenticatable - indicates if resources of this resource class are authenticatable. Typically only resource classes that represent users will be marked as authenticatable.

unuthenticatedCreateAllowed - if true, a resource of this resource class may be created from an unauthenticated session, otherwise the session must be authenticated to create resources of this class.

Throws:

AccessControlException - if an error occurs

createResourcePermission

public void createResourcePermission(String resourceClassName,
                            String permissionName)
                              throws AccessControlException

Description copied from interface: AccessControlContext

Creates a new resource permission that may be applied to objects of the specified resource class.

Note that creating a resource permission is only allowed when this session is authenticated with the system-resource (resourceId=0)

Specified by:

createResourcePermission in interface AccessControlContext

Parameters:

resourceClassName - a string resource class name

permissionName - the string representing the name of this permission. Samples of typical permission names: CREATE, READ, WRITE, UPDATE, VIEW, POST, EDIT, etc.

Throws:

AccessControlException - if an error occurs

createDomain

public void createDomain(String domainName)
                  throws AccessControlException

Description copied from interface: AccessControlContext

Creates a new domain (at the root level of the domain hierarchy).

Specified by:

createDomain in interface AccessControlContext

Parameters:

domainName - a string domain name

Throws:

AccessControlException - if an error occurs

createDomain

public void createDomain(String domainName,
                String parentDomainName)
                  throws AccessControlException

Description copied from interface: AccessControlContext

Creates a new domain under the specified parent domain.

Specified by:

createDomain in interface AccessControlContext

Parameters:

domainName - a string domain name

parentDomainName - the domain name of the parent domain

Throws:

AccessControlException - if an error occurs

createResource

public Resource createResource(String resourceClassName)
                        throws AccessControlException

Description copied from interface: AccessControlContext

Creates a new resource class in the same domain as this session resource.

Specified by:

createResource in interface AccessControlContext

Parameters:

resourceClassName - a string resource class name

Returns:

the integer resourceId of the newly created resource

Throws:

AccessControlException - if an error occurs

createResource

public Resource createResource(String resourceClassName,
                      String domainName)
                        throws AccessControlException

Description copied from interface: AccessControlContext

Creates a new resource class within the specified domain.

Note that the session resource must be member of the specified domain or have SUPER-USER privileges to the specified domain.

Specified by:

createResource in interface AccessControlContext

Parameters:

resourceClassName - a string resource class name

domainName - a string domain name

Returns:

the integer resourceId of the newly created resource

Throws:

AccessControlException - if an error occurs

createAuthenticatableResource

public Resource createAuthenticatableResource(String resourceClassName,
                                     String password)
                                       throws AccessControlException

Description copied from interface: AccessControlContext

Creates a new authenticatable resource in the same domain as the session resource.

Specified by:

createAuthenticatableResource in interface AccessControlContext

Parameters:

resourceClassName - a string resource class name

password - a string password with at least 6 characters and no leading or trailing spaces

Returns:

the integer resourceId of the newly created resource

Throws:

AccessControlException - if an error occurs

createAuthenticatableResource

public Resource createAuthenticatableResource(String resourceClassName,
                                     String domainName,
                                     String password)
                                       throws AccessControlException

Description copied from interface: AccessControlContext

Creates a new authenticatable resource within the specified domain.

Note that the session resource must be member of the specified domain or have SUPER-USER privileges to the specified domain.

Specified by:

createAuthenticatableResource in interface AccessControlContext

Parameters:

resourceClassName - a string resource class name

domainName - a string domain name

password - a string password with at least 6 characters and no leading or trailing spaces

Returns:

the integer resourceId of the newly created resource

Throws:

AccessControlException - if an error occurs

setDomainCreatePermissions

public void setDomainCreatePermissions(Resource accessorResource,
                              Set<DomainCreatePermission> domainCreatePermissions)
                                throws AccessControlException

Description copied from interface: AccessControlContext

Sets the domain permissions the specified accessor resource will receive if it created a domain.

Note that the system-defined CREATE permission needs to be included in the specified set of domain create permissions, unless all permissions should be revoked.

Also note that this method replaces any direct domain create permissions previously granted, but does not affect any domain create permissions the specified accessor resource receives via inheritance.

Specified by:

setDomainCreatePermissions in interface AccessControlContext

Parameters:

accessorResource - the resource to which the privilege should be granted

domainCreatePermissions - the permissions to be granted to the specified domain

Throws:

AccessControlException - if an error occurs

getEffectiveDomainCreatePermissions

public Set<DomainCreatePermission> getEffectiveDomainCreatePermissions(Resource accessorResource)
                                                                throws AccessControlException

Description copied from interface: AccessControlContext

Gets all effective domain create permissions the specified accessor resource has, both directly and inherited (from other resources).

Specified by:

getEffectiveDomainCreatePermissions in interface AccessControlContext

Parameters:

accessorResource - the accessor resource relative which permissions should be returned

Returns:

a set of effective domain create permission the accessor resource has

Throws:

AccessControlException - if an error occurs

setDomainPermissions

public void setDomainPermissions(Resource accessorResource,
                        String domainName,
                        Set<DomainPermission> domainPermissions)
                          throws AccessControlException

Description copied from interface: AccessControlContext

Sets the direct domain permissions the specified accessor resource has on the specified domain.

Note that this method overwrites any direct domain permissions to the specified domain that the accessor has, including permissions granted by other resources.

This call does not change inherited domain permissions the specified accessor resource has on the specified domain, or any domain permissions already granted on ancestors of the domain.

Specified by:

setDomainPermissions in interface AccessControlContext

Parameters:

accessorResource - the resource to which the privilege should be granted

domainName - a string domain name

domainPermissions - the permissions to be granted on the specified domain

Throws:

AccessControlException - if an error occurs

getEffectiveDomainPermissions

public Set<DomainPermission> getEffectiveDomainPermissions(Resource accessorResource,
                                                  String domainName)
                                                    throws AccessControlException

Description copied from interface: AccessControlContext

Gets all effective domain permissions the accessor resource has to the specified domain.

This method takes into account direct domain permissions, inherited domain permissions and any domain permissions the accessor may have to ancestors of the specified domain. In other words, this method will return the domain permissions the specified accessor resource has to the specified domain as a result of the permissions the accessor has on any ancestor (parent, or grandparent, etc.) of that domain.

Specified by:

getEffectiveDomainPermissions in interface AccessControlContext

Parameters:

accessorResource - the accessor resource relative which permissions should be returned

domainName - a string domain name

Returns:

the set of all effective domain permission the accessor resource has to the domain

Throws:

AccessControlException - if an error occurs

getEffectiveDomainPermissionsMap

public Map<String,Set<DomainPermission>> getEffectiveDomainPermissionsMap(Resource accessorResource)
                                                                   throws AccessControlException

Description copied from interface: AccessControlContext

Gets all effective domain permissions the accessor resource has to any domain, mapped by domain name.

This method takes into account direct domain permissions, inherited domain permissions and any domain permissions the accessor may have to ancestors of each domain. The result is returned as a map keyed by the domain name, where each value is the set of permissions for the domain name of the key.

Specified by:

getEffectiveDomainPermissionsMap in interface AccessControlContext

Parameters:

accessorResource - the accessor resource relative which permissions should be returned

Returns:

the sets of effective domain permission the accessor resource has to any domain, mapped by domain name

Throws:

AccessControlException - if an error occurs

setResourceCreatePermissions

public void setResourceCreatePermissions(Resource accessorResource,
                                String resourceClassName,
                                Set<ResourceCreatePermission> resourceCreatePermissions,
                                String domainName)
                                  throws AccessControlException

Description copied from interface: AccessControlContext

Sets the resource permissions the specified accessor resource will receive directly, if it created a resource of the specified resource class in the specified domain.

Note that the system-defined CREATE permission must be included in the specified set of resource create permissions, unless all permissions should be revoked.

Including the CREATE permission allows the accessor resource to create resources of the specified resource class and domain. But if the CREATE permission is the only one specified, then the accessor would not receive any direct permissions on the newly created resource. This is appropriate, for example, if the accessor would already obtain privileges to the newly created resource via global resource permissions, or if indeed the accessor should not receive any direct access to the newly created resource.

Also note that this method replaces any direct resource create permissions previously granted, but does not affect any resource create permissions the specified accessor resource receives via inheritance or from the specified domain's ancestors.

Specified by:

setResourceCreatePermissions in interface AccessControlContext

Parameters:

accessorResource - the resource to which the privilege should be granted

resourceClassName - a string resource class name

resourceCreatePermissions - a set of resource create permissions to be granted

domainName - a string representing a valid domain name

Throws:

AccessControlException - if an error occurs

getEffectiveResourceCreatePermissions

public Set<ResourceCreatePermission> getEffectiveResourceCreatePermissions(Resource accessorResource,
                                                                  String resourceClassName,
                                                                  String domainName)
                                                                    throws AccessControlException

Description copied from interface: AccessControlContext

Gets all effective resource create permissions the accessor resource has to the specified resource class in the specified domain (which effectively define the resource permissions the accessor resource will receive directly, if it created a resource of the specified resource class in the specified domain).

This method takes into account direct resource create permissions, inherited resource create permissions and any resource create permissions the accessor may have to ancestors of the specified domain.

Specified by:

getEffectiveResourceCreatePermissions in interface AccessControlContext

Parameters:

accessorResource - the accessor resource relative which permissions should be returned

resourceClassName - a string resource class name

domainName - a string representing a valid domain name

Returns:

a set of effective resource create permissions

Throws:

AccessControlException - if an error occurs

setResourceCreatePermissions

public void setResourceCreatePermissions(Resource accessorResource,
                                String resourceClassName,
                                Set<ResourceCreatePermission> resourceCreatePermissions)
                                  throws AccessControlException

Description copied from interface: AccessControlContext

Sets the resource permissions the specified accessor resource will receive directly, if it created a resource of the specified resource class in the current session resource's domain.

Note that the system-defined CREATE permission must be included in the specified set of resource create permissions, unless all permissions should be revoked.

Including the CREATE permission allows the accessor resource to create resources of the specified resource class and domain. But if the CREATE permission is the only one specified, then the accessor would not receive any direct permissions on the newly created resource. This is appropriate, for example, if the accessor would already obtain privileges to the newly created resource via global resource permissions, or if indeed the accessor should not receive any direct access to the newly created resource.

Also note that this method replaces any direct resource create permissions previously granted, but does not affect any resource create permissions the specified accessor resource receives via inheritance or from any ancestor of the current session resource's domain.

Specified by:

setResourceCreatePermissions in interface AccessControlContext

Parameters:

accessorResource - the resource to which the privilege should be granted

resourceClassName - a string resource class name

resourceCreatePermissions - a set of resource create permissions to be granted

Throws:

AccessControlException - if an error occurs

getEffectiveResourceCreatePermissions

public Set<ResourceCreatePermission> getEffectiveResourceCreatePermissions(Resource accessorResource,
                                                                  String resourceClassName)
                                                                    throws AccessControlException

Description copied from interface: AccessControlContext

Gets all effective resource create permissions the accessor resource has to the specified resource class in the the current session resource's domain (which effectively define the resource permissions the accessor resource will receive directly, if it created a resource of the specified resource class in the current session resource's domain).

This method takes into account direct resource create permissions, inherited resource create permissions and any resource create permissions the accessor may have to ancestors of the current session resource's domain.

Specified by:

getEffectiveResourceCreatePermissions in interface AccessControlContext

Parameters:

accessorResource - the accessor resource relative which permissions should be returned

resourceClassName - a string resource class name

Returns:

a set of effective resource create permissions

Throws:

AccessControlException - if an error occurs

getEffectiveResourceCreatePermissionsMap

public Map<String,Map<String,Set<ResourceCreatePermission>>> getEffectiveResourceCreatePermissionsMap(Resource accessorResource)
                                                                                               throws AccessControlException

Description copied from interface: AccessControlContext

Gets all effective resource create permissions the accessor resource has to any resource class in any domain, mapped by domain name and resource class name.

Resource create permissions effectively define the resource permissions the accessor resource will receive directly, if it created a resource of a resource class in a domain.

This method takes into account direct resource create permissions, inherited resource create permissions and any resource create permissions the accessor may have to ancestors of each domain.

The result is returned as a map keyed by the domain name, where each value is another map keyed by resource class name, in which each value is the set of resource create permissions for the resource class and domain name of the respective keys.

Specified by:

getEffectiveResourceCreatePermissionsMap in interface AccessControlContext

Parameters:

accessorResource - the accessor resource relative which permissions should be returned

Returns:

a map of maps of effective resource create permissions, keyed by domain name and resource class name

Throws:

AccessControlException - if an error occurs

setResourcePermissions

public void setResourcePermissions(Resource accessorResource,
                          Resource accessedResource,
                          Set<ResourcePermission> resourcePermissions)
                            throws AccessControlException

Description copied from interface: AccessControlContext

Sets the specified resource permissions that the specified accessor resource has to the specified accessed resource directly, that is not via inheritance or globally.

This method replaces any direct resource permissions previously granted, but does not affect any resource permissions the specified accessor resource receives via inheritance.

Specified by:

setResourcePermissions in interface AccessControlContext

Parameters:

accessorResource - the resource to which the privilege should be granted

accessedResource - the resource on which the privilege is granted

resourcePermissions - a set of resource permissions to be granted

Throws:

AccessControlException - if an error occurs

getEffectiveResourcePermissions

public Set<ResourcePermission> getEffectiveResourcePermissions(Resource accessorResource,
                                                      Resource accessedResource)
                                                        throws AccessControlException

Description copied from interface: AccessControlContext

Gets the effective resource permissions that the specified accessor resource has to the specified accessed resource both directly and inherited, but does not take into account any global resource permissions.

Specified by:

getEffectiveResourcePermissions in interface AccessControlContext

Parameters:

accessorResource - the resource relative to which the permissions should be returned

accessedResource - the resource on which the privilege is granted

Returns:

a set of effective resource permissions

Throws:

AccessControlException - if an error occurs

setGlobalResourcePermissions

public void setGlobalResourcePermissions(Resource accessorResource,
                                String resourceClassName,
                                Set<ResourcePermission> resourcePermissions,
                                String domainName)
                                  throws AccessControlException

Description copied from interface: AccessControlContext

Sets the global resource permissions a resource has on any resource of the specified resource class in the specified domain.

Global resource permissions are resource permissions that are defined on a resource class for a given resource domain and thus apply to any and all resources of that resource class and domain. They are not associated directly with every individual resource of that resource class and domain!

Note that the system-defined CREATE resource permission may NOT be set as a global resource permission, because it would be nonsensical. Currently the system-defined INHERIT resource permission may also not be set as a global resource permission.

This method replaces any direct global resource permissions previously granted, but does not affect any global resource permissions the specified accessor resource receives via inheritance or from the specified domain's ancestors.

Specified by:

setGlobalResourcePermissions in interface AccessControlContext

Parameters:

accessorResource - the resource to which the privilege should be granted

resourceClassName - a string resource class name

resourcePermissions - the set of resource permissions to be granted globally to the specified resource class and domain

domainName - a string domain name

Throws:

AccessControlException - if an error occurs

getEffectiveGlobalResourcePermissions

public Set<ResourcePermission> getEffectiveGlobalResourcePermissions(Resource accessorResource,
                                                            String resourceClassName,
                                                            String domainName)
                                                              throws AccessControlException

Description copied from interface: AccessControlContext

Gets the effective global resource permissions the specified accessor resource has to the resources of the specified resource class in the specified domain.

This method takes into account direct global resource permissions, inherited global resource permissions and any global resource permissions the accessor may have to ancestors of the specified domain.

Specified by:

getEffectiveGlobalResourcePermissions in interface AccessControlContext

Parameters:

accessorResource - the resource relative to which the permissions should be returned

resourceClassName - a string resource class name

domainName - a string domain name

Returns:

a set of effective global resource permissions the accessor resource has to resources in the specified resource class and domain

Throws:

AccessControlException - if an error occurs

setGlobalResourcePermissions

public void setGlobalResourcePermissions(Resource accessorResource,
                                String resourceClassName,
                                Set<ResourcePermission> resourcePermissions)
                                  throws AccessControlException

Description copied from interface: AccessControlContext

Sets the global resource permissions a resource has on any resource of the specified resource class in the current session resource's domain.

Global resource permissions are resource permissions that are defined on a resource class for a given resource domain and thus apply to any and all resources of that resource class and domain. They are not associated directly with every individual resource of that resource class and domain!

Note that the system-defined CREATE resource permission may NOT be set as a global resource permission, because it would be nonsensical. Currently the system-defined INHERIT resource permission may also not be set as a global resource permission.

This method replaces any direct global resource permissions previously granted, but does not affect any global resource permissions the specified accessor resource receives via inheritance or from any ancestors of the current session resource's domain.

Specified by:

setGlobalResourcePermissions in interface AccessControlContext

Parameters:

accessorResource - the resource to which the privilege should be granted

resourceClassName - a string resource class name

resourcePermissions - the set of resource permissions to be granted globally to the specified resource class and session resource's domain

Throws:

AccessControlException - if an error occurs

getEffectiveGlobalResourcePermissions

public Set<ResourcePermission> getEffectiveGlobalResourcePermissions(Resource accessorResource,
                                                            String resourceClassName)
                                                              throws AccessControlException

Description copied from interface: AccessControlContext

Gets the effective global resource permissions the specified accessor resource has to the resources of the specified resource class in the current session resource's domain.

This method takes into account direct global resource permissions, inherited global resource permissions and any global resource permissions the accessor may have to ancestors of the current session resource's domain.

Specified by:

getEffectiveGlobalResourcePermissions in interface AccessControlContext

Parameters:

accessorResource - the resource relative to which the permissions should be returned

resourceClassName - a string resource class name

Returns:

the set of effective global resource permissions the accessor resource has to resources of the specified resource class in the current session resource's domain

Throws:

AccessControlException - if an error occurs

getEffectiveGlobalResourcePermissionsMap

public Map<String,Map<String,Set<ResourcePermission>>> getEffectiveGlobalResourcePermissionsMap(Resource accessorResource)
                                                                                         throws AccessControlException

Description copied from interface: AccessControlContext

Gets all effective global resource permissions the specified accessor resource has to the resources of the any resource class in any domain, mapped by domain name and resource class name.

This method takes into account direct global resource permissions, inherited global resource permissions and any global resource permissions the accessor may have to ancestors of each domain.

The result is returned as a map keyed by the domain name, where each value is another map keyed by resource class name, in which each value is the set of global resource permissions for the resource class and domain name of the respective keys.

Specified by:

getEffectiveGlobalResourcePermissionsMap in interface AccessControlContext

Parameters:

accessorResource - the resource relative to which the permissions should be returned

Returns:

a map of maps of all effective global resource permissions the accessor resource has, keyed by domain name and resource class name

Throws:

AccessControlException - if an error occurs

getResourceClassNames

public List<String> getResourceClassNames()
                                   throws AccessControlException

Description copied from interface: AccessControlContext

Returns the list of names of all resource classes defined in the system

Specified by:

getResourceClassNames in interface AccessControlContext

Returns:

a list of string resource class names

Throws:

AccessControlException - if an error occurs

getResourcePermissionNames

public List<String> getResourcePermissionNames(String resourceClassName)
                                        throws AccessControlException

Description copied from interface: AccessControlContext

Returns the list of all resource permission names defined for the specified resource class name

Specified by:

getResourcePermissionNames in interface AccessControlContext

Parameters:

resourceClassName - the resource class name for which the permissions should be retrieved

Returns:

a list of string permission names

Throws:

AccessControlException - if an error occurs