public class AdministrativePointInterceptor extends BaseInterceptor
| Modifier and Type | Field and Description |
|---|---|
private static java.util.Set<java.lang.String> |
INNER_AREA_ROLES
The possible inner area roles
|
private static boolean |
IS_DEBUG
Speedup for logs
|
private static org.slf4j.Logger |
LOG
A
Logger for this class |
private java.util.concurrent.locks.ReentrantReadWriteLock |
mutex
A lock to guarantee the AP cache consistency
|
private PartitionNexus |
nexus
A reference to the nexus for direct backend operations
|
private static java.util.Set<java.lang.String> |
ROLES
The possible roles
|
private static java.util.Map<java.lang.String,java.lang.String> |
ROLES_OID
A Map to associate a role with it's OID
|
private static java.util.Set<java.lang.String> |
SPECIFIC_AREA_ROLES
The possible specific area roles
|
directoryService, dnFactory, PWD_POLICY_STATE_ATTRIBUTE_TYPES, schemaManager| Constructor and Description |
|---|
AdministrativePointInterceptor()
Creates a new instance of a AdministrativePointInterceptor.
|
| Modifier and Type | Method and Description |
|---|---|
void |
add(AddOperationContext addContext)
Add an administrative point into the DIT.
|
private void |
addAdminPointCache(java.util.List<org.apache.directory.api.ldap.model.entry.Entry> adminPointEntries)
Update The Administrative Points cache, adding the given AdminPoints
|
private void |
addRole(java.lang.String role,
org.apache.directory.api.ldap.model.name.Dn dn,
java.lang.String uuid,
org.apache.directory.api.ldap.util.tree.DnNode<AccessControlAdministrativePoint> acapCache,
org.apache.directory.api.ldap.util.tree.DnNode<CollectiveAttributeAdministrativePoint> caapCache,
org.apache.directory.api.ldap.util.tree.DnNode<TriggerExecutionAdministrativePoint> teapCache,
org.apache.directory.api.ldap.util.tree.DnNode<SubschemaAdministrativePoint> ssapCache)
Update the cache clones with the added roles
|
private void |
checkAddRole(org.apache.directory.api.ldap.model.entry.Value<?> role,
org.apache.directory.api.ldap.model.entry.Attribute adminPoint,
org.apache.directory.api.ldap.model.name.Dn dn)
Check if we can safely add a role.
|
private void |
checkDelRole(org.apache.directory.api.ldap.model.entry.Value<?> role,
org.apache.directory.api.ldap.model.entry.Attribute adminPoint,
org.apache.directory.api.ldap.model.name.Dn dn)
Check if we can safely delete a role
|
private void |
checkIAPHasParent(java.lang.String role,
org.apache.directory.api.ldap.model.entry.Attribute adminPoint,
org.apache.directory.api.ldap.model.name.Dn dn)
Check that the IAPs (if any) have a parent.
|
private void |
checkInnerSpecificMix(java.lang.String role,
org.apache.directory.api.ldap.model.entry.Attribute adminPoint)
Check that we don't have an IAP and a SAP with the same family
|
private void |
createAdministrativePoints(org.apache.directory.api.ldap.model.entry.Attribute adminPoint,
org.apache.directory.api.ldap.model.name.Dn dn,
java.lang.String uuid)
Create the list of AP for a given entry
|
void |
delete(DeleteOperationContext deleteContext)
We have to check that we can remove the associated AdministrativePoint :
if we remove an AAP, no descendant IAP should remain orphan If we remove a SAP, no descendant IAP should remain orphan Filters Partition#delete( DeleteOperationContext ) call. |
private void |
deleteAdminPointCache(org.apache.directory.api.ldap.model.entry.Attribute adminPoint,
DeleteOperationContext deleteContext)
Update The Administrative Points cache, removing the given AdminPoint
|
private void |
delRole(java.lang.String role,
org.apache.directory.api.ldap.model.name.Dn dn,
java.lang.String uuid,
org.apache.directory.api.ldap.util.tree.DnNode<AccessControlAdministrativePoint> acapCache,
org.apache.directory.api.ldap.util.tree.DnNode<CollectiveAttributeAdministrativePoint> caapCache,
org.apache.directory.api.ldap.util.tree.DnNode<TriggerExecutionAdministrativePoint> teapCache,
org.apache.directory.api.ldap.util.tree.DnNode<SubschemaAdministrativePoint> ssapCache)
Update the cache clones with the added roles
|
void |
destroy()
This method does nothing by default.
|
private AdministrativePoint |
findParent(AdministrativePoint ap,
org.apache.directory.api.ldap.util.tree.DnNode<java.util.List<AdministrativePoint>> currentNode)
Find the parent for the given administrative point.
|
private java.util.List<org.apache.directory.api.ldap.model.entry.Entry> |
getAdministrativePoints() |
private AdministrativePoint |
getParent(AdministrativePoint ap,
java.util.List<AdministrativePoint> aps,
org.apache.directory.api.ldap.model.subtree.AdministrativeRole role,
org.apache.directory.api.ldap.util.tree.DnNode<java.util.List<AdministrativePoint>> currentNode) |
private boolean |
hasAccessControlSpecificRole(org.apache.directory.api.ldap.model.entry.Attribute adminPoint) |
private boolean |
hasCollectiveAttributeSpecificRole(org.apache.directory.api.ldap.model.entry.Attribute adminPoint) |
private boolean |
hasTriggerExecutionSpecificRole(org.apache.directory.api.ldap.model.entry.Attribute adminPoint) |
void |
init(DirectoryService directoryService)
Registers and initializes all
Authenticators to this service. |
private boolean |
isAAP(org.apache.directory.api.ldap.model.entry.Attribute adminPoint)
Tells if the Administrative Point role is an AAP
|
private boolean |
isAccessControlInnerRole(java.lang.String role)
Tells if the role is an AC IAP
|
private boolean |
isAccessControlSpecificRole(java.lang.String role)
Tells if the role is an AC SAP
|
private boolean |
isAutonomousAreaRole(java.lang.String role)
Tells if the role is an AAP
|
private boolean |
isCollectiveAttributeInnerRole(java.lang.String role)
Tells if the role is a CA IAP
|
private boolean |
isCollectiveAttributeSpecificRole(java.lang.String role)
Tells if the role is a CA SAP
|
private boolean |
isIAP(java.lang.String role) |
private boolean |
isSubschemaSpecficRole(java.lang.String role)
Tells if the role is a SS SAP
|
private boolean |
isTriggerExecutionInnerRole(java.lang.String role)
Tells if the role is a TE IAP
|
private boolean |
isTriggerExecutionSpecificRole(java.lang.String role)
Tells if the role is a TE SAP
|
private boolean |
isValidRole(java.lang.String role)
Tells if a given role is a valid administrative role.
|
void |
lockRead()
Get a read-lock on the AP cache.
|
void |
lockWrite()
Get a write-lock on the AP cache.
|
void |
modify(ModifyOperationContext modifyContext)
Only the add and remove modifications are fully supported.
|
void |
move(MoveOperationContext moveContext)
Filters
Partition#move( MoveOperationContext ) call. |
void |
moveAndRename(MoveAndRenameOperationContext moveAndRenameContext)
Filters
Partition#moveAndRename( MoveAndRenameOperationContext) call. |
void |
rename(RenameOperationContext renameContext)
Filters
Partition#rename( RenameOperationContext ) call. |
void |
unlock()
Release the read-write lock on the AP cache.
|
private static final org.slf4j.Logger LOG
Logger for this classprivate static final boolean IS_DEBUG
private PartitionNexus nexus
private static final java.util.Set<java.lang.String> ROLES
private static final java.util.Map<java.lang.String,java.lang.String> ROLES_OID
private static final java.util.Set<java.lang.String> INNER_AREA_ROLES
private static final java.util.Set<java.lang.String> SPECIFIC_AREA_ROLES
private java.util.concurrent.locks.ReentrantReadWriteLock mutex
public AdministrativePointInterceptor()
public void lockRead()
public void lockWrite()
public void unlock()
private void createAdministrativePoints(org.apache.directory.api.ldap.model.entry.Attribute adminPoint,
org.apache.directory.api.ldap.model.name.Dn dn,
java.lang.String uuid)
throws org.apache.directory.api.ldap.model.exception.LdapException
org.apache.directory.api.ldap.model.exception.LdapExceptionprivate void addRole(java.lang.String role,
org.apache.directory.api.ldap.model.name.Dn dn,
java.lang.String uuid,
org.apache.directory.api.ldap.util.tree.DnNode<AccessControlAdministrativePoint> acapCache,
org.apache.directory.api.ldap.util.tree.DnNode<CollectiveAttributeAdministrativePoint> caapCache,
org.apache.directory.api.ldap.util.tree.DnNode<TriggerExecutionAdministrativePoint> teapCache,
org.apache.directory.api.ldap.util.tree.DnNode<SubschemaAdministrativePoint> ssapCache)
throws org.apache.directory.api.ldap.model.exception.LdapException
org.apache.directory.api.ldap.model.exception.LdapExceptionprivate void delRole(java.lang.String role,
org.apache.directory.api.ldap.model.name.Dn dn,
java.lang.String uuid,
org.apache.directory.api.ldap.util.tree.DnNode<AccessControlAdministrativePoint> acapCache,
org.apache.directory.api.ldap.util.tree.DnNode<CollectiveAttributeAdministrativePoint> caapCache,
org.apache.directory.api.ldap.util.tree.DnNode<TriggerExecutionAdministrativePoint> teapCache,
org.apache.directory.api.ldap.util.tree.DnNode<SubschemaAdministrativePoint> ssapCache)
throws org.apache.directory.api.ldap.model.exception.LdapException
org.apache.directory.api.ldap.model.exception.LdapExceptionprivate AdministrativePoint getParent(AdministrativePoint ap, java.util.List<AdministrativePoint> aps, org.apache.directory.api.ldap.model.subtree.AdministrativeRole role, org.apache.directory.api.ldap.util.tree.DnNode<java.util.List<AdministrativePoint>> currentNode)
private AdministrativePoint findParent(AdministrativePoint ap, org.apache.directory.api.ldap.util.tree.DnNode<java.util.List<AdministrativePoint>> currentNode)
private void checkAddRole(org.apache.directory.api.ldap.model.entry.Value<?> role,
org.apache.directory.api.ldap.model.entry.Attribute adminPoint,
org.apache.directory.api.ldap.model.name.Dn dn)
throws org.apache.directory.api.ldap.model.exception.LdapException
org.apache.directory.api.ldap.model.exception.LdapExceptionprivate void checkDelRole(org.apache.directory.api.ldap.model.entry.Value<?> role,
org.apache.directory.api.ldap.model.entry.Attribute adminPoint,
org.apache.directory.api.ldap.model.name.Dn dn)
throws org.apache.directory.api.ldap.model.exception.LdapException
org.apache.directory.api.ldap.model.exception.LdapExceptionprivate java.util.List<org.apache.directory.api.ldap.model.entry.Entry> getAdministrativePoints()
throws org.apache.directory.api.ldap.model.exception.LdapException
org.apache.directory.api.ldap.model.exception.LdapExceptionprivate boolean isValidRole(java.lang.String role)
private void addAdminPointCache(java.util.List<org.apache.directory.api.ldap.model.entry.Entry> adminPointEntries)
throws org.apache.directory.api.ldap.model.exception.LdapException
org.apache.directory.api.ldap.model.exception.LdapExceptionprivate void deleteAdminPointCache(org.apache.directory.api.ldap.model.entry.Attribute adminPoint,
DeleteOperationContext deleteContext)
throws org.apache.directory.api.ldap.model.exception.LdapException
org.apache.directory.api.ldap.model.exception.LdapExceptionprivate boolean isAccessControlInnerRole(java.lang.String role)
private boolean isAccessControlSpecificRole(java.lang.String role)
private boolean isCollectiveAttributeInnerRole(java.lang.String role)
private boolean isCollectiveAttributeSpecificRole(java.lang.String role)
private boolean isTriggerExecutionInnerRole(java.lang.String role)
private boolean isTriggerExecutionSpecificRole(java.lang.String role)
private boolean isSubschemaSpecficRole(java.lang.String role)
private boolean isAutonomousAreaRole(java.lang.String role)
private boolean isAAP(org.apache.directory.api.ldap.model.entry.Attribute adminPoint)
private boolean hasAccessControlSpecificRole(org.apache.directory.api.ldap.model.entry.Attribute adminPoint)
private boolean isIAP(java.lang.String role)
private boolean hasCollectiveAttributeSpecificRole(org.apache.directory.api.ldap.model.entry.Attribute adminPoint)
private boolean hasTriggerExecutionSpecificRole(org.apache.directory.api.ldap.model.entry.Attribute adminPoint)
private void checkInnerSpecificMix(java.lang.String role,
org.apache.directory.api.ldap.model.entry.Attribute adminPoint)
throws org.apache.directory.api.ldap.model.exception.LdapUnwillingToPerformException
org.apache.directory.api.ldap.model.exception.LdapUnwillingToPerformExceptionprivate void checkIAPHasParent(java.lang.String role,
org.apache.directory.api.ldap.model.entry.Attribute adminPoint,
org.apache.directory.api.ldap.model.name.Dn dn)
throws org.apache.directory.api.ldap.model.exception.LdapUnwillingToPerformException
org.apache.directory.api.ldap.model.exception.LdapUnwillingToPerformExceptionpublic void init(DirectoryService directoryService) throws org.apache.directory.api.ldap.model.exception.LdapException
Authenticators to this service.init in interface Interceptorinit in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionpublic void destroy()
destroy in interface Interceptordestroy in class BaseInterceptorpublic void add(AddOperationContext addContext) throws org.apache.directory.api.ldap.model.exception.LdapException
add in interface Interceptoradd in class BaseInterceptoraddContext - The AddOperationContext instanceorg.apache.directory.api.ldap.model.exception.LdapException - If we had some error while processing the Add operationpublic void delete(DeleteOperationContext deleteContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#delete( DeleteOperationContext ) call.delete in interface Interceptordelete in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionpublic void modify(ModifyOperationContext modifyContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#modify( ModifyOperationContext ) call.modify in interface Interceptormodify in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionpublic void move(MoveOperationContext moveContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#move( MoveOperationContext ) call.move in interface Interceptormove in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionpublic void moveAndRename(MoveAndRenameOperationContext moveAndRenameContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#moveAndRename( MoveAndRenameOperationContext) call.moveAndRename in interface InterceptormoveAndRename in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionpublic void rename(RenameOperationContext renameContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#rename( RenameOperationContext ) call.rename in interface Interceptorrename in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapException