public class AciAuthorizationInterceptor extends BaseInterceptor
| Modifier and Type | Class and Description |
|---|---|
private class |
AciAuthorizationInterceptor.AuthorizationFilter
WARNING: create one of these filters fresh every time for each new search.
|
| Modifier and Type | Field and Description |
|---|---|
private static org.slf4j.Logger |
ACI_LOG
the dedicated logger for ACI
|
private org.apache.directory.api.ldap.aci.ACIItemParser |
aciParser
a normalizing ACIItem parser
|
private static java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> |
ADD_PERMS |
private static java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> |
BROWSE_PERMS |
private static java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> |
COMPARE_PERMS |
static javax.naming.directory.SearchControls |
DEFAULT_SEARCH_CONTROLS |
private ACDFEngine |
engine
use and instance of the ACDF engine
|
private static java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> |
EXPORT_PERMS |
private GroupCache |
groupCache
a groupCache that responds to add, delete, and modify attempts
|
private static java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> |
IMPORT_PERMS |
private static org.slf4j.Logger |
LOG
the logger for this class
|
private static java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> |
LOOKUP_PERMS |
private static java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> |
MOVERENAME_PERMS |
private PartitionNexus |
nexus
A reference to the nexus for direct backend operations
|
private static java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> |
READ_PERMS |
private static java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> |
REMOVE_PERMS |
private static java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> |
RENAME_PERMS |
private static java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> |
REPLACE_PERMS |
private static java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> |
SEARCH_ATTRVAL_PERMS |
private static java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> |
SEARCH_ENTRY_PERMS |
private static SubentryUtils |
subentryUtils
The SubentryUtils instance
|
private java.lang.String |
subschemaSubentryDn
the system wide subschemaSubentryDn
|
private TupleCache |
tupleCache
a tupleCache that responds to add, delete, and modify attempts
|
directoryService, dnFactory, PWD_POLICY_STATE_ATTRIBUTE_TYPES, schemaManager| Constructor and Description |
|---|
AciAuthorizationInterceptor()
Create a AciAuthorizationInterceptor instance
|
| Modifier and Type | Method and Description |
|---|---|
void |
add(AddOperationContext addContext)
Filters
Partition#add( AddOperationContext ) call. |
private void |
addEntryAciTuples(java.util.Collection<org.apache.directory.api.ldap.aci.ACITuple> tuples,
org.apache.directory.api.ldap.model.entry.Entry entry)
Adds the set of entryACI tuples to a collection of tuples.
|
private void |
addPerscriptiveAciTuples(OperationContext opContext,
java.util.Collection<org.apache.directory.api.ldap.aci.ACITuple> tuples,
org.apache.directory.api.ldap.model.name.Dn dn,
org.apache.directory.api.ldap.model.entry.Entry entry)
Adds perscriptiveACI tuples to a collection of tuples by accessing the
tupleCache.
|
private void |
addSubentryAciTuples(OperationContext opContext,
java.util.Collection<org.apache.directory.api.ldap.aci.ACITuple> tuples,
org.apache.directory.api.ldap.model.name.Dn dn,
org.apache.directory.api.ldap.model.entry.Entry entry)
Adds the set of subentryACI tuples to a collection of tuples.
|
void |
cacheNewGroup(org.apache.directory.api.ldap.model.name.Dn name,
org.apache.directory.api.ldap.model.entry.Entry entry) |
private void |
checkLookupAccess(LookupOperationContext lookupContext,
org.apache.directory.api.ldap.model.entry.Entry entry)
Checks if the READ permissions exist to the entry and to each attribute type and
value.
|
boolean |
compare(CompareOperationContext compareContext)
Filters
DefaultPartitionNexus#compare( CompareOperationContext ) call. |
void |
delete(DeleteOperationContext deleteContext)
Filters
Partition#delete( DeleteOperationContext ) call. |
private boolean |
filter(OperationContext opContext,
org.apache.directory.api.ldap.model.name.Dn normName,
org.apache.directory.api.ldap.model.entry.Entry clonedEntry) |
boolean |
hasEntry(HasEntryOperationContext hasEntryContext)
Filters
Partition#hasEntry( HasEntryOperationContext ) call. |
void |
init(DirectoryService directoryService)
Initializes this interceptor based service by getting a handle on the nexus, setting up
the tuple and group membership caches, the ACIItem parser and the ACDF engine.
|
private void |
initGroupCache()
Load the Groups into the cache
|
private void |
initTupleCache()
Load the Tuples into the cache
|
boolean |
isPrincipalAnAdministrator(org.apache.directory.api.ldap.model.name.Dn principalDn) |
private boolean |
isTheAdministrator(org.apache.directory.api.ldap.model.name.Dn normalizedDn) |
org.apache.directory.api.ldap.model.entry.Entry |
lookup(LookupOperationContext lookupContext)
Filters
Partition#lookup( LookupOperationContext ) call. |
void |
modify(ModifyOperationContext modifyContext)
Filters
Partition#modify( ModifyOperationContext ) call. |
void |
move(MoveOperationContext moveContext)
Filters
Partition#move( MoveOperationContext ) call. |
void |
moveAndRename(MoveAndRenameOperationContext moveAndRenameContext)
Filters
Partition#moveAndRename( MoveAndRenameOperationContext) call. |
private void |
protectCriticalEntries(OperationContext opCtx,
org.apache.directory.api.ldap.model.name.Dn dn) |
void |
rename(RenameOperationContext renameContext)
Filters
Partition#rename( RenameOperationContext ) call. |
EntryFilteringCursor |
search(SearchOperationContext searchContext)
Filters
Partition#search( SearchOperationContext ) call. |
private static final org.slf4j.Logger LOG
private static final org.slf4j.Logger ACI_LOG
private static final java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> ADD_PERMS
private static final java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> READ_PERMS
private static final java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> COMPARE_PERMS
private static final java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> SEARCH_ENTRY_PERMS
private static final java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> SEARCH_ATTRVAL_PERMS
private static final java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> REMOVE_PERMS
private static final java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> BROWSE_PERMS
private static final java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> LOOKUP_PERMS
private static final java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> REPLACE_PERMS
private static final java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> RENAME_PERMS
private static final java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> EXPORT_PERMS
private static final java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> IMPORT_PERMS
private static final java.util.Collection<org.apache.directory.api.ldap.aci.MicroOperation> MOVERENAME_PERMS
private TupleCache tupleCache
private GroupCache groupCache
private org.apache.directory.api.ldap.aci.ACIItemParser aciParser
private ACDFEngine engine
private java.lang.String subschemaSubentryDn
private PartitionNexus nexus
public static final javax.naming.directory.SearchControls DEFAULT_SEARCH_CONTROLS
private static SubentryUtils subentryUtils
public AciAuthorizationInterceptor()
private void initTupleCache()
throws org.apache.directory.api.ldap.model.exception.LdapException
org.apache.directory.api.ldap.model.exception.LdapExceptionprivate void initGroupCache()
throws org.apache.directory.api.ldap.model.exception.LdapException
org.apache.directory.api.ldap.model.exception.LdapExceptionpublic void init(DirectoryService directoryService) throws org.apache.directory.api.ldap.model.exception.LdapException
init in interface Interceptorinit in class BaseInterceptordirectoryService - the directory service corejava.lang.Exception - if there are problems during initializationorg.apache.directory.api.ldap.model.exception.LdapExceptionprivate void protectCriticalEntries(OperationContext opCtx, org.apache.directory.api.ldap.model.name.Dn dn) throws org.apache.directory.api.ldap.model.exception.LdapException
org.apache.directory.api.ldap.model.exception.LdapExceptionprivate void addPerscriptiveAciTuples(OperationContext opContext, java.util.Collection<org.apache.directory.api.ldap.aci.ACITuple> tuples, org.apache.directory.api.ldap.model.name.Dn dn, org.apache.directory.api.ldap.model.entry.Entry entry) throws org.apache.directory.api.ldap.model.exception.LdapException
tuples - the collection of tuples to add todn - the normalized distinguished name of the protected entryentry - the target entry whose access is being controlledproxy - the partition nexus proxy objectjava.lang.Exception - if there are problems accessing attribute valuesorg.apache.directory.api.ldap.model.exception.LdapExceptionprivate void addEntryAciTuples(java.util.Collection<org.apache.directory.api.ldap.aci.ACITuple> tuples,
org.apache.directory.api.ldap.model.entry.Entry entry)
throws org.apache.directory.api.ldap.model.exception.LdapException
tuples - the collection of tuples to add toentry - the target entry that access to is being regulatedjava.lang.Exception - if there are problems accessing attribute valuesorg.apache.directory.api.ldap.model.exception.LdapExceptionprivate void addSubentryAciTuples(OperationContext opContext, java.util.Collection<org.apache.directory.api.ldap.aci.ACITuple> tuples, org.apache.directory.api.ldap.model.name.Dn dn, org.apache.directory.api.ldap.model.entry.Entry entry) throws org.apache.directory.api.ldap.model.exception.LdapException
tuples - the collection of tuples to add todn - the normalized distinguished name of the protected entryentry - the target entry that access to is being regulatedproxy - the partition nexus proxy objectjava.lang.Exception - if there are problems accessing attribute valuesorg.apache.directory.api.ldap.model.exception.LdapExceptionpublic void add(AddOperationContext addContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#add( AddOperationContext ) call.add in interface Interceptoradd in class BaseInterceptoraddContext - The AddOperationContext instanceorg.apache.directory.api.ldap.model.exception.LdapException - If we had some error while processing the Add operationpublic boolean compare(CompareOperationContext compareContext) throws org.apache.directory.api.ldap.model.exception.LdapException
DefaultPartitionNexus#compare( CompareOperationContext ) call.compare in interface Interceptorcompare in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionpublic void delete(DeleteOperationContext deleteContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#delete( DeleteOperationContext ) call.delete in interface Interceptordelete in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionpublic boolean hasEntry(HasEntryOperationContext hasEntryContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#hasEntry( HasEntryOperationContext ) call.hasEntry in interface InterceptorhasEntry in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionpublic org.apache.directory.api.ldap.model.entry.Entry lookup(LookupOperationContext lookupContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#lookup( LookupOperationContext ) call.lookup in interface Interceptorlookup in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionpublic void modify(ModifyOperationContext modifyContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#modify( ModifyOperationContext ) call.modify in interface Interceptormodify in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionpublic void move(MoveOperationContext moveContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#move( MoveOperationContext ) call.move in interface Interceptormove in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionpublic void moveAndRename(MoveAndRenameOperationContext moveAndRenameContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#moveAndRename( MoveAndRenameOperationContext) call.moveAndRename in interface InterceptormoveAndRename in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionpublic void rename(RenameOperationContext renameContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#rename( RenameOperationContext ) call.rename in interface Interceptorrename in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionpublic EntryFilteringCursor search(SearchOperationContext searchContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#search( SearchOperationContext ) call.search in interface Interceptorsearch in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionprivate void checkLookupAccess(LookupOperationContext lookupContext, org.apache.directory.api.ldap.model.entry.Entry entry) throws org.apache.directory.api.ldap.model.exception.LdapException
principal - the user associated with the calldn - the name of the entry being looked upentry - the raw entry pulled from the nexusjava.lang.Exception - if undlying access to the DIT failsorg.apache.directory.api.ldap.model.exception.LdapExceptionpublic final boolean isPrincipalAnAdministrator(org.apache.directory.api.ldap.model.name.Dn principalDn)
public void cacheNewGroup(org.apache.directory.api.ldap.model.name.Dn name,
org.apache.directory.api.ldap.model.entry.Entry entry)
throws java.lang.Exception
java.lang.Exceptionprivate boolean filter(OperationContext opContext, org.apache.directory.api.ldap.model.name.Dn normName, org.apache.directory.api.ldap.model.entry.Entry clonedEntry) throws org.apache.directory.api.ldap.model.exception.LdapException
org.apache.directory.api.ldap.model.exception.LdapExceptionprivate boolean isTheAdministrator(org.apache.directory.api.ldap.model.name.Dn normalizedDn)