org.apache.directory.server.core.authz.support

Class ACDFEngine

java.lang.Object

org.apache.directory.server.core.authz.support.ACDFEngine

public class ACDFEngine
extends java.lang.Object

An implementation of Access Control Decision Function (18.8, X.501).
This engine simply filters the collection of tuples using the following ACITupleFilters sequentially:

1. RelatedUserClassFilter
2. RelatedProtectedItemFilter
3. MaxValueCountFilter
4. MaxImmSubFilter
5. RestrictedByFilter
6. MicroOperationFilter
7. HighestPrecedenceFilter
8. MostSpecificUserClassFilter
9. MostSpecificProtectedItemFilter

Operation is determined to be permitted if and only if there is at least one tuple left and all of them grants the access. (18.8.4. X.501)

Field Summary

Fields

Modifier and Type	Field and Description
private ACITupleFilter[]	filters

Constructor Summary

Constructors

Constructor and Description
ACDFEngine(org.apache.directory.api.ldap.model.schema.SchemaManager schemaManager) Creates a new instance.

Method Summary

Modifier and Type	Method and Description
void	checkPermission(AciContext aciContext) Checks the user with the specified name can access the specified resource (entry, attribute type, or attribute value) and throws LdapNoPermissionException if the user doesn't have any permission to perform the specified grants.
boolean	hasPermission(AciContext aciContext) Returns true if the user with the specified name can access the specified resource (entry, attribute type, or attribute value) and throws LdapNoPermissionException if the user doesn't have any permission to perform the specified grants.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

filters

private final ACITupleFilter[] filters

Constructor Detail

ACDFEngine

public ACDFEngine(org.apache.directory.api.ldap.model.schema.SchemaManager schemaManager)

Creates a new instance.

Parameters:

schemaManager - The server schemaManager

Throws:

org.apache.directory.api.ldap.model.exception.LdapException - if failed to initialize internal components

Method Detail

checkPermission

public void checkPermission(AciContext aciContext)
                     throws org.apache.directory.api.ldap.model.exception.LdapException

Checks the user with the specified name can access the specified resource (entry, attribute type, or attribute value) and throws LdapNoPermissionException if the user doesn't have any permission to perform the specified grants.

Parameters:

aciContext - the container for ACI items

Throws:

org.apache.directory.api.ldap.model.exception.LdapException - if failed to evaluate ACI items

hasPermission

public boolean hasPermission(AciContext aciContext)
                      throws org.apache.directory.api.ldap.model.exception.LdapException

Returns true if the user with the specified name can access the specified resource (entry, attribute type, or attribute value) and throws LdapNoPermissionException if the user doesn't have any permission to perform the specified grants.

Parameters:

aciContext - the container for ACI items

Throws:

org.apache.directory.api.ldap.model.exception.LdapException - if failed to evaluate ACI items