org.entityfs.security
Interface AccessController

All Known Implementing Classes:

AbstractAccessController, AccessGranterAccessController, DisabledAccessController, UnixEntityModeAccessController

public interface AccessController

An AccessController is used by a file system if access controlling is enabled to verify that a Subject is authorized to get a Permission that it wants. This role of this class is similar to JAAS' AccessController class.

If the file system is locking, some access controller implementations may need locks for entities that normally are not involved in an operation. The client can query the access controller for necessary LockCommand:s by calling the getLockCommandsForAccessControl(Entity) method. See the access controller implementation documentations for details.

Since:

1.0

Author:

Karl Gustafsson

In_jar:

entityfs-core

Method Summary

void	checkPermission(Permission p) Verify that the current Subject is authorized for the permission.
Collection<? extends LockCommand>	getLockCommandsForAccessControl(Entity ent) Get the collection of lock commands that have to be executed in order to get all required locks for performing an access control on the supplied entity.
Subject	getSubject() Get the Subject for the current thread.
boolean	hasPermission(Permission p) Does the current Subject have the permission? It is up to the access controller implementation to know how to find the current subject.
boolean	isEnabled() Check if the AccessController is enabled.
void	setSubject(Subject s) Set the subject for the current thread.

Method Detail

hasPermission

boolean hasPermission(Permission p)
                      throws UnsupportedCapabilityException

Does the current Subject have the permission? It is up to the access controller implementation to know how to find the current subject. Most implementations will use some kind of ThreadLocal to store the subject.

The checkPermission(Permission) method performs the same checks as this method, but throws an AccessDeniedException if the subject does not have the requested permission.

Parameters:

p - The permission. When EntityFS methods are calling this method, this is always an EntityPermission.

Returns:

true if the subject has the permission, false if not.

Throws:

UnsupportedCapabilityException - If some capability necessary for the authorization control is missing.

See Also:

checkPermission(Permission)

checkPermission

void checkPermission(Permission p)
                     throws AccessDeniedException,
                            UnsupportedCapabilityException

Verify that the current Subject is authorized for the permission.

The hasPermission(Permission) method performs the same checks as this method, but returns false instead of throwing an exception if the subject does not have the requested permission.

Parameters:

p - The permission. When EntityFS methods are calling this method, this is always an EntityPermission.

Throws:

AccessDeniedException - If the current subject is not authorized for the permission.

UnsupportedCapabilityException - If some capability necessary for the authorization control is missing.

See Also:

hasPermission(Permission), getLockCommandsForAccessControl(Entity)

isEnabled

boolean isEnabled()

Check if the AccessController is enabled. A disabled access controller grants all access requests.

Returns:

true if this access controller is enabled.

getSubject

Subject getSubject()

Get the Subject for the current thread.

Returns:

The Subject, or null if the current thread does not have a Subject set.

setSubject

void setSubject(Subject s)

Set the subject for the current thread. Don't invoke this method directly; use one of the Subject.doAs(java.security.PrivilegedAction) or Subject.doAs(java.security.PrivilegedExceptionAction) methods instead.

Parameters:

s - The new subject for the current thread. May be null.

getLockCommandsForAccessControl

Collection<? extends LockCommand> getLockCommandsForAccessControl(Entity ent)

Get the collection of lock commands that have to be executed in order to get all required locks for performing an access control on the supplied entity.

Parameters:

ent - The entity to perform access controls on. The entity must be in the file system that owns this AccessController.

Returns:

The collection of lock commands that have to be run in order to get all required locks. If no locks are required, this method may return null.

See Also:

checkPermission(Permission)