Package ddf.security.pdp.realm

Class AuthzRealm

java.lang.Object
org.apache.shiro.realm.CachingRealm
org.apache.shiro.realm.AuthenticatingRealm
org.apache.shiro.realm.AuthorizingRealm
ddf.security.service.impl.AbstractAuthorizingRealm
ddf.security.pdp.realm.AuthzRealm
All Implemented Interfaces:
org.apache.shiro.authc.LogoutAware, org.apache.shiro.authz.Authorizer, org.apache.shiro.authz.permission.PermissionResolverAware, org.apache.shiro.authz.permission.RolePermissionResolverAware, org.apache.shiro.cache.CacheManagerAware, org.apache.shiro.realm.Realm, org.apache.shiro.util.Initializable, org.apache.shiro.util.Nameable
public class AuthzRealm extends ddf.security.service.impl.AbstractAuthorizingRealm
This simple Authz AbstractAuthorizingRealm provides the ability to check permissions without making calls out to an external PDP. Permission objects are checked against each other to ensure that the subject permissions imply the resource permissions.
Author:
tustisos

  • Field Summary

    Fields inherited from class ddf.security.service.impl.AbstractAuthorizingRealm

    metacardExpansionServices, userExpansionServices

  • Constructor Summary

    Constructors
    Constructor
    Description
    AuthzRealm(String dirPath, org.codice.ddf.parser.Parser parser)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    addPolicyExtension(ddf.security.policy.extension.PolicyExtension policyExtension)
     
    protected org.apache.shiro.authc.AuthenticationInfo
    doGetAuthenticationInfo(org.apache.shiro.authc.AuthenticationToken token)
     
    org.apache.shiro.authz.AuthorizationInfo
    getAuthorizationInfo(org.apache.shiro.subject.PrincipalCollection principals)
    Returns an account's authorization-specific information for the specified principals, or null if no account could be found.
    protected Collection<org.apache.shiro.authz.Permission>
    getPermissions(org.apache.shiro.authz.AuthorizationInfo authorizationInfo)
    Returns a collection of Permission objects that the AuthorizationInfo object of a Subject is asserting.
    boolean[]
    isPermitted(org.apache.shiro.subject.PrincipalCollection subjectPrincipal, List<org.apache.shiro.authz.Permission> permissions)
    Checks if the corresponding Subject/user implies the given Permissions and returns a boolean array indicating which permissions are implied.
    boolean
    isPermitted(org.apache.shiro.subject.PrincipalCollection subjectPrincipal, org.apache.shiro.authz.Permission permission)
    Returns true if the corresponding subject/user is permitted to perform an action or access a resource summarized by the specified permission.
    void
    removePolicyExtension(ddf.security.policy.extension.PolicyExtension policyExtension)
     
    void
    setEnvironmentAttributes(List<String> environmentAttributes)
     
    void
    setMatchAllMappings(List<String> list)
    Sets the mappings used by the "match all" evaluation to determine if this user should be authorized to access requested data.
    void
    setMatchOneMappings(List<String> list)
    Sets the mappings used by the "match one" evaluation to determine if this user should be authorized to access requested data.
    void
    setPolicyExtensions(List<ddf.security.policy.extension.PolicyExtension> policyExtensions)
    Sets list of policy extension objects
    void
    setSecurityLogger(ddf.security.audit.SecurityLogger securityLogger)
     

    Methods inherited from class ddf.security.service.impl.AbstractAuthorizingRealm

    addMetacardExpansion, addMetacardExpansion, addUserExpansion, addUserExpansion, doGetAuthorizationInfo, expandPermissions, removeMetacardExpansion, removeUserExpansion

    Methods inherited from class org.apache.shiro.realm.AuthorizingRealm

    afterCacheManagerSet, checkPermission, checkPermission, checkPermission, checkPermissions, checkPermissions, checkPermissions, checkRole, checkRole, checkRoles, checkRoles, checkRoles, clearCachedAuthorizationInfo, doClearCache, getAuthorizationCache, getAuthorizationCacheKey, getAuthorizationCacheName, getPermissionResolver, getRolePermissionResolver, hasAllRoles, hasRole, hasRole, hasRoles, hasRoles, isAuthorizationCachingEnabled, isPermitted, isPermitted, isPermitted, isPermitted, isPermittedAll, isPermittedAll, isPermittedAll, onInit, setAuthorizationCache, setAuthorizationCacheName, setAuthorizationCachingEnabled, setName, setPermissionResolver, setRolePermissionResolver

    Methods inherited from class org.apache.shiro.realm.AuthenticatingRealm

    assertCredentialsMatch, clearCachedAuthenticationInfo, getAuthenticationCache, getAuthenticationCacheKey, getAuthenticationCacheKey, getAuthenticationCacheName, getAuthenticationInfo, getAuthenticationTokenClass, getCredentialsMatcher, init, isAuthenticationCachingEnabled, isAuthenticationCachingEnabled, setAuthenticationCache, setAuthenticationCacheName, setAuthenticationCachingEnabled, setAuthenticationTokenClass, setCredentialsMatcher, supports

    Methods inherited from class org.apache.shiro.realm.CachingRealm

    clearCache, getAvailablePrincipal, getCacheManager, getName, isCachingEnabled, onLogout, setCacheManager, setCachingEnabled

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface org.apache.shiro.util.Initializable

    init

  • Constructor Details

  • Method Details

    • doGetAuthenticationInfo

      protected org.apache.shiro.authc.AuthenticationInfo doGetAuthenticationInfo(org.apache.shiro.authc.AuthenticationToken token) throws org.apache.shiro.authc.AuthenticationException
      Specified by:
      doGetAuthenticationInfo in class org.apache.shiro.realm.AuthenticatingRealm
      Throws:
      org.apache.shiro.authc.AuthenticationException

    • getAuthorizationInfo

      public org.apache.shiro.authz.AuthorizationInfo getAuthorizationInfo(org.apache.shiro.subject.PrincipalCollection principals)
      Returns an account's authorization-specific information for the specified principals, or null if no account could be found. The resulting AuthorizationInfo object is used by the other method implementations in this class to automatically perform access control checks for the corresponding Subject.

      This implementation obtains the actual AuthorizationInfo object from the subclass's implementation of doGetAuthorizationInfo, and then caches it for efficient reuse if caching is enabled (see below).

      Invocations of this method should be thought of as completely orthogonal to acquiring authenticationInfo , since either could occur in any order.

      For example, in "Remember Me" scenarios, the user identity is remembered (and assumed) for their current session and an authentication attempt during that session might never occur. But because their identity would be remembered, that is sufficient enough information to call this method to execute any necessary authorization checks. For this reason, authentication and authorization should be loosely coupled and not depend on each other.

      Caching

      The AuthorizationInfo values returned from this method are cached for efficient reuse if caching is enabled. Caching is enabled automatically when an authorizationCache instance has been explicitly configured, or if a cacheManager has been configured, which will be used to lazily create the authorizationCache as needed.

      If caching is enabled, the authorization cache will be checked first and if found, will return the cached AuthorizationInfo immediately. If caching is disabled, or there is a cache miss, the authorization info will be looked up from the underlying data store via the AbstractAuthorizingRealm.doGetAuthorizationInfo(org.apache.shiro.subject.PrincipalCollection) method, which must be implemented by subclasses.

      Changed Data

      If caching is enabled and if any authorization data for an account is changed at runtime, such as adding or removing roles and/or permissions, the subclass implementation should clear the cached AuthorizationInfo for that account via the clearCachedAuthorizationInfo method. This ensures that the next call to getAuthorizationInfo(PrincipalCollection) will acquire the account's fresh authorization data, where it will then be cached for efficient reuse. This ensures that stale authorization data will not be reused.
      Overrides:
      getAuthorizationInfo in class org.apache.shiro.realm.AuthorizingRealm
      Parameters:
      principals - the corresponding Subject's identifying principals with which to look up the Subject's AuthorizationInfo.
      Returns:
      the authorization information for the account associated with the specified principals, or null if no account could be found.

    • isPermitted

      public boolean isPermitted(org.apache.shiro.subject.PrincipalCollection subjectPrincipal, org.apache.shiro.authz.Permission permission)
      Returns true if the corresponding subject/user is permitted to perform an action or access a resource summarized by the specified permission.

      More specifically, this method determines if any Permissions associated with the subject imply the specified permission.

      Specified by:
      isPermitted in interface org.apache.shiro.authz.Authorizer
      Overrides:
      isPermitted in class org.apache.shiro.realm.AuthorizingRealm
      Parameters:
      subjectPrincipal - the application-specific subject/user identifier.
      permission - the permission that is being checked.
      Returns:
      true if the corresponding Subject/user is permitted, false otherwise.

    • isPermitted

      public boolean[] isPermitted(org.apache.shiro.subject.PrincipalCollection subjectPrincipal, List<org.apache.shiro.authz.Permission> permissions)
      Checks if the corresponding Subject/user implies the given Permissions and returns a boolean array indicating which permissions are implied.

      More specifically, this method should determine if each Permission in the array is implied by permissions already associated with the subject.

      This is primarily a performance-enhancing method to help reduce the number of isPermitted(org.apache.shiro.subject.PrincipalCollection, org.apache.shiro.authz.Permission) invocations over the wire in client/server systems.

      Specified by:
      isPermitted in interface org.apache.shiro.authz.Authorizer
      Overrides:
      isPermitted in class org.apache.shiro.realm.AuthorizingRealm
      Parameters:
      subjectPrincipal - the application-specific subject/user identifier.
      permissions - the permissions that are being checked.
      Returns:
      an array of booleans whose indices correspond to the index of the permissions in the given list. A true value at an index indicates the user is permitted for for the associated Permission object in the list. A false value at an index indicates otherwise.

    • getPermissions

      protected Collection<org.apache.shiro.authz.Permission> getPermissions(org.apache.shiro.authz.AuthorizationInfo authorizationInfo)
      Returns a collection of Permission objects that the AuthorizationInfo object of a Subject is asserting.
      Overrides:
      getPermissions in class org.apache.shiro.realm.AuthorizingRealm
      Parameters:
      authorizationInfo - the application-specific subject/user identifier.
      Returns:
      collection of Permissions.

    • setPolicyExtensions

      public void setPolicyExtensions(List<ddf.security.policy.extension.PolicyExtension> policyExtensions)
      Sets list of policy extension objects
      Parameters:
      policyExtensions -

    • addPolicyExtension

      public void addPolicyExtension(ddf.security.policy.extension.PolicyExtension policyExtension)

    • removePolicyExtension

      public void removePolicyExtension(ddf.security.policy.extension.PolicyExtension policyExtension)

    • setMatchAllMappings

      public void setMatchAllMappings(List<String> list)
      Sets the mappings used by the "match all" evaluation to determine if this user should be authorized to access requested data.

      Each string is of the format: subjectAttrName=metacardAttrName
      where metacardAttrName is the name of an attribute in the metacard and subjectAttrName is the name of the corresponding attribute in the user credentials.
      It is the values corresponding to each of these attributes that will be evaluated against each other when determining if authorization should be allowed.

      Parameters:
      list - List of Strings that define mappings between metadata attributes and user attributes

    • setMatchOneMappings

      public void setMatchOneMappings(List<String> list)
      Sets the mappings used by the "match one" evaluation to determine if this user should be authorized to access requested data.

      Each string is of the format: subjectAttrName=metacardAttrName
      where metacardAttrName is the name of an attribute in the metacard and subjectAttrName is the name of the corresponding attribute in the user credentials.
      It is the values corresponding to each of these attributes that will be evaluated against each other when determining if authorization should be allowed.

      Parameters:
      list - List of Strings that define mappings between metadata attributes and user attributes

    • setEnvironmentAttributes

      public void setEnvironmentAttributes(List<String> environmentAttributes)

    • setSecurityLogger

      public void setSecurityLogger(ddf.security.audit.SecurityLogger securityLogger)