public final class AciHandler extends AccessControlHandler<DseeCompatAccessControlHandlerCfg>
Constructor and Description |
---|
AciHandler()
Creates a new DSEE-compatible access control handler.
|
Modifier and Type | Method and Description |
---|---|
boolean |
canDiscloseInformation(Entry entry,
Dn entryDN,
Operation operation)
Checks whether the ACIs prevent sending information about the provided entry, or entryDN if entry is null.
|
void |
filterEntry(Operation operation,
SearchResultEntry unfilteredEntry,
AttributeFilter attributeFilter)
Filter the contents of the provided entry such that it no longer contains any attributes or values that the
client is not permitted to access.
|
void |
finalizeAccessControlHandler()
Performs any necessary finalization for the access control handler implementation.
|
void |
initializeAccessControlHandler(DseeCompatAccessControlHandlerCfg configuration,
ServerContext serverContext)
Initializes the access control handler implementation based on the information in the provided configuration
entry.
|
boolean |
isAllowed(AddOperation operation)
Indicates whether the provided add operation is allowed based on the access control configuration.
|
boolean |
isAllowed(BindOperation bindOperation)
Indicates whether the provided bind operation is allowed based on the access control configuration.
|
boolean |
isAllowed(CompareOperation operation)
Check access on compare operations.
|
boolean |
isAllowed(DeleteOperation operation)
Check access on delete operations.
|
boolean |
isAllowed(Dn entryDN,
Operation op,
Control control)
Indicates whether the provided control is allowed based on the access control configuration and the specified
operation.
|
boolean |
isAllowed(ExtendedOperation operation)
Indicates whether the provided extended operation is allowed based on the access control configuration.
|
boolean |
isAllowed(ModifyDnOperation operation)
Checks access on a modifyDN operation.
|
boolean |
isAllowed(ModifyOperation operation)
Indicates whether the provided modify operation is allowed based on the access control configuration.
|
boolean |
isAllowed(Operation operation,
Entry entry,
Filter filter)
Indicates whether the provided operation search filter is allowed based on the access control configuration.
|
boolean |
isAllowed(SearchOperation searchOperation)
Indicates whether the provided search operation is allowed based on the access control configuration.
|
boolean |
mayProxy(Entry proxyUser,
Entry proxiedUser,
Operation op)
Indicates if the specified proxy user entry can proxy, or act on the behalf of the specified proxied user entry.
|
boolean |
maySend(Dn dn,
Operation operation,
SearchResultReference reference)
Indicates whether the provided search result reference may be sent to the client based on the access control
configuration.
|
boolean |
maySend(Operation operation,
SearchResultEntry entry)
Indicates whether the provided search result entry may be sent to the client.
|
isConfigurationAcceptable
public AciHandler()
public void filterEntry(Operation operation, SearchResultEntry unfilteredEntry, AttributeFilter attributeFilter)
AccessControlHandler
filterEntry
in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>
operation
- The operation currently being processed (this will usually be a search, but may be other types of
operation when pre/post read controls are used).unfilteredEntry
- The result entry before any attribute filtering.attributeFilter
- The attribute filter which should be updated to include a predicate or mapping function for
removing disallowed attributes.public void finalizeAccessControlHandler()
AccessControlHandler
finalizeAccessControlHandler
in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>
public void initializeAccessControlHandler(DseeCompatAccessControlHandlerCfg configuration, ServerContext serverContext) throws InitializationException
AccessControlHandler
initializeAccessControlHandler
in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>
configuration
- The configuration object that contains the information to use to initialize this access control
handler.serverContext
- the server context for this Directory Server instance.InitializationException
- If a problem occurs during initialization that is not related to the server configuration.public boolean canDiscloseInformation(Entry entry, Dn entryDN, Operation operation) throws LdapException
AccessControlHandler
canDiscloseInformation
in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>
entry
- the entry for which to check if ACIs prevent information disclosure, if null, then a fake entry will
be created from the entryDN parameterentryDN
- the entry dn for which to check if ACIs prevent information disclosure. Only used if entry is null.operation
- the operation for which to check if ACIs prevent information disclosureLdapException
- If an error occurred while performing the access control check.public boolean isAllowed(Dn entryDN, Operation op, Control control) throws LdapException
AccessControlHandler
isAllowed
in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>
entryDN
- A DN that can be used in the access determination.op
- The operation to use in the determination.control
- The control for which to make the determination.true
if the control should be allowed by the access control configuration, or false
if
not.LdapException
- If an error occurred while performing the access control check. For example, if an attribute could
not be decoded. Care must be taken not to expose any potentially sensitive information in the
exception.public boolean isAllowed(ExtendedOperation operation)
AccessControlHandler
isAllowed
in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>
operation
- The operation for which to make the determination.true
if the operation should be allowed by the access control configuration, or false
if
not.public boolean isAllowed(AddOperation operation) throws LdapException
AccessControlHandler
isAllowed
in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>
operation
- The operation for which to make the determination.true
if the operation should be allowed by the access control configuration, or false
if
not.LdapException
- If an error occurred while performing the access control check. For example, if an attribute could
not be decoded. Care must be taken not to expose any potentially sensitive information in the
exception.public boolean isAllowed(BindOperation bindOperation)
AccessControlHandler
isAllowed
in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>
bindOperation
- The operation for which to make the determination.true
if the operation should be allowed by the access control configuration, or false
if
not.public boolean isAllowed(CompareOperation operation)
isAllowed
in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>
operation
- The compare operation to check access on.public boolean isAllowed(DeleteOperation operation)
isAllowed
in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>
operation
- The delete operation to check access on.public boolean isAllowed(ModifyDnOperation operation)
isAllowed
in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>
operation
- The modifyDN operation to check access on.public boolean isAllowed(ModifyOperation operation) throws LdapException
AccessControlHandler
isAllowed
in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>
operation
- The operation for which to make the determination.true
if the operation should be allowed by the access control configuration, or false
if
not.LdapException
- If an error occurred while performing the access control check. For example, if an attribute could
not be decoded. Care must be taken not to expose any potentially sensitive information in the
exception.public boolean isAllowed(SearchOperation searchOperation)
AccessControlHandler
isAllowed
in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>
searchOperation
- The operation for which to make the determination.true
if the operation should be allowed by the access control configuration, or false
if
not.public boolean isAllowed(Operation operation, Entry entry, Filter filter)
AccessControlHandler
isAllowed
in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>
operation
- The operation for which to make the determination.entry
- The entry for which to make the determination.filter
- The filter to check access on.true
if the operation should be allowed by the access control configuration, or false
if
not.public boolean mayProxy(Entry proxyUser, Entry proxiedUser, Operation op)
AccessControlHandler
mayProxy
in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>
proxyUser
- The entry to use as the proxy user.proxiedUser
- The entry to be proxied by the proxy user.op
- The operation to use in the evaluation.true
if the access control configuration allows the proxy user to proxy the proxied user, or
false
if not.public boolean maySend(Dn dn, Operation operation, SearchResultReference reference)
AccessControlHandler
maySend
in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>
dn
- A DN that can be used in the access determination.operation
- The operation with which the provided reference is associated.reference
- The search result reference for which to make the determination.true
if the access control configuration allows the reference to be returned to the client, or
false
if not.public boolean maySend(Operation operation, SearchResultEntry entry)
AccessControlHandler
maySend
in class AccessControlHandler<DseeCompatAccessControlHandlerCfg>
operation
- The operation currently being processed (this will usually be a search, but may be other types of
operation when pre/post read controls are used).entry
- The result entry before any attribute filtering.true
if the access control configuration allows the entry to be returned to the client, or
false
if not.Copyright 2010-2022 ForgeRock AS.