org.opends.server.authorization.policy

Class PolicyBasedAccessControlHandler

java.lang.Object

org.opends.server.api.AccessControlHandler<PolicyBasedAccessControlHandlerCfg>

org.opends.server.authorization.policy.PolicyBasedAccessControlHandler

All Implemented Interfaces:

RequestFilter

public final class PolicyBasedAccessControlHandler
extends AccessControlHandler<PolicyBasedAccessControlHandlerCfg>
implements RequestFilter

Provides coarse grained access control for all operations, regardless of whether they are destined for local or proxy backends. This class is responsible for managing the global access control policy configuration. Access control decisions are the responsibility of the AccessController.

Implementation notes: this class provides two policy enforcement points. Firstly, it inserts itself in the global router filter chain by invoking PolicyBasedAccessControlRequestFilter.enable(RequestFilter), where it is able to intercept all requests before they are processed by the global router. Secondly, as a side-effect of implementing the AccessControlHandler interface, it is also invoked at the local backend layer, after the router. However, there is no additional access control performed - all of the AccessControlHandler methods are stubbed out.

Constructor Summary

Constructors

Constructor and Description
PolicyBasedAccessControlHandler()

Method Summary

Modifier and Type	Method and Description
Flowable<Response>	filter(org.forgerock.services.context.Context context, Request request, RequestHandler next) Filters the request and/or response of an exchange.
void	finalizeAccessControlHandler() Performs any necessary finalization for the access control handler implementation.
void	initializeAccessControlHandler(PolicyBasedAccessControlHandlerCfg configuration, ServerContext serverContext) Initializes the access control handler implementation based on the information in the provided configuration entry.
boolean	isConfigurationAcceptable(PolicyBasedAccessControlHandlerCfg configuration, List<LocalizableMessage> unacceptableReasons, ServerContext serverContext) Indicates whether the provided configuration is acceptable for this access control handler.

Methods inherited from class org.opends.server.api.AccessControlHandler

canDiscloseInformation, filterEntry, isAllowed, isAllowed, isAllowed, isAllowed, isAllowed, isAllowed, isAllowed, isAllowed, isAllowed, isAllowed, mayProxy, maySend, maySend

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

PolicyBasedAccessControlHandler

public PolicyBasedAccessControlHandler()

Method Detail

initializeAccessControlHandler

public void initializeAccessControlHandler(PolicyBasedAccessControlHandlerCfg configuration,
                                           ServerContext serverContext)
                                    throws ConfigException,
                                           InitializationException

Description copied from class: AccessControlHandler

Initializes the access control handler implementation based on the information in the provided configuration entry.

Specified by:

initializeAccessControlHandler in class AccessControlHandler<PolicyBasedAccessControlHandlerCfg>

Parameters:

configuration - The configuration object that contains the information to use to initialize this access control handler.

serverContext - the server context for this Directory Server instance.

Throws:

ConfigException - If an unrecoverable problem arises in the process of performing the initialization.

InitializationException - If a problem occurs during initialization that is not related to the server configuration.

isConfigurationAcceptable

public boolean isConfigurationAcceptable(PolicyBasedAccessControlHandlerCfg configuration,
                                         List<LocalizableMessage> unacceptableReasons,
                                         ServerContext serverContext)

Description copied from class: AccessControlHandler

Indicates whether the provided configuration is acceptable for this access control handler. It should be possible to call this method on an uninitialized access control handler instance in order to determine whether the handler would be able to use the provided configuration.

Overrides:

isConfigurationAcceptable in class AccessControlHandler<PolicyBasedAccessControlHandlerCfg>

Parameters:

configuration - The access control handler configuration for which to make the determination.

unacceptableReasons - A list that may be used to hold the reasons that the provided configuration is not acceptable.

serverContext - the server context for this Directory Server instance.

Returns:

true if the provided configuration is acceptable for this access control handler, or false if not.

finalizeAccessControlHandler

public void finalizeAccessControlHandler()

Description copied from class: AccessControlHandler

Performs any necessary finalization for the access control handler implementation. This will be called just after the handler has been deregistered with the server but before it has been unloaded.

Overrides:

finalizeAccessControlHandler in class AccessControlHandler<PolicyBasedAccessControlHandlerCfg>

filter

public Flowable<Response> filter(org.forgerock.services.context.Context context,
                                 Request request,
                                 RequestHandler next)
                          throws Exception

Description copied from interface: RequestFilter

Filters the request and/or response of an exchange. To pass the request to the next filter or handler in the chain, the filter calls next.handle(context, request).

This method may elect not to pass the request to the next filter or handler, and instead handle the request itself. It can achieve this by merely avoiding a call to next.handle(context, request) and creating its own response object. The filter is also at liberty to replace a response with another of its own by intercepting the response returned by the next handler.

Specified by:

filter in interface RequestFilter

Parameters:

context - The request context.

request - The request.

next - The next filter or handler in the chain to handle the request.

Returns:

A Flowable representing the response to be returned to the client.

Throws:

Exception - If an error occurred during the processing of the request.