directory-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From trus...@apache.org
Subject svn commit: r292940 - /directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/
Date Sat, 01 Oct 2005 08:05:09 GMT
Author: trustin
Date: Sat Oct  1 01:05:01 2005
New Revision: 292940

URL: http://svn.apache.org/viewcvs?rev=292940&view=rev
Log:
Added JavaDoc for ACDFEngine and its support classes.

Modified:
    directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/ACDFEngine.java
    directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/ACITupleFilter.java
    directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/HighestPrecedenceFilter.java
    directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MaxImmSubFilter.java
    directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MaxValueCountFilter.java
    directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MicroOperationFilter.java
    directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MostSpecificProtectedItemFilter.java
    directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MostSpecificUserClassFilter.java
    directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/OperationScope.java
    directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/RelatedProtectedItemFilter.java
    directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/RelatedUserClassFilter.java
    directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/RestrictedByFilter.java

Modified: directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/ACDFEngine.java
URL: http://svn.apache.org/viewcvs/directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/ACDFEngine.java?rev=292940&r1=292939&r2=292940&view=diff
==============================================================================
--- directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/ACDFEngine.java
(original)
+++ directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/ACDFEngine.java
Sat Oct  1 01:05:01 2005
@@ -40,10 +40,41 @@
 import org.apache.ldap.server.subtree.RefinementLeafEvaluator;
 import org.apache.ldap.server.subtree.SubtreeEvaluator;
 
+/**
+ * An implementation of Access Control Decision Function (18.8, X.501).
+ * <p>
+ * This engine simply filters the collection of tuples using the following
+ * {@link ACITupleFilter}s sequentially:
+ * <ol>
+ * <li>{@link RelatedUserClassFilter}</li>
+ * <li>{@link RelatedProtectedItemFilter}</li>
+ * <li>{@link MaxValueCountFilter}</li>
+ * <li>{@link MaxImmSubFilter}</li>
+ * <li>{@link RestrictedByFilter}</li>
+ * <li>{@link MicroOperationFilter}</li>
+ * <li>{@link HighestPrecedenceFilter}</li>
+ * <li>{@link MostSpecificUserClassFilter}</li>
+ * <li>{@link MostSpecificProtectedItemFilter}</li>
+ * </ol>
+ * <p>
+ * Operation is determined to be permitted if and only if there is at least one
+ * tuple left and all of them grants the access. (18.8.4. X.501)
+ * 
+ * @author The Apache Directory Project
+ * @version $Rev$, $Date$
+ */
 public class ACDFEngine
 {
     private final ACITupleFilter[] filters;
     
+    /**
+     * Creates a new instance.
+     * 
+     * @param oidRegistry an OID registry to be used by internal components
+     * @param attrTypeRegistry an attribute type registry to be used by internal components

+     * 
+     * @throws NamingException if failed to initialize internal components
+     */
     public ACDFEngine( OidRegistry oidRegistry, AttributeTypeRegistry attrTypeRegistry )
throws NamingException
     {
         Evaluator entryEvaluator = new ExpressionEvaluator( oidRegistry, attrTypeRegistry
);
@@ -70,7 +101,7 @@
      * if the user doesn't have any permission to perform the specified grants.
      * 
      * @param next the next interceptor to the current interceptor
-     * @param userGroupNames the DN of the group of the user who is trying to access the
resource
+     * @param userGroupNames the collection of the group DNs the user who is trying to access
the resource belongs
      * @param username the DN of the user who is trying to access the resource
      * @param entryName the DN of the entry the user is trying to access 
      * @param attrId the attribute type of the attribute the user is trying to access.
@@ -103,7 +134,7 @@
      * if the user doesn't have any permission to perform the specified grants.
      * 
      * @param next the next interceptor to the current interceptor 
-     * @param userGroupNames the DN of the group of the user who is trying to access the
resource
+     * @param userGroupNames the collection of the group DNs the user who is trying to access
the resource belongs
      * @param userName the DN of the user who is trying to access the resource
      * @param entryName the DN of the entry the user is trying to access 
      * @param attrId the attribute type of the attribute the user is trying to access.

Modified: directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/ACITupleFilter.java
URL: http://svn.apache.org/viewcvs/directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/ACITupleFilter.java?rev=292940&r1=292939&r2=292940&view=diff
==============================================================================
--- directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/ACITupleFilter.java
(original)
+++ directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/ACITupleFilter.java
Sat Oct  1 01:05:01 2005
@@ -25,10 +25,39 @@
 import javax.naming.directory.Attributes;
 
 import org.apache.ldap.common.aci.AuthenticationLevel;
+import org.apache.ldap.common.aci.MicroOperation;
 import org.apache.ldap.server.interceptor.NextInterceptor;
 
+/**
+ * An interface that filters the specified collection of tuples using the
+ * specified extra information.
+ *
+ * @author The Apache Directory Project
+ * @version $Rev$, $Date$
+ *
+ */
 public interface ACITupleFilter
 {
+    /**
+     * Returns the collection of the filtered tuples using the specified
+     * extra information.
+     * 
+     * @param tuples the collection of tuples to filter
+     * @param scope the scope of the operation to be performed
+     * @param next the next interceptor for this filter to access the DIT
+     * @param userGroupNames the collection of group ({@link Name})s which the current user
belongs to
+     * @param userName the {@link Name} of the current user
+     * @param userEntry the {@link Attributes} of the current user entry in the DIT
+     * @param authenticationLevel the level of authentication of the current user
+     * @param entryName the {@link Name} of the entry the current user accesses
+     * @param attrId the attribute ID the current user accesses
+     * @param attrValue the value of the attribute the current user accesses
+     * @param entry the {@link Attributes} of the entry the current user accesses
+     * @param microOperations the set of {@link MicroOperation}s the current user will perform
+     * 
+     * @return the collection of filtered tuples
+     * @throws NamingException if failed to filter the specifiec tuples
+     */
     Collection filter(
             Collection tuples, OperationScope scope, NextInterceptor next,
             Collection userGroupNames, Name userName, Attributes userEntry,

Modified: directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/HighestPrecedenceFilter.java
URL: http://svn.apache.org/viewcvs/directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/HighestPrecedenceFilter.java?rev=292940&r1=292939&r2=292940&view=diff
==============================================================================
--- directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/HighestPrecedenceFilter.java
(original)
+++ directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/HighestPrecedenceFilter.java
Sat Oct  1 01:05:01 2005
@@ -29,6 +29,13 @@
 import org.apache.ldap.common.aci.AuthenticationLevel;
 import org.apache.ldap.server.interceptor.NextInterceptor;
 
+/**
+ * An {@link ACITupleFilter} that discards all tuples having a precedence less
+ * than the highest remaining precedence. (18.8.4.1, X.501)
+ *
+ * @author The Apache Directory Project
+ * @version $Rev$, $Date$
+ */
 public class HighestPrecedenceFilter implements ACITupleFilter
 {
     public Collection filter( Collection tuples, OperationScope scope, NextInterceptor next,
Collection userGroupNames, Name userName, Attributes userEntry, AuthenticationLevel authenticationLevel,
Name entryName, String attrId, Object attrValue, Attributes entry, Collection microOperations
) throws NamingException

Modified: directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MaxImmSubFilter.java
URL: http://svn.apache.org/viewcvs/directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MaxImmSubFilter.java?rev=292940&r1=292939&r2=292940&view=diff
==============================================================================
--- directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MaxImmSubFilter.java
(original)
+++ directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MaxImmSubFilter.java
Sat Oct  1 01:05:01 2005
@@ -35,6 +35,13 @@
 import org.apache.ldap.common.filter.PresenceNode;
 import org.apache.ldap.server.interceptor.NextInterceptor;
 
+/**
+ * An {@link ACITupleFilter} that discards all tuples that doesn't satisfy
+ * {@link ProtectedItem.MaxImmSub} constraint if available. (18.8.3.3, X.501)
+ *
+ * @author The Apache Directory Project
+ * @version $Rev$, $Date$
+ */
 public class MaxImmSubFilter implements ACITupleFilter
 {
     private final ExprNode childrenFilter;

Modified: directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MaxValueCountFilter.java
URL: http://svn.apache.org/viewcvs/directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MaxValueCountFilter.java?rev=292940&r1=292939&r2=292940&view=diff
==============================================================================
--- directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MaxValueCountFilter.java
(original)
+++ directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MaxValueCountFilter.java
Sat Oct  1 01:05:01 2005
@@ -32,6 +32,13 @@
 import org.apache.ldap.common.aci.ProtectedItem.MaxValueCountItem;
 import org.apache.ldap.server.interceptor.NextInterceptor;
 
+/**
+ * An {@link ACITupleFilter} that discards all tuples that doesn't satisfy
+ * {@link ProtectedItem.MaxValueCount} constraint if available. (18.8.3.3, X.501)
+ *
+ * @author The Apache Directory Project
+ * @version $Rev$, $Date$
+ */
 public class MaxValueCountFilter implements ACITupleFilter
 {
     public Collection filter( Collection tuples, OperationScope scope, NextInterceptor next,
Collection userGroupNames, Name userName, Attributes userEntry, AuthenticationLevel authenticationLevel,
Name entryName, String attrId, Object attrValue, Attributes entry, Collection microOperations
) throws NamingException

Modified: directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MicroOperationFilter.java
URL: http://svn.apache.org/viewcvs/directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MicroOperationFilter.java?rev=292940&r1=292939&r2=292940&view=diff
==============================================================================
--- directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MicroOperationFilter.java
(original)
+++ directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MicroOperationFilter.java
Sat Oct  1 01:05:01 2005
@@ -30,6 +30,14 @@
 import org.apache.ldap.common.aci.MicroOperation;
 import org.apache.ldap.server.interceptor.NextInterceptor;
 
+/**
+ * An {@link ACITupleFilter} that discard tuples which doesn't contain any
+ * related {@link MicroOperation}s. (18.8.3.4, X.501) 
+ *
+ * @author The Apache Directory Project
+ * @version $Rev$, $Date$
+ *
+ */
 public class MicroOperationFilter implements ACITupleFilter
 {
     public Collection filter( Collection tuples, OperationScope scope, NextInterceptor next,
Collection userGroupNames, Name userName, Attributes userEntry, AuthenticationLevel authenticationLevel,
Name entryName, String attrId, Object attrValue, Attributes entry, Collection microOperations
) throws NamingException

Modified: directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MostSpecificProtectedItemFilter.java
URL: http://svn.apache.org/viewcvs/directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MostSpecificProtectedItemFilter.java?rev=292940&r1=292939&r2=292940&view=diff
==============================================================================
--- directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MostSpecificProtectedItemFilter.java
(original)
+++ directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MostSpecificProtectedItemFilter.java
Sat Oct  1 01:05:01 2005
@@ -31,6 +31,21 @@
 import org.apache.ldap.common.aci.ProtectedItem;
 import org.apache.ldap.server.interceptor.NextInterceptor;
 
+/**
+ * An {@link ACITupleFilter} that chooses the tuples with the most specific
+ * protected item. (18.8.4.3, X.501)
+ * <p>
+ * If more than one tuple remains, choose the tuples with the most specific
+ * protected item. If the protected item is an attribute and there are tuples 
+ * that specify the attribute type explicitly, discard all other tuples. If
+ * the protected item is an attribute value, and there are tuples that specify
+ * the attribute value explicitly, discard all other tuples. A protected item
+ * which is a rangeOfValues is to be treated as specifying an attribute value
+ * explicitly.
+ * 
+ * @author The Apache Directory Project
+ * @version $Rev$, $Date$
+ */
 public class MostSpecificProtectedItemFilter implements ACITupleFilter
 {
     public Collection filter( Collection tuples, OperationScope scope, NextInterceptor next,
Collection userGroupNames, Name userName, Attributes userEntry, AuthenticationLevel authenticationLevel,
Name entryName, String attrId, Object attrValue, Attributes entry, Collection microOperations
) throws NamingException

Modified: directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MostSpecificUserClassFilter.java
URL: http://svn.apache.org/viewcvs/directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MostSpecificUserClassFilter.java?rev=292940&r1=292939&r2=292940&view=diff
==============================================================================
--- directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MostSpecificUserClassFilter.java
(original)
+++ directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/MostSpecificUserClassFilter.java
Sat Oct  1 01:05:01 2005
@@ -31,6 +31,19 @@
 import org.apache.ldap.common.aci.UserClass;
 import org.apache.ldap.server.interceptor.NextInterceptor;
 
+/**
+ * An {@link ACITupleFilter} that chooses the tuples with the most specific user
+ * class. (18.8.4.2)
+ * <p>
+ * If more than one tuple remains, choose the tuples with the most specific user
+ * class. If there are any tuples matching the requestor with UserClasses element
+ * name or thisEntry, discard all other tuples. Otherwise if there are any tuples
+ * matching UserGroup, discard all other tuples. Otherwise if there are any tuples
+ * matching subtree, discard all other tuples.
+ *
+ * @author The Apache Directory Project
+ * @version $Rev$, $Date$
+ */
 public class MostSpecificUserClassFilter implements ACITupleFilter
 {
     public Collection filter( Collection tuples, OperationScope scope, NextInterceptor next,
Collection userGroupNames, Name userName, Attributes userEntry, AuthenticationLevel authenticationLevel,
Name entryName, String attrId, Object attrValue, Attributes entry, Collection microOperations
) throws NamingException

Modified: directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/OperationScope.java
URL: http://svn.apache.org/viewcvs/directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/OperationScope.java?rev=292940&r1=292939&r2=292940&view=diff
==============================================================================
--- directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/OperationScope.java
(original)
+++ directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/OperationScope.java
Sat Oct  1 01:05:01 2005
@@ -18,10 +18,27 @@
  */
 package org.apache.ldap.server.authz.support;
 
+/**
+ * An enumeration that represents the scope of user operation.
+ *
+ * @author The Apache Directory Project
+ * @version $Rev$, $Date$
+ */
 public class OperationScope
 {
+    /**
+     * An operation that affects the whole entry.
+     */
     public static final OperationScope ENTRY = new OperationScope( "Entry" );
+    
+    /**
+     * An operation that affects all values in an attribute type.
+     */
     public static final OperationScope ATTRIBUTE_TYPE = new OperationScope( "Attribute Type"
);
+    
+    /**
+     * An operation that affects the specific value in an attribute type.
+     */
     public static final OperationScope ATTRIBUTE_TYPE_AND_VALUE = new OperationScope( "Attribute
Type & Value" );
     
     private final String name;
@@ -31,11 +48,17 @@
         this.name = name;
     }
     
+    /**
+     * Return the name of this scope.
+     */
     public String getName()
     {
         return name;
     }
-    
+
+    /**
+     * Returns the name of this scope.
+     */
     public String toString()
     {
         return name;

Modified: directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/RelatedProtectedItemFilter.java
URL: http://svn.apache.org/viewcvs/directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/RelatedProtectedItemFilter.java?rev=292940&r1=292939&r2=292940&view=diff
==============================================================================
--- directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/RelatedProtectedItemFilter.java
(original)
+++ directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/RelatedProtectedItemFilter.java
Sat Oct  1 01:05:01 2005
@@ -37,6 +37,13 @@
 import org.apache.ldap.server.schema.AttributeTypeRegistry;
 import org.apache.ldap.server.subtree.RefinementEvaluator;
 
+/**
+ * An {@link ACITupleFilter} that discards all tuples whose {@link ProtectedItem}s
+ * are not related with the operation. (18.8.3.2, X.501)
+ *
+ * @author The Apache Directory Project
+ * @version $Rev$, $Date$
+ */
 public class RelatedProtectedItemFilter implements ACITupleFilter
 {
     private final AttributeTypeRegistry attrTypeRegistry;

Modified: directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/RelatedUserClassFilter.java
URL: http://svn.apache.org/viewcvs/directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/RelatedUserClassFilter.java?rev=292940&r1=292939&r2=292940&view=diff
==============================================================================
--- directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/RelatedUserClassFilter.java
(original)
+++ directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/RelatedUserClassFilter.java
Sat Oct  1 01:05:01 2005
@@ -33,6 +33,13 @@
 import org.apache.ldap.server.interceptor.NextInterceptor;
 import org.apache.ldap.server.subtree.SubtreeEvaluator;
 
+/**
+ * An {@link ACITupleFilter} that discards all tuples whose {@link UserClass}es
+ * are not related with the current user. (18.8.3.1, X.501)
+ *
+ * @author The Apache Directory Project
+ * @version $Rev$, $Date$
+ */
 public class RelatedUserClassFilter implements ACITupleFilter
 {
     private static final LdapName ROOTDSE_NAME = new LdapName();

Modified: directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/RestrictedByFilter.java
URL: http://svn.apache.org/viewcvs/directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/RestrictedByFilter.java?rev=292940&r1=292939&r2=292940&view=diff
==============================================================================
--- directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/RestrictedByFilter.java
(original)
+++ directory/apacheds/trunk/core/src/main/java/org/apache/ldap/server/authz/support/RestrictedByFilter.java
Sat Oct  1 01:05:01 2005
@@ -32,6 +32,13 @@
 import org.apache.ldap.common.aci.ProtectedItem.RestrictedByItem;
 import org.apache.ldap.server.interceptor.NextInterceptor;
 
+/**
+ * An {@link ACITupleFilter} that discards all tuples that doesn't satisfy
+ * {@link ProtectedItem.RestrictedBy} constraint if available. (18.8.3.3, X.501)
+ *
+ * @author The Apache Directory Proejct
+ * @version $Rev$, $Date$
+ */
 public class RestrictedByFilter implements ACITupleFilter
 {
     public Collection filter( Collection tuples, OperationScope scope, NextInterceptor next,
Collection userGroupNames, Name userName, Attributes userEntry, AuthenticationLevel authenticationLevel,
Name entryName, String attrId, Object attrValue, Attributes entry, Collection microOperations
) throws NamingException



Mime
View raw message