Overview  Package   Class  Use  Deprecated  Index
Home >> All >> org >> acegisecurity >> [ afterinvocation overview ]	PREV CLASS  NEXT CLASS
SUMMARY:  JAVADOC |  SOURCE |  DOWNLOAD | NESTED | FIELD | CONSTR | METHOD	DETAIL: FIELD | CONSTR | METHOD

---

org.acegisecurity.afterinvocation
Class BasicAclEntryAfterInvocationCollectionFilteringProvider  

java.lang.Object
  org.acegisecurity.afterinvocation.BasicAclEntryAfterInvocationCollectionFilteringProvider

All Implemented Interfaces:

AfterInvocationProvider, org.springframework.beans.factory.InitializingBean

---

public class BasicAclEntryAfterInvocationCollectionFilteringProvider

extends java.lang.Object

implements AfterInvocationProvider, org.springframework.beans.factory.InitializingBean

Given a Collection of domain object instances returned from a secure object invocation, remove any Collection elements the principal does not have appropriate permission to access as defined by the org.acegisecurity.acl.AclManager.

The AclManager is used to retrieve the access control list (ACL) permissions associated with each Collection domain object instance element for the current Authentication object. This class is designed to process org.acegisecurity.acl.AclEntrys that are subclasses of org.acegisecurity.acl.basic.BasicAclEntry only. Generally these are obtained by using the org.acegisecurity.acl.basic.BasicAclProvider.

This after invocation provider will fire if any ConfigAttribute#getAttribute() matches the processConfigAttribute 55 . The provider will then lookup the ACLs from the AclManager and ensure the principal is BasicAclEntry.isPermitted(int)>BasicAclEntry.isPermitted(int) 55 for at least one of the requirePermission 55 s for each Collection element. If the principal does not have at least one of the permissions, that element will not be included in the returned Collection.

Often users will setup a BasicAclEntryAfterInvocationProvider with a processConfigAttribute 55 of AFTER_ACL_COLLECTION_READ and a requirePermission 55 of SimpleAclEntry.READ. These are also the defaults.

The AclManager is allowed to return any implementations of AclEntry it wishes. However, this provider will only be able to validate against BasicAclEntrys, and thus a Collection element will be filtered from the resulting Collection if no AclEntry is of type BasicAclEntry.

If the provided returnObject is null, a nullCollection will be returned. If the provided returnObject is not a Collection, an org.acegisecurity.AuthorizationServiceException will be thrown.

All comparisons and prefixes are case sensitive.

Version:

$Id: BasicAclEntryAfterInvocationCollectionFilteringProvider.java,v 1.7 2005/11/17 00:55:56 benalex Exp $

---

Field Summary
private  org.acegisecurity.acl.AclManager	aclManager
protected static org.apache.commons.logging.Log	logger
private  java.lang.String	processConfigAttribute
private  int[]	requirePermission

 

Constructor Summary

BasicAclEntryAfterInvocationCollectionFilteringProvider()

 

Method Summary
void	afterPropertiesSet()           Invoked by a BeanFactory after it has set all bean properties supplied (and satisfied BeanFactoryAware and ApplicationContextAware).
java.lang.Object	decide(org.acegisecurity.Authentication authentication, java.lang.Object object, ConfigAttributeDefinition config, java.lang.Object returnedObject)
org.acegisecurity.acl.AclManager	getAclManager()
java.lang.String	getProcessConfigAttribute()
int[]	getRequirePermission()
void	setAclManager(org.acegisecurity.acl.AclManager aclManager)
void	setProcessConfigAttribute(java.lang.String processConfigAttribute)
void	setRequirePermission(int[] requirePermission)
boolean	supports(ConfigAttribute attribute)           Indicates whether this AfterInvocationProvider is able to participate in a decision involving the passed ConfigAttribute.

 

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

 

Field Detail

logger

protected static final org.apache.commons.logging.Log logger

---

aclManager

private org.acegisecurity.acl.AclManager aclManager

---

processConfigAttribute

private java.lang.String processConfigAttribute

---

requirePermission

private int[] requirePermission

Constructor Detail

BasicAclEntryAfterInvocationCollectionFilteringProvider

public BasicAclEntryAfterInvocationCollectionFilteringProvider()

Method Detail

setAclManager

public void setAclManager(org.acegisecurity.acl.AclManager aclManager)

---

getAclManager

public org.acegisecurity.acl.AclManager getAclManager()

---

setProcessConfigAttribute

public void setProcessConfigAttribute(java.lang.String processConfigAttribute)

---

getProcessConfigAttribute

public java.lang.String getProcessConfigAttribute()

---

setRequirePermission

public void setRequirePermission(int[] requirePermission)

---

getRequirePermission

public int[] getRequirePermission()

---

afterPropertiesSet

public void afterPropertiesSet()
                        throws java.lang.Exception

Description copied from interface: org.springframework.beans.factory.InitializingBean

Invoked by a BeanFactory after it has set all bean properties supplied (and satisfied BeanFactoryAware and ApplicationContextAware).

This method allows the bean instance to perform initialization only possible when all bean properties have been set and to throw an exception in the event of misconfiguration.

Specified by:

afterPropertiesSet in interface org.springframework.beans.factory.InitializingBean

---

decide

public java.lang.Object decide(org.acegisecurity.Authentication authentication,
                               java.lang.Object object,
                               ConfigAttributeDefinition config,
                               java.lang.Object returnedObject)
                        throws org.acegisecurity.AccessDeniedException

Specified by:

decide in interface AfterInvocationProvider

---

supports

public boolean supports(ConfigAttribute attribute)

Description copied from interface: AfterInvocationProvider

Indicates whether this AfterInvocationProvider is able to participate in a decision involving the passed ConfigAttribute.

This allows the AbstractSecurityInterceptor to check every configuration attribute can be consumed by the configured AccessDecisionManager and/or RunAsManager and/or AccessDecisionManager.

Specified by:

supports in interface AfterInvocationProvider

---

Overview  Package   Class  Use  Deprecated  Index
Home >> All >> org >> acegisecurity >> [ afterinvocation overview ]	PREV CLASS  NEXT CLASS
SUMMARY:  JAVADOC |  SOURCE |  DOWNLOAD | NESTED | FIELD | CONSTR | METHOD	DETAIL: FIELD | CONSTR | METHOD

---