org.glite.security.authz.pdp
Class BlackListServicePDP

java.lang.Object
  extended byorg.glite.security.authz.pdp.BlackListServicePDP
All Implemented Interfaces:
ServiceInterceptor, ServicePDP

public class BlackListServicePDP
extends java.lang.Object
implements ServicePDP

BlackList ServicePDP implementation allowing blacklist files to be set. The blacklist file may be updated at runtime.

See Also:
ServicePDP

Field Summary
static java.lang.String BLACK_LIST_FILE
          This configuration property should point to a file containing a row separated list of Subject DNs that should be denied access.
 
Constructor Summary
BlackListServicePDP()
           
 
Method Summary
 void close()
          this method is called by the PDP framework to indicate that the interceptor now should remove all state that was allocated in the initialize call.
 void initialize(ChainConfig config, java.lang.String name, java.lang.String id)
          initializes the interceptor with configuration information that are valid up until the point when close is called.
 boolean isPermitted(javax.security.auth.Subject peerSubject, javax.xml.rpc.handler.MessageContext context, javax.xml.namespace.QName operation)
          this operation is called by the PDP Framework whenever the application needs to call secured operations.
 
Methods inherited from class java.lang.Object
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Field Detail

BLACK_LIST_FILE

public static final java.lang.String BLACK_LIST_FILE
This configuration property should point to a file containing a row separated list of Subject DNs that should be denied access.

See Also:
Constant Field Values
Constructor Detail

BlackListServicePDP

public BlackListServicePDP()
Method Detail

initialize

public void initialize(ChainConfig config,
                       java.lang.String name,
                       java.lang.String id)
                throws InitializeException
initializes the interceptor with configuration information that are valid up until the point when close is called.

Specified by:
initialize in interface ServiceInterceptor
Parameters:
config - holding interceptor specific configuration values, that may be obtained using the name paramter
name - the name that should be used to access all the interceptor local configuration
id - the id in common for all interceptors in a chain (it is valid up until close is called) if close is not called the interceptor may assume that the id still exists after a process restart
Throws:
InitializeException - if blacklist file was not found

isPermitted

public boolean isPermitted(javax.security.auth.Subject peerSubject,
                           javax.xml.rpc.handler.MessageContext context,
                           javax.xml.namespace.QName operation)
                    throws AuthorizationException
this operation is called by the PDP Framework whenever the application needs to call secured operations. The PDP should return true if the local policy allows the subject to invoke the operation. If the PDP has no local knowledge about whether the operation is allowed or not it should return false to allow other PDPs and PIPs in the chain to continue the evaluation. Obligations to be read by other PIPs or PDPs may be set as attributes in the Subject credentials.

Specified by:
isPermitted in interface ServicePDP
Parameters:
peerSubject - authenticated client subject with credentials and attributes
context - holds properties of this XML message exchange
operation - operation that the subject wants to invoke
Returns:
false if user was not found in the blacklist
Throws:
AuthorizationException - if user was found in the blacklist

close

public void close()
           throws CloseException
this method is called by the PDP framework to indicate that the interceptor now should remove all state that was allocated in the initialize call.

Specified by:
close in interface ServiceInterceptor
Throws:
CloseException - if exception occured when closing this PDP