org.glite.security.authz.pdp
Class GridMapServicePDP

java.lang.Object
  extended byorg.glite.security.authz.pdp.GridMapServicePDP
All Implemented Interfaces:
ServiceInterceptor, ServicePDP

public class GridMapServicePDP
extends java.lang.Object
implements ServicePDP

Simple ServicePDP implementation allowing role permissions and blacklists to be set.

See Also:
ServicePDP

Field Summary
static java.lang.String GRID_MAP
          Property used to set in-memory grid map.
static java.lang.String GRID_MAP_FILE
          Property used to set grid map file name.
 
Constructor Summary
GridMapServicePDP()
           
 
Method Summary
 void close()
          this method is called by the PDP framework to indicate that the interceptor now should remove all state that was allocated in the initialize call.
 void initialize(ChainConfig config, java.lang.String name, java.lang.String id)
          initializes the interceptor with configuration information that are valid up until the point when close is called.
 boolean isPermitted(javax.security.auth.Subject peerSubject, javax.xml.rpc.handler.MessageContext context, javax.xml.namespace.QName operation)
          this operation is called by the PDP Framework whenever the application needs to call secured operations.
 
Methods inherited from class java.lang.Object
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Field Detail

GRID_MAP

public static final java.lang.String GRID_MAP
Property used to set in-memory grid map.

See Also:
Constant Field Values

GRID_MAP_FILE

public static final java.lang.String GRID_MAP_FILE
Property used to set grid map file name.

See Also:
Constant Field Values
Constructor Detail

GridMapServicePDP

public GridMapServicePDP()
Method Detail

initialize

public void initialize(ChainConfig config,
                       java.lang.String name,
                       java.lang.String id)
                throws InitializeException
initializes the interceptor with configuration information that are valid up until the point when close is called.

Specified by:
initialize in interface ServiceInterceptor
Parameters:
config - holding interceptor specific configuration values, that may be obtained using the name paramter
name - the name that should be used to access all the interceptor local configuration
id - the id in common for all interceptors in a chain (it is valid up until close is called) if close is not called the interceptor may assume that the id still exists after a process restart
Throws:
InitializeException - if gridmap was not found

isPermitted

public boolean isPermitted(javax.security.auth.Subject peerSubject,
                           javax.xml.rpc.handler.MessageContext context,
                           javax.xml.namespace.QName operation)
                    throws AuthorizationException
this operation is called by the PDP Framework whenever the application needs to call secured operations. The PDP should return true if the local policy allows the subject to invoke the operation. If the PDP has no local knowledge about whether the operation is allowed or not it should return false to allow other PDPs and PIPs in the chain to continue the evaluation. Obligations to be read by other PIPs or PDPs may be set as attributes in the Subject credentials.

Specified by:
isPermitted in interface ServicePDP
Parameters:
peerSubject - authenticated client subject with credentials and attributes
context - holds properties of this XML message exchange
operation - operation that the subject wants to invoke
Returns:
true if user was found in gridmap, otherwise false
Throws:
AuthorizationException - if an exception occured during evaluation

close

public void close()
           throws CloseException
this method is called by the PDP framework to indicate that the interceptor now should remove all state that was allocated in the initialize call.

Specified by:
close in interface ServiceInterceptor
Throws:
CloseException - if exception occured when closing this PDP