org.globus.wsrf.impl.security.authorization
Class IdentityAuthorization

java.lang.Object
  org.globus.wsrf.impl.security.authorization.BasicSubjectAuthorization
      org.globus.wsrf.impl.security.authorization.IdentityAuthorization

All Implemented Interfaces:

Authorization, Interceptor, PDP, java.io.Serializable

public class IdentityAuthorization

extends BasicSubjectAuthorization

implements Authorization, PDP

Does identity authorization and and implements PDP and Authorization interface.

See Also:

Serialized Form

Field Summary

(package private) static org.globus.util.I18n	i18n
static java.lang.String	IDENTITY_PROP
protected javax.security.auth.Subject	subject

Fields inherited from class org.globus.wsrf.impl.security.authorization.BasicSubjectAuthorization

Fields inherited from interface org.globus.wsrf.impl.security.authorization.Authorization

AUTHORIZATION, AUTHZ_CLASS, AUTHZ_GRIDMAP, AUTHZ_HOST, AUTHZ_IDENTITY, AUTHZ_NONE, AUTHZ_SAML, AUTHZ_SELF, AUTHZ_USERNAME, GRIDMAP_PREFIX, HOST_PREFIX, IDENTITY_PREFIX, NONE_PREFIX, RESOURCE, SAML_PREFIX, SELF_PREFIX, USERNAME_PREFIX

Constructor Summary

IdentityAuthorization()

IdentityAuthorization(java.lang.String globusIdentity)

IdentityAuthorization(javax.security.auth.Subject subject_)

Method Summary

void	authorize(javax.security.auth.Subject peerSubject, javax.xml.rpc.handler.MessageContext context) Does identity authorization of the server.
void	close() this method is called by the PDP framework to indicate that the interceptor now should remove all state that was allocated in the initialize call
java.lang.String	getIdentity()
org.ietf.jgss.GSSName	getName(javax.xml.rpc.handler.MessageContext ctx) Returns the identity of the authorized entity
org.w3c.dom.Node	getPolicy(org.w3c.dom.Node policy) gets the current policy of the PDP
java.lang.String[]	getPolicyNames() gets the names (typically uris) of all the policies that the PDP supports
void	initialize(PDPConfig config, java.lang.String name, java.lang.String id) Initializes the interceptor with configuration information that are valid up until the point when close is called.
boolean	isPermitted(javax.security.auth.Subject peerSubject, javax.xml.rpc.handler.MessageContext context, javax.xml.namespace.QName op) Does identity authorization of the client.The expected identity can be set by a) using contructor by passing an identity/subject b) configuring a property idenAuthz-identityin the PDPConfig object passed.
org.w3c.dom.Node	setPolicy(org.w3c.dom.Node policy) sets the current policy of the PDP

Methods inherited from class org.globus.wsrf.impl.security.authorization.BasicSubjectAuthorization

authorize

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

subject

protected javax.security.auth.Subject subject

IDENTITY_PROP

public static final java.lang.String IDENTITY_PROP

See Also:

Constant Field Values

i18n

static org.globus.util.I18n i18n

Constructor Detail

IdentityAuthorization

public IdentityAuthorization()

IdentityAuthorization

public IdentityAuthorization(javax.security.auth.Subject subject_)

IdentityAuthorization

public IdentityAuthorization(java.lang.String globusIdentity)

Method Detail

initialize

public void initialize(PDPConfig config,
                       java.lang.String name,
                       java.lang.String id)
                throws InitializeException

Description copied from interface: Interceptor

Initializes the interceptor with configuration information that are valid up until the point when close is called.

Specified by:

initialize in interface Interceptor

Parameters:

config - holding interceptor specific configuration values, that may be obtained using the name paramter

name - the name that should be used to access all the interceptor local configuration

id - the id in common for all interceptors in a chain (it is valid up until close is called) if close is not called the interceptor may assume that the id still exists after a process restart

Throws:

InitializeException

getPolicyNames

public java.lang.String[] getPolicyNames()

Description copied from interface: PDP

gets the names (typically uris) of all the policies that the PDP supports

Specified by:

getPolicyNames in interface PDP

Returns:

array of policy names

getPolicy

public org.w3c.dom.Node getPolicy(org.w3c.dom.Node policy)
                           throws InvalidPolicyException

Description copied from interface: PDP

gets the current policy of the PDP

Specified by:

getPolicy in interface PDP

Parameters:

policy - may be used to query for a subset of a policy

Returns:

the policy

Throws:

InvalidPolicyException

setPolicy

public org.w3c.dom.Node setPolicy(org.w3c.dom.Node policy)
                           throws InvalidPolicyException

Description copied from interface: PDP

sets the current policy of the PDP

Specified by:

setPolicy in interface PDP

Parameters:

policy - new policy

Returns:

optional set policy result

Throws:

InvalidPolicyException

close

public void close()
           throws CloseException

Description copied from interface: Interceptor

this method is called by the PDP framework to indicate that the interceptor now should remove all state that was allocated in the initialize call

Specified by:

close in interface Interceptor

Throws:

CloseException

isPermitted

public boolean isPermitted(javax.security.auth.Subject peerSubject,
                           javax.xml.rpc.handler.MessageContext context,
                           javax.xml.namespace.QName op)
                    throws AuthorizationException

Does identity authorization of the client.The expected identity can be set by a) using contructor by passing an identity/subject b) configuring a property idenAuthz-identityin the PDPConfig object passed. If the PDPConfig implementation used is ServicePropertiesPDPConfig, then the property needs to be set in service deployment descriptor, if ResourcePDPConfig is used, then the property needs to be populated in the hashmap in that class, if ContainerPDPConfig is used then the property needs to be set as a global parameter in the deployment descriptor.

Specified by:

isPermitted in interface PDP

Parameters:

peerSubject - authenticated client subject with credentials and attributes

context - holds properties of this XML message exchange

op - operation that the subject wants to invoke

Throws:

AuthorizationException

authorize

public void authorize(javax.security.auth.Subject peerSubject,
                      javax.xml.rpc.handler.MessageContext context)
               throws AuthorizationException

Does identity authorization of the server. The identity is set by passing the value in the constructor.

Specified by:

authorize in interface Authorization

Throws:

AuthorizationException

getIdentity

public java.lang.String getIdentity()

getName

public org.ietf.jgss.GSSName getName(javax.xml.rpc.handler.MessageContext ctx)
                              throws AuthorizationException

Description copied from interface: Authorization

Returns the identity of the authorized entity

Specified by:

getName in interface Authorization

Throws:

AuthorizationException