org.acegisecurity.vote

Class LabelBasedAclVoter

java.lang.Object

org.acegisecurity.vote.AbstractAclVoter

org.acegisecurity.vote.LabelBasedAclVoter

All Implemented Interfaces:

AccessDecisionVoter

public class LabelBasedAclVoter
extends AbstractAclVoter

This Acl voter will evaluate methods based on labels applied to incoming arguments. It will only check methods that have been properly tagged in the MethodSecurityInterceptor with the value stored in attributeIndicatingLabeledOperation. If a method has been tagged, then it examines each argument, and if the argument implements LabeledData, then it will asses if the user's list of granted authorities matches.

By default, if none of the arguments are labeled, then the access will be granted. This can be overridden by setting allowAccessIfNoAttributesAreLabeled to false in the Spring context file.

In many situations, different values are linked together to define a common label, it is necessary to define a map in the application context that links user-assigned label access to domain object labels. This is done by setting up the labelMap in the application context.

Version:

$Id: LabelBasedAclVoter.java 1962 2007-08-27 17:21:16Z luke_t $

Author:

Greg Turnquist

See Also:

MethodSecurityInterceptor

Field Summary

Fields inherited from interface org.acegisecurity.vote.AccessDecisionVoter

ACCESS_ABSTAIN, ACCESS_DENIED, ACCESS_GRANTED

Constructor Summary

Constructors

Constructor and Description
LabelBasedAclVoter()

Method Summary

Modifier and Type	Method and Description
void	setAllowAccessIfNoAttributesAreLabeled(boolean allowAccessIfNoAttributesAreLabeled) Set whether or not to allow the user to run methods in which none of the incoming arguments are labeled.
void	setAttributeIndicatingLabeledOperation(String attributeIndicatingLabeledOperation) Each method intended for evaluation by this voter must include this tag name in the definition of the MethodSecurityInterceptor, indicating if this voter should evaluate the arguments and compare them against the label map.
void	setLabelMap(Map labelMap) Set the map that correlate a user's assigned label against domain object values that are considered data labels.
boolean	supports(ConfigAttribute attribute) This acl voter will only evaluate labeled methods if they are marked in the security interceptor's configuration with the attribute stored in attributeIndicatingLabeledOperation.
int	vote(Authentication authentication, Object object, ConfigAttributeDefinition config) Vote on whether or not the user has all the labels necessary to match the method argument's labeled data.

Methods inherited from class org.acegisecurity.vote.AbstractAclVoter

getDomainObjectInstance, getProcessDomainObjectClass, setProcessDomainObjectClass, supports

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

LabelBasedAclVoter

public LabelBasedAclVoter()

Method Detail

setAllowAccessIfNoAttributesAreLabeled

public void setAllowAccessIfNoAttributesAreLabeled(boolean allowAccessIfNoAttributesAreLabeled)

Set whether or not to allow the user to run methods in which none of the incoming arguments are labeled.

Default value: true, users can run such methods.

Parameters:

allowAccessIfNoAttributesAreLabeled - boolean

setAttributeIndicatingLabeledOperation

public void setAttributeIndicatingLabeledOperation(String attributeIndicatingLabeledOperation)

Each method intended for evaluation by this voter must include this tag name in the definition of the MethodSecurityInterceptor, indicating if this voter should evaluate the arguments and compare them against the label map.

Parameters:

attributeIndicatingLabeledOperation - string

setLabelMap

public void setLabelMap(Map labelMap)

Set the map that correlate a user's assigned label against domain object values that are considered data labels. An example application context configuration of a labelMap:

 <bean id="accessDecisionManager" class="org.acegisecurity.vote.UnanimousBased">
     <property name="allowIfAllAbstainDecisions"><value>false</value></property>
     <property name="decisionVoters">
       <list>
         <bean class="org.acegisecurity.vote.RoleVoter"/>
         <bean class="org.acegisecurity.vote.LabelBasedAclVoter">
           <property name="attributeIndicatingLabeledOperation">
             <value>LABELED_OPERATION</value>
           </property>
           <property name="labelMap">
             <map>
               <entry key="DATA_LABEL_BLUE">
                 <list>
                   <value>blue</value>
                   <value>indigo</value>
                   <value>purple</value>
                 </list>
               </entry>
               <entry key="LABEL_ORANGE">
                 <list>
                   <value>orange</value>
                   <value>sunshine</value>
                   <value>amber</value>
                 </list>
               </entry>
               <entry key="LABEL_ADMIN">
                 <list>
                   <value>blue</value>
                   <value>indigo</value>
                   <value>purple</value>
                   <value>orange</value>
                   <value>sunshine</value>
                   <value>amber</value>
                 </list>
               </entry>
             </map>
           </property>
         </bean>
       </list>
     </property>
   </bean>
 

Parameters:

labelMap - a map structured as in the above example.

supports

public boolean supports(ConfigAttribute attribute)

This acl voter will only evaluate labeled methods if they are marked in the security interceptor's configuration with the attribute stored in attributeIndicatingLabeledOperation.

Parameters:

attribute - DOCUMENT ME!

Returns:

DOCUMENT ME!

See Also:

AbstractAclVoter, MethodSecurityInterceptor

vote

public int vote(Authentication authentication,
                Object object,
                ConfigAttributeDefinition config)

Vote on whether or not the user has all the labels necessary to match the method argument's labeled data.

Parameters:

authentication - DOCUMENT ME!

object - DOCUMENT ME!

config - DOCUMENT ME!

Returns:

ACCESS_ABSTAIN, ACCESS_GRANTED, or ACCESS_DENIED.