org.apache.river.api.security

Class RemotePolicyProvider

java.lang.Object

java.security.Policy

org.apache.river.api.security.AbstractPolicy

org.apache.river.api.security.RemotePolicyProvider

All Implemented Interfaces:

RemotePolicy, ScalableNestedPolicy

@Beta
public class RemotePolicyProvider
extends AbstractPolicy
implements RemotePolicy, ScalableNestedPolicy

An implementation of RemotePolicy.

Since:

3.0.0

Author:

Peter Firmstone

Nested Class Summary

Nested classes/interfaces inherited from class java.security.Policy

Policy.Parameters

Field Summary

Fields

Modifier and Type	Field and Description
private Policy	basePolicy
private boolean	basePolicyIsConcurrent
private boolean	basePolicyIsRemote
private Object	grantLock
private boolean	loggable
private static Logger	logger
private static ProtectionDomain	policyDomain
private PermissionCollection	policyPermissions
private Guard	protectionDomainPermission
private PermissionGrant[]	remotePolicyGrants
private Permission	remotePolicyPermission

Fields inherited from class org.apache.river.api.security.AbstractPolicy

ALL_PERMISSION, comparator, umbrella

Fields inherited from class java.security.Policy

UNSUPPORTED_EMPTY_COLLECTION

Constructor Summary

Constructors

Constructor and Description
RemotePolicyProvider(Policy basePolicy) Creates a new RemotePolicyProvider instance that wraps around the given non-null base policy object.

Method Summary

Modifier and Type	Method and Description
List<PermissionGrant>	getPermissionGrants(ProtectionDomain domain) Returns a new List containing immutable PermissionGrant's, the List returned is not synchronised and must not be shared with policy internal state.
PermissionCollection	getPermissions(CodeSource codesource)
PermissionCollection	getPermissions(ProtectionDomain domain)
boolean	implies(ProtectionDomain domain, Permission permission)
private void	processRemotePolicyGrants(PermissionGrant[] grants) Any grants must first be checked for PermissionGrants, checkCallerHasGrants has been provided for this purpose, then prior to calling this method, the PermissionGrant's must be added to the grantsCache.
void	replace(PermissionGrant[] grants) Replaces the existing RemotePolicy's PermissionGrant's.

Methods inherited from class org.apache.river.api.security.AbstractPolicy

checkCallerHasGrants, checkNullElements, convert, expandUmbrella, extractGrantFromPolicy, processGrants

Methods inherited from class java.security.Policy

getInstance, getInstance, getInstance, getParameters, getPolicy, getProvider, getType, refresh, setPolicy

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

logger

private static final Logger logger

policyDomain

private static final ProtectionDomain policyDomain

remotePolicyGrants

private volatile PermissionGrant[] remotePolicyGrants

grantLock

private final Object grantLock

remotePolicyPermission

private final Permission remotePolicyPermission

protectionDomainPermission

private final Guard protectionDomainPermission

basePolicy

private final Policy basePolicy

basePolicyIsRemote

private final boolean basePolicyIsRemote

basePolicyIsConcurrent

private final boolean basePolicyIsConcurrent

policyPermissions

private final PermissionCollection policyPermissions

loggable

private final boolean loggable

Constructor Detail

RemotePolicyProvider

public RemotePolicyProvider(Policy basePolicy)

Creates a new RemotePolicyProvider instance that wraps around the given non-null base policy object.

Parameters:

basePolicy - base policy object containing information about non-dynamic grants

Throws:

NullPointerException - if basePolicy is null

Method Detail

replace

public void replace(PermissionGrant[] grants)
             throws IOException

Description copied from interface: RemotePolicy

Replaces the existing RemotePolicy's PermissionGrant's. The array is defensively copied, the caller, must have RuntimePermission("getProtectionDomain") as well as GrantPermission or UmbrellaGrantPermission for every Permission granted by each PermissionGrant. If the calling Subject doesn't have sufficient permission, the first permission that fails will include the SecurityException as the cause of the thrown IOException. Permissions required by the callers Subject should be set in the local policy files at the RemotePolicy server. Where an IOException is thrown, no update to the RemotePolicy has occurred.

Specified by:

replace in interface RemotePolicy

Throws:

IOException

processRemotePolicyGrants

private void processRemotePolicyGrants(PermissionGrant[] grants)

Any grants must first be checked for PermissionGrants, checkCallerHasGrants has been provided for this purpose, then prior to calling this method, the PermissionGrant's must be added to the grantsCache. processRemotePolicyGrants places the PermissionGrant's in the remotePolicyGrants array. It is recommended that only this method be used to update the remotePolicyGrants reference.

Parameters:

grants -

getPermissions

public PermissionCollection getPermissions(CodeSource codesource)

Overrides:

getPermissions in class Policy

getPermissions

public PermissionCollection getPermissions(ProtectionDomain domain)

Overrides:

getPermissions in class Policy

implies

public boolean implies(ProtectionDomain domain,
                       Permission permission)

Overrides:

implies in class Policy

getPermissionGrants

public List<PermissionGrant> getPermissionGrants(ProtectionDomain domain)

Description copied from interface: ScalableNestedPolicy

Returns a new List containing immutable PermissionGrant's, the List returned is not synchronised and must not be shared with policy internal state. Only those PermissionGrant's that imply the domain will be returned. If any PermissionGrant's are privileged (contain AllPermission), then only that one PermissionGrant should be added to the collection. If a List has a size of 1, and contains only a privileged PermissionGrant, it enables the calling policy to determine the privileged state quickly. If a policy has a privileged PermissionGrant to add to a Collection, then the Collection must be cleared before the privileged PermissionGrant is added, so the Collection only contains the privileged PermissionGrant. The top level policy gathers all PermissionGrant's, retrieves all relevant permissions, then sorts them using a PermissionComparator, so Permission objects are added to a PermissionCollection in the most efficient order. If a nested base policy doesn't support ScalableNestedPolicy, then the implementer should create a PermissionGrant for the domain, containing the Permission objects returned from the policy. The first nested base policy (usually a file policy provider) is responsible for merging any static Permission objects from the ProtectionDomain.

Specified by:

getPermissionGrants in interface ScalableNestedPolicy

Returns:

Collection