View Javadoc

    1   /* Copyright 2004, 2005 Acegi Technology Pty Limited
    2    *
    3    * Licensed under the Apache License, Version 2.0 (the "License");
    4    * you may not use this file except in compliance with the License.
    5    * You may obtain a copy of the License at
    6    *
    7    *     http://www.apache.org/licenses/LICENSE-2.0
    8    *
    9    * Unless required by applicable law or agreed to in writing, software
    10   * distributed under the License is distributed on an "AS IS" BASIS,
    11   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12   * See the License for the specific language governing permissions and
    13   * limitations under the License.
    14   */
    15
    16  package org.acegisecurity.intercept.method;
    17
    18  import org.acegisecurity.AccessDeniedException;
    19  import org.acegisecurity.Authentication;
    20  import org.acegisecurity.ConfigAttributeDefinition;
    21
    22  import org.acegisecurity.intercept.AbstractSecurityInterceptor;
    23
    24  import org.aopalliance.intercept.MethodInvocation;
    25
    26  import org.springframework.beans.factory.InitializingBean;
    27
    28  import org.springframework.util.Assert;
    29
    30
    31  /***
    32   * Allows users to determine whether they have "before invocation" privileges
    33   * for a given method invocation.
    34   *
    35   * <p>
    36   * Of course, if an {@link org.acegisecurity.AfterInvocationManager} is used to
    37   * authorize the <em>result</em> of a method invocation, this class cannot
    38   * assist determine whether or not the <code>AfterInvocationManager</code>
    39   * will enable access. Instead this class aims to allow applications to
    40   * determine whether or not the current principal would be allowed to at least
    41   * attempt to invoke the method, irrespective of the "after" invocation
    42   * handling.
    43   * </p>
    44   *
    45   * @author Ben Alex
    46   * @version $Id: MethodInvocationPrivilegeEvaluator.java,v 1.2 2005/11/25 04:56:01 benalex Exp $
    47   */
    48  public class MethodInvocationPrivilegeEvaluator implements InitializingBean {
    49      //~ Instance fields ========================================================
    50
    51      private AbstractSecurityInterceptor securityInterceptor;
    52
    53      //~ Methods ================================================================
    54
    55      public boolean isAllowed(MethodInvocation mi, Authentication authentication) {
    56          Assert.notNull(authentication, "Authentication required");
    57          Assert.notNull(authentication.getAuthorities(),
    58              "Authentication must provided non-null GrantedAuthority[]s");
    59          Assert.notNull(mi, "MethodInvocation required");
    60          Assert.notNull(mi.getMethod(),
    61              "MethodInvocation must provide a non-null getMethod()");
    62
    63          ConfigAttributeDefinition attrs = securityInterceptor.obtainObjectDefinitionSource()
    64                                                               .getAttributes(mi);
    65
    66          if (attrs == null) {
    67              if (securityInterceptor.isRejectPublicInvocations()) {
    68                  return false;
    69              }
    70
    71              return true;
    72          }
    73
    74          if (authentication == null) {
    75              return false;
    76          }
    77
    78          try {
    79              securityInterceptor.getAccessDecisionManager().decide(authentication,
    80                  mi, attrs);
    81          } catch (AccessDeniedException unauthorized) {
    82              unauthorized.printStackTrace();
    83
    84              return false;
    85          }
    86
    87          return true;
    88      }
    89
    90      public void setSecurityInterceptor(
    91          AbstractSecurityInterceptor securityInterceptor) {
    92          Assert.notNull(securityInterceptor,
    93              "AbstractSecurityInterceptor cannot be null");
    94          Assert.isTrue(MethodInvocation.class.equals(
    95                  securityInterceptor.getSecureObjectClass()),
    96              "AbstractSecurityInterceptor does not support MethodInvocations");
    97          Assert.notNull(securityInterceptor.getAccessDecisionManager(),
    98              "AbstractSecurityInterceptor must provide a non-null AccessDecisionManager");
    99          this.securityInterceptor = securityInterceptor;
    100     }
    101
    102     public void afterPropertiesSet() throws Exception {
    103         Assert.notNull(securityInterceptor, "SecurityInterceptor required");
    104     }
    105 }