Overview | Package | Class | Use | Tree | Deprecated | Index | Help
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD

## org.acegisecurity.vote
Class BasicAclEntryVoter

    java.lang.Object
      org.acegisecurity.vote.AbstractAclVoter
          org.acegisecurity.vote.BasicAclEntryVoter

All Implemented Interfaces:
  AccessDecisionVoter, InitializingBean

    public class BasicAclEntryVoter

extends AbstractAclVoter
implements InitializingBean

Given a domain object instance passed as a method argument, ensures the principal has appropriate permission as defined by the `AclManager`.

The `AclManager` is used to retrieve the access control list (ACL) permissions associated with a domain object instance for the current `Authentication` object. This class is designed to process `AclEntry`s that are subclasses of `BasicAclEntry` only. Generally these are obtained by using the `BasicAclProvider`.

The voter will vote if any `ConfigAttribute.getAttribute()` matches the `processConfigAttribute`. The provider will then locate the first method argument of type `AbstractAclVoter.processDomainObjectClass`. Assuming that method argument is non-null, the provider will then lookup the ACLs from the `AclManager` and ensure the principal is `BasicAclEntry.isPermitted(int)` for at least one of the `requirePermission`s.

If the method argument is `null`, the voter will abstain from voting. If the method argument could not be found, an `AuthorizationServiceException` will be thrown.

In practical terms users will typically setup a number of `BasicAclEntryVoter`s. Each will have a different `AbstractAclVoter.processDomainObjectClass`, `processConfigAttribute` and `requirePermission` combination. For example, a small application might employ the following instances of `BasicAclEntryVoter`:

- Process domain object class `BankAccount`, configuration attribute `VOTE_ACL_BANK_ACCONT_READ`, require permission `SimpleAclEntry.READ`
- Process domain object class `BankAccount`, configuration attribute `VOTE_ACL_BANK_ACCOUNT_WRITE`, require permission list `SimpleAclEntry.WRITE` and `SimpleAclEntry.CREATE` (allowing the principal to have either of these two permissions
- Process domain object class `Customer`, configuration attribute `VOTE_ACL_CUSTOMER_READ`, require permission `SimpleAclEntry.READ`
- Process domain object class `Customer`, configuration attribute `VOTE_ACL_CUSTOMER_WRITE`, require permission list `SimpleAclEntry.WRITE` and `SimpleAclEntry.CREATE`

Alternatively, you could have used a common superclass or interface for the `AbstractAclVoter.processDomainObjectClass` if both `BankAccount` and `Customer` had common parents.

If the principal does not have sufficient permissions, the voter will vote to deny access.

The `AclManager` is allowed to return any implementations of `AclEntry` it wishes. However, this provider will only be able to validate against `AbstractBasicAclEntry`s, and thus a vote to deny access will be made if no `AclEntry` is of type `AbstractBasicAclEntry`.

All comparisons and prefixes are case sensitive.

Version:
  $Id: BasicAclEntryVoter.java,v 1.8 2005/11/17 00:55:47 benalex Exp $
Author:
  Ben Alex

Field Summary

Fields inherited from interface org.acegisecurity.vote.AccessDecisionVoter
`ACCESS_ABSTAIN, ACCESS_DENIED, ACCESS_GRANTED`

Constructor Summary
`BasicAclEntryVoter()`

Method Summary
`void` | `afterPropertiesSet()`
`AclManager` | `getAclManager()`
`String` | `getInternalMethod()` Optionally specifies a method of the domain object that will be used to obtain a contained domain object.
`String` | `getProcessConfigAttribute()`
`int[]` | `getRequirePermission()`
`void` | `setAclManager(AclManager aclManager)`
`void` | `setInternalMethod(String internalMethod)`
`void` | `setProcessConfigAttribute(String processConfigAttribute)`
`void` | `setRequirePermission(int[] requirePermission)`
`boolean` | `supports(ConfigAttribute attribute)` Indicates whether this `AccessDecisionVoter` is able to vote on the passed `ConfigAttribute`.
`int` | `vote(Authentication authentication, Object object, ConfigAttributeDefinition config)` Indicates whether or not access is granted.

Methods inherited from class org.acegisecurity.vote.AbstractAclVoter
`getDomainObjectInstance, getProcessDomainObjectClass, setProcessDomainObjectClass, supports`

Methods inherited from class java.lang.Object
`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

Constructor Detail

### BasicAclEntryVoter

    public BasicAclEntryVoter()

Method Detail

### setAclManager

    public void setAclManager(AclManager aclManager)

### getAclManager

    public AclManager getAclManager()

### setInternalMethod

    public void setInternalMethod(String internalMethod)

### getInternalMethod

    public String getInternalMethod()

  Optionally specifies a method of the domain object that will be used to obtain a contained domain object. That contained domain object will be used for the ACL evaluation. This is useful if a domain object contains a parent that an ACL evaluation should be targeted for, instead of the child domain object (which perhaps is being created and as such does not yet have any ACL permissions)

  Returns:
    `null` to use the domain object, or the name of a method (that requires no arguments) that should be invoked to obtain an `Object` which will be the domain object used for ACL evaluation

### setProcessConfigAttribute

    public void setProcessConfigAttribute(String processConfigAttribute)

### getProcessConfigAttribute

    public String getProcessConfigAttribute()

### setRequirePermission

    public void setRequirePermission(int[] requirePermission)

### getRequirePermission

    public int[] getRequirePermission()

### afterPropertiesSet

    public void afterPropertiesSet()
                            throws Exception

  Specified by:
    `afterPropertiesSet` in interface `InitializingBean`
  Throws:
    `Exception`

### supports

    public boolean supports(ConfigAttribute attribute)

  Description copied from interface: `AccessDecisionVoter`
  Indicates whether this `AccessDecisionVoter` is able to vote on the passed `ConfigAttribute`.

  This allows the `AbstractSecurityInterceptor` to check every configuration attribute can be consumed by the configured `AccessDecisionManager` and/or `RunAsManager` and/or `AccessDecisionManager`.

  Specified by:
    `supports` in interface `AccessDecisionVoter`
  Parameters:
    `attribute` - a configuration attribute that has been configured against the `AbstractSecurityInterceptor`
  Returns:
    true if this `AccessDecisionVoter` can support the passed configuration attribute

### vote

    public int vote(Authentication authentication,
                    Object object,
                    ConfigAttributeDefinition config)

  Description copied from interface: `AccessDecisionVoter`
  Indicates whether or not access is granted.

  The decision must be affirmative (`ACCESS_GRANTED`), negative (`ACCESS_DENIED`) or the `AccessDecisionVoter` can abstain (`ACCESS_ABSTAIN`) from voting. Under no circumstances should implementing classes return any other value. If a weighting of results is desired, this should be handled in a custom `AccessDecisionManager` instead.

  Unless an `AccessDecisionVoter` is specifically intended to vote on an access control decision due to a passed method invocation or configuration attribute parameter, it must return `ACCESS_ABSTAIN`. This prevents the coordinating `AccessDecisionManager` from counting votes from those `AccessDecisionVoter`s without a legitimate interest in the access control decision.

  Whilst the method invocation is passed as a parameter to maximise flexibility in making access control decisions, implementing classes must never modify the behaviour of the method invocation (such as calling `MethodInvocation.proceed()`).

  Specified by:
    `vote` in interface `AccessDecisionVoter`
  Parameters:
    `authentication` - the caller invoking the method
    `object` - the secured object
    `config` - the configuration attributes associated with the method being invoked
  Returns:
    either `AccessDecisionVoter.ACCESS_GRANTED`, `AccessDecisionVoter.ACCESS_ABSTAIN` or `AccessDecisionVoter.ACCESS_DENIED`

Overview | Package | Class | Use | Tree | Deprecated | Index | Help
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD

Copyright © 2004-2005 Acegi Technology Pty Limited. All Rights Reserved.