View Javadoc

    1   /* Copyright 2004 Acegi Technology Pty Limited
    2    *
    3    * Licensed under the Apache License, Version 2.0 (the "License");
    4    * you may not use this file except in compliance with the License.
    5    * You may obtain a copy of the License at
    6    *
    7    *     http://www.apache.org/licenses/LICENSE-2.0
    8    *
    9    * Unless required by applicable law or agreed to in writing, software
    10   * distributed under the License is distributed on an "AS IS" BASIS,
    11   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12   * See the License for the specific language governing permissions and
    13   * limitations under the License.
    14   */
    15
    16  package org.acegisecurity.vote;
    17
    18  import org.acegisecurity.Authentication;
    19  import org.acegisecurity.ConfigAttribute;
    20  import org.acegisecurity.ConfigAttributeDefinition;
    21
    22  import java.util.Iterator;
    23
    24
    25  /***
    26   * <p>
    27   * Votes if any {@link ConfigAttribute#getAttribute()} starts with a prefix
    28   * indicating that it is a role. The default prefix string is
    29   * <Code>ROLE_</code>, but this may be overriden to any value. It may also be
    30   * set to empty, which means that essentially any attribute will be voted on.
    31   * As described further below, the effect of an empty prefix may not be quite
    32   * desireable.
    33   * </p>
    34   *
    35   * <p>
    36   * Abstains from voting if no configuration attribute commences with the  role
    37   * prefix. Votes to grant access if there is an exact matching {@link
    38   * org.acegisecurity.GrantedAuthority} to a <code>ConfigAttribute</code>
    39   * starting with the role prefix. Votes to deny access if there is no exact
    40   * matching <code>GrantedAuthority</code>  to a <code>ConfigAttribute</code>
    41   * starting with the role prefix.
    42   * </p>
    43   *
    44   * <p>
    45   * An empty role prefix means that the voter will vote for every
    46   * ConfigAttribute. When there are different categories of ConfigAttributes
    47   * used, this will not be optimal since the voter will be voting for
    48   * attributes which do not represent roles. However, this option may be of
    49   * some use when using preexisting role names without a prefix, and no ability
    50   * exists to prefix them with a role prefix on reading them in, such as
    51   * provided for example in  {@link
    52   * org.acegisecurity.userdetails.jdbc.JdbcDaoImpl}.
    53   * </p>
    54   *
    55   * <p>
    56   * All comparisons and prefixes are case sensitive.
    57   * </p>
    58   *
    59   * @author Ben Alex
    60   * @author colin sampaleanu
    61   * @version $Id: RoleVoter.java,v 1.6 2005/11/29 13:10:15 benalex Exp $
    62   */
    63  public class RoleVoter implements AccessDecisionVoter {
    64      //~ Instance fields ========================================================
    65
    66      private String rolePrefix = "ROLE_";
    67
    68      //~ Methods ================================================================
    69
    70      /***
    71       * Allows the default role prefix of <code>ROLE_</code> to be overriden.
    72       * May be set to an empty value, although this is usually not desireable.
    73       *
    74       * @param rolePrefix the new prefix
    75       */
    76      public void setRolePrefix(String rolePrefix) {
    77          this.rolePrefix = rolePrefix;
    78      }
    79
    80      public String getRolePrefix() {
    81          return rolePrefix;
    82      }
    83
    84      public boolean supports(ConfigAttribute attribute) {
    85          if ((attribute.getAttribute() != null)
    86              && attribute.getAttribute().startsWith(getRolePrefix())) {
    87              return true;
    88          } else {
    89              return false;
    90          }
    91      }
    92
    93      /***
    94       * This implementation supports any type of class, because it does not
    95       * query the presented secure object.
    96       *
    97       * @param clazz the secure object
    98       *
    99       * @return always <code>true</code>
    100      */
    101     public boolean supports(Class clazz) {
    102         return true;
    103     }
    104
    105     public int vote(Authentication authentication, Object object,
    106         ConfigAttributeDefinition config) {
    107         int result = ACCESS_ABSTAIN;
    108         Iterator iter = config.getConfigAttributes();
    109
    110         while (iter.hasNext()) {
    111             ConfigAttribute attribute = (ConfigAttribute) iter.next();
    112
    113             if (this.supports(attribute)) {
    114                 result = ACCESS_DENIED;
    115
    116                 // Attempt to find a matching granted authority
    117                 for (int i = 0; i < authentication.getAuthorities().length;
    118                     i++) {
    119                     if (attribute.getAttribute().equals(authentication
    120                             .getAuthorities()[i].getAuthority())) {
    121                         return ACCESS_GRANTED;
    122                     }
    123                 }
    124             }
    125         }
    126
    127         return result;
    128     }
    129 }