View Javadoc

    1   /* Copyright 2004, 2005 Acegi Technology Pty Limited
    2    *
    3    * Licensed under the Apache License, Version 2.0 (the "License");
    4    * you may not use this file except in compliance with the License.
    5    * You may obtain a copy of the License at
    6    *
    7    *     http://www.apache.org/licenses/LICENSE-2.0
    8    *
    9    * Unless required by applicable law or agreed to in writing, software
    10   * distributed under the License is distributed on an "AS IS" BASIS,
    11   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12   * See the License for the specific language governing permissions and
    13   * limitations under the License.
    14   */
    15
    16  package org.acegisecurity.vote;
    17
    18  import org.acegisecurity.AccessDeniedException;
    19  import org.acegisecurity.Authentication;
    20  import org.acegisecurity.ConfigAttributeDefinition;
    21
    22  import org.apache.commons.logging.Log;
    23  import org.apache.commons.logging.LogFactory;
    24
    25  import java.util.Iterator;
    26
    27
    28  /***
    29   * Simple concrete implementation of  {@link
    30   * org.acegisecurity.AccessDecisionManager} that grants access if any
    31   * <code>AccessDecisionVoter</code> returns an affirmative response.
    32   */
    33  public class AffirmativeBased extends AbstractAccessDecisionManager {
    34      //~ Static fields/initializers =============================================
    35
    36      private static final Log logger = LogFactory.getLog(AffirmativeBased.class);
    37
    38      //~ Methods ================================================================
    39
    40      /***
    41       * This concrete implementation simply polls all configured  {@link
    42       * AccessDecisionVoter}s and grants access if any
    43       * <code>AccessDecisionVoter</code> voted affirmatively. Denies access
    44       * only if there was a deny vote AND no affirmative votes.
    45       *
    46       * <p>
    47       * If every <code>AccessDecisionVoter</code> abstained from voting, the
    48       * decision will be based on the {@link #isAllowIfAllAbstainDecisions()}
    49       * property (defaults to false).
    50       * </p>
    51       *
    52       * @param authentication the caller invoking the method
    53       * @param object the secured object
    54       * @param config the configuration attributes associated with the method
    55       *        being invoked
    56       *
    57       * @throws AccessDeniedException if access is denied
    58       */
    59      public void decide(Authentication authentication, Object object,
    60          ConfigAttributeDefinition config) throws AccessDeniedException {
    61          Iterator iter = this.getDecisionVoters().iterator();
    62          int deny = 0;
    63
    64          while (iter.hasNext()) {
    65              AccessDecisionVoter voter = (AccessDecisionVoter) iter.next();
    66              int result = voter.vote(authentication, object, config);
    67
    68              switch (result) {
    69              case AccessDecisionVoter.ACCESS_GRANTED:
    70                  return;
    71
    72              case AccessDecisionVoter.ACCESS_DENIED:
    73                  deny++;
    74
    75                  break;
    76
    77              default:
    78                  break;
    79              }
    80          }
    81
    82          if (deny > 0) {
    83              throw new AccessDeniedException(messages.getMessage(
    84                      "AbstractAccessDecisionManager.accessDenied",
    85                      "Access is denied"));
    86          }
    87
    88          // To get this far, every AccessDecisionVoter abstained
    89          if (this.isAllowIfAllAbstainDecisions()) {
    90              return;
    91          } else {
    92              throw new AccessDeniedException(messages.getMessage(
    93                      "AbstractAccessDecisionManager.accessDenied",
    94                      "Access is denied"));
    95          }
    96      }
    97  }