View Javadoc

1   /* Copyright 2004 Acegi Technology Pty Limited
2    *
3    * Licensed under the Apache License, Version 2.0 (the "License");
4    * you may not use this file except in compliance with the License.
5    * You may obtain a copy of the License at
6    *
7    *     http://www.apache.org/licenses/LICENSE-2.0
8    *
9    * Unless required by applicable law or agreed to in writing, software
10   * distributed under the License is distributed on an "AS IS" BASIS,
11   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12   * See the License for the specific language governing permissions and
13   * limitations under the License.
14   */
15  
16  package org.acegisecurity.providers.cas;
17  
18  import java.util.List;
19  
20  
21  /***
22   * Decides whether a proxy list presented via CAS is trusted or not.
23   * 
24   * <P>
25   * CAS 1.0 allowed services to receive a service ticket and then validate it.
26   * CAS 2.0 allows services to receive a service ticket and then validate it
27   * with a proxy callback URL. The callback will enable the CAS server to
28   * authenticate the service. In doing so the service will receive a
29   * proxy-granting ticket and a proxy-granting ticket IOU. The IOU is just an
30   * internal record that a proxy-granting ticket is due to be received via the
31   * callback URL.
32   * </p>
33   * 
34   * <P>
35   * With a proxy-granting ticket, a service can request the CAS server provides
36   * it with a proxy ticket. A proxy ticket is just a service ticket, but the
37   * CAS server internally tracks the list (chain) of services used to build the
38   * proxy ticket. The proxy ticket is then presented to the target service.
39   * </p>
40   * 
41   * <P>
42   * If this application is a target service of a proxy ticket, the
43   * <code>CasProxyDecider</code> resolves whether or not the proxy list is
44   * trusted. Applications should only trust services they allow to impersonate
45   * an end user.
46   * </p>
47   * 
48   * <P>
49   * If this application is a service that should never accept proxy-granting
50   * tickets, the implementation should reject tickets that present a proxy list
51   * with any members. If the list has no members, it indicates the CAS server
52   * directly authenticated the user (ie there are no services which proxied the
53   * user authentication).
54   * </p>
55   *
56   * @author Ben Alex
57   * @version $Id: CasProxyDecider.java,v 1.2 2005/11/17 00:55:47 benalex Exp $
58   */
59  public interface CasProxyDecider {
60      //~ Methods ================================================================
61  
62      /***
63       * Decides whether the proxy list is trusted.
64       * 
65       * <P>
66       * Must throw any <code>ProxyUntrustedException</code> if the proxy list is
67       * untrusted.
68       * </p>
69       */
70      public void confirmProxyListTrusted(List proxyList)
71          throws ProxyUntrustedException;
72  }