View Javadoc

1   /* Copyright 2004, 2005 Acegi Technology Pty Limited
2    *
3    * Licensed under the Apache License, Version 2.0 (the "License");
4    * you may not use this file except in compliance with the License.
5    * You may obtain a copy of the License at
6    *
7    *     http://www.apache.org/licenses/LICENSE-2.0
8    *
9    * Unless required by applicable law or agreed to in writing, software
10   * distributed under the License is distributed on an "AS IS" BASIS,
11   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12   * See the License for the specific language governing permissions and
13   * limitations under the License.
14   */
15  
16  package org.acegisecurity.vote;
17  
18  import org.acegisecurity.AccessDeniedException;
19  import org.acegisecurity.Authentication;
20  import org.acegisecurity.ConfigAttribute;
21  import org.acegisecurity.ConfigAttributeDefinition;
22  
23  import org.apache.commons.logging.Log;
24  import org.apache.commons.logging.LogFactory;
25  
26  import java.util.Iterator;
27  
28  
29  /***
30   * Simple concrete implementation of  {@link
31   * org.acegisecurity.AccessDecisionManager} that  requires all voters to
32   * abstain or grant access.
33   */
34  public class UnanimousBased extends AbstractAccessDecisionManager {
35      //~ Static fields/initializers =============================================
36  
37      private static final Log logger = LogFactory.getLog(UnanimousBased.class);
38  
39      //~ Methods ================================================================
40  
41      /***
42       * This concrete implementation polls all configured  {@link
43       * AccessDecisionVoter}s for each {@link ConfigAttribute} and grants
44       * access if <b>only</b> grant votes were received.
45       * 
46       * <p>
47       * Other voting implementations usually pass the entire list of {@link
48       * ConfigAttributeDefinition}s to the  <code>AccessDecisionVoter</code>.
49       * This implementation differs in that each
50       * <code>AccessDecisionVoter</code> knows only about a single
51       * <code>ConfigAttribute</code> at a time.
52       * </p>
53       * 
54       * <p>
55       * If every <code>AccessDecisionVoter</code> abstained from voting, the
56       * decision will be based on the {@link #isAllowIfAllAbstainDecisions()}
57       * property (defaults to false).
58       * </p>
59       *
60       * @param authentication the caller invoking the method
61       * @param object the secured object
62       * @param config the configuration attributes associated with the method
63       *        being invoked
64       *
65       * @throws AccessDeniedException if access is denied
66       */
67      public void decide(Authentication authentication, Object object,
68          ConfigAttributeDefinition config) throws AccessDeniedException {
69          int grant = 0;
70          int deny = 0;
71          int abstain = 0;
72  
73          Iterator configIter = config.getConfigAttributes();
74  
75          while (configIter.hasNext()) {
76              ConfigAttributeDefinition thisDef = new ConfigAttributeDefinition();
77              thisDef.addConfigAttribute((ConfigAttribute) configIter.next());
78  
79              Iterator voters = this.getDecisionVoters().iterator();
80  
81              while (voters.hasNext()) {
82                  AccessDecisionVoter voter = (AccessDecisionVoter) voters.next();
83                  int result = voter.vote(authentication, object, thisDef);
84  
85                  switch (result) {
86                  case AccessDecisionVoter.ACCESS_GRANTED:
87                      grant++;
88  
89                      break;
90  
91                  case AccessDecisionVoter.ACCESS_DENIED:
92                      deny++;
93  
94                      break;
95  
96                  default:
97                      abstain++;
98  
99                      break;
100                 }
101             }
102         }
103 
104         if (deny > 0) {
105             throw new AccessDeniedException(messages.getMessage(
106                     "AbstractAccessDecisionManager.accessDenied",
107                     "Access is denied"));
108         }
109 
110         // To get this far, there were no deny votes
111         if (grant > 0) {
112             return;
113         }
114 
115         // To get this far, every AccessDecisionVoter abstained
116         if (this.isAllowIfAllAbstainDecisions()) {
117             return;
118         } else {
119             throw new AccessDeniedException(messages.getMessage(
120                     "AbstractAccessDecisionManager.accessDenied",
121                     "Access is denied"));
122         }
123     }
124 }