Overview  Package   Class  Tree  Deprecated  Index  Help 
 PREV CLASS   NEXT CLASS FRAMES    NO FRAMES    
SUMMARY: NESTED | FIELD | CONSTR | METHOD DETAIL: FIELD | CONSTR | METHOD

edu.internet2.middleware.grouper.privs
Class GrouperSystemAccessResolver

java.lang.Object
  extended by edu.internet2.middleware.grouper.privs.AccessResolverDecorator
      extended by edu.internet2.middleware.grouper.privs.GrouperSystemAccessResolver
All Implemented Interfaces:
AccessResolver
public class GrouperSystemAccessResolver
extends AccessResolverDecorator

Decorator that provides GrouperSystem privilege resolution for AccessResolver.

Since:
1.2.1
Version:
$Id: GrouperSystemAccessResolver.java,v 1.15 2009-09-21 06:14:26 mchyzer Exp $
Author:
blair christensen.

Constructor Summary
GrouperSystemAccessResolver(AccessResolver resolver)
           
 
Method Summary
 void flushCache()
          flush cache if caching resolver
 Set<AccessPrivilege> getPrivileges(Group group, edu.internet2.middleware.subject.Subject subject)
          Get all privileges subject has on group.
 boolean hasPrivilege(Group group, edu.internet2.middleware.subject.Subject subject, Privilege privilege)
          Check whether subject has privilege on group.
 boolean hqlFilterGroupsNotWithPrivWhereClause(edu.internet2.middleware.subject.Subject subject, HqlQuery hqlQuery, StringBuilder hql, String groupColumn, Privilege privilege, boolean considerAllSubject)
          for a group query, check to make sure the subject cant see the records
 boolean hqlFilterGroupsWhereClause(edu.internet2.middleware.subject.Subject subject, HqlQuery hqlQuery, StringBuilder hql, String groupColumn, Set<Privilege> privInSet)
          for a group query, check to make sure the subject can see the records (if filtering HQL, you can do the postHqlFilterGroups instead if you like)
 Set<Group> postHqlFilterGroups(Set<Group> groups, edu.internet2.middleware.subject.Subject subject, Set<Privilege> privInSet)
          after HQL is run, filter groups.
 Set<Membership> postHqlFilterMemberships(edu.internet2.middleware.subject.Subject subject, Set<Membership> memberships)
          filter memberships for things the subject can see
 Set<Stem> postHqlFilterStemsWithGroups(Set<Stem> stems, edu.internet2.middleware.subject.Subject subject, Set<Privilege> inPrivSet)
          after HQL is run, filter stems that have groups with privs.
 void stop()
          clean up resources, session is stopped
 
Methods inherited from class edu.internet2.middleware.grouper.privs.AccessResolverDecorator
getDecoratedResolver, getGrouperSession, getGroupsWhereSubjectDoesntHavePrivilege, getGroupsWhereSubjectHasPrivilege, getStemsWhereGroupThatSubjectHasPrivilege, getSubjectsWithPrivilege, grantPrivilege, privilegeCopy, privilegeCopy, retrievePrivileges, revokeAllPrivilegesForSubject, revokePrivilege, revokePrivilege
 
Methods inherited from class java.lang.Object
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Constructor Detail

GrouperSystemAccessResolver

public GrouperSystemAccessResolver(AccessResolver resolver)
Parameters:
resolver -
Since:
1.2.1
Method Detail

stop

public void stop()
Description copied from interface: AccessResolver
clean up resources, session is stopped

Specified by:
stop in interface AccessResolver
Overrides:
stop in class AccessResolverDecorator
See Also:
AccessResolver.stop()

flushCache

public void flushCache()
Description copied from interface: AccessResolver
flush cache if caching resolver

Specified by:
flushCache in interface AccessResolver
Overrides:
flushCache in class AccessResolverDecorator
See Also:
AccessResolver.flushCache()

getPrivileges

public Set<AccessPrivilege> getPrivileges(Group group,
                                          edu.internet2.middleware.subject.Subject subject)
                                   throws IllegalArgumentException
Description copied from interface: AccessResolver
Get all privileges subject has on group.

Specified by:
getPrivileges in interface AccessResolver
Overrides:
getPrivileges in class AccessResolverDecorator
Returns:
the set
Throws:
IllegalArgumentException - if any parameter is null.
Since:
1.2.1
See Also:
AccessResolver.getPrivileges(Group, Subject)

hasPrivilege

public boolean hasPrivilege(Group group,
                            edu.internet2.middleware.subject.Subject subject,
                            Privilege privilege)
                     throws IllegalArgumentException
Description copied from interface: AccessResolver
Check whether subject has privilege on group.

Specified by:
hasPrivilege in interface AccessResolver
Overrides:
hasPrivilege in class AccessResolverDecorator
Returns:
boolean
Throws:
IllegalArgumentException - if any parameter is null.
Since:
1.2.1
See Also:
AccessResolver.hasPrivilege(Group, Subject, Privilege)

postHqlFilterGroups

public Set<Group> postHqlFilterGroups(Set<Group> groups,
                                      edu.internet2.middleware.subject.Subject subject,
                                      Set<Privilege> privInSet)
Description copied from interface: AccessResolver
after HQL is run, filter groups. If you are filtering in HQL, then dont filter here

Specified by:
postHqlFilterGroups in interface AccessResolver
Overrides:
postHqlFilterGroups in class AccessResolverDecorator
subject - which needs view access to the groups
privInSet - find a privilege which is in this set (e.g. for view, send all access privs). There are pre-canned sets in AccessAdapter
Returns:
the set of filtered groups
See Also:
AccessResolver.postHqlFilterGroups(java.util.Set, edu.internet2.middleware.subject.Subject, java.util.Set)

postHqlFilterStemsWithGroups

public Set<Stem> postHqlFilterStemsWithGroups(Set<Stem> stems,
                                              edu.internet2.middleware.subject.Subject subject,
                                              Set<Privilege> inPrivSet)
Description copied from interface: AccessResolver
after HQL is run, filter stems that have groups with privs. If you are filtering HQL, then dont filter here.

Specified by:
postHqlFilterStemsWithGroups in interface AccessResolver
Overrides:
postHqlFilterStemsWithGroups in class AccessResolverDecorator
Returns:
the set of filtered stems
See Also:
AccessResolver.postHqlFilterStemsWithGroups(java.util.Set, edu.internet2.middleware.subject.Subject, java.util.Set)

hqlFilterGroupsWhereClause

public boolean hqlFilterGroupsWhereClause(edu.internet2.middleware.subject.Subject subject,
                                          HqlQuery hqlQuery,
                                          StringBuilder hql,
                                          String groupColumn,
                                          Set<Privilege> privInSet)
Description copied from interface: AccessResolver
for a group query, check to make sure the subject can see the records (if filtering HQL, you can do the postHqlFilterGroups instead if you like)

Specified by:
hqlFilterGroupsWhereClause in interface AccessResolver
Overrides:
hqlFilterGroupsWhereClause in class AccessResolverDecorator
Parameters:
subject - which needs view access to the groups
hql - the select and current from part
groupColumn - is the name of the group column to join to
privInSet - find a privilege which is in this set (e.g. for view, send all access privs)
Returns:
if the statement was changed
See Also:
AccessResolver.hqlFilterGroupsWhereClause(edu.internet2.middleware.subject.Subject, edu.internet2.middleware.grouper.hibernate.HqlQuery, java.lang.StringBuilder, String, Set)

hqlFilterGroupsNotWithPrivWhereClause

public boolean hqlFilterGroupsNotWithPrivWhereClause(edu.internet2.middleware.subject.Subject subject,
                                                     HqlQuery hqlQuery,
                                                     StringBuilder hql,
                                                     String groupColumn,
                                                     Privilege privilege,
                                                     boolean considerAllSubject)
Description copied from interface: AccessResolver
for a group query, check to make sure the subject cant see the records

Specified by:
hqlFilterGroupsNotWithPrivWhereClause in interface AccessResolver
Overrides:
hqlFilterGroupsNotWithPrivWhereClause in class AccessResolverDecorator
Parameters:
subject - which needs view access to the groups
hql - the select and current from part
groupColumn - is the name of the group column to join to
privilege - find a privilege which is in this set (e.g. for view, send all access privs)
considerAllSubject - if true, then consider GrouperAll when seeign if subject has priv, else do not
Returns:
if the statement was changed
See Also:
AccessResolver.hqlFilterGroupsNotWithPrivWhereClause(edu.internet2.middleware.subject.Subject, edu.internet2.middleware.grouper.hibernate.HqlQuery, java.lang.StringBuilder, String, Privilege, boolean)

postHqlFilterMemberships

public Set<Membership> postHqlFilterMemberships(edu.internet2.middleware.subject.Subject subject,
                                                Set<Membership> memberships)
Description copied from interface: AccessResolver
filter memberships for things the subject can see

Specified by:
postHqlFilterMemberships in interface AccessResolver
Overrides:
postHqlFilterMemberships in class AccessResolverDecorator
Returns:
the memberships
See Also:
AccessResolver.postHqlFilterMemberships(edu.internet2.middleware.subject.Subject, java.util.Set)
Overview  Package   Class  Tree  Deprecated  Index  Help 
 PREV CLASS   NEXT CLASS FRAMES    NO FRAMES    
SUMMARY: NESTED | FIELD | CONSTR | METHOD DETAIL: FIELD | CONSTR | METHOD