org.dataone.service.types.v1.util

Class AuthUtils

java.lang.Object

org.dataone.service.types.v1.util.AuthUtils

public class AuthUtils
extends Object

Constructor Summary

Constructors

Constructor and Description
AuthUtils()

Method Summary

Methods

Modifier and Type	Method and Description
static Set<Subject>	authorizedClientSubjects(Session session) Derived from Metacat implementation Creates a set of subjects represented in the session object, parsing both the subject of the session and the subjectInfo.
static boolean	comparePermissions(Permission requested, Collection<Permission> allowed) a comparison algorithm for hierarchical permissions (WRITE implies READ, and CHANGE implies WRITE and READ).
static void	findPersonsSubjects(Set<Subject> foundSubjects, SubjectInfo subjectInfo, Subject targetSubject) A recursive method to traverse the equivalent-identity relationships and to handle the transitive nature of group membership and verified status.
static boolean	isAuthorized(Collection<Subject> subjectSet, Permission requestedPerm, SystemMetadata systemMetadata) Queries the systemMetadata to see if one of the given subjects is allowed the specified permission against the given systemMetadata

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AuthUtils

public AuthUtils()

Method Detail

authorizedClientSubjects

public static Set<Subject> authorizedClientSubjects(Session session)

Derived from Metacat implementation Creates a set of subjects represented in the session object, parsing both the subject of the session and the subjectInfo. - It will always include 'public' subject - Includes 'authenticated' subject when the session subject is not empty or 'public' - Zeros-out the subjectInfo of the session if the subject of the session is null or 'public' - 'verified' is included if primary subject or equivalent identity in the subectInfo is verified. - group membership is transitive, too - the group subjects of equivalent identities are returned as well. - Does not handle administrative access / authorization

Parameters:

session -

Returns:

- the set of Subject objects.

findPersonsSubjects

public static void findPersonsSubjects(Set<Subject> foundSubjects,
                       SubjectInfo subjectInfo,
                       Subject targetSubject)

A recursive method to traverse the equivalent-identity relationships and to handle the transitive nature of group membership and verified status. Note: this is a low-level function that does not provide a complete list of authorized subjects for a given SubjectInfo, so callers beware.

isAuthorized

public static boolean isAuthorized(Collection<Subject> subjectSet,
                   Permission requestedPerm,
                   SystemMetadata systemMetadata)

Queries the systemMetadata to see if one of the given subjects is allowed the specified permission against the given systemMetadata

Parameters:

subjectSet - - the collection of subjects, assumed to represent the subjects of a session

requestedPerm - - the permission that is requested authorization for

systemMetadata - - the systemMetadata of the target object to test

Returns:

- true if one of the subjects is authorized for the given permission otherwise false

comparePermissions

public static boolean comparePermissions(Permission requested,
                         Collection<Permission> allowed)

a comparison algorithm for hierarchical permissions (WRITE implies READ, and CHANGE implies WRITE and READ). returns true if the requested permission is allowed.