Package ch.tocco.nice2.security.api

Interface SecurityManager

All Known Implementing Classes:

SecurityManagerImpl

public interface SecurityManager

Factory for SecurityContexts. The most important task of this interace is creating SecurityContexts after the user logged in (using the login(Principal) method). Other functions provided by this class are reading permission expressions as used in ACL files, and entering/exiting privileged mode.

Privileged mode is important to temporarily disable the security system, which is often needed for certain internal operations. A good example for such an internal operation is checking permissions in entities based on entity values. If security checks weren't disabled during condition checks, the condition check itself would cause the security system to check, whether the current user has access to that field, ultimately resulting in a recursive permission check until a StackOverflowError is thrown. Temporarily disabling security during condition check by entering privileged mode prevents this.

Method Summary

Modifier and Type	Method	Description
Invoker	anonymous()
void	enterPrivileged()	Deprecated. Use privileged() instead
void	exitPrivileged()	Deprecated. Use privileged() instead
SecurityContext	getAnonymousContext()
Policy	getPolicy()
boolean	isPrivileged()
default SecurityContext	login(Principal principal)
default SecurityContext	login(Principal principal, UUID sessionId)
SecurityContext	login(Principal principal, UUID sessionId, boolean disablePolicyProcessors)
void	logout(SecurityContext securityContext)	Called to clean up resources when a SecurityContext is destroyed
Invoker	privileged()
default Policy	processPolicy(Object target, Policy policy, Phase phase, Predicate<Rule> filter)
Policy	processPolicy(Object target, Policy policy, Phase phase, Predicate<Rule> filter, boolean disableProcessors)
Permission	readPermission(String domainName, String expression)
void	reloadPolicy()
Invoker	secured()
Invoker	withAdditionalRules(Consumer<PolicyBuilder> consumer)	Note: This method sets a new SecurityContext into the ExecutionContext.
Invoker	withLogin(Principal principal)
Invoker	withLogin(String username, String password)
Invoker	withLogin(String username, String password, boolean ignoreCaptchaVerification)
Invoker	withRules(Consumer<PolicyBuilder> consumer)	Note: This method sets a new SecurityContext into the ExecutionContext.

Method Details

login

default SecurityContext login(Principal principal)
                       throws SecurityException

Throws:

SecurityException

login

default SecurityContext login(Principal principal,
 UUID sessionId)
                       throws SecurityException

Throws:

SecurityException

login

SecurityContext login(Principal principal,
 UUID sessionId,
 boolean disablePolicyProcessors)
               throws SecurityException

Throws:

SecurityException

logout

void logout(SecurityContext securityContext)

Called to clean up resources when a SecurityContext is destroyed

readPermission

Permission readPermission(String domainName,
 String expression)
                   throws InvalidPermissionException

Throws:

InvalidPermissionException

privileged

Invoker privileged()

Returns:

Invoker that runs in privileged mode

secured

Invoker secured()

Returns:

Invoker that runs in secured mode (i.e. privileged mode is not active)

anonymous

Invoker anonymous()

Returns:

Invoker that runs with an anonymous principal

See Also:

• getAnonymousContext()

withLogin

Invoker withLogin(Principal principal)

Returns:

Invoker that runs with the passed principal

withLogin

Invoker withLogin(String username,
 String password)

Returns:

Invoker that runs with the principal of the passed username and password

withLogin

Invoker withLogin(String username,
 String password,
 boolean ignoreCaptchaVerification)

Parameters:

ignoreCaptchaVerification - if true, ReCaptcha validation is skipped during login

Returns:

Invoker that runs with the principal of the passed username and password

withRules

Invoker withRules(Consumer<PolicyBuilder> consumer)

Note: This method sets a new SecurityContext into the ExecutionContext. To get the enhanced policy, it needs to be fetched again from the ExecutionContext.

Returns:

an invoker that runs with the given rules

withAdditionalRules

Invoker withAdditionalRules(Consumer<PolicyBuilder> consumer)

Note: This method sets a new SecurityContext into the ExecutionContext. To get the enhanced policy, it needs to be fetched again from the ExecutionContext.

Returns:

an invoker that runs with an enhanced policy which contains the additional given rules

enterPrivileged

@Deprecated
void enterPrivileged()
              throws SecurityException

Deprecated.

Use privileged() instead

Throws:

SecurityException

exitPrivileged

@Deprecated
void exitPrivileged()
             throws SecurityException

Deprecated.

Use privileged() instead

Throws:

SecurityException

isPrivileged

boolean isPrivileged()

reloadPolicy

void reloadPolicy()

getPolicy

Policy getPolicy()

getAnonymousContext

SecurityContext getAnonymousContext()

processPolicy

default Policy processPolicy(Object target,
 Policy policy,
 Phase phase,
 Predicate<Rule> filter)

processPolicy

Policy processPolicy(Object target,
 Policy policy,
 Phase phase,
 Predicate<Rule> filter,
 boolean disableProcessors)