edu.internet2.middleware.grouper.privs

Class ValidatingNamingResolver

java.lang.Object

edu.internet2.middleware.grouper.privs.NamingResolverDecorator

edu.internet2.middleware.grouper.privs.ValidatingNamingResolver

All Implemented Interfaces:

NamingResolver

public class ValidatingNamingResolver
extends NamingResolverDecorator

Decorator that provides parameter validation for NamingResolver.

Since:

1.2.1

Version:

$Id: ValidatingNamingResolver.java,v 1.11 2009-09-21 06:14:26 mchyzer Exp $

Constructor Summary

Constructors

Constructor and Description
ValidatingNamingResolver(NamingResolver resolver)

Method Summary

Modifier and Type	Method and Description
void	flushCache() flush cache if caching resolver
Set<NamingPrivilege>	getPrivileges(Stem stem, Subject subject) Get all privileges subject has on group.
Set<Stem>	getStemsWhereSubjectDoesntHavePrivilege(String stemId, Stem.Scope scope, Subject subject, Privilege privilege, boolean considerAllSubject, String sqlLikeString) find the stems which do not have a certain privilege
Set<Stem>	getStemsWhereSubjectHasPrivilege(Subject subject, Privilege privilege) Get all groups where subject has privilege.
Set<Subject>	getSubjectsWithPrivilege(Stem stem, Privilege privilege) Get all subjects with privilege on group.
void	grantPrivilege(Stem stem, Subject subject, Privilege privilege, String uuid) Grant privilege to subject on group.
boolean	hasPrivilege(Stem stem, Subject subject, Privilege privilege) Check whether subject has privilege on group.
boolean	hqlFilterStemsNotWithPrivWhereClause(Subject subject, HqlQuery hqlQuery, StringBuilder hql, String stemColumn, Privilege privilege, boolean considerAllSubject) for a stem query, check to make sure the subject doesnt have privs
boolean	hqlFilterStemsWhereClause(Subject subject, HqlQuery hqlQuery, StringBuilder hql, String stemColumn, Set<Privilege> privInSet) for a stem query, check to make sure the subject can see the records (if filtering HQL, you can do the postHqlFilterGroups instead if you like).
Set<Stem>	postHqlFilterStems(Set<Stem> stems, Subject subject, Set<Privilege> privInSet) after HQL is run, filter stems.
void	privilegeCopy(Stem stem1, Stem stem2, Privilege priv) Copies privileges for subjects that have the specified privilege on stem1 to stem2.
void	privilegeCopy(Subject subj1, Subject subj2, Privilege priv) Copies privileges of type priv on any subject for the given Subject subj1 to the given Subject subj2.
void	revokeAllPrivilegesForSubject(Subject subject) Revoke all naming privileges that this subject has.
void	revokePrivilege(Stem stem, Privilege privilege) Revoke privilege from all subjects on group.
void	revokePrivilege(Stem stem, Subject subject, Privilege privilege) Revoke privilege from subject on group.

Methods inherited from class edu.internet2.middleware.grouper.privs.NamingResolverDecorator

getDecoratedResolver, getGrouperSession, getStemsWhereSubjectDoesHavePrivilege, hqlFilterStemsWithPrivWhereClause, stop

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

ValidatingNamingResolver

public ValidatingNamingResolver(NamingResolver resolver)

Parameters:

resolver -

Since:

1.2.1

Method Detail

getStemsWhereSubjectDoesntHavePrivilege

public Set<Stem> getStemsWhereSubjectDoesntHavePrivilege(String stemId,
                                                         Stem.Scope scope,
                                                         Subject subject,
                                                         Privilege privilege,
                                                         boolean considerAllSubject,
                                                         String sqlLikeString)
                                                  throws IllegalArgumentException

Description copied from interface: NamingResolver

find the stems which do not have a certain privilege

Specified by:

getStemsWhereSubjectDoesntHavePrivilege in interface NamingResolver

Overrides:

getStemsWhereSubjectDoesntHavePrivilege in class NamingResolverDecorator

Returns:

the stems

Throws:

IllegalArgumentException

See Also:

NamingResolver#getStemsWhereSubjectDoesntHavePrivilege(String, Scope, Subject, Privilege, boolean, String)

flushCache

public void flushCache()

Description copied from interface: NamingResolver

flush cache if caching resolver

Specified by:

flushCache in interface NamingResolver

Overrides:

flushCache in class NamingResolverDecorator

See Also:

NamingResolver.flushCache()

getStemsWhereSubjectHasPrivilege

public Set<Stem> getStemsWhereSubjectHasPrivilege(Subject subject,
                                                  Privilege privilege)
                                           throws IllegalArgumentException

Description copied from interface: NamingResolver

Get all groups where subject has privilege.

Specified by:

getStemsWhereSubjectHasPrivilege in interface NamingResolver

Overrides:

getStemsWhereSubjectHasPrivilege in class NamingResolverDecorator

Returns:

set

Throws:

IllegalArgumentException - if any parameter is null.

Since:

1.2.1

See Also:

NamingResolver.getStemsWhereSubjectHasPrivilege(Subject, Privilege)

getPrivileges

public Set<NamingPrivilege> getPrivileges(Stem stem,
                                          Subject subject)
                                   throws IllegalArgumentException

Description copied from interface: NamingResolver

Get all privileges subject has on group.

Specified by:

getPrivileges in interface NamingResolver

Overrides:

getPrivileges in class NamingResolverDecorator

Returns:

set of naming privileges

Throws:

IllegalArgumentException - if any parameter is null.

Since:

1.2.1

See Also:

NamingResolver.getPrivileges(Stem, Subject)

getSubjectsWithPrivilege

public Set<Subject> getSubjectsWithPrivilege(Stem stem,
                                             Privilege privilege)
                                      throws IllegalArgumentException

Description copied from interface: NamingResolver

Get all subjects with privilege on group.

Specified by:

getSubjectsWithPrivilege in interface NamingResolver

Overrides:

getSubjectsWithPrivilege in class NamingResolverDecorator

Returns:

set of subjects

Throws:

IllegalArgumentException - if any parameter is null.

Since:

1.2.1

See Also:

NamingResolver.getSubjectsWithPrivilege(Stem, Privilege)

grantPrivilege

public void grantPrivilege(Stem stem,
                           Subject subject,
                           Privilege privilege,
                           String uuid)
                    throws IllegalArgumentException,
                           UnableToPerformException

Description copied from interface: NamingResolver

Grant privilege to subject on group.

Specified by:

grantPrivilege in interface NamingResolver

Overrides:

grantPrivilege in class NamingResolverDecorator

uuid - if known or null

Throws:

IllegalArgumentException - if any parameter is null.

UnableToPerformException - if the privilege could not be granted.

Since:

1.2.1

See Also:

NamingResolver.grantPrivilege(Stem, Subject, Privilege, String)

hasPrivilege

public boolean hasPrivilege(Stem stem,
                            Subject subject,
                            Privilege privilege)
                     throws IllegalArgumentException

Description copied from interface: NamingResolver

Check whether subject has privilege on group.

Specified by:

hasPrivilege in interface NamingResolver

Overrides:

hasPrivilege in class NamingResolverDecorator

Returns:

if has privilege

Throws:

IllegalArgumentException - if any parameter is null.

Since:

1.2.1

See Also:

NamingResolver.hasPrivilege(Stem, Subject, Privilege)

revokePrivilege

public void revokePrivilege(Stem stem,
                            Privilege privilege)
                     throws IllegalArgumentException,
                            UnableToPerformException

Description copied from interface: NamingResolver

Revoke privilege from all subjects on group.

Specified by:

revokePrivilege in interface NamingResolver

Overrides:

revokePrivilege in class NamingResolverDecorator

Throws:

IllegalArgumentException - if any parameter is null.

UnableToPerformException - if the privilege could not be revoked.

Since:

1.2.1

See Also:

NamingResolver.revokePrivilege(Stem, Privilege)

revokePrivilege

public void revokePrivilege(Stem stem,
                            Subject subject,
                            Privilege privilege)
                     throws IllegalArgumentException,
                            UnableToPerformException

Description copied from interface: NamingResolver

Revoke privilege from subject on group.

Specified by:

revokePrivilege in interface NamingResolver

Overrides:

revokePrivilege in class NamingResolverDecorator

Throws:

IllegalArgumentException - if any parameter is null.

UnableToPerformException - if the privilege could not be revoked.

Since:

1.2.1

See Also:

NamingResolver.revokePrivilege(Stem, Subject, Privilege)

privilegeCopy

public void privilegeCopy(Stem stem1,
                          Stem stem2,
                          Privilege priv)
                   throws IllegalArgumentException,
                          UnableToPerformException

Description copied from interface: NamingResolver

Copies privileges for subjects that have the specified privilege on stem1 to stem2.

Specified by:

privilegeCopy in interface NamingResolver

Overrides:

privilegeCopy in class NamingResolverDecorator

Throws:

IllegalArgumentException

UnableToPerformException

See Also:

NamingResolver.privilegeCopy(edu.internet2.middleware.grouper.Stem, edu.internet2.middleware.grouper.Stem, edu.internet2.middleware.grouper.privs.Privilege)

privilegeCopy

public void privilegeCopy(Subject subj1,
                          Subject subj2,
                          Privilege priv)
                   throws IllegalArgumentException,
                          UnableToPerformException

Description copied from interface: NamingResolver

Copies privileges of type priv on any subject for the given Subject subj1 to the given Subject subj2. For instance, if subj1 has STEM privilege to Stem x, this method will result with subj2 having STEM privilege to Stem x.

Specified by:

privilegeCopy in interface NamingResolver

Overrides:

privilegeCopy in class NamingResolverDecorator

Throws:

IllegalArgumentException

UnableToPerformException

See Also:

NamingResolver.privilegeCopy(edu.internet2.middleware.subject.Subject, edu.internet2.middleware.subject.Subject, edu.internet2.middleware.grouper.privs.Privilege)

hqlFilterStemsWhereClause

public boolean hqlFilterStemsWhereClause(Subject subject,
                                         HqlQuery hqlQuery,
                                         StringBuilder hql,
                                         String stemColumn,
                                         Set<Privilege> privInSet)

Description copied from interface: NamingResolver

for a stem query, check to make sure the subject can see the records (if filtering HQL, you can do the postHqlFilterGroups instead if you like). Note, this joins to tables, so the queries should probably be "distinct"

Specified by:

hqlFilterStemsWhereClause in interface NamingResolver

Overrides:

hqlFilterStemsWhereClause in class NamingResolverDecorator

Parameters:

subject - which needs view access to the groups

hql - is the select and part part (hql prefix)

stemColumn - is the name of the stem column to join to

privInSet - find a privilege which is in this set (e.g. for view, send all access privs). There are pre-canned sets in AccessAdapter

Returns:

if the query was changed

See Also:

NamingResolver.hqlFilterStemsWhereClause(edu.internet2.middleware.subject.Subject, edu.internet2.middleware.grouper.hibernate.HqlQuery, java.lang.StringBuilder, java.lang.String, java.util.Set)

postHqlFilterStems

public Set<Stem> postHqlFilterStems(Set<Stem> stems,
                                    Subject subject,
                                    Set<Privilege> privInSet)

Description copied from interface: NamingResolver

after HQL is run, filter stems. If you are filtering in HQL, then dont filter here

Specified by:

postHqlFilterStems in interface NamingResolver

Overrides:

postHqlFilterStems in class NamingResolverDecorator

subject - which needs view access to the groups

privInSet - find a privilege which is in this set (e.g. for view, send all access privs). There are pre-canned sets in NamingPrivilege

Returns:

the set of filtered groups

See Also:

NamingResolver.postHqlFilterStems(java.util.Set, edu.internet2.middleware.subject.Subject, java.util.Set)

revokeAllPrivilegesForSubject

public void revokeAllPrivilegesForSubject(Subject subject)

Description copied from interface: NamingResolver

Revoke all naming privileges that this subject has.

Specified by:

revokeAllPrivilegesForSubject in interface NamingResolver

Overrides:

revokeAllPrivilegesForSubject in class NamingResolverDecorator

See Also:

NamingResolver.revokeAllPrivilegesForSubject(edu.internet2.middleware.subject.Subject)

hqlFilterStemsNotWithPrivWhereClause

public boolean hqlFilterStemsNotWithPrivWhereClause(Subject subject,
                                                    HqlQuery hqlQuery,
                                                    StringBuilder hql,
                                                    String stemColumn,
                                                    Privilege privilege,
                                                    boolean considerAllSubject)

Description copied from interface: NamingResolver

for a stem query, check to make sure the subject doesnt have privs

Specified by:

hqlFilterStemsNotWithPrivWhereClause in interface NamingResolver

Overrides:

hqlFilterStemsNotWithPrivWhereClause in class NamingResolverDecorator

Parameters:

subject - which needs view access to the groups

hql - the select and current from part

stemColumn - is the name of the group column to join to

privilege - find a privilege which is in this set (e.g. stem or create)

considerAllSubject - if true, then consider GrouperAll when seeign if subject has priv, else do not

Returns:

if the statement was changed

See Also:

edu.internet2.middleware.grouper.privs.NamingResolver#hqlFilterStemsWhereClause(edu.internet2.middleware.subject.Subject, edu.internet2.middleware.grouper.hibernate.HqlQuery, java.lang.StringBuilder, String, Privilege, boolean)