Package edu.internet2.middleware.grouper.privs

Interface AccessResolver

All Known Implementing Classes:

AccessResolverDecorator, AccessWrapper, CachingAccessResolver, GrouperAllAccessResolver, GrouperSystemAccessResolver, ValidatingAccessResolver, WheelAccessResolver

public interface AccessResolver

Facade for the AccessAdapter interface.

Since:

1.2.1

Version:

$Id: AccessResolver.java,v 1.12 2009-08-29 15:57:59 shilen Exp $

Method Summary

Modifier and Type	Method	Description
void	flushCache()	flush cache if caching resolver
GrouperSession	getGrouperSession()	get a reference to the session
Set<Group>	getGroupsWhereSubjectDoesHavePrivilege(String stemId, Stem.Scope scope, Subject subject, Privilege privilege, boolean considerAllSubject, String sqlLikeString)	find the groups which do have a certain privilege
Set<Group>	getGroupsWhereSubjectDoesntHavePrivilege(String stemId, Stem.Scope scope, Subject subject, Privilege privilege, boolean considerAllSubject, String sqlLikeString)	find the groups which do not have a certain privilege
Set<Group>	getGroupsWhereSubjectHasPrivilege(Subject subject, Privilege privilege)	Get all groups where subject has privilege.
Set<AccessPrivilege>	getPrivileges(Group group, Subject subject)	Get all privileges subject has on group.
Map<Group,Set<Privilege>>	getPrivileges(Collection<Group> groups, Subject subject, Set<Privilege> privilegesToCheck)	Bulk-resolve, per group, the subset of privilegesToCheck that subject actually holds.
Set<Stem>	getStemsWhereGroupThatSubjectHasPrivilege(Subject subject, Privilege privilege)	Get all stems which have groups where subject has privilege.
Set<Subject>	getSubjectsWithPrivilege(Group group, Privilege privilege)	Get all subjects with privilege on group.
void	grantPrivilege(Group group, Subject subject, Privilege privilege, String uuid)	Grant privilege to subject on group.
boolean	hasPrivilege(Group group, Subject subject, Privilege privilege)	Check whether subject has privilege on group.
boolean	hqlFilterGroupsNotWithPrivWhereClause(Subject subject, HqlQuery hqlQuery, StringBuilder hql, String groupColumn, Privilege privilege, boolean considerAllSubject)	for a group query, check to make sure the subject cant see the records
boolean	hqlFilterGroupsWhereClause(Subject subject, HqlQuery hqlQuery, StringBuilder hql, String groupColumn, Set<Privilege> privInSet)	for a group query, check to make sure the subject can see the records (if filtering HQL, you can do the postHqlFilterGroups instead if you like)
boolean	hqlFilterGroupsWithPrivWhereClause(Subject subject, HqlQuery hqlQuery, StringBuilder hql, String groupColumn, Privilege privilege, boolean considerAllSubject)	for a group query, check to make sure the result has privs
Set<Group>	postHqlFilterGroups(Set<Group> groups, Subject subject, Set<Privilege> privInSet)	after HQL is run, filter groups.
Set<Membership>	postHqlFilterMemberships(Subject subject, Set<Membership> memberships)	filter memberships for things the subject can see
Set<Stem>	postHqlFilterStemsWithGroups(Set<Stem> stems, Subject subject, Set<Privilege> inPrivSet)	after HQL is run, filter stems that have groups with privs.
void	privilegeCopy(Group g1, Group g2, Privilege priv)	Copies privileges for subjects that have the specified privilege on g1 to g2.
void	privilegeCopy(Subject subj1, Subject subj2, Privilege priv)	Copies privileges of type priv on any subject for the given Subject subj1 to the given Subject subj2.
Set<PrivilegeSubjectContainer>	retrievePrivileges(Group group, Set<Privilege> privileges, MembershipType membershipType, QueryPaging queryPaging, Set<Member> additionalMembers)	get a list of privilege subjects, there are no results with the same subject
void	revokeAllPrivilegesForSubject(Subject subject)	Revoke all access privileges that this subject has.
void	revokePrivilege(Group group, Privilege privilege)	Revoke privilege from all subjects on group.
void	revokePrivilege(Group group, Subject subject, Privilege privilege)	Revoke privilege from subject on group.
void	stop()	clean up resources, session is stopped

Method Details

stop

void stop()

clean up resources, session is stopped

getGrouperSession

GrouperSession getGrouperSession()

get a reference to the session

Returns:

the session

flushCache

void flushCache()

flush cache if caching resolver

getGroupsWhereSubjectHasPrivilege

Set<Group> getGroupsWhereSubjectHasPrivilege(Subject subject,
 Privilege privilege)
                                      throws IllegalArgumentException

Get all groups where subject has privilege.

Parameters:

subject -

privilege -

Returns:

the set

Throws:

IllegalArgumentException - if any parameter is null.

Since:

1.2.1

See Also:

• AccessAdapter.getGroupsWhereSubjectHasPriv(edu.internet2.middleware.grouper.GrouperSession, Subject, Privilege)

getGroupsWhereSubjectDoesntHavePrivilege

Set<Group> getGroupsWhereSubjectDoesntHavePrivilege(String stemId,
 Stem.Scope scope,
 Subject subject,
 Privilege privilege,
 boolean considerAllSubject,
 String sqlLikeString)

find the groups which do not have a certain privilege

Parameters:

stemId -

scope -

subject -

privilege -

considerAllSubject -

sqlLikeString -

Returns:

the groups

getGroupsWhereSubjectDoesHavePrivilege

Set<Group> getGroupsWhereSubjectDoesHavePrivilege(String stemId,
 Stem.Scope scope,
 Subject subject,
 Privilege privilege,
 boolean considerAllSubject,
 String sqlLikeString)

find the groups which do have a certain privilege

Parameters:

stemId -

scope -

subject -

privilege -

considerAllSubject -

sqlLikeString -

Returns:

the groups

getStemsWhereGroupThatSubjectHasPrivilege

Set<Stem> getStemsWhereGroupThatSubjectHasPrivilege(Subject subject,
 Privilege privilege)
                                             throws IllegalArgumentException

Get all stems which have groups where subject has privilege.

Parameters:

subject -

privilege -

Returns:

the set

Throws:

IllegalArgumentException - if any parameter is null.

Since:

1.2.1

See Also:

• AccessAdapter.getGroupsWhereSubjectHasPriv(edu.internet2.middleware.grouper.GrouperSession, Subject, Privilege)

getPrivileges

Set<AccessPrivilege> getPrivileges(Group group,
 Subject subject)
                            throws IllegalArgumentException

Get all privileges subject has on group.

Parameters:

group -

subject -

Returns:

the set

Throws:

IllegalArgumentException - if any parameter is null.

Since:

1.2.1

See Also:

• AccessAdapter.getPrivs(GrouperSession, Group, Subject)

getPrivileges

Map<Group,Set<Privilege>> getPrivileges(Collection<Group> groups,
 Subject subject,
 Set<Privilege> privilegesToCheck)
                                 throws IllegalArgumentException

Bulk-resolve, per group, the subset of privilegesToCheck that subject actually holds. This is the batched form of getPrivileges(Group, Subject) scoped to a specific set of privileges, intended to resolve privileges for many groups (e.g. a UI list page) in one query instead of an N+1 of per-group checks. Returns privilege identities (not granted AccessPrivilege instances) - callers compare against the AccessPrivilege constants (e.g. AccessPrivilege.ADMIN). ADMIN is NOT auto-expanded to UPDATE/READ here; the caller ORs the implication-expanded set per capability (e.g. AccessPrivilege.UPDATE_PRIVILEGES).

Parameters:

groups - the groups to resolve privileges for

subject - the subject whose privileges to resolve

privilegesToCheck - the access privileges to check (only these are resolved/returned)

Returns:

map of group to the subset of privilegesToCheck the subject holds (empty set if none); every input group is present in the map

Throws:

IllegalArgumentException - if subject is null.

getSubjectsWithPrivilege

Set<Subject> getSubjectsWithPrivilege(Group group,
 Privilege privilege)
                               throws IllegalArgumentException

Get all subjects with privilege on group.

Parameters:

group -

privilege -

Returns:

the set

Throws:

IllegalArgumentException - if any parameter is null.

Since:

1.2.1

See Also:

• AccessAdapter.getSubjectsWithPriv(GrouperSession, Group, Privilege)

grantPrivilege

void grantPrivilege(Group group,
 Subject subject,
 Privilege privilege,
 String uuid)
             throws IllegalArgumentException,
UnableToPerformException

Grant privilege to subject on group.

Parameters:

group -

subject -

privilege -

uuid - send uuid if known, else null

Throws:

IllegalArgumentException - if any parameter is null.

UnableToPerformException - if the privilege could not be granted.

Since:

1.2.1

See Also:

• AccessAdapter#grantPriv(GrouperSession, Group, Subject, Privilege)

hasPrivilege

boolean hasPrivilege(Group group,
 Subject subject,
 Privilege privilege)
              throws IllegalArgumentException

Check whether subject has privilege on group.

Parameters:

group -

subject -

privilege -

Returns:

boolean

Throws:

IllegalArgumentException - if any parameter is null.

Since:

1.2.1

See Also:

• AccessAdapter.hasPriv(GrouperSession, Group, Subject, Privilege)

revokePrivilege

void revokePrivilege(Group group,
 Privilege privilege)
              throws IllegalArgumentException,
UnableToPerformException

Revoke privilege from all subjects on group.

Parameters:

group -

privilege -

Throws:

IllegalArgumentException - if any parameter is null.

UnableToPerformException - if the privilege could not be revoked.

Since:

1.2.1

See Also:

• AccessAdapter.revokePriv(GrouperSession, Group, Privilege)

revokePrivilege

void revokePrivilege(Group group,
 Subject subject,
 Privilege privilege)
              throws IllegalArgumentException,
UnableToPerformException

Revoke privilege from subject on group.

Parameters:

group -

subject -

privilege -

Throws:

IllegalArgumentException - if any parameter is null.

UnableToPerformException - if the privilege could not be revoked.

Since:

1.2.1

See Also:

• AccessAdapter.revokePriv(GrouperSession, Group, Subject, Privilege)

privilegeCopy

void privilegeCopy(Group g1,
 Group g2,
 Privilege priv)
            throws IllegalArgumentException,
UnableToPerformException

Copies privileges for subjects that have the specified privilege on g1 to g2.

Parameters:

g1 -

g2 -

priv -

Throws:

IllegalArgumentException

UnableToPerformException

privilegeCopy

void privilegeCopy(Subject subj1,
 Subject subj2,
 Privilege priv)
            throws IllegalArgumentException,
UnableToPerformException

Copies privileges of type priv on any subject for the given Subject subj1 to the given Subject subj2. For instance, if subj1 has ADMIN privilege to Group x, this method will result with subj2 having ADMIN privilege to Group x.

Parameters:

subj1 -

subj2 -

priv -

Throws:

IllegalArgumentException

UnableToPerformException

postHqlFilterGroups

Set<Group> postHqlFilterGroups(Set<Group> groups,
 Subject subject,
 Set<Privilege> privInSet)

after HQL is run, filter groups. If you are filtering in HQL, then dont filter here

Parameters:

groups -

subject - which needs view access to the groups

privInSet - find a privilege which is in this set (e.g. for view, send all access privs). There are pre-canned sets in AccessAdapter

Returns:

the set of filtered groups

postHqlFilterStemsWithGroups

Set<Stem> postHqlFilterStemsWithGroups(Set<Stem> stems,
 Subject subject,
 Set<Privilege> inPrivSet)

after HQL is run, filter stems that have groups with privs. If you are filtering HQL, then dont filter here.

Parameters:

stems -

subject -

inPrivSet -

Returns:

the set of filtered stems

hqlFilterGroupsWhereClause

boolean hqlFilterGroupsWhereClause(Subject subject,
 HqlQuery hqlQuery,
 StringBuilder hql,
 String groupColumn,
 Set<Privilege> privInSet)

for a group query, check to make sure the subject can see the records (if filtering HQL, you can do the postHqlFilterGroups instead if you like)

Parameters:

subject - which needs view access to the groups

hqlQuery -

hql - the select and current from part

groupColumn - is the name of the group column to join to

privInSet - find a privilege which is in this set (e.g. for view, send all access privs)

Returns:

if the statement was changed

hqlFilterGroupsNotWithPrivWhereClause

boolean hqlFilterGroupsNotWithPrivWhereClause(Subject subject,
 HqlQuery hqlQuery,
 StringBuilder hql,
 String groupColumn,
 Privilege privilege,
 boolean considerAllSubject)

for a group query, check to make sure the subject cant see the records

Parameters:

subject - which needs view access to the groups

hqlQuery -

hql - the select and current from part

groupColumn - is the name of the group column to join to

privilege - find a privilege which is in this set (e.g. for view, send all access privs)

considerAllSubject - if true, then consider GrouperAll when seeign if subject has priv, else do not

Returns:

if the statement was changed

hqlFilterGroupsWithPrivWhereClause

boolean hqlFilterGroupsWithPrivWhereClause(Subject subject,
 HqlQuery hqlQuery,
 StringBuilder hql,
 String groupColumn,
 Privilege privilege,
 boolean considerAllSubject)

for a group query, check to make sure the result has privs

Parameters:

subject - which needs view access to the groups

hqlQuery -

hql - the select and current from part

groupColumn - is the name of the group column to join to

privilege - find a privilege which is in this set (e.g. for view, send all access privs)

considerAllSubject - if true, then consider GrouperAll when seeign if subject has priv, else do not

Returns:

if the statement was changed

postHqlFilterMemberships

Set<Membership> postHqlFilterMemberships(Subject subject,
 Set<Membership> memberships)

filter memberships for things the subject can see

Parameters:

memberships -

subject -

Returns:

the memberships

revokeAllPrivilegesForSubject

void revokeAllPrivilegesForSubject(Subject subject)

Revoke all access privileges that this subject has.

Parameters:

subject -

retrievePrivileges

Set<PrivilegeSubjectContainer> retrievePrivileges(Group group,
 Set<Privilege> privileges,
 MembershipType membershipType,
 QueryPaging queryPaging,
 Set<Member> additionalMembers)

get a list of privilege subjects, there are no results with the same subject

Parameters:

group - to search on

privileges - if blank, get all

membershipType - if immediate, effective, or blank for all

queryPaging - if a certain page should be returned, based on subject

additionalMembers - additional members to query that the user is finding or adding

Returns:

the privilege subject combinations