org.openl.rules.security

Class AccessVoter

java.lang.Object

org.openl.rules.security.AccessVoter

All Implemented Interfaces:

org.springframework.security.access.AccessDecisionVoter<Object>

public class AccessVoter
extends Object
implements org.springframework.security.access.AccessDecisionVoter<Object>

Based on org.springframework.security.access.vote.RoleVoter. If Authentication has Privileges.ADMIN authority it will get access even if it is not specified explicitly.

Votes if any ConfigAttribute.getAttribute() starts with a prefix indicating that it is a role. The prefix string is GROUP_.

Abstains from voting if no configuration attribute commences with the role prefix. Votes to grant access if there is an exact matching GrantedAuthority to a ConfigAttribute starting with the role prefix. Votes to deny access if there is no exact matching GrantedAuthority to a ConfigAttribute.

All comparisons and prefixes are case sensitive.

Author:

Aleh Bykhavets

Field Summary

Fields inherited from interface org.springframework.security.access.AccessDecisionVoter

ACCESS_ABSTAIN, ACCESS_DENIED, ACCESS_GRANTED

Constructor Summary

Constructors

Constructor and Description
AccessVoter()

Method Summary

Modifier and Type	Method and Description
boolean	supports(Class<?> aClass) This implementation supports any type of class, because it does not query the presented secure object.
boolean	supports(org.springframework.security.access.ConfigAttribute configAttribute)
int	vote(org.springframework.security.core.Authentication authentication, Object object, Collection<org.springframework.security.access.ConfigAttribute> configAttributes) Votes whether access should be granted.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AccessVoter

public AccessVoter()

Method Detail

supports

public boolean supports(Class<?> aClass)

This implementation supports any type of class, because it does not query the presented secure object.

Specified by:

supports in interface org.springframework.security.access.AccessDecisionVoter<Object>

Parameters:

aClass - the secure object

Returns:

always true

supports

public boolean supports(org.springframework.security.access.ConfigAttribute configAttribute)

Specified by:

supports in interface org.springframework.security.access.AccessDecisionVoter<Object>

vote

public int vote(org.springframework.security.core.Authentication authentication,
                Object object,
                Collection<org.springframework.security.access.ConfigAttribute> configAttributes)

Votes whether access should be granted.

Specified by:

vote in interface org.springframework.security.access.AccessDecisionVoter<Object>

Parameters:

authentication - Authentication (Principal)

object - Ignored in current implementation

configAttributes - attributes (required Authorities)

Returns:

AccessDecisionVoter.ACCESS_DENIED or AccessDecisionVoter.ACCESS_ABSTAIN or AccessDecisionVoter.ACCESS_GRANTED