fedora.server.security
Class DefaultAuthorization

java.lang.Object
  fedora.server.Parameterized
      fedora.server.Pluggable
          fedora.server.Module
              fedora.server.security.DefaultAuthorization

All Implemented Interfaces:

Constants, Authorization

public class DefaultAuthorization
extends Module
implements Authorization

The Authorization module, protecting access to Fedora's API-A and API-M endpoints.

Version:

$Id: DefaultAuthorization.java 6858 2008-03-26 09:38:58Z cwilper $

Author:

wdn5e@virginia.edu

Nested Class Summary

Nested classes/interfaces inherited from interface fedora.common.Constants

Constants.FedoraHome

Field Summary

Fields inherited from interface fedora.server.security.Authorization

ACTION_CATEGORY, ACTION_CATEGORY_ACCESS, ENVIRONMENT_CATEGORY, ENVIRONMENT_CATEGORY_ACCESS, FEDORA_ROLE_KEY, RESOURCE_CATEGORY, RESOURCE_CATEGORY_ACCESS, SUBJECT_CATEGORY, SUBJECT_CATEGORY_ACCESS

Fields inherited from interface fedora.common.Constants

ACTION, BDEF, BMECH, DATASTREAM, DC, DISSEMINATOR, ENVIRONMENT, FEDORA, FEDORA_HOME, FEDORA_SYSTEM_DEF_PID, FEDORA_SYSTEM_DEF_URI, HTTP_REQUEST, MODEL, OBJECT, RDF, RECOVERY, RELS_EXT, RESOURCE, SUBJECT, TUCANA, VIEW, XSD

Constructor Summary

DefaultAuthorization(java.util.Map moduleParameters, Server server, java.lang.String role)
Creates and initializes the Access Module.

Method Summary

static java.lang.String	dateAsString(java.util.Date date)
void	enforce_Internal_DSState(Context context, java.lang.String id, java.lang.String state)
void	enforceAddDatastream(Context context, java.lang.String pid, java.lang.String dsId, java.lang.String[] altIDs, java.lang.String MIMEType, java.lang.String formatURI, java.lang.String dsLocation, java.lang.String controlGroup, java.lang.String dsState, java.lang.String checksumType, java.lang.String checksum) Enforce authorization for adding a datastream to an object.
void	enforceAddDisseminator(Context context, java.lang.String pid, java.lang.String bDefPid, java.lang.String bMechPid, java.lang.String dissState)
void	enforceAdminPing(Context context)
void	enforceCompareDatastreamChecksum(Context context, java.lang.String pid, java.lang.String datastreamId, java.util.Date versionDate)
void	enforceDescribeRepository(Context context)
void	enforceExportObject(Context context, java.lang.String pid, java.lang.String format, java.lang.String exportContext, java.lang.String exportEncoding)
void	enforceFindObjects(Context context)
void	enforceGetDatastream(Context context, java.lang.String pid, java.lang.String datastreamId, java.util.Date asOfDateTime)
void	enforceGetDatastreamDissemination(Context context, java.lang.String pid, java.lang.String datastreamId, java.util.Date asOfDate)
void	enforceGetDatastreamHistory(Context context, java.lang.String pid, java.lang.String datastreamId)
void	enforceGetDatastreams(Context context, java.lang.String pid, java.util.Date asOfDate, java.lang.String datastreamState)
void	enforceGetDissemination(Context context, java.lang.String pid, java.lang.String bdefPid, java.lang.String methodName, java.util.Date asOfDate, java.lang.String objectState, java.lang.String bdefState, java.lang.String bmechPid, java.lang.String bmechState, java.lang.String dissState)
void	enforceGetDisseminator(Context context, java.lang.String pid, java.lang.String disseminatorId, java.util.Date asOfDate)
void	enforceGetDisseminatorHistory(Context context, java.lang.String pid, java.lang.String disseminatorId)
void	enforceGetDisseminators(Context context, java.lang.String pid, java.util.Date asOfDate, java.lang.String disseminatorState)
void	enforceGetNextPid(Context context, java.lang.String namespace, int nNewPids)
void	enforceGetObjectHistory(Context context, java.lang.String pid)
void	enforceGetObjectProfile(Context context, java.lang.String pid, java.util.Date asOfDate)
void	enforceGetObjectProperties(Context context, java.lang.String pid)
void	enforceGetObjectXML(Context context, java.lang.String pid, java.lang.String objectXmlEncoding)
void	enforceIngestObject(Context context, java.lang.String pid, java.lang.String format, java.lang.String ingestEncoding)
void	enforceListDatastreams(Context context, java.lang.String pid, java.util.Date asOfDate)
void	enforceListMethods(Context context, java.lang.String pid, java.util.Date asOfDate)
void	enforceListObjectInFieldSearchResults(Context context, java.lang.String pid)
void	enforceListObjectInResourceIndexResults(Context context, java.lang.String pid)
void	enforceMethods(Context context) This method serves only to hold comments common to the various Enforce methods of this class.
void	enforceModifyDatastreamByReference(Context context, java.lang.String pid, java.lang.String datastreamId, java.lang.String[] datastreamNewAltIDs, java.lang.String datastreamNewMimeType, java.lang.String datastreamNewFormatURI, java.lang.String datastreamNewLocation, java.lang.String datastreamNewChecksumType, java.lang.String datastreamNewChecksum)
void	enforceModifyDatastreamByValue(Context context, java.lang.String pid, java.lang.String datastreamId, java.lang.String[] newDatastreamAltIDs, java.lang.String newDatastreamMimeType, java.lang.String newDatastreamFormatURI, java.lang.String newDatastreamChecksumType, java.lang.String newDatastreamChecksum)
void	enforceModifyDisseminator(Context context, java.lang.String pid, java.lang.String disseminatorId, java.lang.String bmechNewPid, java.lang.String disseminatorNewState)
void	enforceModifyObject(Context context, java.lang.String pid, java.lang.String objectNewState, java.lang.String objectNewOwnerId)
void	enforceOAIRespond(Context context)
void	enforcePurgeDatastream(Context context, java.lang.String pid, java.lang.String datastreamId, java.util.Date endDT)
void	enforcePurgeDisseminator(Context context, java.lang.String pid, java.lang.String disseminatorId, java.util.Date endDT)
void	enforcePurgeObject(Context context, java.lang.String pid)
void	enforceReloadPolicies(Context context)
void	enforceResolveDatastream(Context context, java.util.Date ticketIssuedDateTime)
void	enforceRIFindObjects(Context context)
void	enforceServerShutdown(Context context)
void	enforceServerStatus(Context context)
void	enforceSetDatastreamState(Context context, java.lang.String pid, java.lang.String datastreamId, java.lang.String datastreamNewState)
void	enforceSetDatastreamVersionable(Context context, java.lang.String pid, java.lang.String datastreamId, boolean datastreamNewVersionable)
void	enforceSetDisseminatorState(Context context, java.lang.String pid, java.lang.String disseminatorId, java.lang.String disseminatorNewState)
void	enforceUpload(Context context)
void	initModule() Initializes the module.
void	postInitModule() Second stage of Module initialization.
void	reloadPolicies(Context context)

Methods inherited from class fedora.server.Module

getRole, getServer, shutdownModule

Methods inherited from class fedora.server.Pluggable

getHelp, getOptionalParameters, getParameterHelp, getRequiredModuleRoles, getRequiredParameters

Methods inherited from class fedora.server.Parameterized

getParameter, getParameter, getParameters, parameterNames, setParameter, setParameters

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

DefaultAuthorization

public DefaultAuthorization(java.util.Map moduleParameters,
                            Server server,
                            java.lang.String role)
                     throws ModuleInitializationException

Creates and initializes the Access Module. When the server is starting up, this is invoked as part of the initialization process.

Parameters:

moduleParameters - A pre-loaded Map of name-value pairs comprising the intended configuration of this Module.

server - The Server instance.

role - The role this module fulfills, a java class name.

Throws:

ModuleInitializationException - If initilization values are invalid or initialization fails for some other reason.

Method Detail

initModule

public void initModule()
                throws ModuleInitializationException

Initializes the module.

Overrides:

initModule in class Module

Throws:

ModuleInitializationException - If the module cannot be initialized.

postInitModule

public void postInitModule()
                    throws ModuleInitializationException

Description copied from class: Module

Second stage of Module initialization. This is guaranteed to run after all Module's initModule() methods have run.

Overrides:

postInitModule in class Module

Throws:

ModuleInitializationException - If initialization values are invalid or initialization fails for some other reason.

reloadPolicies

public void reloadPolicies(Context context)
                    throws java.lang.Exception

Specified by:

reloadPolicies in interface Authorization

Throws:

java.lang.Exception

enforceMethods

public final void enforceMethods(Context context)

This method serves only to hold comments common to the various Enforce methods of this class.

The following attributes are available for use in authorization policies during any fedora interface call.

subject attributes

• urn:fedora:names:fedora:2.1:subject:loginId (available only if user has authenticated)
• urn:fedora:names:fedora:2.1:subject:x (available if authenticated user has attribute x)

environment attributes derived from HTTP request

• urn:fedora:names:fedora:2.1:environment:httpRequest:security
  • == urn:fedora:names:fedora:2.1:environment:httpRequest:security-secure(i.e., request is HTTPS/SSL)
  • == urn:fedora:names:fedora:2.1:environment:httpRequest:security-insecure(i.e., request is HTTP/non-SSL)
• urn:fedora:names:fedora:2.1:environment:httpRequest:messageProtocol
  • == urn:fedora:names:fedora:2.1:environment:httpRequest:messageProtocol-soap(i.e., request is over SOAP/Axis)
  • == urn:fedora:names:fedora:2.1:environment:httpRequest:messageProtocol-rest(i.e., request is over non-SOAP/Axis ("REST") HTTP call)

environment attributes directly from HTTP request

• urn:fedora:names:fedora:2.1:environment:httpRequest:authType
• urn:fedora:names:fedora:2.1:environment:httpRequest:clientFqdn
• urn:fedora:names:fedora:2.1:environment:httpRequest:clientIpAddress
• urn:fedora:names:fedora:2.1:environment:httpRequest:contentLength
• urn:fedora:names:fedora:2.1:environment:httpRequest:contentType
• urn:fedora:names:fedora:2.1:environment:httpRequest:method
• urn:fedora:names:fedora:2.1:environment:httpRequest:protocol
• urn:fedora:names:fedora:2.1:environment:httpRequest:scheme
• urn:fedora:names:fedora:2.1:environment:httpRequest:serverFqdn
• urn:fedora:names:fedora:2.1:environment:httpRequest:serverIpAddress
• urn:fedora:names:fedora:2.1:environment:httpRequest:serverPort
• urn:fedora:names:fedora:2.1:environment:httpRequest:sessionEncoding
• urn:fedora:names:fedora:2.1:environment:httpRequest:sessionStatus

other environment attributes

• urn:fedora:names:fedora:2.1:currentDateTime
• urn:fedora:names:fedora:2.1:currentDate
• urn:fedora:names:fedora:2.1:currentTime

See Also:

HttpServletRequest interface documentation

enforceAddDatastream

public final void enforceAddDatastream(Context context,
                                       java.lang.String pid,
                                       java.lang.String dsId,
                                       java.lang.String[] altIDs,
                                       java.lang.String MIMEType,
                                       java.lang.String formatURI,
                                       java.lang.String dsLocation,
                                       java.lang.String controlGroup,
                                       java.lang.String dsState,
                                       java.lang.String checksumType,
                                       java.lang.String checksum)
                                throws AuthzException

Enforce authorization for adding a datastream to an object. Provide attributes for the authorization decision and wrap that xacml decision.

The following attributes are available for use in authorization policies during a call to this method.

action attributes

• urn:fedora:names:fedora:2.1:action:id == urn:fedora:names:fedora:2.1:action:id-addDatastream
• urn:fedora:names:fedora:2.1:action:api == urn:fedora:names:fedora:2.1:action:api-m

resource attributes of object to which datastream would be added

• urn:fedora:names:fedora:2.1:resource:object:pid
• urn:fedora:names:fedora:2.1:resource:object:namespace (if pid is "x:y", namespace is "x")

resource attributes of datastream which would be added

• urn:fedora:names:fedora:2.1:resource:datastream:mimeType
• urn:fedora:names:fedora:2.1:resource:datastream:formatUri
• urn:fedora:names:fedora:2.1:resource:datastream:state
• urn:fedora:names:fedora:2.1:resource:datastream:id
• urn:fedora:names:fedora:2.1:resource:datastream:location
• urn:fedora:names:fedora:2.1:resource:datastream:controlGroup
• urn:fedora:names:fedora:2.1:resource:datastream:altIds
• urn:fedora:names:fedora:2.1:resource:datastream:checksumType
• urn:fedora:names:fedora:2.1:resource:datastream:checksum

Specified by:

enforceAddDatastream in interface Authorization

Throws:

AuthzException

See Also:

common attributes available on any fedora interface call

enforceAddDisseminator

public final void enforceAddDisseminator(Context context,
                                         java.lang.String pid,
                                         java.lang.String bDefPid,
                                         java.lang.String bMechPid,
                                         java.lang.String dissState)
                                  throws AuthzException

Specified by:

enforceAddDisseminator in interface Authorization

Throws:

AuthzException

enforceExportObject

public final void enforceExportObject(Context context,
                                      java.lang.String pid,
                                      java.lang.String format,
                                      java.lang.String exportContext,
                                      java.lang.String exportEncoding)
                               throws AuthzException

Specified by:

enforceExportObject in interface Authorization

Throws:

AuthzException

enforceGetDisseminatorHistory

public final void enforceGetDisseminatorHistory(Context context,
                                                java.lang.String pid,
                                                java.lang.String disseminatorId)
                                         throws AuthzException

Specified by:

enforceGetDisseminatorHistory in interface Authorization

Throws:

AuthzException

enforceGetNextPid

public final void enforceGetNextPid(Context context,
                                    java.lang.String namespace,
                                    int nNewPids)
                             throws AuthzException

Specified by:

enforceGetNextPid in interface Authorization

Throws:

AuthzException

enforceGetDatastream

public final void enforceGetDatastream(Context context,
                                       java.lang.String pid,
                                       java.lang.String datastreamId,
                                       java.util.Date asOfDateTime)
                                throws AuthzException

Specified by:

enforceGetDatastream in interface Authorization

Throws:

AuthzException

enforceGetDatastreamHistory

public final void enforceGetDatastreamHistory(Context context,
                                              java.lang.String pid,
                                              java.lang.String datastreamId)
                                       throws AuthzException

Specified by:

enforceGetDatastreamHistory in interface Authorization

Throws:

AuthzException

enforceGetDatastreams

public final void enforceGetDatastreams(Context context,
                                        java.lang.String pid,
                                        java.util.Date asOfDate,
                                        java.lang.String datastreamState)
                                 throws AuthzException

Specified by:

enforceGetDatastreams in interface Authorization

Throws:

AuthzException

enforceGetDisseminator

public final void enforceGetDisseminator(Context context,
                                         java.lang.String pid,
                                         java.lang.String disseminatorId,
                                         java.util.Date asOfDate)
                                  throws AuthzException

Specified by:

enforceGetDisseminator in interface Authorization

Throws:

AuthzException

enforceGetDisseminators

public final void enforceGetDisseminators(Context context,
                                          java.lang.String pid,
                                          java.util.Date asOfDate,
                                          java.lang.String disseminatorState)
                                   throws AuthzException

Specified by:

enforceGetDisseminators in interface Authorization

Throws:

AuthzException

enforceGetObjectProperties

public final void enforceGetObjectProperties(Context context,
                                             java.lang.String pid)
                                      throws AuthzException

Specified by:

enforceGetObjectProperties in interface Authorization

Throws:

AuthzException

enforceGetObjectXML

public final void enforceGetObjectXML(Context context,
                                      java.lang.String pid,
                                      java.lang.String objectXmlEncoding)
                               throws AuthzException

Specified by:

enforceGetObjectXML in interface Authorization

Throws:

AuthzException

enforceIngestObject

public final void enforceIngestObject(Context context,
                                      java.lang.String pid,
                                      java.lang.String format,
                                      java.lang.String ingestEncoding)
                               throws AuthzException

Specified by:

enforceIngestObject in interface Authorization

Throws:

AuthzException

enforceListObjectInFieldSearchResults

public final void enforceListObjectInFieldSearchResults(Context context,
                                                        java.lang.String pid)
                                                 throws AuthzException

Specified by:

enforceListObjectInFieldSearchResults in interface Authorization

Throws:

AuthzException

enforceListObjectInResourceIndexResults

public final void enforceListObjectInResourceIndexResults(Context context,
                                                          java.lang.String pid)
                                                   throws AuthzException

Specified by:

enforceListObjectInResourceIndexResults in interface Authorization

Throws:

AuthzException

enforceModifyDatastreamByReference

public final void enforceModifyDatastreamByReference(Context context,
                                                     java.lang.String pid,
                                                     java.lang.String datastreamId,
                                                     java.lang.String[] datastreamNewAltIDs,
                                                     java.lang.String datastreamNewMimeType,
                                                     java.lang.String datastreamNewFormatURI,
                                                     java.lang.String datastreamNewLocation,
                                                     java.lang.String datastreamNewChecksumType,
                                                     java.lang.String datastreamNewChecksum)
                                              throws AuthzException

Specified by:

enforceModifyDatastreamByReference in interface Authorization

Throws:

AuthzException

enforceModifyDatastreamByValue

public final void enforceModifyDatastreamByValue(Context context,
                                                 java.lang.String pid,
                                                 java.lang.String datastreamId,
                                                 java.lang.String[] newDatastreamAltIDs,
                                                 java.lang.String newDatastreamMimeType,
                                                 java.lang.String newDatastreamFormatURI,
                                                 java.lang.String newDatastreamChecksumType,
                                                 java.lang.String newDatastreamChecksum)
                                          throws AuthzException

Specified by:

enforceModifyDatastreamByValue in interface Authorization

Throws:

AuthzException

enforceModifyDisseminator

public final void enforceModifyDisseminator(Context context,
                                            java.lang.String pid,
                                            java.lang.String disseminatorId,
                                            java.lang.String bmechNewPid,
                                            java.lang.String disseminatorNewState)
                                     throws AuthzException

Specified by:

enforceModifyDisseminator in interface Authorization

Throws:

AuthzException

enforceModifyObject

public final void enforceModifyObject(Context context,
                                      java.lang.String pid,
                                      java.lang.String objectNewState,
                                      java.lang.String objectNewOwnerId)
                               throws AuthzException

Specified by:

enforceModifyObject in interface Authorization

Throws:

AuthzException

enforcePurgeDatastream

public final void enforcePurgeDatastream(Context context,
                                         java.lang.String pid,
                                         java.lang.String datastreamId,
                                         java.util.Date endDT)
                                  throws AuthzException

Specified by:

enforcePurgeDatastream in interface Authorization

Throws:

AuthzException

enforcePurgeDisseminator

public final void enforcePurgeDisseminator(Context context,
                                           java.lang.String pid,
                                           java.lang.String disseminatorId,
                                           java.util.Date endDT)
                                    throws AuthzException

Specified by:

enforcePurgeDisseminator in interface Authorization

Throws:

AuthzException

enforcePurgeObject

public final void enforcePurgeObject(Context context,
                                     java.lang.String pid)
                              throws AuthzException

Specified by:

enforcePurgeObject in interface Authorization

Throws:

AuthzException

enforceSetDatastreamState

public final void enforceSetDatastreamState(Context context,
                                            java.lang.String pid,
                                            java.lang.String datastreamId,
                                            java.lang.String datastreamNewState)
                                     throws AuthzException

Specified by:

enforceSetDatastreamState in interface Authorization

Throws:

AuthzException

enforceSetDatastreamVersionable

public final void enforceSetDatastreamVersionable(Context context,
                                                  java.lang.String pid,
                                                  java.lang.String datastreamId,
                                                  boolean datastreamNewVersionable)
                                           throws AuthzException

Specified by:

enforceSetDatastreamVersionable in interface Authorization

Throws:

AuthzException

enforceSetDisseminatorState

public final void enforceSetDisseminatorState(Context context,
                                              java.lang.String pid,
                                              java.lang.String disseminatorId,
                                              java.lang.String disseminatorNewState)
                                       throws AuthzException

Specified by:

enforceSetDisseminatorState in interface Authorization

Throws:

AuthzException

enforceCompareDatastreamChecksum

public final void enforceCompareDatastreamChecksum(Context context,
                                                   java.lang.String pid,
                                                   java.lang.String datastreamId,
                                                   java.util.Date versionDate)
                                            throws AuthzException

Specified by:

enforceCompareDatastreamChecksum in interface Authorization

Throws:

AuthzException

enforceDescribeRepository

public void enforceDescribeRepository(Context context)
                               throws AuthzException

Specified by:

enforceDescribeRepository in interface Authorization

Throws:

AuthzException

enforceFindObjects

public void enforceFindObjects(Context context)
                        throws AuthzException

Specified by:

enforceFindObjects in interface Authorization

Throws:

AuthzException

enforceRIFindObjects

public void enforceRIFindObjects(Context context)
                          throws AuthzException

Specified by:

enforceRIFindObjects in interface Authorization

Throws:

AuthzException

enforceGetDatastreamDissemination

public void enforceGetDatastreamDissemination(Context context,
                                              java.lang.String pid,
                                              java.lang.String datastreamId,
                                              java.util.Date asOfDate)
                                       throws AuthzException

Specified by:

enforceGetDatastreamDissemination in interface Authorization

Throws:

AuthzException

enforceGetDissemination

public void enforceGetDissemination(Context context,
                                    java.lang.String pid,
                                    java.lang.String bdefPid,
                                    java.lang.String methodName,
                                    java.util.Date asOfDate,
                                    java.lang.String objectState,
                                    java.lang.String bdefState,
                                    java.lang.String bmechPid,
                                    java.lang.String bmechState,
                                    java.lang.String dissState)
                             throws AuthzException

Specified by:

enforceGetDissemination in interface Authorization

Throws:

AuthzException

enforceGetObjectHistory

public void enforceGetObjectHistory(Context context,
                                    java.lang.String pid)
                             throws AuthzException

Specified by:

enforceGetObjectHistory in interface Authorization

Throws:

AuthzException

enforceGetObjectProfile

public void enforceGetObjectProfile(Context context,
                                    java.lang.String pid,
                                    java.util.Date asOfDate)
                             throws AuthzException

Specified by:

enforceGetObjectProfile in interface Authorization

Throws:

AuthzException

enforceListDatastreams

public void enforceListDatastreams(Context context,
                                   java.lang.String pid,
                                   java.util.Date asOfDate)
                            throws AuthzException

Specified by:

enforceListDatastreams in interface Authorization

Throws:

AuthzException

enforceListMethods

public void enforceListMethods(Context context,
                               java.lang.String pid,
                               java.util.Date asOfDate)
                        throws AuthzException

Specified by:

enforceListMethods in interface Authorization

Throws:

AuthzException

enforceAdminPing

public void enforceAdminPing(Context context)
                      throws AuthzException

Specified by:

enforceAdminPing in interface Authorization

Throws:

AuthzException

enforceServerShutdown

public void enforceServerShutdown(Context context)
                           throws AuthzException

Specified by:

enforceServerShutdown in interface Authorization

Throws:

AuthzException

enforceServerStatus

public void enforceServerStatus(Context context)
                         throws AuthzException

Specified by:

enforceServerStatus in interface Authorization

Throws:

AuthzException

enforceOAIRespond

public void enforceOAIRespond(Context context)
                       throws AuthzException

Specified by:

enforceOAIRespond in interface Authorization

Throws:

AuthzException

enforceUpload

public void enforceUpload(Context context)
                   throws AuthzException

Specified by:

enforceUpload in interface Authorization

Throws:

AuthzException

enforce_Internal_DSState

public void enforce_Internal_DSState(Context context,
                                     java.lang.String id,
                                     java.lang.String state)
                              throws AuthzException

Specified by:

enforce_Internal_DSState in interface Authorization

Throws:

AuthzException

enforceResolveDatastream

public void enforceResolveDatastream(Context context,
                                     java.util.Date ticketIssuedDateTime)
                              throws AuthzException

Specified by:

enforceResolveDatastream in interface Authorization

Throws:

AuthzException

enforceReloadPolicies

public void enforceReloadPolicies(Context context)
                           throws AuthzException

Specified by:

enforceReloadPolicies in interface Authorization

Throws:

AuthzException

dateAsString

public static final java.lang.String dateAsString(java.util.Date date)
                                           throws java.lang.Exception

Throws:

java.lang.Exception