Package org.mycore.access.mcrimpl

Class MCRAccessControlSystem

java.lang.Object

org.mycore.access.MCRAccessBaseImpl

org.mycore.access.mcrimpl.MCRAccessControlSystem

All Implemented Interfaces:

MCRAccessInterface, MCRRuleAccessInterface

public class MCRAccessControlSystem
extends MCRAccessBaseImpl

MyCoRe-Standard Implementation of the MCRAccessInterface Maps object ids to rules

Author:

Matthias Kramm, Heiko Helmbrecht

Field Summary

Fields

Modifier and Type	Field	Description
static final String	LEXICOGRAPHICAL_PATTERN
static final String	POOL_PRIVILEGE_ID
static final String	SYSTEM_RULE_PREFIX

Fields inherited from class org.mycore.access.MCRAccessBaseImpl

ACCESS_PERMISSIONS

Method Summary

Modifier and Type	Method	Description
void	addRule(String id, String pool, Element rule, String description)	adds an access rule for an ID to an access system.
void	addRule(String permission, Element rule, String description)	adds an access rule for an "a priori-permission" like "create-document"
boolean	checkAccess(String objID, String permission, String userID, MCRIPAddress ip)	Deprecated.
boolean	checkAccess(String objID, String permission, MCRUserInformation userInfo, MCRIPAddress ip)	Validator methods to validate access definition for given object and pool
boolean	checkPermission(String permission)	determines whether the current user has the permission to perform a certain action.
boolean	checkPermission(String id, String permission, MCRUserInformation userInfo)	determines whether a given user has the permission to perform a certain action. no session data will be checked here.
boolean	checkPermission(Element rule)	determines whether the current user has the permission to perform a certain action.
boolean	checkPermissionForUser(String permission, String userID)	Deprecated.
boolean	checkPermissionForUser(String permission, MCRUserInformation userInfo)	determines whether a given user has the permission to perform a certain action. no session data will be checked here.
void	createRule(String ruleString, String creator, String description)	create an access rule in the rulestore using an rule string in plain text
void	createRule(Element rule, String creator, String description)	create an access rule in the rulestore using an rule string in plain text
MCRAccessRule	getAccessRule(String objID, String pool)	returns a MCRAccessRule which could be validated All information regarding the current user is capsulated by a MCRSession instance which can be retrieved by
Collection<String>	getAllControlledIDs()	lists all String IDs, a permission is assigned to.
MCRRuleMapping	getAutoGeneratedRuleMapping(Element rule, String creator, String pool, String id, String description)	returns a auto-generated MCRRuleMapping, needed to create Access Definitions
String	getNextFreeRuleID(String prefix)	method that delivers the next free ruleID for a given Prefix and sets the counter to counter + 1
String	getNormalizedRuleString(Element rule)	delivers the rule as string, after normalizing it via sorting with MCRAccessConditionsComparator
Collection<String>	getPermissions()	lists all a-priori permissions like "create-document".
Collection<String>	getPermissionsForID(String objid)	lists all permissions defined for the id.
Element	getRule(String permission)	exports a access rule for a "a priori permission" as JDOM element.
Element	getRule(String objID, String permission)	exports a access rule as JDOM element.
String	getRuleDescription(String permission)	returns the prosa description of a defined rule for a "a priori" permission like "create-document".
String	getRuleDescription(String objID, String permission)	returns the prosa description of a defined rule.
boolean	hasRule(String id)	checks wether a rule with the id is defined.
boolean	hasRule(String id, String permission)	checks wether a rule with the id and permission is defined.
static MCRRuleAccessInterface	instance()
boolean	isDisabled()
Element	normalize(Element rule)	method, that normalizes the jdom-representation of a mycore access condition
void	removeAllRules(String id)	removes all rules of the id.
void	removeRule(String permission)	removes a rule for an "a priori permission" like "create-document"
void	removeRule(String id, String pool)	removes a rule.
void	updateRule(String id, String pool, Element rule, String description)	updates an access rule for an ID to an access system.
void	updateRule(String permission, Element rule, String description)	updates an access rule for an "a priori permission" of an access system like "create-document".

Methods inherited from class org.mycore.access.MCRAccessBaseImpl

checkPermission, getAccessPermissionsFromConfiguration

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

SYSTEM_RULE_PREFIX

public static final String SYSTEM_RULE_PREFIX

See Also:

• Constant Field Values

POOL_PRIVILEGE_ID

public static final String POOL_PRIVILEGE_ID

See Also:

• Constant Field Values

LEXICOGRAPHICAL_PATTERN

public static final String LEXICOGRAPHICAL_PATTERN

See Also:

• Constant Field Values

Method Details

instance

public static MCRRuleAccessInterface instance()

createRule

public void createRule(String ruleString,
 String creator,
 String description)

Description copied from interface: MCRRuleAccessInterface

create an access rule in the rulestore using an rule string in plain text

Specified by:

createRule in interface MCRRuleAccessInterface

Overrides:

createRule in class MCRAccessBaseImpl

Parameters:

ruleString - the rule string in plain text

description - a String description of the rule in prosa

createRule

public void createRule(Element rule,
 String creator,
 String description)

Description copied from interface: MCRRuleAccessInterface

create an access rule in the rulestore using an rule string in plain text

Specified by:

createRule in interface MCRRuleAccessInterface

Overrides:

createRule in class MCRAccessBaseImpl

Parameters:

rule - the rule string as xml

description - a String description of the rule in prosa

addRule

public void addRule(String id,
 String pool,
 Element rule,
 String description)
             throws MCRException

Description copied from interface: MCRRuleAccessInterface

adds an access rule for an ID to an access system. The parameter id serves as an identifier for the concrete underlying rule, e.g. a MCRObjectID.

Specified by:

addRule in interface MCRRuleAccessInterface

Overrides:

addRule in class MCRAccessBaseImpl

Parameters:

id - the ID-String of the object

pool - the access permission for the rule

rule - the access rule

description - a String description of the rule in prosa

Throws:

MCRException - if an error occured

addRule

public void addRule(String permission,
 Element rule,
 String description)

Description copied from interface: MCRRuleAccessInterface

adds an access rule for an "a priori-permission" like "create-document"

Specified by:

addRule in interface MCRRuleAccessInterface

Overrides:

addRule in class MCRAccessBaseImpl

Parameters:

permission - the access permission for the rule (e.g. "create-document")

rule - the access rule

description - a String description of the rule in prosa

removeRule

public void removeRule(String id,
 String pool)
                throws MCRException

Description copied from interface: MCRRuleAccessInterface

removes a rule. The parameter id serves as an identifier for the concrete underlying rule, e.g. a MCRObjectID.

Specified by:

removeRule in interface MCRRuleAccessInterface

Overrides:

removeRule in class MCRAccessBaseImpl

Parameters:

id - the ID-String of the object

pool - the access permission for the rule

Throws:

MCRException - if an error occured

removeRule

public void removeRule(String permission)
                throws MCRException

Description copied from interface: MCRRuleAccessInterface

removes a rule for an "a priori permission" like "create-document"

Specified by:

removeRule in interface MCRRuleAccessInterface

Overrides:

removeRule in class MCRAccessBaseImpl

Parameters:

permission - the access permission for the rule

Throws:

MCRException - if an error occured

removeAllRules

public void removeAllRules(String id)
                    throws MCRException

Description copied from interface: MCRRuleAccessInterface

removes all rules of the id. The parameter id serves as an identifier for the concrete underlying rule, e.g. a MCRObjectID.

Specified by:

removeAllRules in interface MCRRuleAccessInterface

Overrides:

removeAllRules in class MCRAccessBaseImpl

Parameters:

id - the ID-String of the object

Throws:

MCRException - if an errow was occured

updateRule

public void updateRule(String id,
 String pool,
 Element rule,
 String description)
                throws MCRException

Description copied from interface: MCRRuleAccessInterface

updates an access rule for an ID to an access system. The parameter id serves as an identifier for the concrete underlying rule, e.g. a MCRObjectID.

Specified by:

updateRule in interface MCRRuleAccessInterface

Overrides:

updateRule in class MCRAccessBaseImpl

Parameters:

id - the ID-String of the object

pool - the access permission for the rule

rule - the access rule

description - a String description of the rule in prosa

Throws:

MCRException - if an errow was occured

updateRule

public void updateRule(String permission,
 Element rule,
 String description)
                throws MCRException

Description copied from interface: MCRRuleAccessInterface

updates an access rule for an "a priori permission" of an access system like "create-document".

Specified by:

updateRule in interface MCRRuleAccessInterface

Overrides:

updateRule in class MCRAccessBaseImpl

Parameters:

permission - the access permission for the rule

rule - the access rule

description - a String description of the rule in prosa

Throws:

MCRException - if an errow was occured

checkPermission

public boolean checkPermission(String id,
 String permission,
 MCRUserInformation userInfo)

Description copied from interface: MCRAccessInterface

determines whether a given user has the permission to perform a certain action. no session data will be checked here. The parameter id serves as an identifier for the concrete underlying rule, e.g. a MCRObjectID.

Specified by:

checkPermission in interface MCRAccessInterface

Overrides:

checkPermission in class MCRAccessBaseImpl

Parameters:

id - the ID-String of the object

permission - the permission/action to be granted, e.g. "read"

userInfo - the MCRUser, whose permissions are checked

Returns:

true if the permission is granted, else false

checkPermission

public boolean checkPermission(String permission)

Description copied from interface: MCRAccessInterface

determines whether the current user has the permission to perform a certain action. All information regarding the current user is capsulated by a MCRSession instance which can be retrieved by

 MCRSession currentSession = MCRSessionMgr.getCurrentSession();
 

This method is used for checking "a priori permissions" like "create-document" where a String ID does not exist yet

Specified by:

checkPermission in interface MCRAccessInterface

Overrides:

checkPermission in class MCRAccessBaseImpl

Parameters:

permission - the permission/action to be granted, e.g. "create-document"

Returns:

true if the permission is granted, else false

See Also:

• MCRSessionMgr.getCurrentSession()
• MCRSession

checkPermissionForUser

@Deprecated
public boolean checkPermissionForUser(String permission,
 String userID)

Deprecated.

Description copied from interface: MCRRuleAccessInterface

determines whether a given user has the permission to perform a certain action. no session data will be checked here. This method is used for checking "a priori permissions" like "create-document" where a String ID does not exist yet

Specified by:

checkPermissionForUser in interface MCRRuleAccessInterface

Overrides:

checkPermissionForUser in class MCRAccessBaseImpl

Parameters:

permission - the permission/action to be granted, e.g. "create-document"

userID - the MCRUser, whose permissions are checked

Returns:

true if the permission is granted, else false

See Also:

• MCRSessionMgr.getCurrentSession()
• MCRSession

checkPermissionForUser

public boolean checkPermissionForUser(String permission,
 MCRUserInformation userInfo)

Description copied from interface: MCRAccessInterface

determines whether a given user has the permission to perform a certain action. no session data will be checked here. This method is used for checking "a priori permissions" like "create-document" where a String ID does not exist yet

Specified by:

checkPermissionForUser in interface MCRAccessInterface

Overrides:

checkPermissionForUser in class MCRAccessBaseImpl

Parameters:

permission - the permission/action to be granted, e.g. "create-document"

userInfo - the MCRUser, whose permissions are checked

Returns:

true if the permission is granted, else false

checkPermission

public boolean checkPermission(Element rule)

Description copied from interface: MCRRuleAccessInterface

determines whether the current user has the permission to perform a certain action. All information regarding the current user is capsulated by a MCRSession instance which can be retrieved by

 MCRSession currentSession = MCRSessionMgr.getCurrentSession();
 

Specified by:

checkPermission in interface MCRRuleAccessInterface

Overrides:

checkPermission in class MCRAccessBaseImpl

Parameters:

rule - the jdom-representation of a mycore access rule

Returns:

true if the permission is granted, else false

See Also:

• MCRSessionMgr.getCurrentSession()
• MCRSession

getRule

public Element getRule(String objID,
 String permission)

Description copied from interface: MCRRuleAccessInterface

exports a access rule as JDOM element.

Specified by:

getRule in interface MCRRuleAccessInterface

Overrides:

getRule in class MCRAccessBaseImpl

Parameters:

objID - the ID-String of the object

permission - the access permission for the rule

Returns:

the rule as jdom element, or null if no rule is defined

getRule

public Element getRule(String permission)

Description copied from interface: MCRRuleAccessInterface

exports a access rule for a "a priori permission" as JDOM element.

Specified by:

getRule in interface MCRRuleAccessInterface

Overrides:

getRule in class MCRAccessBaseImpl

Parameters:

permission - the access permission for the rule

Returns:

the rule as jdom element, or null if no rule is defined

getRuleDescription

public String getRuleDescription(String permission)

Description copied from interface: MCRRuleAccessInterface

returns the prosa description of a defined rule for a "a priori" permission like "create-document".

Specified by:

getRuleDescription in interface MCRRuleAccessInterface

Overrides:

getRuleDescription in class MCRAccessBaseImpl

Parameters:

permission - the access permission for the rule

Returns:

the String of the description

getRuleDescription

public String getRuleDescription(String objID,
 String permission)

Description copied from interface: MCRRuleAccessInterface

returns the prosa description of a defined rule.

Specified by:

getRuleDescription in interface MCRRuleAccessInterface

Overrides:

getRuleDescription in class MCRAccessBaseImpl

Parameters:

objID - the ID-String of the object

permission - the access permission for the rule

Returns:

the String of the description

getPermissionsForID

public Collection<String> getPermissionsForID(String objid)

Description copied from interface: MCRRuleAccessInterface

lists all permissions defined for the id. The parameter id serves as an identifier for the concrete underlying rule, e.g. a MCRObjectID.

Specified by:

getPermissionsForID in interface MCRRuleAccessInterface

Overrides:

getPermissionsForID in class MCRAccessBaseImpl

Returns:

a List of all for id defined permission

getPermissions

public Collection<String> getPermissions()

Description copied from interface: MCRRuleAccessInterface

lists all a-priori permissions like "create-document".

Specified by:

getPermissions in interface MCRRuleAccessInterface

Overrides:

getPermissions in class MCRAccessBaseImpl

Returns:

a List of all defined permissions

hasRule

public boolean hasRule(String id,
 String permission)

Description copied from class: MCRAccessBaseImpl

checks wether a rule with the id and permission is defined. It's the same as calling

    (getRule(id, permission)!=null);
 

Specified by:

hasRule in interface MCRRuleAccessInterface

Overrides:

hasRule in class MCRAccessBaseImpl

Parameters:

id - the ID-String of the object

permission - the access permission for the rule

Returns:

false, if getRule(id, permission) would return null, else true

See Also:

• MCRAccessBaseImpl.getRule(String, String)

hasRule

public boolean hasRule(String id)

Description copied from class: MCRAccessBaseImpl

checks wether a rule with the id is defined. It's the same as calling

    (getPermissionsForID(id).size()>0);
 

Specified by:

hasRule in interface MCRRuleAccessInterface

Overrides:

hasRule in class MCRAccessBaseImpl

Parameters:

id - the ID-String of the object

Returns:

false, if getPermissionsForID(id) would return an empty list, else true

See Also:

• MCRAccessBaseImpl.getRule(String, String)

getAllControlledIDs

public Collection<String> getAllControlledIDs()

Description copied from interface: MCRRuleAccessInterface

lists all String IDs, a permission is assigned to. The parameter id serves as an identifier for the concrete underlying rule, e.g. a MCRObjectID.

Specified by:

getAllControlledIDs in interface MCRRuleAccessInterface

Overrides:

getAllControlledIDs in class MCRAccessBaseImpl

Returns:

a sorted and distinct List of all String IDs

isDisabled

public boolean isDisabled()

getAccessRule

public MCRAccessRule getAccessRule(String objID,
 String pool)

Description copied from interface: MCRRuleAccessInterface

returns a MCRAccessRule which could be validated All information regarding the current user is capsulated by a MCRSession instance which can be retrieved by

 MCRSession currentSession = MCRSessionMgr.getCurrentSession();
 

The parameter id serves as an identifier for the concrete underlying rule, e.g. a MCRObjectID.

Specified by:

getAccessRule in interface MCRRuleAccessInterface

Overrides:

getAccessRule in class MCRAccessBaseImpl

Parameters:

objID - the ID-String of the object

pool - the permission/action to be granted, e.g. "read"

Returns:

MCRAccessRule instance or null if no rule is defined;

See Also:

• MCRSessionMgr.getCurrentSession()
• MCRSession

checkAccess

@Deprecated
public boolean checkAccess(String objID,
 String permission,
 String userID,
 MCRIPAddress ip)

Deprecated.

Validator methods to validate access definition for given object and pool

Parameters:

permission - poolname as string

objID - MCRObjectID as string

userID - MCRUser

ip - ip-Address

Returns:

true if access is granted according to defined access rules

checkAccess

public boolean checkAccess(String objID,
 String permission,
 MCRUserInformation userInfo,
 MCRIPAddress ip)

Validator methods to validate access definition for given object and pool

Parameters:

permission - poolname as string

objID - MCRObjectID as string

userInfo - MCRUser

ip - ip-Address

Returns:

true if access is granted according to defined access rules

getNextFreeRuleID

public String getNextFreeRuleID(String prefix)

method that delivers the next free ruleID for a given Prefix and sets the counter to counter + 1

Parameters:

prefix - String

Returns:

String

getNormalizedRuleString

public String getNormalizedRuleString(Element rule)

delivers the rule as string, after normalizing it via sorting with MCRAccessConditionsComparator

Specified by:

getNormalizedRuleString in interface MCRRuleAccessInterface

Overrides:

getNormalizedRuleString in class MCRAccessBaseImpl

Parameters:

rule - Jdom-Element

Returns:

String

getAutoGeneratedRuleMapping

public MCRRuleMapping getAutoGeneratedRuleMapping(Element rule,
 String creator,
 String pool,
 String id,
 String description)

returns a auto-generated MCRRuleMapping, needed to create Access Definitions

Parameters:

rule - JDOM-Representation of a MCRAccess Rule

creator - String

pool - String

id - String

Returns:

MCRRuleMapping

normalize

public Element normalize(Element rule)

method, that normalizes the jdom-representation of a mycore access condition

Parameters:

rule - condition-JDOM of an access-rule

Returns:

the normalized JDOM-Rule