com.bea.ales.management
Class PoliciesManager

java.lang.Object
  |
  +--com.bea.ales.management.PoliciesManager

public class PoliciesManager

extends java.lang.Object

This class manage authorization policies and membership rules. It provides methods to create, remove and find authorization policies and membership rules.

Field Summary

static java.lang.String	FILTER_OPERATOR_AND Specifies a filter search operator of AND.
static java.lang.String	FILTER_OPERATOR_OR Specifies a filter search operator of OR.

Method Summary

AuthorizationPolicy	createAuthorizationPolicy(PolicyEffectType effect, Action action, Resource resource, java.lang.Object subject, User delegator, java.lang.String constraint) Create a new authorization policy with single action, resource and subject.
AuthorizationPolicy	createAuthorizationPolicy(PolicyEffectType effect, java.util.List actions, java.util.List resources, java.util.List subjects, User delegator, java.lang.String constraint) Create a new authorization policy with one or more actions, resources and subjects.
MembershipRule	createMembershipRule(PolicyEffectType effect, java.util.List roles, java.util.List resources, java.util.List subjects, User delegator, java.lang.String constraint) Create a new membership rule with one or more roles, resources and subjects.
MembershipRule	createMembershipRule(PolicyEffectType effect, Role role, Resource resource, java.lang.Object subject, User delegator, java.lang.String constraint) Create the new membership rule with single role, resource and subject.
void	deleteQuery(PolicyQuery policyQuery) Delete the policy query.
AuthorizationPolicyQueryResult	getAuthorizationPolicies(PolicyEffectType effectType, java.util.List actions, java.util.List resources, java.util.List subjects, java.util.List delegators, java.lang.String constraintPattern, java.lang.String filterSearchOperator) Find authorization policies which match the given query criteria.
AuthorizationPolicy	getAuthorizationPolicy(PolicyEffectType effect, java.util.List actions, java.util.List resources, java.util.List subjects, User delegator, java.lang.String constraint) Find the existing authorization policy which matches exactly all given parameters.
MembershipRule	getMembershipRule(PolicyEffectType effect, java.util.List roles, java.util.List resources, java.util.List subjects, User delegator, java.lang.String constraint) Find the existing membership rule which matches exactly all given parameters.
MembershipRuleQueryResult	getMembershipRules(PolicyEffectType effectType, java.util.List roles, java.util.List resources, java.util.List subjects, java.util.List delegators, java.lang.String constraintPattern, java.lang.String filterSearchOperator) Find membership rules which match the given query criteria..
java.util.Collection	listAllQueries(PolicyType policyType) Find all policy queries with the specific type.
java.util.Collection	listQueries(PolicyType policyType, java.lang.String owner) Find all policy queries created by the specific user.
void	removeAuthorizationPolicy(AuthorizationPolicy authorizationPolicy) Remove the authorization policy.
void	removeAuthorizationPolicy(PolicyEffectType effect, Action action, Resource resource, java.lang.Object subject, User delegator, java.lang.String constraint) Remove an authorization policy which matches accurately all parameters passed in.
void	removeAuthorizationPolicy(PolicyEffectType effect, java.util.List actions, java.util.List resources, java.util.List subjects, User delegator, java.lang.String constraint) Remove the authorization policy which matches exactly all given parameters.
void	removeMembershipRule(MembershipRule membershipRule) Remove the membership rule.
void	removeMembershipRule(PolicyEffectType effect, java.util.List roles, java.util.List resources, java.util.List subjects, User delegator, java.lang.String constraint) Remove the membership rule which matches accurately all given parameters.
void	removeMembershipRule(PolicyEffectType effect, Role role, Resource resource, java.lang.Object subject, User delegator, java.lang.String constraint) Remove the membership rule which matches accurately all given parameters.
void	saveQuery(PolicyQuery policyQuery, boolean overwrite) Save the policy query if the query does not exist, or modifies the existing policy query if the query already exists.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

FILTER_OPERATOR_OR

public static final java.lang.String FILTER_OPERATOR_OR

Specifies a filter search operator of OR.

FILTER_OPERATOR_AND

public static final java.lang.String FILTER_OPERATOR_AND

Specifies a filter search operator of AND.

Method Detail

createAuthorizationPolicy

public AuthorizationPolicy createAuthorizationPolicy(PolicyEffectType effect,
                                                     java.util.List actions,
                                                     java.util.List resources,
                                                     java.util.List subjects,
                                                     User delegator,
                                                     java.lang.String constraint)
                                              throws java.lang.IllegalArgumentException,
                                                     ManagementException

Create a new authorization policy with one or more actions, resources and subjects.

Parameters:

effect - effect of the authorization policy. One of possible values is GRANT, DENY or DELEGATE. If it is null, an IllegalArgumentException will be thrown.

actions - list of actions as Action. If the list is null or empty, an IllegalArgumentException will be thrown. If the element of list is null or its type is incorrect, an IllegalArgumentException will be thrown.

resources - list of resource as Resource. If the list is null or empty, an IllegalArgumentException will be thrown. If the element of list is null or its type is incorrect, an IllegalArgumentException will be thrown.

subjects - list of subjects. If the list is null or empty, an IllegalArgumentException will be thrown. One of possible type of subject is User, Group or Role. If the element of list is null or its type is incorrect, an IllegalArgumentException will be thrown.

delegator - delegator of the authorization policy. This parameter is available only when the policy effect is DELEGATE, otherwise it is ignored. If it is null for delegate policy, an IllegalArgumentException will be thrown.

constraint - constraint of the authorization. The constraint is a series of boolean operations over attribute values which can be used to further limit the applicability of the authorization policy.

Returns:

the authorization policy created.

Throws:

java.lang.IllegalArgumentException - if any parameter is invalid.

ManagementException - if failed to create an authorization policy.

createAuthorizationPolicy

public AuthorizationPolicy createAuthorizationPolicy(PolicyEffectType effect,
                                                     Action action,
                                                     Resource resource,
                                                     java.lang.Object subject,
                                                     User delegator,
                                                     java.lang.String constraint)
                                              throws java.lang.IllegalArgumentException,
                                                     ManagementException

Create a new authorization policy with single action, resource and subject.

Parameters:

effect - effect of the authorization policy. One of possible values is GRANT, DENY or DELEGATE. If it is null, an IllegalArgumentException will be thrown.

action - action of the authorization policy. If it is null, an IllegalArgumentException will be thrown.

resource - resource of the authorization policy. If it is null, an IllegalArgumentException will be thrown.

subject - subject of the authorization policy. One of possible type of subject is User, Group or Role. If it is null or incorrect type, an IllegalArgumentException will be thrown.

delegator - delegator of the authorization policy. This parameter is available only when the policy effect is DELEGATE, otherwise it is ignored. If it is null for delegate policy, an IllegalArgumentException will be thrown.

constraint - constraint of the authorization. The constraint is a series of boolean operations over attribute values which can be used to further limit the applicability of the authorization policy.

Returns:

the authorization policy created.

Throws:

java.lang.IllegalArgumentException - if any parameter is invalid.

ManagementException - if failed to create an authorization policy.

createMembershipRule

public MembershipRule createMembershipRule(PolicyEffectType effect,
                                           java.util.List roles,
                                           java.util.List resources,
                                           java.util.List subjects,
                                           User delegator,
                                           java.lang.String constraint)
                                    throws java.lang.IllegalArgumentException,
                                           ManagementException

Create a new membership rule with one or more roles, resources and subjects.

Parameters:

effect - effect of the membership rule. One of possible values is GRANT, DENY or DELEGATE. If it is null, an IllegalArgumentException will be thrown.

roles - list of roles as com.bea.ales.management.RBAC_Role. If the list is null or empty, an IllegalArgumentException will be thrown. If the element of list is null or its type is incorrect, an IllegalArgumentException will be thrown.

resources - list of resources as Resource. If the list is null or empty, an IllegalArgumentException will be thrown. If the element of list is null or its type is incorrect, an IllegalArgumentException will be thrown.

subjects - list of subjects. If the list is null or empty, an IllegalArgumentException will be thrown. One of possible type of subject is User or Group. If the element of list is null or its type is incorrect, an IllegalArgumentException will be thrown.

delegator - delegator of the membership rule. This parameter is available only when the policy effect is DELEGATE, otherwise it is ignored. If it is null for delegate policy, an IllegalArgumentException will be thrown.

constraint - constraint of the membership rule. The constraint is a series of boolean operations over attribute values which can be used to further limit the applicability of membership rule.

Returns:

the membership rule created.

Throws:

java.lang.IllegalArgumentException - if any parameter is invalid.

ManagementException - if failed to create a membership rule.

createMembershipRule

public MembershipRule createMembershipRule(PolicyEffectType effect,
                                           Role role,
                                           Resource resource,
                                           java.lang.Object subject,
                                           User delegator,
                                           java.lang.String constraint)
                                    throws java.lang.IllegalArgumentException,
                                           ManagementException

Create the new membership rule with single role, resource and subject.

Parameters:

effect - effect of the membership rule. One of possible values is GRANT, DENY or DELEGATE. If it is null, an IllegalArgumentException will be thrown.

role - role of the membership rule. If it is null, an IllegalArgumentException will be thrown.

resource - resource of the membership rule. If it is null, an IllegalArgumentException will be thrown.

subject - subject of the membership rule. One of possible type of subject is User or Group. If it is null or incorrect type, an IllegalArgumentException will be thrown.

delegator - delegator of the membership rule. This parameter is available only when the policy effect is DELEGATE, otherwise it is ignored. If it is null for delegate policy, an IllegalArgumentException will be thrown.

constraint - constraint of the membership rule. The constraint is a series of boolean operations over attribute values which can be used to further limit the applicability of membership rule.

Returns:

the membership rule created.

Throws:

java.lang.IllegalArgumentException - if any parameter is invalid.

ManagementException - if failed to create the membership rule.

getAuthorizationPolicy

public AuthorizationPolicy getAuthorizationPolicy(PolicyEffectType effect,
                                                  java.util.List actions,
                                                  java.util.List resources,
                                                  java.util.List subjects,
                                                  User delegator,
                                                  java.lang.String constraint)
                                           throws java.lang.IllegalArgumentException,
                                                  ManagementException

Find the existing authorization policy which matches exactly all given parameters.

Parameters:

effect - effect of authorization policy. One of possible values is GRANT, DENY or DELEGATE. If it is null, an IllegalArgumentException will be thrown.

actions - list of actions as Action. If the list is null or empty, an IllegalArgumentException will be thrown. If the element of list is null or its type is incorrect, an IllegalArgumentException will be thrown.

resources - list of resources as Resource. If the list is null or empty, an IllegalArgumentException will be thrown. If the element of list is null or its type is incorrect, an IllegalArgumentException will be thrown.

subjects - list of subjects. If the list is null or empty, an IllegalArgumentException will be thrown. One of possible type of subject is User, Group or com.bea.ales.management.RBAC_Role. If the element of list is null or its type is incorrect, an IllegalArgumentException will be thrown.

delegator - delegator of authorization policy. This parameter is available only when the policy effect is DELEGATE, otherwise it is ignored. If it is null for delegate policy, an IllegalArgumentException will be thrown.

constraint - constraint of authorization policy. The constraint is a series of boolean operations over attribute values which can be used to further limit the applicability of authorization policy.

Returns:

the authorization policy found. The null will be returned if no such authorization policy exists.

Throws:

java.lang.IllegalArgumentException - if any parameter is invalid.

ManagementException - if failed to get an authorization policy.

getAuthorizationPolicies

public AuthorizationPolicyQueryResult getAuthorizationPolicies(PolicyEffectType effectType,
                                                               java.util.List actions,
                                                               java.util.List resources,
                                                               java.util.List subjects,
                                                               java.util.List delegators,
                                                               java.lang.String constraintPattern,
                                                               java.lang.String filterSearchOperator)
                                                        throws java.lang.IllegalArgumentException,
                                                               ManagementException

Find authorization policies which match the given query criteria.

Parameters:

effectType - One of possible values is GRANT, DENY, DELEGATE or ALL.

actions - list of actions names as Action. An empty or null list is allowed and will match any action.

resources - list of resources as Resource. An empty or null list is allowed and will match any resource.

subjects - list of subjects. One of possible type of subject is User, Group or Role. An empty or null list is allowed and will match any subject.

delegators - list of delegators as User. An empty or null list is allowed and will match any delegator. If the parameter filterSearchOperator is PoliciesManager.FILTER_OPERATOR_AND, the list can not have more than one item. Otherwise, an IllegalArgumentException will be thrown.

constraintPattern - constraint string. Unlike the other fields in the filter method, the constraint filed supports pattern matching, with the use of the * character. An empty or null value is allowed, and will match any constraint.

filterSearchOperator - one of: PoliciesManager.FILTER_OPERATOR_OR, PoliciesManager.FILTER_OPERATOR_AND

Returns:

authorization policies which match the given criteria.

Throws:

ManagementException - if failed to retrieve authorization policies.

getMembershipRule

public MembershipRule getMembershipRule(PolicyEffectType effect,
                                        java.util.List roles,
                                        java.util.List resources,
                                        java.util.List subjects,
                                        User delegator,
                                        java.lang.String constraint)
                                 throws java.lang.IllegalArgumentException,
                                        ManagementException

Find the existing membership rule which matches exactly all given parameters.

Parameters:

effect - effect of membership rule. One of possible values is GRANT, DENY or DELEGATE. If it is null, an IllegalArgumentException will be thrown.

roles - list of roles as com.bea.ales.management.RBAC_Role. If the list is null or empty, an IllegalArgumentException will be thrown. If the element of list is null or its type is incorrect, an IllegalArgumentException will be thrown.

resources - list of resources as Resource. If the list is null or empty, an IllegalArgumentException will be thrown. If the element of list is null or its type is incorrect, an IllegalArgumentException will be thrown.

subjects - list of subjects. If the list is null or empty, an IllegalArgumentException will be thrown. One of possible type of subject is User or Group. If the element of list is null or its type is incorrect, an IllegalArgumentException will be thrown.

delegator - delegator of the membership rule. This parameter is available only when the policy effect is DELEGATE, otherwise it is ignored. If it is null for delegate policy, an IllegalArgumentException will be thrown.

constraint - constraint of authorization policy. The constraint is a series of boolean operations over attribute values which can be used to further limit the applicability of the membership rule.

Returns:

the membership rule found.

Throws:

java.lang.IllegalArgumentException - if any parameter is invalid.

ManagementException - if failed to get the membership rule.

getMembershipRules

public MembershipRuleQueryResult getMembershipRules(PolicyEffectType effectType,
                                                    java.util.List roles,
                                                    java.util.List resources,
                                                    java.util.List subjects,
                                                    java.util.List delegators,
                                                    java.lang.String constraintPattern,
                                                    java.lang.String filterSearchOperator)
                                             throws java.lang.IllegalArgumentException,
                                                    ManagementException

Find membership rules which match the given query criteria..

Parameters:

effectType - One of possible values is GRANT, DENY, DELEGATE or ALL.

roles - list of actions names as com.bea.ales.management.RBAC_Role. An empty or null list is allowed and will match any role.

resources - list of resources as Resource. An empty or null list is allowed and will match any resource.

subjects - list of subjects. One of possible type of subject is User or Group. An empty or null list is allowed and will match any subject.

delegators - list of delegators as User. An empty or null list is allowed and will match any delegator. If the parameter filterSearchOperator is PoliciesManager.FILTER_OPERATOR_AND, the list can not have more than one item. Otherwise, an IllegalArgumentException will be thrown.

constraintPattern - constraint string. Unlike the other fields in the filter method, the constraint filed supports pattern matching, with the use of the * character. An empty or null value is allowed, and will match any constraint.

filterSearchOperator - one of: PoliciesManager.FILTER_OPERATOR_OR, PoliciesManager.FILTER_OPERATOR_AND

Returns:

membership rules which match the given criteria.

Throws:

ManagementException - if failed to retrieve membership roles.

removeAuthorizationPolicy

public void removeAuthorizationPolicy(PolicyEffectType effect,
                                      java.util.List actions,
                                      java.util.List resources,
                                      java.util.List subjects,
                                      User delegator,
                                      java.lang.String constraint)
                               throws java.lang.IllegalArgumentException,
                                      ManagementException

Remove the authorization policy which matches exactly all given parameters.

Parameters:

effect - effect of authorization policy. One of possible values is GRANT, DENY or DELEGATE. If it is null, an IllegalArgumentException will be thrown.

actions - list of actions as Action. If the list is null or empty, an IllegalArgumentException will be thrown. If the element of list is null or its type is incorrect, an IllegalArgumentException will be thrown.

resources - list of resources as Resource. If the list is null or empty, an IllegalArgumentException will be thrown. If the element of list is null or its type is incorrect, an IllegalArgumentException will be thrown.

subjects - list of subjects. If the list is null or empty, an IllegalArgumentException will be thrown. One of possible type of subject is User, Group or com.bea.ales.management.RBAC_Role. If the element of list is null or its type is incorrect, an IllegalArgumentException will be thrown.

delegator - delegator of authorization policy. This parameter is available only when the policy effect is DELEGATE, otherwise it is ignored. If it is null for delegate policy, an IllegalArgumentException will be thrown.

constraint - constraint of authorization policy. The constraint is a series of boolean operations over attribute values which can be used to further limit the applicability of authorization policy.

Throws:

java.lang.IllegalArgumentException - if any parameter is invalid.

ManagementException - if fails to remove the policy.

removeAuthorizationPolicy

public void removeAuthorizationPolicy(PolicyEffectType effect,
                                      Action action,
                                      Resource resource,
                                      java.lang.Object subject,
                                      User delegator,
                                      java.lang.String constraint)
                               throws java.lang.IllegalArgumentException,
                                      ManagementException

Remove an authorization policy which matches accurately all parameters passed in. This method provides an convenient way to remove a policy which only has single action, resource and subject.

Parameters:

effect - effect of authorization policy. One of possible values is GRANT, DENY or DELEGATE. If it is null, an IllegalArgumentException will be thrown.

action - action of authorization policy. If it is null, an IllegalArgumentException will be thrown.

resource - resource of authorization policy. If it is null, an IllegalArgumentException will be thrown.

subject - subject of authorization policy. One of possible type of subject is User, Group or Role. If it is null or its type is incorrect, an IllegalArgumentException will be thrown.

delegator - delegator of authorization policy. This parameter is available only when the policy effect is DELEGATE, otherwise it is ignored. If it is null for delegate policy, an IllegalArgumentException will be thrown.

constraint - constraint of authorization policy. The constraint is a series of boolean operations over attribute values which can be used to further limit the applicability of authorization policy.

Throws:

java.lang.IllegalArgumentException - if any parameter is invalid.

ManagementException - if fails to remove the policy.

removeAuthorizationPolicy

public void removeAuthorizationPolicy(AuthorizationPolicy authorizationPolicy)
                               throws java.lang.IllegalArgumentException,
                                      ManagementException

Remove the authorization policy.

Parameters:

authorizationPolicy - the authorization policy to be removed.

Throws:

java.lang.IllegalArgumentException - if the authorizationPolicy is null.

ManagementException - if failed to remove the authorization policy.

removeMembershipRule

public void removeMembershipRule(PolicyEffectType effect,
                                 java.util.List roles,
                                 java.util.List resources,
                                 java.util.List subjects,
                                 User delegator,
                                 java.lang.String constraint)
                          throws java.lang.IllegalArgumentException,
                                 ManagementException

Remove the membership rule which matches accurately all given parameters.

Parameters:

effect - effect of membership rule. One of possible values is GRANT, DENY or DELEGATE. If it is null, an IllegalArgumentException will be thrown.

roles - list of roles as com.bea.ales.management.RBAC_Role. If the list is null or empty, an IllegalArgumentException will be thrown. If the element of list is null or its type is incorrect, an IllegalArgumentException will be thrown.

resources - list of resources as Resource. If the list is null or empty, an IllegalArgumentException will be thrown. If the element of list is null or its type is incorrect, an IllegalArgumentException will be thrown.

subjects - list of subjects. If the list is null or empty, an IllegalArgumentException will be thrown. One of possible type of subject is User or Group. If the element of list is null or its type is incorrect, an IllegalArgumentException will be thrown.

delegator - delegator of the membership rule. This parameter is available only when the policy effect is DELEGATE, otherwise it is ignored. If it is null for delegate policy, an IllegalArgumentException will be thrown.

constraint - constraint of authorization policy. The constraint is a series of boolean operations over attribute values which can be used to further limit the applicability of the membership rule.

Throws:

java.lang.IllegalArgumentException - if any parameter is invalid.

ManagementException - if fails to remove the membership rule.

removeMembershipRule

public void removeMembershipRule(PolicyEffectType effect,
                                 Role role,
                                 Resource resource,
                                 java.lang.Object subject,
                                 User delegator,
                                 java.lang.String constraint)
                          throws java.lang.IllegalArgumentException,
                                 ManagementException

Remove the membership rule which matches accurately all given parameters. This method provides an convenient way to remove a membership rule which only has single role, resource and subject.

Parameters:

effect - effect of membership rule. One of possible values is GRANT, DENY or DELEGATE. If it is null, an IllegalArgumentException will be thrown.

role - role of membership rule. If it is null, an IllegalArgumentException will be thrown.

resource - resource of the membership rule. If it is null, an IllegalArgumentException will be thrown.

subject - subject of the membership rule. One of possible type of subject is User or Group. If it is null or incorrect type, an IllegalArgumentException will be thrown.

delegator - delegator of the membership rule. This parameter is available only when the policy effect is DELEGATE, otherwise it is ignored. If it is null for delegate policy, an IllegalArgumentException will be thrown.

constraint - constraint of authorization policy. The constraint is a series of boolean operations over attribute values which can be used to further limit the applicability of the membership rule.

Throws:

java.lang.IllegalArgumentException - if one of parameters is invalid.

ManagementException - if failed to get a membership rule.

removeMembershipRule

public void removeMembershipRule(MembershipRule membershipRule)
                          throws java.lang.IllegalArgumentException,
                                 ManagementException

Remove the membership rule.

Parameters:

membershipRule - the membership rule to be removed.

Throws:

java.lang.IllegalArgumentException - if the membershipRule is null

ManagementException - if failed to remove the membership rule

listAllQueries

public java.util.Collection listAllQueries(PolicyType policyType)
                                    throws ManagementException

Find all policy queries with the specific type.

Parameters:

policyType - policy type. one of possible values is PolicyType.AUTHORIZATION_POLICY or PolicyType.MEMBERSHIP_RULE. If it is null, both types of policy queries will be returned.

Returns:

the collection of all policy queries which is against the specific policy type. The Java type of collection items is PolicyQuery.

Throws:

ManagementException - if failed to retrieve policy queries.

listQueries

public java.util.Collection listQueries(PolicyType policyType,
                                        java.lang.String owner)
                                 throws java.lang.IllegalArgumentException,
                                        ManagementException

Find all policy queries created by the specific user.

Parameters:

policyType - policy type. one of possible values is PolicyType.AUTHORIZATION_POLICY or PolicyType.MEMBERSHIP_RULE. If it is null, both types of policy queries will be returned.

owner - the user who creates policy queries. It is a qualified name, like "//user/asi/system/". If it is null, an IllegalArgumentException will be returned.

Returns:

the collection of all policy queries which match the policy type and owner. The Java type of collection items is PolicyQuery.

Throws:

java.lang.IllegalArgumentException - if owner is null

ManagementException - if failed to retrieve policy queries.

deleteQuery

public void deleteQuery(PolicyQuery policyQuery)
                 throws java.lang.IllegalArgumentException,
                        ManagementException

Delete the policy query.

Parameters:

policyQuery - the policy query to be deleted.

Throws:

java.lang.IllegalArgumentException - if policyQuery is null.

ManagementException - if failed to delete the policy query.

saveQuery

public void saveQuery(PolicyQuery policyQuery,
                      boolean overwrite)
               throws java.lang.IllegalArgumentException,
                      ManagementException

Save the policy query if the query does not exist, or modifies the existing policy query if the query already exists.

Parameters:

policyQuery - the policy query to be saved or modified.

overwrite - true if overwriting the existing policy query is wanted, false if not.

Throws:

java.lang.IllegalArgumentException - if policyQuery is null or invalid.

ManagementException - if failed to save or modify the changes of policy query.