org.jaffa.security
Class SecurityManager

java.lang.Object
  org.jaffa.security.SecurityManager

public class SecurityManager

extends Object

Security Manager is the main interface to the BusinessFunction and Component Security Architecture. It provide a mechanism for setting the security context for a thread of execution, and then provide a guard for securing code in that thread. The access to the guarded code is derived from a role based security policy file.

Constructor Summary

SecurityManager()

Method Summary

static boolean	checkComponentAccess(String componentName) See if the current thread has access to the named component.
static boolean	checkFunctionAccess(String functionName) See if the current thread has access to the named business function.
static Principal	getPrincipal() Get the Security Prinipal Object for the Current User.
static Object	runFunction(String functionName, PrivilegedAction action) Run the guarded business function, only if the current thread has access
static Object	runFunction(String functionName, PrivilegedExceptionAction action) Run the guarded business function, only if the current thread has access.
static Object	runWithContext(EJBContext ctx, Object obj, Method method, Object[] args) Bind a security context to a thread and contine executing the thread by running the supplied method against the specified object with the supplied paramters.
static Object	runWithContext(EJBContext ctx, Object obj, String method, Object[] args) Bind a security context to a thread and contine executing the thread by running the supplied method against the specified object with the supplied paramters.
static Object	runWithContext(EJBContext ctx, Object obj, String method, Object[] args, Class[] sig) Bind a security context to a thread and contine executing the thread by running the supplied method against the specified object with the supplied paramters.
static Object	runWithContext(HttpServletRequest ctx, Object obj, Method method, Object[] args) Bind a security context to a thread and contine executing the thread by running the supplied method against the specified object with the supplied paramters.
static Object	runWithContext(HttpServletRequest ctx, Object obj, String method, Object[] args) Bind a security context to a thread and contine executing the thread by running the supplied method against the specified object with the supplied paramters.
static Object	runWithContext(HttpServletRequest ctx, Object obj, String method, Object[] args, Class[] sig) Bind a security context to a thread and contine executing the thread by running the supplied method against the specified object with the supplied paramters.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SecurityManager

public SecurityManager()

Method Detail

runWithContext

public static Object runWithContext(HttpServletRequest ctx,
                                    Object obj,
                                    String method,
                                    Object[] args)
                             throws Exception

Bind a security context to a thread and contine executing the thread by running the supplied method against the specified object with the supplied paramters. In this case the security context is derived from a HttpServletRequest.

Parameters:

ctx - Web Server Request Context to use

obj - The object contains the method to execute under the thread security context

method - The name of the method to execute in the specified object

args - An Object array of argument to pass to the method. If there are no parameters for the method null can be passed

Returns:

Returns any Object that the method being invoked can return

Throws:

Exception - Returns any Exception that the method being invoked may return

runWithContext

public static Object runWithContext(HttpServletRequest ctx,
                                    Object obj,
                                    String method,
                                    Object[] args,
                                    Class[] sig)
                             throws Exception

Bind a security context to a thread and contine executing the thread by running the supplied method against the specified object with the supplied paramters. In this case the security context is derived from a HttpServletRequest.

Parameters:

sig - This is an array of classes that represent the signature to the supplied method. This will be used for introspection for the supplied method on the given object

ctx - Web Server Request Context to use

obj - The object contains the method to execute under the thread security context

method - The name of the method to execute in the specified object

args - An Object array of argument to pass to the method. If there are no parameters for the method null can be passed

Returns:

Returns any Object that the method being invoked can return

Throws:

Exception - Returns any Exception that the method being invoked may return

runWithContext

public static Object runWithContext(HttpServletRequest ctx,
                                    Object obj,
                                    Method method,
                                    Object[] args)
                             throws Exception

Bind a security context to a thread and contine executing the thread by running the supplied method against the specified object with the supplied paramters. The signature of the method is introspected used the classes associated to the objects in the parameter array If these classes are not able to specified the methods signiture, use the variation of this method that allows the class[] singature to be supplied. In this case the security context is derived from a HttpServletRequest.

Parameters:

ctx - Web Server Request Context to use

obj - The object contains the method to execute under the thread security context

method - The name of the method to execute in the specified object

args - An Object array of argument to pass to the method. If there are no parameters for the method null can be passed

Returns:

Returns any Object that the method being invoked can return the supplied method on the given object

Throws:

Exception - Returns any Exception that the method being invoked may return

runWithContext

public static Object runWithContext(EJBContext ctx,
                                    Object obj,
                                    String method,
                                    Object[] args)
                             throws Exception

Bind a security context to a thread and contine executing the thread by running the supplied method against the specified object with the supplied paramters. In this case the security context is derived from an EJBContext.

Parameters:

ctx - Web Server Request Context to use

obj - The object contains the method to execute under the thread security context

method - The name of the method to execute in the specified object

args - An Object array of argument to pass to the method. If there are no parameters for the method null can be passed

Returns:

Returns any Object that the method being invoked can return

Throws:

Exception - Returns any Exception that the method being invoked may return

runWithContext

public static Object runWithContext(EJBContext ctx,
                                    Object obj,
                                    String method,
                                    Object[] args,
                                    Class[] sig)
                             throws Exception

Bind a security context to a thread and contine executing the thread by running the supplied method against the specified object with the supplied paramters. In this case the security context is derived from an EJBContext.

Parameters:

sig - This is an array of classes that represent the signature to the supplied method. This will be used for introspection for the supplied method on the given object

ctx - Web Server Request Context to use

obj - The object contains the method to execute under the thread security context

method - The name of the method to execute in the specified object

args - An Object array of argument to pass to the method. If there are no parameters for the method null can be passed

Returns:

Returns any Object that the method being invoked can return

Throws:

Exception - Returns any Exception that the method being invoked may return

runWithContext

public static Object runWithContext(EJBContext ctx,
                                    Object obj,
                                    Method method,
                                    Object[] args)
                             throws Exception

Bind a security context to a thread and contine executing the thread by running the supplied method against the specified object with the supplied paramters. The signature of the method is introspected used the classes associated to the objects in the parameter array If these classes are not able to specified the methods signiture, use the variation of this method that allows the class[] singature to be supplied. In this case the security context is derived from an EJBContext.

Parameters:

ctx - Web Server Request Context to use

obj - The object contains the method to execute under the thread security context

method - The name of the method to execute in the specified object

args - An Object array of argument to pass to the method. If there are no parameters for the method null can be passed

Returns:

Returns any Object that the method being invoked can return the supplied method on the given object

Throws:

Exception - Returns any Exception that the method being invoked may return

runFunction

public static Object runFunction(String functionName,
                                 PrivilegedAction action)
                          throws AccessControlException

Run the guarded business function, only if the current thread has access

Parameters:

functionName - Name of the business function being guarded

action - An action object which will be executed, this should contain the guarded code

Returns:

Returns back the object that the guarded code returned

Throws:

AccessControlException - This is thrown if the user doesn't have authorization for this function

runFunction

public static Object runFunction(String functionName,
                                 PrivilegedExceptionAction action)
                          throws PrivilegedActionException,
                                 AccessControlException

Run the guarded business function, only if the current thread has access. This guarded function may throw a PrivilegedActionException which will contain the real exception

Parameters:

functionName - Name of the business function being guarded

action - An action object which will be executed, this should contain the guarded code

Returns:

Returns back the object that the guarded code returned

Throws:

PrivilegedActionException - This is the wrapped exception the the guarded code threw

AccessControlException - This is thrown if the user doesn't have authorization for this function

checkComponentAccess

public static boolean checkComponentAccess(String componentName)

See if the current thread has access to the named component. This can be used by a Component Manager to preempt a security violation

Parameters:

componentName - Name of component to check

Returns:

true, if the current thread has access to this component, otherwise false is returned

checkFunctionAccess

public static boolean checkFunctionAccess(String functionName)

See if the current thread has access to the named business function.

Parameters:

functionName - Name of business function to check

Returns:

true, if the current thread has access to this business function, otherwise false is returned

getPrincipal

public static Principal getPrincipal()

Get the Security Prinipal Object for the Current User. If this is called 'outsite' or the Jaffa framework it will return null. Typically jaffa security is backed by either Web Container or EJB Container security, and this will return Principle as created by the Web/EJB container that is associated to the thread of execution calling this method

In a typical web environment SecurityManager.getPrincipal().getName() will return you the username used to log on.

Returns:

The security principal associated to the current thread