com.tivoli.mts
Class PDPermission

java.lang.Object
  |
  +--java.security.Permission
        |
        +--com.ibm.IBMPermission
              |
              +--com.tivoli.mts.PDPermission
All Implemented Interfaces:
java.security.Guard, java.io.Serializable

public class PDPermission
extends com.ibm.IBMPermission

This class represents an authorization permission for accessing a resource object in the protected domain defined by Policy Director.

PDPermission allows usage of Policy Director as the authorization backend for normal Java 2 permission checks. In PD 3.7, ivacld offers an SSL-based access mode for remote ACL checking. Permission check is done by implies() method which sets up an SSL-based connection to a remote ivacld server for the authorization check.

Permissions are created with resource name and actions. They are immutable once they are created.

The actions must correspond to one of the operations for which a Policy Director permission has been defined. The actions strings use this format: []. Action group name is optional. Action list consists of action names which are one character in length. Examples of valid actions strings are: "[primary]rwc" "rw" "[java]rc[primary]rwx". The following is a list of action names defined and used in Policy Director.

The requested resource to query for must correspond to a resource that has been defined as a protected object within Policy Director's protected object namespace.

See Also:
Serialized Form

Constructor Summary
PDPermission(java.lang.String rname, java.lang.String actions)
          Creates a new PDPermission object with the specified actions and resource.
 
Method Summary
 boolean equals(java.lang.Object obj)
          Checks two PDPermission objects for equality.
 java.lang.String getActions()
          Returns the canonical string representation of the actions.
 int hashCode()
          Returns the hash code value for this object.
 boolean implies(PDPrincipal princ)
          Checks if Policy Director grants the specified permissions to the PDPrincipal.
 boolean implies(PDPrincipal princ, PDAttrs inputList, PDAttrs outputList)
          Checks if Policy Director grants the specified permissions to the PDPrincipal.
 boolean implies(java.security.Permission p)
          Checks to see if Policy Director grants the specified permission.
 
Methods inherited from class java.security.Permission
checkGuard, getName, newPermissionCollection, toString
 
Methods inherited from class java.lang.Object
getClass, notify, notifyAll, wait, wait, wait
 

Constructor Detail

PDPermission

public PDPermission(java.lang.String rname,
                    java.lang.String actions)
Creates a new PDPermission object with the specified actions and resource.

Action names can only be one character in length. Policy Director 3.6 supported the following actions:


Policy Director 3.7 adds some more extended operations:
Administrators may add additional action groups and additional permissions.
Parameters:
rname - name of the target resource object.
actions - name of the requested operations. The actions can be concatenated together to form complex operation strings. The format is "[""]"< action-name>.. "[""]".... Example action strings for the AznAPI would be: "[primary]rwc" "rw" "[java]rc[primary]rwx". "primary" is the default action group if an action group name is not specified.
Method Detail

implies

public boolean implies(java.security.Permission p)
Checks to see if Policy Director grants the specified permission.

More specifically, this method returns true if:

Overrides:
implies in class com.ibm.IBMPermission
Parameters:
p - the permission to check.
Returns:
true if the specified permission is granted by Policy Director,false if not.

implies

public boolean implies(PDPrincipal princ)
Checks if Policy Director grants the specified permissions to the PDPrincipal.

More specifically, this method returns true if:

Parameters:
princ - the PDPrincipal whose permissions will be checked.
Returns:
true if the specified permission is implied by this object, false if not.

implies

public boolean implies(PDPrincipal princ,
                       PDAttrs inputList,
                       PDAttrs outputList)
Checks if Policy Director grants the specified permissions to the PDPrincipal.

More specifically, this method returns true if:

Parameters:
princ - the PDPrincipal whose permissions will be checked.
inputList - the input attribute list passed to server.
outputList - the output attribute list received from server.
Returns:
true if the specified permission is implied by this object, false if not.

equals

public boolean equals(java.lang.Object obj)
Checks two PDPermission objects for equality. Checks that obj is a PDPermission, and has the same name and actions as this object.

Overrides:
equals in class com.ibm.IBMPermission
Parameters:
obj - the object we are testing for equality with this object.
Returns:
true if obj is a PDPermission, and has the same name and actions as this PDPermission object.

getActions

public java.lang.String getActions()
Returns the canonical string representation of the actions.
Overrides:
getActions in class java.security.Permission
Returns:
the canonical string representation of the actions.

hashCode

public int hashCode()
Returns the hash code value for this object.
Overrides:
hashCode in class com.ibm.IBMPermission
Returns:
a hash code value for this object.