com.neurosys.security.auth.service

Interface IAuthorizationService

All Known Implementing Classes:

AuthorizationService

public interface IAuthorizationService

Perform basic Role based Authorization

Author:

Arjun Dhar

Nested Class Summary

Nested Classes

Modifier and Type	Interface and Description
static class	IAuthorizationService.AuthState

Method Summary

Modifier and Type	Method and Description
Collection<Authorization>	getAuthorizationsForUser(String authorizableId, User user) Get the Authorizations granted to a user.
List<Authorization>	getInOrderOfRestriction(Collection<Authorization> userAuthsForFeature, boolean leastRestrictiveToMost) When confronted with multiple Authorizations return a new List of Authorization. Max weight, i.e.
Authorization	getLeastRestrictive(Collection<Authorization> userAuthsForFeature) When confronted with multiple Authorizations return the least restrictive Authorization
Authorization	getMostRestrictive(Collection<Authorization> userAuthsForFeature) When confronted with multiple Authorizations return the most restrictive Authorization
<R extends Role> RoleService<R>	getRoleService() RoleService
IAuthorizationService.AuthState	isAuthorized(Authorization featureRequiredAuth, Collection<Authorization> userAuthsForFeature) Authorize the Users Roles against the Authorization required by the feature
IAuthorizationService.AuthState	isAuthorized(Collection<Authorization> featureRequiredAuths, Collection<Authorization> userAuthsForFeature) Authorize the Users Authorizations against the Authorizations required by the feature. This is completely left to implementation as a general rule the user must satisfy one of the roles demanded by the feature (but some implementation may choose to upset this rule if required)

Method Detail

isAuthorized

IAuthorizationService.AuthState isAuthorized(Collection<Authorization> featureRequiredAuths,
                                             Collection<Authorization> userAuthsForFeature)

Authorize the Users Authorizations against the Authorizations required by the feature.
This is completely left to implementation as a general rule the user must satisfy one of the roles demanded by the feature (but some implementation may choose to upset this rule if required)

Parameters:

featureRequiredAuths - as Collection of Authorization @nullable true

userAuthsForFeature - as Collection of Authorization @nullable true

Returns:

IAuthorizationService.AuthState

isAuthorized

IAuthorizationService.AuthState isAuthorized(Authorization featureRequiredAuth,
                                             Collection<Authorization> userAuthsForFeature)

Authorize the Users Roles against the Authorization required by the feature

Parameters:

featureRequiredAuth - @nullable true

userAuthsForFeature - as Collection of Authorization @nullable true

Returns:

IAuthorizationService.AuthState

getMostRestrictive

Authorization getMostRestrictive(Collection<Authorization> userAuthsForFeature)

When confronted with multiple Authorizations return the most restrictive Authorization

Parameters:

userAuthsForFeature - as Collection of Authorization @nullable true

Returns:

Authorization @nullable true if none found

getLeastRestrictive

Authorization getLeastRestrictive(Collection<Authorization> userAuthsForFeature)

When confronted with multiple Authorizations return the least restrictive Authorization

Parameters:

userAuthsForFeature - as Collection of Authorization @nullable true

Returns:

Authorization @nullable true if none found

getInOrderOfRestriction

List<Authorization> getInOrderOfRestriction(Collection<Authorization> userAuthsForFeature,
                                            boolean leastRestrictiveToMost)

When confronted with multiple Authorizations return a new List of Authorization.
Max weight, i.e. Lest restrictive first element.

Parameters:

userAuthsForFeature - as Collection of Authorization @nullable true

leastRestrictiveToMost - as boolean. If true Least restrictive element will be first and most restrictive, the last.

getAuthorizationsForUser

Collection<Authorization> getAuthorizationsForUser(String authorizableId,
                                                   User user)

Get the Authorizations granted to a user. If User.getRoleNames() is not empty then append them.

Role based Authorizations are determined at runtime, while direct auths are setup from the User object directly. This implis that if we change a Role, then those changes will impact the user @ runtime and will be dynamic.

Parameters:

authorizableId - as String , which can be derived from any Authorizable.getAuthorizableId(). Example(s): IModuleAware or MountModuleUI or a simple Authorizable entity.

user - as User

Returns:

Collection of Authorization

getRoleService

<R extends Role> RoleService<R> getRoleService()

RoleService

Can be null:

true