com.sun.identity.policy
Class PolicyEvaluator

java.lang.Object
  |
  +--com.sun.identity.policy.PolicyEvaluator

public class PolicyEvaluator
extends java.lang.Object

The class PolicyEvaluator evaluates policies and provides policy decisions.


Field Summary
static java.lang.String ALL_RESOURCES
          Constant used to identity all the resources of a service type.
static java.lang.String EMPTY_RESOURCE_NAME
          Constant used to identity empty resource
 
Constructor Summary
PolicyEvaluator(java.lang.String serviceTypeName)
          Constructor to create a PolicyEvaluator given the service type name
 
Method Summary
 void addPolicyListener(PolicyListener policyListener)
          Adds a policy listener that would be notified whenever a policy is added, removed or changed
 PolicyDecision getPolicyDecision(SSOToken token, java.lang.String resourceName, java.util.Set actionNames, java.util.Map envParameters)
          Evaluates privileges of the user to perform the specified actions the the specified resource.
 java.util.Set getProtectedResourcesIgnoreConditions(SSOToken token, java.lang.String rootResource)
          Gets protected resources for a user identified by sso token Conditions defined in the policies are ignored while computing protected resources.
 ResourceResult getResourceResult(SSOToken token, java.lang.String resourceName, java.lang.String scope, java.util.Map envParameters)
          Gets resource result given a resource name.
 java.util.Set getResourceResults(SSOToken token, java.lang.String resourceName, java.lang.String scope, java.util.Map envParameters)
          Gets resource result objects given a resource name.
 boolean isAllowed(SSOToken token, java.lang.String resourceName, java.lang.String actionName, java.util.Map envParameters)
          Evaluates simple privileges of boolean type.
 void removePolicyListener(PolicyListener policyListener)
          Removes a policy listener that was previously registered to receive notifications whenever a policy is added, removed or changed.
 
Methods inherited from class java.lang.Object
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Field Detail

ALL_RESOURCES

public static final java.lang.String ALL_RESOURCES
Constant used to identity all the resources of a service type. The resources include the subresources of all resource prefixes of resource type

EMPTY_RESOURCE_NAME

public static final java.lang.String EMPTY_RESOURCE_NAME
Constant used to identity empty resource
Constructor Detail

PolicyEvaluator

public PolicyEvaluator(java.lang.String serviceTypeName)
                throws SSOException,
                       PolicyException,
                       NameNotFoundException
Constructor to create a PolicyEvaluator given the service type name
Parameters:
serviceTypeName - the name of the service type for which this evaluator can be used for
Method Detail

isAllowed

public boolean isAllowed(SSOToken token,
                         java.lang.String resourceName,
                         java.lang.String actionName,
                         java.util.Map envParameters)
                  throws PolicyException,
                         SSOException
Evaluates simple privileges of boolean type. The privilege indicate if the user can perform specified action on the specified resource. The evaluation depends on user's application environment parameters. Invoking this method would result in PolicyException, if the syntax for the actionName is not declared to be boolean, in the service schema
Parameters:
token - SSO token of the user evaluating policies
resourceName - name of the resource the user is trying to access
actionName - name of the action the user is trying to perform on the resource
envParameters - run-time environment parameters
Returns:
the result of the evaluation as a boolean value
Throws:
SSOException - single-sign-on token invalid or expired
PolicyException - if result could not be computed for any reason other than sso token problem.

getPolicyDecision

public PolicyDecision getPolicyDecision(SSOToken token,
                                        java.lang.String resourceName,
                                        java.util.Set actionNames,
                                        java.util.Map envParameters)
                                 throws PolicyException,
                                        SSOException
Evaluates privileges of the user to perform the specified actions the the specified resource. The evaluation depends on user's application environment parameters.
Parameters:
token - SSO token of the user evaluating policies
resourceName - name of the resource the user is trying to access
actionName - name of the action the user is trying to perform on the resource
envParameters - run-time environment parameters
Returns:
policy decision
Throws:
SSOException - single-sign-on token invalid or expired

getProtectedResourcesIgnoreConditions

public java.util.Set getProtectedResourcesIgnoreConditions(SSOToken token,
                                                           java.lang.String rootResource)
                                                    throws PolicyException,
                                                           SSOException
Gets protected resources for a user identified by sso token Conditions defined in the policies are ignored while computing protected resources. Only resources that are subresources of the given rootResource or equal to the given rootResource would be returned. If all policies applicable to a resource are only referral policies, no ProtectedResource would be returned for such a resource.
Parameters:
token - ssoToken of the user
rootResource - only resources that are subresources of the given rootResource or equal to the given rootResource would be returned rootResource would be returned. If PolicyEvaluator.ALL_RESOURCES is passed as rootResource, resources under all root resources of the service type are considered while computing protected resources.
Returns:
set of protected resources. The set contains ProtectedResource objects.
Throws:
PolicyException -  
SSOException - if sso token is invalid
See Also:
ProtectedResource

getResourceResults

public java.util.Set getResourceResults(SSOToken token,
                                        java.lang.String resourceName,
                                        java.lang.String scope,
                                        java.util.Map envParameters)
                                 throws PolicyException,
                                        SSOException
Gets resource result objects given a resource name. The set contains ResourceResult objects for all resources that would affect policy decisions for any resource assosciated with the argument resource name. To determine whether to include the ResourceResult of a resource, we compare argument resource name and policy resource name, treating wild characters in the policy resource name as wild. If the comparsion resulted in EXACT_MATCH, WILD_CARD_MACTH or SUB_RESOURCE_MACTH, the resource result would be included.
Parameters:
token - SSO token of the user evaluating policies
resourceName - name of the resource
scope - indicates whether to compute the resource result based on the policy decision for only the resourceName or all the resources assosciated with the resource name
envParameters - run-time environment parameters
Returns:
set of ResourceResult objects
Throws:
PolicyException -  
SSOException -  
See Also:
ResourceMatch.EXACT_MATCH, ResourceMatch.SUB_RESOURCE_MATCH, ResourceMatch.WILDCARD_MATCH

getResourceResult

public ResourceResult getResourceResult(SSOToken token,
                                        java.lang.String resourceName,
                                        java.lang.String scope,
                                        java.util.Map envParameters)
                                 throws PolicyException,
                                        SSOException
Gets resource result given a resource name. ResourceResult is a tree representation of policy decisions for all resources rooted at the resource name. To determine whether a resource defined in the policy is a sub resource of argument resource name, argument resource name and policy resource name are compared, treating wild characters as literals. If comparison resulted in EXACT_MACTH or SUB_RESOURCE_MACTH, the resource would be included
Parameters:
token - SSO token of the user evaluating policies
resourceName - name of the resource
scope - indicates whether to compute the resource result based on the policy decision for only the resourceName or all the resources assosciated with the resource name
envParameters - run-time environment parameters
Returns:
ResourceResult
Throws:
PolicyException -  
SSOException -  
See Also:
ResourceMatch.EXACT_MATCH, ResourceMatch.SUB_RESOURCE_MATCH, ResourceMatch.WILDCARD_MATCH

addPolicyListener

public void addPolicyListener(PolicyListener policyListener)
Adds a policy listener that would be notified whenever a policy is added, removed or changed
Parameters:
policyListener - the listener to be added

removePolicyListener

public void removePolicyListener(PolicyListener policyListener)
Removes a policy listener that was previously registered to receive notifications whenever a policy is added, removed or changed. It is not an error to attempt to remove a listener that was not registered. It would return silently.
Parameters:
policyListener - the listener to be removed