org.fcrepo.server.security

Class DefaultAuthorization

java.lang.Object

org.fcrepo.server.Parameterized

org.fcrepo.server.Pluggable

org.fcrepo.server.Module

org.fcrepo.server.security.DefaultAuthorization

All Implemented Interfaces:

Constants, Authorization

public class DefaultAuthorization
extends Module
implements Authorization

The Authorization module, protecting access to Fedora's API-A and API-M endpoints.

The following attributes are available for use in authorization policies during any enforce call.

subject attributes

• urn:fedora:names:fedora:2.1:subject:loginId (available only if user has authenticated)
• urn:fedora:names:fedora:2.1:subject:x (available if authenticated user has attribute x)

environment attributes derived from HTTP request

• urn:fedora:names:fedora:2.1:environment:httpRequest:security
  • == urn:fedora:names:fedora:2.1:environment:httpRequest:security-secure(i.e., request is HTTPS/SSL)
  • == urn:fedora:names:fedora:2.1:environment:httpRequest:security-insecure(i.e., request is HTTP/non-SSL)
• urn:fedora:names:fedora:2.1:environment:httpRequest:messageProtocol
  • == urn:fedora:names:fedora:2.1:environment:httpRequest:messageProtocol-soap(i.e., request is over SOAP/CXF)
  • == urn:fedora:names:fedora:2.1:environment:httpRequest:messageProtocol-rest(i.e., request is over non-SOAP/CXF ("REST") HTTP call)

environment attributes directly from HTTP request

• urn:fedora:names:fedora:2.1:environment:httpRequest:authType
• urn:fedora:names:fedora:2.1:environment:httpRequest:clientFqdn
• urn:fedora:names:fedora:2.1:environment:httpRequest:clientIpAddress
• urn:fedora:names:fedora:2.1:environment:httpRequest:contentLength
• urn:fedora:names:fedora:2.1:environment:httpRequest:contentType
• urn:fedora:names:fedora:2.1:environment:httpRequest:method
• urn:fedora:names:fedora:2.1:environment:httpRequest:protocol
• urn:fedora:names:fedora:2.1:environment:httpRequest:scheme
• urn:fedora:names:fedora:2.1:environment:httpRequest:serverFqdn
• urn:fedora:names:fedora:2.1:environment:httpRequest:serverIpAddress
• urn:fedora:names:fedora:2.1:environment:httpRequest:serverPort
• urn:fedora:names:fedora:2.1:environment:httpRequest:sessionEncoding
• urn:fedora:names:fedora:2.1:environment:httpRequest:sessionStatus

other environment attributes

• urn:fedora:names:fedora:2.1:currentDateTime
• urn:fedora:names:fedora:2.1:currentDate
• urn:fedora:names:fedora:2.1:currentTime

See Also:

HttpServletRequest interface documentation

Nested Class Summary

Nested classes/interfaces inherited from interface org.fcrepo.common.Constants

Constants.FedoraHome

Field Summary

Fields inherited from interface org.fcrepo.server.security.Authorization

ACTION_CATEGORY, ACTION_CATEGORY_ACCESS, ENVIRONMENT_CATEGORY, ENVIRONMENT_CATEGORY_ACCESS, FEDORA_ROLE_KEY, RESOURCE_CATEGORY, RESOURCE_CATEGORY_ACCESS, SUBJECT_CATEGORY, SUBJECT_CATEGORY_ACCESS

Fields inherited from interface org.fcrepo.common.Constants

ACCESS, ACTION, API, ATOM_APIM1_0, ATOM_ZIP1_1, ATOM1_1, AUDIT, AUDIT1_0, BATCH_MODIFY, BATCH_MODIFY1_1, BE_SECURITY, BE_SECURITY1_0, BINDING_SPEC, DATASTREAM, DC, DISSEMINATOR, DS_COMPOSITE_MODEL, DS_COMPOSITE_MODEL1_0, DS_INPUT_SPEC1_0, DS_INPUT_SPEC1_1, ENVIRONMENT, FCFG, FEDORA, FEDORA_APP_CONTEXT_NAME, FEDORA_DEFAULT_APP_CONTEXT, FEDORA_HOME, FEDORA_REPOSITORY_PID, FOXML, FOXML1_0, FOXML1_0_LEGACY, FOXML1_1, HTTP_REQUEST, MANAGEMENT, METHOD_MAP, METS, METS_EXT, METS_EXT1_0, METS_EXT1_0_LEGACY, METS_EXT1_1, MODEL, MULGARA, OAI_DC, OAI_DC2_0, OAI_FRIENDS, OAI_FRIENDS2_0, OAI_IDENTIFIER, OAI_IDENTIFIER2_0, OAI_PMH, OAI_PMH2_0, OAI_PROV, OAI_PROV2_0, OBJ_DATASTREAMS1_0, OBJ_HISTORY1_0, OBJ_ITEMS1_0, OBJ_METHODS1_0, OBJ_PROFILE1_0, OBJ_VALIDATION1_0, OBJECT, OLD_XLINK, PID_LIST1_0, RDF, RDF_XSD, RECOVERY, RELS_EXT, RELS_EXT1_0, RELS_INT1_0, REPO_DESC1_0, RESOURCE, SDEF, SDEF_METHOD_MAP1_0, SDEP, SDEP_METHOD_MAP1_0, SDEP_METHOD_MAP1_1, SERVICE_PROFILE, SOAP, SOAP_ENC, SUBJECT, TYPES, VIEW, WSDL, WSDL_HTTP, WSDL_MIME, XACML_POLICY, XACML_POLICY1_0, XACML1, XACML1_ACTION, XACML1_POLICY, XACML1_RESOURCE, XACML1_SUBJECT, XACML2_POLICY_SCHEMA, XLINK, XML_XSD, XMLNS, XSI

Constructor Summary

Constructors

Constructor and Description
DefaultAuthorization(Map<String,String> moduleParameters, Server server, String role) Creates and initializes the Access Module.

Method Summary

Methods

Modifier and Type	Method and Description
static String	dateAsString(Date date)
void	enforce_Internal_DSState(Context context, String id, String state)
void	enforceAddDatastream(Context context, String pid, String dsId, String[] altIDs, String MIMEType, String formatURI, String dsLocation, String controlGroup, String dsState, String checksumType, String checksum) Enforce authorization for adding a datastream to an object.
void	enforceAddRelationship(Context context, String pid, String predicate, String object, boolean isLiteral, String datatype)
void	enforceCompareDatastreamChecksum(Context context, String pid, String datastreamId, Date versionDate)
void	enforceDescribeRepository(Context context)
void	enforceExport(Context context, String pid, String format, String exportContext, String exportEncoding)
void	enforceExportObject(Context context, String pid, String format, String exportContext, String exportEncoding) Deprecated. in Fedora 3.0, use enforceExport() instead
void	enforceFindObjects(Context context)
void	enforceGetDatastream(Context context, String pid, String datastreamId, Date asOfDateTime)
void	enforceGetDatastreamDissemination(Context context, String pid, String datastreamId, Date asOfDate)
void	enforceGetDatastreamHistory(Context context, String pid, String datastreamId)
void	enforceGetDatastreams(Context context, String pid, Date asOfDate, String datastreamState)
void	enforceGetDissemination(Context context, String pid, String sDefPid, String methodName, Date asOfDate, String objectState, String sDefState, String sDepPid, String sDepState, String dissState)
void	enforceGetNextPid(Context context, String namespace, int nNewPids)
void	enforceGetObjectHistory(Context context, String pid)
void	enforceGetObjectProfile(Context context, String pid, Date asOfDate)
void	enforceGetObjectXML(Context context, String pid, String objectXmlEncoding)
void	enforceGetRelationships(Context context, String pid, String predicate)
void	enforceIngest(Context context, String pid, String format, String ingestEncoding)
void	enforceIngestObject(Context context, String pid, String format, String ingestEncoding) Deprecated. in Fedora 3.0, use enforceIngest() instead
void	enforceListDatastreams(Context context, String pid, Date asOfDate)
void	enforceListMethods(Context context, String pid, Date asOfDate)
void	enforceListObjectInFieldSearchResults(Context context, String pid)
void	enforceListObjectInResourceIndexResults(Context context, String pid)
void	enforceModifyDatastreamByReference(Context context, String pid, String datastreamId, String[] datastreamNewAltIDs, String datastreamNewMimeType, String datastreamNewFormatURI, String datastreamNewLocation, String datastreamNewChecksumType, String datastreamNewChecksum)
void	enforceModifyDatastreamByValue(Context context, String pid, String datastreamId, String[] newDatastreamAltIDs, String newDatastreamMimeType, String newDatastreamFormatURI, String newDatastreamChecksumType, String newDatastreamChecksum)
void	enforceModifyObject(Context context, String pid, String objectNewState, String objectNewOwnerId)
void	enforceOAIRespond(Context context)
void	enforcePurgeDatastream(Context context, String pid, String datastreamId, Date endDT)
void	enforcePurgeObject(Context context, String pid)
void	enforcePurgeRelationship(Context context, String pid, String predicate, String object, boolean isLiteral, String datatype)
void	enforceReloadPolicies(Context context)
void	enforceResolveDatastream(Context context, Date ticketIssuedDateTime)
void	enforceRetrieveFile(Context context, String fileURI)
void	enforceRIFindObjects(Context context)
void	enforceServerStatus(Context context)
void	enforceSetDatastreamState(Context context, String pid, String datastreamId, String datastreamNewState)
void	enforceSetDatastreamVersionable(Context context, String pid, String datastreamId, boolean datastreamNewVersionable)
void	enforceUpload(Context context)
void	enforceValidate(Context context, String pid, Date asOfDate)
void	initModule() Initializes the Module based on configuration parameters.
void	postInitModule() Second stage of Module initialization.
void	reloadPolicies(Context context)

Methods inherited from class org.fcrepo.server.Module

getRole, getServer, shutdownModule

Methods inherited from class org.fcrepo.server.Pluggable

getHelp, getOptionalParameters, getParameterHelp, getRequiredModuleRoles, getRequiredParameters

Methods inherited from class org.fcrepo.server.Parameterized

getParameter, getParameter, getParameter, getParameterList, getParameters, getParameters, parameterNames, setParameter, setParameters, setParameters

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

DefaultAuthorization

public DefaultAuthorization(Map<String,String> moduleParameters,
                    Server server,
                    String role)
                     throws ModuleInitializationException

Creates and initializes the Access Module. When the server is starting up, this is invoked as part of the initialization process.

Parameters:

moduleParameters - A pre-loaded Map of name-value pairs comprising the intended configuration of this Module.

server - The Server instance.

role - The role this module fulfills, a java class name.

Throws:

ModuleInitializationException - If initilization values are invalid or initialization fails for some other reason.

Method Detail

initModule

public void initModule()
                throws ModuleInitializationException

Description copied from class: Module

Initializes the Module based on configuration parameters.

Overrides:

initModule in class Module

Throws:

ModuleInitializationException - If initialization values are invalid or initialization fails for some other reason.

postInitModule

public void postInitModule()
                    throws ModuleInitializationException

Description copied from class: Module

Second stage of Module initialization. This is guaranteed to run after all Modules' initModule() methods have run.

Overrides:

postInitModule in class Module

Throws:

ModuleInitializationException - If initialization values are invalid or initialization fails for some other reason.

reloadPolicies

public void reloadPolicies(Context context)
                    throws Exception

Specified by:

reloadPolicies in interface Authorization

Throws:

Exception

enforceAddDatastream

public final void enforceAddDatastream(Context context,
                        String pid,
                        String dsId,
                        String[] altIDs,
                        String MIMEType,
                        String formatURI,
                        String dsLocation,
                        String controlGroup,
                        String dsState,
                        String checksumType,
                        String checksum)
                                throws AuthzException

Enforce authorization for adding a datastream to an object. Provide attributes for the authorization decision and wrap that xacml decision.

The following attributes are available for use in authorization policies during a call to this method.

action attributes

• urn:fedora:names:fedora:2.1:action:id == urn:fedora:names:fedora:2.1:action:id-addDatastream
• urn:fedora:names:fedora:2.1:action:api == urn:fedora:names:fedora:2.1:action:api-m

resource attributes of object to which datastream would be added

• urn:fedora:names:fedora:2.1:resource:object:pid
• urn:fedora:names:fedora:2.1:resource:object:namespace (if pid is "x:y", namespace is "x")

resource attributes of datastream which would be added

• urn:fedora:names:fedora:2.1:resource:datastream:mimeType
• urn:fedora:names:fedora:2.1:resource:datastream:formatUri
• urn:fedora:names:fedora:2.1:resource:datastream:state
• urn:fedora:names:fedora:2.1:resource:datastream:id
• urn:fedora:names:fedora:2.1:resource:datastream:location
• urn:fedora:names:fedora:2.1:resource:datastream:controlGroup
• urn:fedora:names:fedora:2.1:resource:datastream:altIds
• urn:fedora:names:fedora:2.1:resource:datastream:checksumType
• urn:fedora:names:fedora:2.1:resource:datastream:checksum

Specified by:

enforceAddDatastream in interface Authorization

Throws:

AuthzException

enforceExport

public final void enforceExport(Context context,
                 String pid,
                 String format,
                 String exportContext,
                 String exportEncoding)
                         throws AuthzException

Specified by:

enforceExport in interface Authorization

Throws:

AuthzException

enforceExportObject

@Deprecated
public final void enforceExportObject(Context context,
                                  String pid,
                                  String format,
                                  String exportContext,
                                  String exportEncoding)
                               throws AuthzException

Deprecated. in Fedora 3.0, use enforceExport() instead

Specified by:

enforceExportObject in interface Authorization

Throws:

AuthzException

enforceGetNextPid

public final void enforceGetNextPid(Context context,
                     String namespace,
                     int nNewPids)
                             throws AuthzException

Specified by:

enforceGetNextPid in interface Authorization

Throws:

AuthzException

enforceGetDatastream

public final void enforceGetDatastream(Context context,
                        String pid,
                        String datastreamId,
                        Date asOfDateTime)
                                throws AuthzException

Specified by:

enforceGetDatastream in interface Authorization

Throws:

AuthzException

enforceGetDatastreamHistory

public final void enforceGetDatastreamHistory(Context context,
                               String pid,
                               String datastreamId)
                                       throws AuthzException

Specified by:

enforceGetDatastreamHistory in interface Authorization

Throws:

AuthzException

enforceGetDatastreams

public final void enforceGetDatastreams(Context context,
                         String pid,
                         Date asOfDate,
                         String datastreamState)
                                 throws AuthzException

Specified by:

enforceGetDatastreams in interface Authorization

Throws:

AuthzException

enforceGetObjectXML

public final void enforceGetObjectXML(Context context,
                       String pid,
                       String objectXmlEncoding)
                               throws AuthzException

Specified by:

enforceGetObjectXML in interface Authorization

Throws:

AuthzException

enforceIngest

public final void enforceIngest(Context context,
                 String pid,
                 String format,
                 String ingestEncoding)
                         throws AuthzException

Specified by:

enforceIngest in interface Authorization

Throws:

AuthzException

enforceIngestObject

@Deprecated
public final void enforceIngestObject(Context context,
                                  String pid,
                                  String format,
                                  String ingestEncoding)
                               throws AuthzException

Deprecated. in Fedora 3.0, use enforceIngest() instead

Specified by:

enforceIngestObject in interface Authorization

Throws:

AuthzException

enforceListObjectInFieldSearchResults

public final void enforceListObjectInFieldSearchResults(Context context,
                                         String pid)
                                                 throws AuthzException

Specified by:

enforceListObjectInFieldSearchResults in interface Authorization

Throws:

AuthzException

enforceListObjectInResourceIndexResults

public final void enforceListObjectInResourceIndexResults(Context context,
                                           String pid)
                                                   throws AuthzException

Specified by:

enforceListObjectInResourceIndexResults in interface Authorization

Throws:

AuthzException

enforceModifyDatastreamByReference

public final void enforceModifyDatastreamByReference(Context context,
                                      String pid,
                                      String datastreamId,
                                      String[] datastreamNewAltIDs,
                                      String datastreamNewMimeType,
                                      String datastreamNewFormatURI,
                                      String datastreamNewLocation,
                                      String datastreamNewChecksumType,
                                      String datastreamNewChecksum)
                                              throws AuthzException

Specified by:

enforceModifyDatastreamByReference in interface Authorization

Throws:

AuthzException

enforceModifyDatastreamByValue

public final void enforceModifyDatastreamByValue(Context context,
                                  String pid,
                                  String datastreamId,
                                  String[] newDatastreamAltIDs,
                                  String newDatastreamMimeType,
                                  String newDatastreamFormatURI,
                                  String newDatastreamChecksumType,
                                  String newDatastreamChecksum)
                                          throws AuthzException

Specified by:

enforceModifyDatastreamByValue in interface Authorization

Throws:

AuthzException

enforceModifyObject

public final void enforceModifyObject(Context context,
                       String pid,
                       String objectNewState,
                       String objectNewOwnerId)
                               throws AuthzException

Specified by:

enforceModifyObject in interface Authorization

Throws:

AuthzException

enforcePurgeDatastream

public final void enforcePurgeDatastream(Context context,
                          String pid,
                          String datastreamId,
                          Date endDT)
                                  throws AuthzException

Specified by:

enforcePurgeDatastream in interface Authorization

Throws:

AuthzException

enforcePurgeObject

public final void enforcePurgeObject(Context context,
                      String pid)
                              throws AuthzException

Specified by:

enforcePurgeObject in interface Authorization

Throws:

AuthzException

enforceSetDatastreamState

public final void enforceSetDatastreamState(Context context,
                             String pid,
                             String datastreamId,
                             String datastreamNewState)
                                     throws AuthzException

Specified by:

enforceSetDatastreamState in interface Authorization

Throws:

AuthzException

enforceSetDatastreamVersionable

public final void enforceSetDatastreamVersionable(Context context,
                                   String pid,
                                   String datastreamId,
                                   boolean datastreamNewVersionable)
                                           throws AuthzException

Specified by:

enforceSetDatastreamVersionable in interface Authorization

Throws:

AuthzException

enforceCompareDatastreamChecksum

public final void enforceCompareDatastreamChecksum(Context context,
                                    String pid,
                                    String datastreamId,
                                    Date versionDate)
                                            throws AuthzException

Specified by:

enforceCompareDatastreamChecksum in interface Authorization

Throws:

AuthzException

enforceDescribeRepository

public void enforceDescribeRepository(Context context)
                               throws AuthzException

Specified by:

enforceDescribeRepository in interface Authorization

Throws:

AuthzException

enforceFindObjects

public void enforceFindObjects(Context context)
                        throws AuthzException

Specified by:

enforceFindObjects in interface Authorization

Throws:

AuthzException

enforceRIFindObjects

public void enforceRIFindObjects(Context context)
                          throws AuthzException

Specified by:

enforceRIFindObjects in interface Authorization

Throws:

AuthzException

enforceGetDatastreamDissemination

public void enforceGetDatastreamDissemination(Context context,
                                     String pid,
                                     String datastreamId,
                                     Date asOfDate)
                                       throws AuthzException

Specified by:

enforceGetDatastreamDissemination in interface Authorization

Throws:

AuthzException

enforceGetDissemination

public void enforceGetDissemination(Context context,
                           String pid,
                           String sDefPid,
                           String methodName,
                           Date asOfDate,
                           String objectState,
                           String sDefState,
                           String sDepPid,
                           String sDepState,
                           String dissState)
                             throws AuthzException

Specified by:

enforceGetDissemination in interface Authorization

Throws:

AuthzException

enforceGetObjectHistory

public void enforceGetObjectHistory(Context context,
                           String pid)
                             throws AuthzException

Specified by:

enforceGetObjectHistory in interface Authorization

Throws:

AuthzException

enforceGetObjectProfile

public void enforceGetObjectProfile(Context context,
                           String pid,
                           Date asOfDate)
                             throws AuthzException

Specified by:

enforceGetObjectProfile in interface Authorization

Throws:

AuthzException

enforceListDatastreams

public void enforceListDatastreams(Context context,
                          String pid,
                          Date asOfDate)
                            throws AuthzException

Specified by:

enforceListDatastreams in interface Authorization

Throws:

AuthzException

enforceListMethods

public void enforceListMethods(Context context,
                      String pid,
                      Date asOfDate)
                        throws AuthzException

Specified by:

enforceListMethods in interface Authorization

Throws:

AuthzException

enforceServerStatus

public void enforceServerStatus(Context context)
                         throws AuthzException

Specified by:

enforceServerStatus in interface Authorization

Throws:

AuthzException

enforceOAIRespond

public void enforceOAIRespond(Context context)
                       throws AuthzException

Specified by:

enforceOAIRespond in interface Authorization

Throws:

AuthzException

enforceUpload

public void enforceUpload(Context context)
                   throws AuthzException

Specified by:

enforceUpload in interface Authorization

Throws:

AuthzException

enforce_Internal_DSState

public void enforce_Internal_DSState(Context context,
                            String id,
                            String state)
                              throws AuthzException

Specified by:

enforce_Internal_DSState in interface Authorization

Throws:

AuthzException

enforceResolveDatastream

public void enforceResolveDatastream(Context context,
                            Date ticketIssuedDateTime)
                              throws AuthzException

Specified by:

enforceResolveDatastream in interface Authorization

Throws:

AuthzException

enforceReloadPolicies

public void enforceReloadPolicies(Context context)
                           throws AuthzException

Specified by:

enforceReloadPolicies in interface Authorization

Throws:

AuthzException

dateAsString

public static final String dateAsString(Date date)
                                 throws Exception

Throws:

Exception

enforceGetRelationships

public void enforceGetRelationships(Context context,
                           String pid,
                           String predicate)
                             throws AuthzException

Specified by:

enforceGetRelationships in interface Authorization

Throws:

AuthzException

enforceAddRelationship

public void enforceAddRelationship(Context context,
                          String pid,
                          String predicate,
                          String object,
                          boolean isLiteral,
                          String datatype)
                            throws AuthzException

Specified by:

enforceAddRelationship in interface Authorization

Throws:

AuthzException

enforcePurgeRelationship

public void enforcePurgeRelationship(Context context,
                            String pid,
                            String predicate,
                            String object,
                            boolean isLiteral,
                            String datatype)
                              throws AuthzException

Specified by:

enforcePurgeRelationship in interface Authorization

Throws:

AuthzException

enforceRetrieveFile

public void enforceRetrieveFile(Context context,
                       String fileURI)
                         throws AuthzException

Specified by:

enforceRetrieveFile in interface Authorization

Throws:

AuthzException

enforceValidate

public void enforceValidate(Context context,
                   String pid,
                   Date asOfDate)
                     throws AuthzException

Specified by:

enforceValidate in interface Authorization

Throws:

AuthzException