org.jboss.as.controller.access.rbac

Interface RoleMapper

All Known Implementing Classes:

RunAsRoleMapper, StandardRoleMapper, SuperUserRoleMapper

public interface RoleMapper

Determines the set of roles applicable for a management request.

Author:

Brian Stansberry (c) 2013 Red Hat Inc.

Method Summary

Methods

Modifier and Type	Method and Description
boolean	canRunAs(Set<String> mappedRoles, String runAsRole) Gets whether the given set of mapped roles provides a caller with the privilege to run as the given "runAsRole".
Set<String>	mapRoles(Caller caller, Environment callEnvironment, Action action, TargetAttribute attribute) Determine the roles available for the caller for a management operation affecting an individual attribute.
Set<String>	mapRoles(Caller caller, Environment callEnvironment, Action action, TargetResource resource) Determine the roles available for the caller for a management operation affecting an entire resource.
Set<String>	mapRoles(Caller caller, Environment callEnvironment, Set<String> operationHeaderRoles) Determine the roles available for the caller without reference to a particular action or target.

Method Detail

mapRoles

Set<String> mapRoles(Caller caller,
                   Environment callEnvironment,
                   Action action,
                   TargetAttribute attribute)

Determine the roles available for the caller for a management operation affecting an individual attribute.

Parameters:

caller - the caller. Cannot be null

callEnvironment - the call environment. Cannot be null

action - the action being authorized. Cannot be null

attribute - the target of the action. Cannot be null

Returns:

the roles. Will not be null, but may be an empty set

mapRoles

Set<String> mapRoles(Caller caller,
                   Environment callEnvironment,
                   Action action,
                   TargetResource resource)

Determine the roles available for the caller for a management operation affecting an entire resource.

Parameters:

caller - the caller. Cannot be null

callEnvironment - the call environment. Cannot be null

action - the action being authorized. Cannot be null

resource - the target of the action. Cannot be null

Returns:

the roles. Will not be null, but may be an empty set

mapRoles

Set<String> mapRoles(Caller caller,
                   Environment callEnvironment,
                   Set<String> operationHeaderRoles)

Determine the roles available for the caller without reference to a particular action or target. Note that actually mapping a caller to roles without reference to a particular action or target is not required.

Parameters:

caller - the caller. Cannot be null

callEnvironment - the call environment. Cannot be null

operationHeaderRoles - any roles specified as headers in the operation. May be null

Returns:

the roles. Will not be null, but may be an empty set

canRunAs

boolean canRunAs(Set<String> mappedRoles,
               String runAsRole)

Gets whether the given set of mapped roles provides a caller with the privilege to run as the given "runAsRole".

Parameters:

mappedRoles - a set of roles obtained from a call to one of this mapper's mapRoles methods

runAsRole - the role the caller wishes to run as

Returns:

true if running as runAsRole is allowed