hudson.security

Class SidACL

java.lang.Object

hudson.security.ACL

hudson.security.SidACL

Direct Known Subclasses:

SparseACL

public abstract class SidACL
extends ACL

ACL that checks permissions based on GrantedAuthority of the Authentication.

Author:

Kohsuke Kawaguchi

Field Summary

Fields inherited from class hudson.security.ACL

ANONYMOUS, ANONYMOUS_USERNAME, AUTOMATIC_SIDS, EVERYONE, SYSTEM, SYSTEM_USERNAME, SYSTEM2

Constructor Summary

Constructors

Constructor and Description
SidACL()

Method Summary

Modifier and Type	Method and Description
protected Boolean	_hasPermission(org.springframework.security.core.Authentication a, Permission permission) Implementation that backs up hasPermission2(Authentication, Permission).
protected abstract Boolean	hasPermission(Sid p, Permission permission) Checks if the given Sid has the given Permission.
boolean	hasPermission2(org.springframework.security.core.Authentication a, Permission permission) Checks if the given principle has the given permission.
SidACL	newInheritingACL(SidACL parent) Creates a new SidACL that first consults 'this' SidACL and then delegate to the given parent SidACL.
protected String	toString(Sid p)

Methods inherited from class hudson.security.ACL

as, as, as2, checkAnyPermission, checkCreatePermission, checkCreatePermission, checkPermission, hasAnyPermission, hasCreatePermission, hasCreatePermission, hasCreatePermission2, hasCreatePermission2, hasPermission, hasPermission, impersonate, impersonate, impersonate, impersonate2, impersonate2, impersonate2, isAnonymous, isAnonymous2, lambda, lambda2

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SidACL

public SidACL()

Method Detail

hasPermission2

public boolean hasPermission2(@NonNull
                              org.springframework.security.core.Authentication a,
                              Permission permission)

Description copied from class: ACL

Checks if the given principle has the given permission.

Note that ACL.SYSTEM2 can be passed in as the authentication parameter, in which case you should probably just assume it has every permission.

Overrides:

hasPermission2 in class ACL

_hasPermission

protected Boolean _hasPermission(@NonNull
                                 org.springframework.security.core.Authentication a,
                                 Permission permission)

Implementation that backs up hasPermission2(Authentication, Permission).

Returns:

true or false if hasPermission(Sid, Permission) returns it. Otherwise null, indicating that this ACL doesn't have any entry for it.

hasPermission

protected abstract Boolean hasPermission(Sid p,
                                         Permission permission)

Checks if the given Sid has the given Permission.

hasPermission2(Authentication, Permission) is implemented by checking authentication's GrantedAuthority by using this method.

It is the implementor's responsibility to recognize Permission.impliedBy and take that into account.

Returns:

true if the access should be granted, false if it should be denied. The null value indicates that the ACL does no rule for this Sid/Permission combination. The caller can decide what to do—such as consulting the higher level ACL, or denying the access (if the model is no-access-by-default.)

toString

protected String toString(Sid p)

newInheritingACL

public final SidACL newInheritingACL(SidACL parent)

Creates a new SidACL that first consults 'this' SidACL and then delegate to the given parent SidACL. By doing this at the SidACL level and not at the ACL level, this allows the child ACLs to have an explicit deny entry. Note that the combined ACL calls hasPermission(Sid,Permission) in the child and parent SidACLs directly, so if these override _hasPermission then this custom behavior will not be applied.