Interface AccessControlProvider

  • All Known Implementing Classes:
    AbstractAccessControlProvider, ACLProvider, ACLProvider, CombinedProvider, UserAccessControlProvider

    public interface AccessControlProvider
    The AccessControlProvider is used to provide access control policy and entry objects that apply to an item in a single workspace. The provider is bound to a system session in contrast to the AccessControlManager that is bound to a specific session/subject.

    Please note following additional special conditions:

    • The detection of access control policy/entries is an implementation detail. They may be resource based or retrieved by other means.
    • An access control policy/entry may be inherited across the item hierarchy. The details are left to the implementation
    • If no policy can be determined for a particular Item the implementation must return some implementation specific default policy.
    • Transient (NEW) items created within a regular Session object are unknown to and cannot be handled by the AccessControlProvider.
    • If the item id passed to the corresponding calls doesn't point to an existing item, ItemNotFoundException will be thrown. It is therefore recommended to evaluate the id of the closest not-new ancestor node before calling any methods on the provider.
    • Changes to access control policy and entries made through the AccessControlEditor are not effective unless they are persisted by calling Session.save() on the session that has been used to obtain the editor.
    See Also:
    AccessControlProviderFactory
    • Method Detail

      • close

        void close()
        Closes this provider when it is no longer used by the respective workspace and release resources bound by this provider.
      • isLive

        boolean isLive()
        Returns true, if this provider is still alive and able to evaluate permissions; false otherwise.
        Returns:
        true, if this provider is still alive and able to evaluate permissions; false otherwise.
      • getEditor

        AccessControlEditor getEditor​(Session session)
                               throws RepositoryException
        Returns an AccessControlEditor for the given Session object or null if the implementation does not support editing of access control policies.
        Parameters:
        session - The editing session.
        Returns:
        the ACL editor or null.
        Throws:
        RepositoryException - If an error occurs.
      • compilePermissions

        CompiledPermissions compilePermissions​(Set<Principal> principals)
                                        throws RepositoryException
        Compiles the effective policy for the specified set of Principals.
        Parameters:
        principals - Set of principals to compile the permissions for. If the order of evaluating permissions for principals is meaningful, the caller should pass a Set that respects the order of insertion.
        Returns:
        The effective, compiled CompiledPolicy that applies for the specified set of principals.
        Throws:
        RepositoryException - If an error occurs.
      • canAccessRoot

        boolean canAccessRoot​(Set<Principal> principals)
                       throws RepositoryException
        Returns true if the given set of principals can access the root node of the workspace this provider has been built for; false otherwise.
        Parameters:
        principals - Set of principals to be tested for being allowed to access the root node.
        Returns:
        true if the given set of principals can access the root node of the workspace this provider has been built for; false otherwise.
        Throws:
        RepositoryException - If an error occurs.