Class UserAdminPermission
- All Implemented Interfaces:
Serializable
,Guard
Role
objects managed by a User
Admin service.
This class represents access to the Role
objects managed by a User
Admin service and their properties and credentials (in the case of
User
objects).
The permission name is the name (or name prefix) of a property or credential. The naming convention follows the hierarchical property naming convention. Also, an asterisk may appear at the end of the name, following a ".", or by itself, to signify a wildcard match. For example: "org.osgi.security.protocol.*" or "*" is valid, but "*protocol" or "a*b" are not valid.
The UserAdminPermission
with the reserved name "admin"
represents the permission required for creating and removing Role
objects in the User Admin service, as well as adding and removing members in
a Group
object. This UserAdminPermission
does not have any
actions associated with it.
The actions to be granted are passed to the constructor in a string
containing a list of one or more comma-separated keywords. The possible
keywords are: changeProperty
,changeCredential
, and
getCredential
. Their meaning is defined as follows:
action changeProperty Permission to change (i.e., add and remove) Role object properties whose names start with the name argument specified in the constructor. changeCredential Permission to change (i.e., add and remove) User object credentials whose names start with the name argument specified in the constructor. getCredential Permission to retrieve and check for the existence of User object credentials whose names start with the name argument specified in the constructor.The action string is converted to lowercase before processing.
Following is a PermissionInfo style policy entry which grants a user
administration bundle a number of UserAdminPermission
object:
(org.osgi.service.useradmin.UserAdminPermission "admin") (org.osgi.service.useradmin.UserAdminPermission "com.foo.*" "changeProperty,getCredential,changeCredential") (org.osgi.service.useradmin.UserAdminPermission "user.*" "changeProperty,changeCredential")The first permission statement grants the bundle the permission to perform any User Admin service operations of type "admin", that is, create and remove roles and configure
Group
objects.
The second permission statement grants the bundle the permission to change
any properties as well as get and change any credentials whose names start
with com.foo.
.
The third permission statement grants the bundle the permission to change any
properties and credentials whose names start with user.
. This means
that the bundle is allowed to change, but not retrieve any credentials with
the given prefix.
The following policy entry empowers the Http Service bundle to perform user authentication:
grant codeBase "${jars}http.jar" { permission org.osgi.service.useradmin.UserAdminPermission "user.password", "getCredential"; };
The permission statement grants the Http Service bundle the permission to validate any password credentials (for authentication purposes), but the bundle is not allowed to change any properties or credentials.
- See Also:
-
Field Summary
FieldsModifier and TypeFieldDescriptionprivate static final int
All actionsprivate static final int
private static final int
private static final int
private int
The actions mask.(package private) static final int
No actions.private String
The actions in canonical form.static final String
The permission name "admin".static final String
The action string "changeCredential".static final String
The action string "changeProperty".static final String
The action string "getCredential".(package private) static final long
-
Constructor Summary
ConstructorsConstructorDescriptionUserAdminPermission
(String name, int mask) Package private constructor used byUserAdminPermissionCollection
.UserAdminPermission
(String name, String actions) Creates a newUserAdminPermission
with the specified name and actions. -
Method Summary
Modifier and TypeMethodDescriptionboolean
Checks twoUserAdminPermission
objects for equality.Returns the canonical string representation of the actions, separated by comma.(package private) int
Returns the current action mask.int
hashCode()
Returns the hash code value for this object.boolean
Checks if thisUserAdminPermission
object "implies" the specified permission.private static boolean
match_change
(char[] a, int i) private static boolean
match_credential
(char[] a, int i) private static boolean
match_get
(char[] a, int i) private static boolean
match_property
(char[] a, int i) Returns a newPermissionCollection
object for storingUserAdminPermission
objects.private static int
parseActions
(String actions) Parse action string into action mask.private void
private void
setTransients
(int mask) Called by constructors and when deserialized.toString()
Returns a string describing thisUserAdminPermission
object.private void
writeObject is called to save the state of this object to a stream.Methods inherited from class java.security.Permission
checkGuard, getName
-
Field Details
-
serialVersionUID
static final long serialVersionUID- See Also:
-
ADMIN
The permission name "admin".- See Also:
-
CHANGE_PROPERTY
The action string "changeProperty".- See Also:
-
ACTION_CHANGE_PROPERTY
private static final int ACTION_CHANGE_PROPERTY- See Also:
-
CHANGE_CREDENTIAL
The action string "changeCredential".- See Also:
-
ACTION_CHANGE_CREDENTIAL
private static final int ACTION_CHANGE_CREDENTIAL- See Also:
-
GET_CREDENTIAL
The action string "getCredential".- See Also:
-
ACTION_GET_CREDENTIAL
private static final int ACTION_GET_CREDENTIAL- See Also:
-
ACTION_ALL
private static final int ACTION_ALLAll actions- See Also:
-
ACTION_NONE
static final int ACTION_NONENo actions.- See Also:
-
actions
The actions in canonical form. -
action_mask
private transient int action_maskThe actions mask.
-
-
Constructor Details
-
UserAdminPermission
Creates a newUserAdminPermission
with the specified name and actions.name
is either the reserved string "admin" or the name of a credential or property, andactions
contains a comma-separated list of the actions granted on the specified name. Valid actions arechangeProperty
,changeCredential
, and getCredential.- Parameters:
name
- the name of thisUserAdminPermission
actions
- the action string.- Throws:
IllegalArgumentException
- Ifname
equals "admin" andactions
are specified.
-
UserAdminPermission
UserAdminPermission(String name, int mask) Package private constructor used byUserAdminPermissionCollection
.- Parameters:
name
- class namemask
- action mask
-
-
Method Details
-
setTransients
private void setTransients(int mask) Called by constructors and when deserialized.- Parameters:
mask
- action mask
-
getActionsMask
int getActionsMask()Returns the current action mask.Used by the UserAdminPermissionCollection class.
- Returns:
- Current action mask.
-
parseActions
Parse action string into action mask.- Parameters:
actions
- Action string.- Returns:
- action mask.
-
match_change
private static boolean match_change(char[] a, int i) -
match_get
private static boolean match_get(char[] a, int i) -
match_property
private static boolean match_property(char[] a, int i) -
match_credential
private static boolean match_credential(char[] a, int i) -
implies
Checks if thisUserAdminPermission
object "implies" the specified permission.More specifically, this method returns
true
if:- p is an instanceof
UserAdminPermission
, - p's actions are a proper subset of this object's actions, and
- p's name is implied by this object's name. For example, "java.*" implies "java.home".
- Overrides:
implies
in classBasicPermission
- Parameters:
p
- the permission to check against.- Returns:
true
if the specified permission is implied by this object;false
otherwise.
- p is an instanceof
-
getActions
Returns the canonical string representation of the actions, separated by comma.- Overrides:
getActions
in classBasicPermission
- Returns:
- the canonical string representation of the actions.
-
newPermissionCollection
Returns a newPermissionCollection
object for storingUserAdminPermission
objects.- Overrides:
newPermissionCollection
in classBasicPermission
- Returns:
- a new
PermissionCollection
object suitable for storingUserAdminPermission
objects.
-
equals
Checks twoUserAdminPermission
objects for equality. Checks thatobj
is aUserAdminPermission
, and has the same name and actions as this object.- Overrides:
equals
in classBasicPermission
- Parameters:
obj
- the object to be compared for equality with this object.- Returns:
true
ifobj
is aUserAdminPermission
object, and has the same name and actions as thisUserAdminPermission
object.
-
hashCode
public int hashCode()Returns the hash code value for this object.- Overrides:
hashCode
in classBasicPermission
- Returns:
- A hash code value for this object.
-
writeObject
writeObject is called to save the state of this object to a stream. The actions are serialized, and the superclass takes care of the name.- Throws:
IOException
-
readObject
- Throws:
IOException
ClassNotFoundException
-
toString
Returns a string describing thisUserAdminPermission
object. This string must be inPermissionInfo
encoded format.- Overrides:
toString
in classPermission
- Returns:
- The
PermissionInfo
encoded string for thisUserAdminPermission
object. - See Also:
-