001/* 002 * CDDL HEADER START 003 * 004 * The contents of this file are subject to the terms of the 005 * Common Development and Distribution License, Version 1.0 only 006 * (the "License"). You may not use this file except in compliance 007 * with the License. 008 * 009 * You can obtain a copy of the license at legal-notices/CDDLv1_0.txt 010 * or http://forgerock.org/license/CDDLv1.0.html. 011 * See the License for the specific language governing permissions 012 * and limitations under the License. 013 * 014 * When distributing Covered Code, include this CDDL HEADER in each 015 * file and include the License file at legal-notices/CDDLv1_0.txt. 016 * If applicable, add the following below this CDDL HEADER, with the 017 * fields enclosed by brackets "[]" replaced with your own identifying 018 * information: 019 * Portions Copyright [yyyy] [name of copyright owner] 020 * 021 * CDDL HEADER END 022 * 023 * 024 * Copyright 2008 Sun Microsystems, Inc. 025 * Portions Copyright 2014-2015 ForgeRock AS 026 */ 027package org.opends.server.authorization.dseecompat; 028 029import org.opends.server.types.AttributeType; 030import org.forgerock.opendj.ldap.ByteString; 031import org.opends.server.types.Entry; 032import java.util.List; 033 034/** 035 * The AciTargetMatchContext interface provides a 036 * view of an AciContainer that exposes information to be 037 * used by the Aci.isApplicable() method to determine if 038 * an ACI is applicable (targets matched) to the LDAP operation, 039 * operation rights and entry and attributes having access 040 * checked on. 041 */ 042public interface AciTargetMatchContext { 043 044 /** 045 * Set the deny ACI list. 046 * @param denyList The deny ACI list. 047 */ 048 void setDenyList(List<Aci> denyList); 049 050 /** 051 * Set the allow ACI list. 052 * @param allowList The list of allow ACIs. 053 */ 054 void setAllowList(List<Aci> allowList); 055 056 /** 057 * Get the entry being evaluated. This is known as the 058 * resource entry. 059 * @return The entry being evaluated. 060 */ 061 Entry getResourceEntry(); 062 063 /** 064 * Get the current attribute type being evaluated. 065 * @return The attribute type being evaluated. 066 */ 067 AttributeType getCurrentAttributeType(); 068 069 /** 070 * The current attribute type value being evaluated. 071 * @return The current attribute type value being evaluated. 072 */ 073 ByteString getCurrentAttributeValue(); 074 075 /** 076 * True if the first attribute of the resource entry is being evaluated. 077 * @return True if this is the first attribute. 078 */ 079 boolean isFirstAttribute(); 080 081 /** 082 * Set to true if the first attribute of the resource entry is 083 * being evaluated. 084 * @param isFirst True if this is the first attribute of the 085 * resource entry being evaluated. 086 */ 087 void setIsFirstAttribute(boolean isFirst); 088 089 /** 090 * Set the attribute type to be evaluated. 091 * @param type The attribute type to set to. 092 */ 093 void setCurrentAttributeType(AttributeType type); 094 095 /** 096 * Set the attribute value to be evaluated. 097 * @param v The current attribute value to set to. 098 */ 099 void setCurrentAttributeValue(ByteString v); 100 101 /** 102 * True if the target matching code found an entry test rule. An 103 * entry test rule is an ACI without a targetattr target rule. 104 * @param val True if an entry test rule was found. 105 */ 106 void setEntryTestRule(boolean val); 107 108 /** 109 * True if an entry test rule was found. 110 * @return True if an entry test rule was found. 111 */ 112 boolean hasEntryTestRule(); 113 114 /** 115 * Return the rights for this container's LDAP operation. 116 * @return The rights for the container's LDAP operation. 117 */ 118 int getRights(); 119 120 /** 121 * Return the OID (Object Identifier) string of the control being evaluated. 122 * 123 * @return The OID string of the control being evaluated. 124 */ 125 String getControlOID(); 126 127 128 /** 129 * Return The OID (Object Identifier) string of the extended operation being 130 * evaluated. 131 * 132 * @return The OID string of the extended operation being evaluated. 133 */ 134 String getExtOpOID(); 135 136 /** 137 * Checks if the container's rights has the specified rights. 138 * @param rights The rights to check for. 139 * @return True if the container's rights has the specified rights. 140 */ 141 boolean hasRights(int rights); 142 143 /** 144 * Set the rights of the container to the specified rights. 145 * @param rights The rights to set the container's rights to. 146 */ 147 void setRights(int rights); 148 149 /** 150 * Set to true if the ACI had a targattrfilter rule that matched. 151 * @param v The value to use. 152 */ 153 void setTargAttrFiltersMatch(boolean v); 154 155 /** 156 * Return the value of the targAttrFiltersMatch variable. This is set to 157 * true if the ACI had a targattrfilter rule that matched. 158 * @return True if the ACI had a targattrfilter rule that matched. 159 */ 160 boolean getTargAttrFiltersMatch(); 161 162 /** 163 * Add the specified ACI to a list of ACIs that have a targattrfilters rule 164 * that matched. This is used by geteffectiverights to determine the rights 165 * of an attribute that possibly might evaluate to true. 166 * @param aci The ACI to save. 167 */ 168 void addTargAttrFiltersMatchAci(Aci aci); 169 170 /** 171 * Save the name of the last ACI that matched a targattrfilters rule. This 172 * is used by geteffectiverights evaluation. 173 * @param name The ACI's name to save. 174 */ 175 void setTargAttrFiltersAciName(String name); 176 177 /** 178 * Returns true of a match context is performing a geteffectiverights 179 * evaluation. 180 * @return True if a match context is evaluating geteffectiverights. 181 */ 182 boolean isGetEffectiveRightsEval(); 183 184 /** 185 * This method toggles a mask that indicates that access checking of 186 * individual user attributes may or may not be skipped depending 187 * on if there is a single ACI containing a targetattr all user 188 * attributes rule (targetattr="*"). 189 * 190 * The only case where individual user attribute access checking 191 * can be skipped, is when a single ACI matched using a targetattr 192 * all user attributes rule and the attribute type being check is not 193 * operational. 194 * 195 * @param v The mask to this value. 196 */ 197 void setEvalUserAttributes(int v); 198 199 /** 200 * This method toggles a mask that indicates that access checking of 201 * individual operational attributes may or may not be skipped depending 202 * on if there is a single ACI containing a targetattr all operational 203 * attributes rule (targetattr="+"). 204 * 205 * The only case where individual operational attribute access checking 206 * can be skipped, is when a single ACI matched using a targetattr 207 * all operational attributes rule and the attribute type being check is 208 * operational. 209 * 210 * @param v The mask to this value. 211 */ 212 void setEvalOpAttributes(int v); 213 214 /** 215 * Return true if the evaluating ACI either contained an explicitly defined 216 * user attribute type in a targeattr target rule or both a targetattr all 217 * user attributes rule matched and a explicitly defined targetattr target rule 218 * matched. 219 * 220 * @return True if the above condition was seen. 221 */ 222 boolean hasEvalUserAttributes(); 223 224 /** 225 * Return true if the evaluating ACI either contained an explicitly defined 226 * operational attribute type in a targetattr target rule or both a targetattr 227 * all operational attributes rule matched and a explicitly defined targetattr 228 * target rule matched. 229 * 230 * @return True if the above condition was seen. 231 */ 232 boolean hasEvalOpAttributes(); 233 234 235 /** 236 * Used to clear the mask used to detect if access checking needs to be 237 * performed on individual attributes types. The specified 238 * value is cleared from the mask or if the value equals 0 the mask is 239 * completely cleared. 240 * 241 * @param v The flag to clear or 0 to set the mask to 0. 242 */ 243 void clearEvalAttributes(int v); 244} 245 246