001/*
002 * CDDL HEADER START
003 *
004 * The contents of this file are subject to the terms of the
005 * Common Development and Distribution License, Version 1.0 only
006 * (the "License").  You may not use this file except in compliance
007 * with the License.
008 *
009 * You can obtain a copy of the license at legal-notices/CDDLv1_0.txt
010 * or http://forgerock.org/license/CDDLv1.0.html.
011 * See the License for the specific language governing permissions
012 * and limitations under the License.
013 *
014 * When distributing Covered Code, include this CDDL HEADER in each
015 * file and include the License file at legal-notices/CDDLv1_0.txt.
016 * If applicable, add the following below this CDDL HEADER, with the
017 * fields enclosed by brackets "[]" replaced with your own identifying
018 * information:
019 *      Portions Copyright [yyyy] [name of copyright owner]
020 *
021 * CDDL HEADER END
022 *
023 *
024 *      Copyright 2008 Sun Microsystems, Inc.
025 *      Portions Copyright 2014-2015 ForgeRock AS
026 */
027package org.opends.server.authorization.dseecompat;
028
029import org.opends.server.types.AttributeType;
030import org.forgerock.opendj.ldap.ByteString;
031import org.opends.server.types.Entry;
032import java.util.List;
033
034/**
035 * The AciTargetMatchContext interface provides a
036 * view of an AciContainer that exposes information to be
037 * used by the Aci.isApplicable() method to determine if
038 * an ACI is applicable (targets matched) to the LDAP operation,
039 * operation rights and entry and attributes having access
040 * checked on.
041 */
042public interface AciTargetMatchContext {
043
044    /**
045     * Set the deny ACI list.
046     * @param denyList The deny ACI list.
047     */
048    void setDenyList(List<Aci> denyList);
049
050    /**
051     * Set the allow ACI list.
052     * @param allowList The list of allow ACIs.
053     */
054    void setAllowList(List<Aci> allowList);
055
056    /**
057     * Get the entry being evaluated. This is known as the
058     * resource entry.
059     * @return The entry being evaluated.
060     */
061    Entry getResourceEntry();
062
063    /**
064     * Get the current attribute type being evaluated.
065     * @return  The attribute type being evaluated.
066     */
067    AttributeType getCurrentAttributeType();
068
069    /**
070     * The current attribute type value being evaluated.
071     * @return The current attribute type value being evaluated.
072     */
073    ByteString getCurrentAttributeValue();
074
075    /**
076     * True if the first attribute of the resource entry is being evaluated.
077     * @return True if this is the first attribute.
078     */
079    boolean isFirstAttribute();
080
081    /**
082     * Set to true if the first attribute of the resource entry is
083     * being evaluated.
084     * @param isFirst  True if this is the first attribute of the
085     * resource entry being evaluated.
086     */
087    void setIsFirstAttribute(boolean isFirst);
088
089    /**
090     * Set the attribute type to be evaluated.
091     * @param type  The attribute type to set to.
092     */
093    void setCurrentAttributeType(AttributeType type);
094
095    /**
096     * Set the attribute value to be evaluated.
097     * @param v The current attribute value to set to.
098     */
099    void setCurrentAttributeValue(ByteString v);
100
101    /**
102     * True if the target matching code found an entry test rule. An
103     * entry test rule is an ACI without a targetattr target rule.
104     * @param val True if an entry test rule was found.
105     */
106    void setEntryTestRule(boolean val);
107
108    /**
109     * True if an entry test rule was found.
110     * @return True if an entry test rule was found.
111     */
112    boolean hasEntryTestRule();
113
114    /**
115     * Return the rights for this container's LDAP operation.
116     * @return  The rights for the container's LDAP operation.
117     */
118    int getRights();
119
120    /**
121     * Return the OID (Object Identifier) string of the control being evaluated.
122     *
123     * @return The OID string of the control being evaluated.
124     */
125    String getControlOID();
126
127
128   /**
129    * Return The OID (Object Identifier) string of the extended operation being
130    *        evaluated.
131    *
132    * @return The OID string of the extended operation being evaluated.
133    */
134    String getExtOpOID();
135
136    /**
137     * Checks if the container's rights has the specified rights.
138     * @param  rights The rights to check for.
139     * @return True if the container's rights has the specified rights.
140     */
141    boolean hasRights(int rights);
142
143    /**
144     * Set the rights of the container to the specified rights.
145     * @param rights The rights to set the container's rights to.
146     */
147    void setRights(int rights);
148
149    /**
150     * Set to true  if the ACI had a targattrfilter rule that matched.
151     * @param v  The value to use.
152     */
153    void setTargAttrFiltersMatch(boolean v);
154
155    /**
156     * Return the value of the targAttrFiltersMatch variable. This is set to
157     * true if the ACI had a targattrfilter rule that matched.
158     * @return  True if the ACI had a targattrfilter rule that matched.
159     */
160    boolean getTargAttrFiltersMatch();
161
162    /**
163     * Add the specified ACI to a list of ACIs that have a targattrfilters rule
164     * that matched. This is used by geteffectiverights to determine the rights
165     * of an attribute that possibly might evaluate to true.
166     * @param aci The ACI to save.
167     */
168    void addTargAttrFiltersMatchAci(Aci aci);
169
170    /**
171     * Save the name of the last ACI that matched a targattrfilters rule. This
172     * is used by geteffectiverights evaluation.
173     * @param name The ACI's name to save.
174     */
175    void setTargAttrFiltersAciName(String name);
176
177    /**
178     * Returns true of a match context is performing a geteffectiverights
179     * evaluation.
180     * @return  True if a match context is evaluating geteffectiverights.
181     */
182    boolean isGetEffectiveRightsEval();
183
184  /**
185   * This method toggles a mask that indicates that access checking of
186   * individual user attributes may or may not be skipped depending
187   * on if there is a single ACI containing a targetattr all user
188   * attributes rule (targetattr="*").
189   *
190   * The only case where individual user attribute access checking
191   * can be skipped, is when a single ACI matched using a targetattr
192   * all user attributes rule and the attribute type being check is not
193   * operational.
194   *
195   * @param v  The mask to this value.
196   */
197  void setEvalUserAttributes(int v);
198
199  /**
200   * This method toggles a mask that indicates that access checking of
201   * individual operational attributes may or may not be skipped depending
202   * on if there is a single ACI containing a targetattr all operational
203   * attributes rule (targetattr="+").
204   *
205   * The only case where individual operational attribute access checking
206   * can be skipped, is when a single ACI matched using a targetattr
207   * all operational attributes rule and the attribute type being check is
208   * operational.
209   *
210   * @param v  The mask to this value.
211   */
212  void setEvalOpAttributes(int v);
213
214  /**
215   * Return true if the evaluating ACI either contained an explicitly defined
216   * user attribute type in a targeattr target rule or both a targetattr all
217   * user attributes rule matched and a explicitly defined targetattr target rule
218   * matched.
219   *
220   * @return  True if the above condition was seen.
221   */
222    boolean hasEvalUserAttributes();
223
224  /**
225   * Return true if the evaluating ACI either contained an explicitly defined
226   * operational attribute type in a targetattr target rule or both a targetattr
227   * all operational attributes rule matched and a explicitly defined targetattr
228   * target rule matched.
229   *
230   * @return  True if the above condition was seen.
231   */
232    boolean hasEvalOpAttributes();
233
234
235  /**
236   * Used to clear the mask used to detect if access checking needs to be
237   * performed on individual attributes types. The specified
238   * value is cleared from the mask or if the value equals 0 the mask is
239   * completely cleared.
240   *
241   * @param v  The flag to clear or 0 to set the mask to 0.
242   */
243    void clearEvalAttributes(int v);
244}
245
246