co.cask.cdap.security.spi.authorization

Interface AuthorizationEnforcer

All Known Subinterfaces:

Authorizer

All Known Implementing Classes:

AbstractAuthorizer, NoOpAuthorizer

@Beta
public interface AuthorizationEnforcer

Enforces authorization for a Principal to perform an Action on an EntityId.

Method Summary

Methods

Modifier and Type	Method and Description
Predicate<EntityId>	createFilter(Principal principal) Returns a Predicate that can be used to filter a set of entities to only return the entities that the specified Principal has access (READ/WRITE/ADMIN/ALL) to.
void	enforce(EntityId entity, Principal principal, Action action) Enforces authorization for the specified Principal for the specified Action on the specified EntityId.
void	enforce(EntityId entity, Principal principal, Set<Action> actions) Enforces authorization for the specified Principal for the specified actions on the specified EntityId.

Method Detail

enforce

void enforce(EntityId entity,
           Principal principal,
           Action action)
             throws Exception

Enforces authorization for the specified Principal for the specified Action on the specified EntityId.

Parameters:

entity - the EntityId on which authorization is to be enforced

principal - the Principal that performs the action

action - the Action being performed

Throws:

UnauthorizedException - if the principal is not authorized to perform the specified action on the entity

Exception - if any other errors occurred while performing the authorization enforcement check

enforce

void enforce(EntityId entity,
           Principal principal,
           Set<Action> actions)
             throws Exception

Enforces authorization for the specified Principal for the specified actions on the specified EntityId.

Parameters:

entity - the EntityId on which authorization is to be enforced

principal - the Principal that performs the actions

actions - the actions being performed

Throws:

UnauthorizedException - if the principal is not authorized to perform the specified actions on the entity

Exception - if any other errors occurred while performing the authorization enforcement check

createFilter

Predicate<EntityId> createFilter(Principal principal)
                                 throws Exception

Returns a Predicate that can be used to filter a set of entities to only return the entities that the specified Principal has access (READ/WRITE/ADMIN/ALL) to.

Parameters:

principal - the Principal for which to filter

Returns:

a set of entities that the specified user has access to

Throws:

Exception