Class AbacProvider

java.lang.Object

io.helidon.security.providers.abac.AbacProvider

All Implemented Interfaces:

AuthorizationProvider, SecurityProvider

public final class AbacProvider
extends Object
implements AuthorizationProvider

Attribute based access control (ABAC) provider. This provider gathers all attributes to be validated on endpoint and makes sure they are all validated as expected during authorization process. Each attribute to be validated must have a AbacValidator implemented.

See Also:

• builder()
• create(Config)

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	AbacProvider.Builder	A fluent API builder for AbacProvider.

Field Summary

Fields

Modifier and Type	Field	Description
static final TypeName	DENY_ALL_JAKARTA_TYPE	Type name for jakarta.annotation.security.DenyAll.
static final TypeName	DENY_ALL_JAVAX_TYPE	Type name for javax.annotation.security.DenyAll.
static final TypeName	PERMIT_ALL_JAKARTA_TYPE	Type name for jakarta.annotation.security.PermitAll.
static final TypeName	PERMIT_ALL_JAVAX_TYPE	Type name for javax.annotation.security.PermitAll.
static final TypeName	ROLES_ALLOWED_JAKARTA_TYPE	Type name for jakarta.annotation.security.RolesAllowed.
static final TypeName	ROLES_ALLOWED_JAVAX_TYPE	Type name for javax.annotation.security.RolesAllowed.

Method Summary

Modifier and Type	Method	Description
AuthorizationResponse	authorize(ProviderRequest providerRequest)	Authorize a request based on configuration.
static AbacProvider.Builder	builder()	Creates a fluent API builder to build new instances of this class.
static AbacProvider	create()	Creates a new provider instance with default configuration.
static AbacProvider	create(Config config)	Creates a new provider instance from configuration.
Collection<Class<? extends Annotation>>	supportedAnnotations()	Provide extension annotations supported by this provider (e.g.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface AuthorizationProvider

isUserInRole

Modifier and Type	Method	Description
default boolean	isUserInRole(Subject subject, String role)	Return true if current user is in the specified role.

Methods inherited from interface SecurityProvider

supportedAttributes, supportedConfigKeys, supportedCustomObjects

Modifier and Type	Method	Description
default Collection<String>	supportedAttributes()	A collection of attribute names expected by this provider to override endpoint configuration.
default Collection<String>	supportedConfigKeys()	Keys expected in configuration.
default Collection<Class<? extends ProviderConfig>>	supportedCustomObjects()	Class of the configuration type.

Field Details

ROLES_ALLOWED_JAKARTA_TYPE

public static final TypeName ROLES_ALLOWED_JAKARTA_TYPE

Type name for jakarta.annotation.security.RolesAllowed.

ROLES_ALLOWED_JAVAX_TYPE

public static final TypeName ROLES_ALLOWED_JAVAX_TYPE

Type name for javax.annotation.security.RolesAllowed.

PERMIT_ALL_JAKARTA_TYPE

public static final TypeName PERMIT_ALL_JAKARTA_TYPE

Type name for jakarta.annotation.security.PermitAll.

PERMIT_ALL_JAVAX_TYPE

public static final TypeName PERMIT_ALL_JAVAX_TYPE

Type name for javax.annotation.security.PermitAll.

DENY_ALL_JAKARTA_TYPE

public static final TypeName DENY_ALL_JAKARTA_TYPE

Type name for jakarta.annotation.security.DenyAll.

DENY_ALL_JAVAX_TYPE

public static final TypeName DENY_ALL_JAVAX_TYPE

Type name for javax.annotation.security.DenyAll.

Method Details

builder

public static AbacProvider.Builder builder()

Creates a fluent API builder to build new instances of this class.

Returns:

a new builder instance

create

public static AbacProvider create(Config config)

Creates a new provider instance from configuration.

Parameters:

config - configuration

Returns:

ABAC provider instantiated from config

create

public static AbacProvider create()

Creates a new provider instance with default configuration.

Returns:

ABAC provider

supportedAnnotations

public Collection<Class<? extends Annotation>> supportedAnnotations()

Description copied from interface: SecurityProvider

Provide extension annotations supported by this provider (e.g. jakarta.annotation.security.RolesAllowed). Annotations will be collected according to framework in use. For endpoint-style integrations, annotations from the application layer, endpoint class, and endpoint methods may all be collected.

Specified by:

supportedAnnotations in interface SecurityProvider

Returns:

Collection of annotations this provider expects.

authorize

public AuthorizationResponse authorize(ProviderRequest providerRequest)

Description copied from interface: AuthorizationProvider

Authorize a request based on configuration. Authorization cannot be optional. If this method is called, it should always attempt to authorize the current request. This method will be invoked for inbound requests ONLY.

Specified by:

authorize in interface AuthorizationProvider

Parameters:

providerRequest - context of this security enforcement/validation

Returns:

response that either permits, denies or abstains from decision

See Also:

• AuthorizationResponse.permit()