Interface AuthorizationProvider

All Superinterfaces:

SecurityProvider

All Known Implementing Classes:

AbacProvider

Functional Interface:

This is a functional interface and can therefore be used as the assignment target for a lambda expression or method reference.

@FunctionalInterface
public interface AuthorizationProvider
extends SecurityProvider

Authorization security provider. Validates the request and decides whether it should continue processing.

See Also:

• SecurityProvider.supportedAnnotations()
• SecurityProvider.supportedCustomObjects()
• SecurityProvider.supportedConfigKeys()

Method Summary

Modifier and Type	Method	Description
AuthorizationResponse	authorize(ProviderRequest context)	Authorize a request based on configuration.
default boolean	isUserInRole(Subject subject, String role)	Return true if current user is in the specified role.

Methods inherited from interface SecurityProvider

supportedAnnotations, supportedAttributes, supportedConfigKeys, supportedCustomObjects

Modifier and Type	Method	Description
default Collection<Class<? extends Annotation>>	supportedAnnotations()	Provide extension annotations supported by this provider (e.g.
default Collection<String>	supportedAttributes()	A collection of attribute names expected by this provider to override endpoint configuration.
default Collection<String>	supportedConfigKeys()	Keys expected in configuration.
default Collection<Class<? extends ProviderConfig>>	supportedCustomObjects()	Class of the configuration type.

Method Details

authorize

AuthorizationResponse authorize(ProviderRequest context)

Authorize a request based on configuration. Authorization cannot be optional. If this method is called, it should always attempt to authorize the current request. This method will be invoked for inbound requests ONLY.

Parameters:

context - context of this security enforcement/validation

Returns:

response that either permits, denies or abstains from decision

See Also:

• AuthorizationResponse.permit()

isUserInRole

default boolean isUserInRole(Subject subject,
 String role)

Return true if current user is in the specified role. Only providers that support role based access should implement this method. For others it checks the subject for the presence of Role grant of the specified name. This method is defined to conform with one of the most commonly used authorization concepts, as it is required for frameworks such as Servlet and HTTP endpoint integrations.

Parameters:

subject - current subject

role - role name

Returns:

true if current user is in this role