Package org.eclipse.jetty.security

Interface Constraint

public interface Constraint

A Security constraint that is applied to a request, which contain:

• A name
• Authorization to specify if authentication is needed and what roles are applicable
• An optional list of role names used for Constraint.Authorization.KNOWN_ROLE
• A Transport constraint, indicating if it must be secure or not.

The core constraint is not the same as the servlet specification AuthConstraint, but it is sufficiently capable to represent servlet constraints.

Nested Class Summary

Nested Classes

Modifier and Type	Interface	Description
static enum	Constraint.Authorization	The Authorization applied to any authentication of the request/
static class	Constraint.Builder	Builder for Constraint.
static enum	Constraint.Transport	The constraints requirement for the transport

Field Summary

Fields

Modifier and Type	Field	Description
static final Constraint	ALLOWED	A static Constraint that has Constraint.Authorization.ALLOWED and Constraint.Transport.INHERIT.
static final Constraint	ALLOWED_ANY_TRANSPORT	A static Constraint that has Constraint.Authorization.ALLOWED and Constraint.Transport.ANY.
static final Constraint	ANY_TRANSPORT	A static Constraint that has Constraint.Transport.ANY and Constraint.Authorization.INHERIT
static final Constraint	ANY_USER	A static Constraint that has Constraint.Authorization.ANY_USER and Constraint.Transport.INHERIT.
static final Constraint	FORBIDDEN	A static Constraint that has Constraint.Authorization.FORBIDDEN and Constraint.Transport.INHERIT.
static final Constraint	KNOWN_ROLE	A static Constraint that has Constraint.Authorization.KNOWN_ROLE and Constraint.Transport.INHERIT.
static final Constraint	SECURE_TRANSPORT	A static Constraint that has Constraint.Transport.SECURE and Constraint.Authorization.INHERIT

Method Summary

Modifier and Type	Method	Description
static Constraint	combine(String name, Constraint leastSpecific, Constraint mostSpecific)	Combine two Constraints by:
static Constraint	combine(Constraint leastSpecific, Constraint mostSpecific)	Combine two Constraints by using combine(String, Constraint, Constraint) with a generated name.
static Constraint	from(String... roles)
static Constraint	from(String name, Constraint.Authorization authorization, String... roles)
static Constraint	from(String name, Constraint.Transport transport)
static Constraint	from(String name, Constraint.Transport transport, Constraint.Authorization authorization, Set<String> roles)
static Constraint	from(Constraint.Transport transport, Constraint.Authorization authorization, Set<String> roles)
Constraint.Authorization	getAuthorization()
String	getName()
Set<String>	getRoles()
Constraint.Transport	getTransport()

Field Details

ALLOWED

static final Constraint ALLOWED

A static Constraint that has Constraint.Authorization.ALLOWED and Constraint.Transport.INHERIT.

FORBIDDEN

static final Constraint FORBIDDEN

A static Constraint that has Constraint.Authorization.FORBIDDEN and Constraint.Transport.INHERIT.

ANY_USER

static final Constraint ANY_USER

A static Constraint that has Constraint.Authorization.ANY_USER and Constraint.Transport.INHERIT.

KNOWN_ROLE

static final Constraint KNOWN_ROLE

A static Constraint that has Constraint.Authorization.KNOWN_ROLE and Constraint.Transport.INHERIT.

SECURE_TRANSPORT

static final Constraint SECURE_TRANSPORT

A static Constraint that has Constraint.Transport.SECURE and Constraint.Authorization.INHERIT

ANY_TRANSPORT

static final Constraint ANY_TRANSPORT

A static Constraint that has Constraint.Transport.ANY and Constraint.Authorization.INHERIT

ALLOWED_ANY_TRANSPORT

static final Constraint ALLOWED_ANY_TRANSPORT

A static Constraint that has Constraint.Authorization.ALLOWED and Constraint.Transport.ANY.

Method Details

getName

String getName()

Returns:

The name for the Constraint or "unnamed@hashcode" if not named

getTransport

Constraint.Transport getTransport()

Returns:

The required Constraint.Transport or null if the transport can be either.

getAuthorization

Constraint.Authorization getAuthorization()

Returns:

The Constraint.Authorization criteria applied by this Constraint or null if this constraint does not have any authorization requirements.

getRoles

Set<String> getRoles()

Returns:

The set of roles applied by this Constraint or the empty set.

combine

static Constraint combine(Constraint leastSpecific,
 Constraint mostSpecific)

Combine two Constraints by using combine(String, Constraint, Constraint) with a generated name.

Parameters:

leastSpecific - Constraint to combine

mostSpecific - Constraint to combine

Returns:

the combined constraint.

See Also:

• combine(String, Constraint, Constraint)

combine

static Constraint combine(String name,
 Constraint leastSpecific,
 Constraint mostSpecific)

Combine two Constraints by:

• if both constraints are Null, then ALLOWED is returned.
• if either constraint is Null the other is returned.
• only if the mostSpecific constraint has Constraint.Authorization.INHERIT is the leastSpecific constraint's Constraint.Authorization used, otherwise the mostSpecific's is used.
• if the combined constraint has Constraint.Authorization.SPECIFIC_ROLE, then the role set from the constraint that specified the Constraint.Authorization.SPECIFIC_ROLE is used.
• only if the mostSpecific constraint has Constraint.Transport.INHERIT is the leastSpecific constraint's Constraint.Transport used, otherwise the mostSpecific's is used.

Typically the path of the constraint is used to determine which constraint is most specific. For example if the following paths mapped to Constraints as:

     /*         -> Authorization.FORBIDDEN,roles=[],Transport.SECURE
     /admin/*   -> Authorization.SPECIFIC_ROLE,roles=["admin"],Transport.INHERIT
 

The the /admin/* constraint would be consider most specific and a request to /admin/file would have Constraint.Authorization.SPECIFIC_ROLE from the /admin/* constraint and Constraint.Transport.SECURE inherited from the /* constraint. For more examples see SecurityHandler.PathMapped.

Note that this combination is not equivalent to the combination done by the EE servlet specification.

Parameters:

name - The name to use for the combined constraint

leastSpecific - Constraint to combine

mostSpecific - Constraint to combine

Returns:

the combined constraint.

from

static Constraint from(String... roles)

from

static Constraint from(String name,
 Constraint.Transport transport)

from

static Constraint from(String name,
 Constraint.Authorization authorization,
 String... roles)

from

static Constraint from(Constraint.Transport transport,
 Constraint.Authorization authorization,
 Set<String> roles)

from

static Constraint from(String name,
 Constraint.Transport transport,
 Constraint.Authorization authorization,
 Set<String> roles)