 |
|
Contents |
|
|
|
Contents |
It delegates lexical analysis to a pluggable scanner and converts received tokens to a set of PolicyEntries. For details of policy format, see the default policy description.
For ordinary uses, this class has just one public method parse(), which performs the main task. Extensions of this parser may redefine specific operations separately, by overriding corresponding protected methods.
This implementation is effectively thread-safe, as it has no field references to data being processed (that is, passes all the data as method parameters).
Public Member Functions | |
| DefaultPolicyParser () | |
| Default constructor, DefaultPolicyScanner is used. | |
| DefaultPolicyParser (DefaultPolicyScanner s) | |
| Extension constructor for plugging-in custom scanner. | |
| Collection< PolicyEntry > | parse (URL location, Properties system) throws Exception |
| This is the main business method. | |
Protected Member Functions | |
| PolicyEntry | resolveGrant (DefaultPolicyScanner.GrantEntry ge, KeyStore ks, Properties system, boolean resolve) throws Exception |
| Translates GrantEntry token to PolicyEntry object. | |
| Permission | resolvePermission (DefaultPolicyScanner.PermissionEntry pe, DefaultPolicyScanner.GrantEntry ge, KeyStore ks, Properties system, boolean resolve) throws Exception |
| Translates PermissionEntry token to Permission object. | |
| Certificate[] | resolveSigners (KeyStore ks, String signers) throws Exception |
| Takes a comma-separated list of aliases and obtains corresponding certificates. | |
| Principal | getPrincipalByAlias (KeyStore ks, String alias) throws KeyStoreException, CertificateException |
| Returns a subject's X500Principal of an X509Certificate, which is associated with the specified keystore alias. | |
| KeyStore | initKeyStore (List< KeystoreEntry >keystores, URL base, Properties system, boolean resolve) |
| Returns the first successfully loaded KeyStore, from the specified list of possible locations. | |
Private Attributes | |
| final DefaultPolicyScanner | scanner |
Classes | |
| class | PermissionExpander |
| Specific handler for expanding self and alias protocols. More... | |
Default constructor, DefaultPolicyScanner is used.
Extension constructor for plugging-in custom scanner.
| Collection<PolicyEntry> parse | ( | URL | location, | |
| Properties | system | |||
| ) | throws Exception |
This is the main business method.
It manages loading process as follows: the associated scanner is used to parse the stream to a set of composite tokens, then this set is iterated and each token is translated to a PolicyEntry. Semantically invalid tokens are ignored, the same as void PolicyEntries.
A policy file may refer to some KeyStore(s), and in this case the first valid reference is initialized and used in processing tokens.
| location | an URL of a policy file to be loaded | |
| system | system properties, used for property expansion |
| Exception | IO error while reading location or file syntax error |
| PolicyEntry resolveGrant | ( | DefaultPolicyScanner.GrantEntry | ge, | |
| KeyStore | ks, | |||
| Properties | system, | |||
| boolean | resolve | |||
| ) | throws Exception [protected] |
Translates GrantEntry token to PolicyEntry object.
It goes step by step, trying to resolve each component of the GrantEntry:
codebase is specified, expand it and construct an URL. signers is specified, expand it and obtain corresponding Certificates. principals collection is specified, iterate over it. For each PrincipalEntry, expand name and if no class specified, resolve actual X500Principal from a KeyStore certificate; otherwise keep it as UnresolvedPrincipal. permissions collection. For each PermissionEntry, try to resolve (see method resolvePermission()) a corresponding permission. If resolution failed, ignore the PermissionEntry.
| ge | GrantEntry token to be resolved | |
| ks | KeyStore for resolving Certificates, may be null | |
| system | system properties, used for property expansion | |
| resolve | flag enabling/disabling property expansion |
| Exception | if unable to resolve codebase, signers or principals of the GrantEntry |
DefaultPolicyScanner.PermissionEntry
org.apache.harmony.security.PolicyUtils
| Permission resolvePermission | ( | DefaultPolicyScanner.PermissionEntry | pe, | |
| DefaultPolicyScanner.GrantEntry | ge, | |||
| KeyStore | ks, | |||
| Properties | system, | |||
| boolean | resolve | |||
| ) | throws Exception [protected] |
Translates PermissionEntry token to Permission object.
First, it performs general expansion for non-null name and properties expansion for non-null name, action and signers. Then, it obtains signing Certificates(if any), tries to find a class specified by klass name and instantiate a corresponding permission object. If class is not found or it is signed improperly, returns UnresolvedPermission.
| pe | PermissionEntry token to be resolved | |
| ge | parental GrantEntry of the PermissionEntry | |
| ks | KeyStore for resolving Certificates, may be null | |
| system | system properties, used for property expansion | |
| resolve | flag enabling/disabling property expansion |
| Exception | if failed to expand properties, or to get a Certificate, or to create an instance of a successfully found class |
| Certificate [] resolveSigners | ( | KeyStore | ks, | |
| String | signers | |||
| ) | throws Exception [protected] |
Takes a comma-separated list of aliases and obtains corresponding certificates.
| ks | KeyStore for resolving Certificates, may be null | |
| signers | comma-separated list of certificate aliases, must be not null |
| Exception | if KeyStore is null or if it failed to provide a certificate |
| Principal getPrincipalByAlias | ( | KeyStore | ks, | |
| String | alias | |||
| ) | throws KeyStoreException, CertificateException [protected] |
Returns a subject's X500Principal of an X509Certificate, which is associated with the specified keystore alias.
| ks | KeyStore for resolving Certificate, may be null | |
| alias | alias to a certificate |
| KeyStoreException | if KeyStore is null or if it failed to provide a certificate | |
| CertificateException | if found certificate is not an X509Certificate |
| KeyStore initKeyStore | ( | List< KeystoreEntry > | keystores, | |
| URL | base, | |||
| Properties | system, | |||
| boolean | resolve | |||
| ) | [protected] |
Returns the first successfully loaded KeyStore, from the specified list of possible locations.
This method iterates over the list of KeystoreEntries; for each entry expands url and type, tries to construct instances of specified URL and KeyStore and to load the keystore. If it is loaded, returns the keystore, otherwise proceeds to the next KeystoreEntry.
Note: an url may be relative to the policy file location or absolute.
| keystores | list of available KeystoreEntries | |
| base | the policy file location | |
| system | system properties, used for property expansion | |
| resolve | flag enabling/disabling property expansion |
null
final DefaultPolicyScanner scanner [private] |