| | |
| | | * |
| | | * |
| | | * Copyright 2008-2010 Sun Microsystems, Inc. |
| | | * Portions Copyright 2013 ForgeRock AS |
| | | */ |
| | | |
| | | package org.opends.server.authorization.dseecompat; |
| | | import org.opends.messages.Message; |
| | | |
| | | import static org.opends.messages.AccessControlMessages.*; |
| | | import static org.opends.server.authorization.dseecompat.Aci.*; |
| | | |
| | | import java.util.regex.Matcher; |
| | | import java.util.regex.Pattern; |
| | | |
| | | import org.opends.messages.Message; |
| | | import org.opends.server.types.AttributeType; |
| | | import org.opends.server.types.DN; |
| | | import org.opends.server.types.SearchScope; |
| | | import java.util.regex.Matcher; |
| | | import java.util.regex.Pattern; |
| | | |
| | | /** |
| | | * This class represents target part of an ACI's syntax. This is the part |
| | |
| | | */ |
| | | public class AciTargets { |
| | | |
| | | /* |
| | | /** |
| | | * ACI syntax has a target keyword. |
| | | */ |
| | | private Target target = null ; |
| | | |
| | | /* |
| | | /** |
| | | * ACI syntax has a targetscope keyword. |
| | | */ |
| | | private SearchScope targetScope = SearchScope.WHOLE_SUBTREE; |
| | | |
| | | /* |
| | | /** |
| | | * ACI syntax has a targetattr keyword. |
| | | */ |
| | | private TargetAttr targetAttr = null ; |
| | | |
| | | /* |
| | | /** |
| | | * ACI syntax has a targetfilter keyword. |
| | | */ |
| | | private TargetFilter targetFilter=null; |
| | | |
| | | /* |
| | | /** |
| | | * ACI syntax has a targattrtfilters keyword. |
| | | */ |
| | | private TargAttrFilters targAttrFilters=null; |
| | |
| | | */ |
| | | private ExtOp extOp=null; |
| | | |
| | | /* |
| | | /** |
| | | * The number of regular expression group positions in a valid ACI target |
| | | * expression. |
| | | */ |
| | | private static final int targetElementCount = 3; |
| | | |
| | | /* |
| | | /** |
| | | * Regular expression group position of a target keyword. |
| | | */ |
| | | private static final int targetKeywordPos = 1; |
| | | |
| | | /* |
| | | /** |
| | | * Regular expression group position of a target operator enumeration. |
| | | */ |
| | | private static final int targetOperatorPos = 2; |
| | | |
| | | /* |
| | | /** |
| | | * Regular expression group position of a target expression statement. |
| | | */ |
| | | private static final int targetExpressionPos = 3; |
| | | |
| | | /* |
| | | /** |
| | | * Regular expression used to match a single target rule. |
| | | */ |
| | | private static final String targetRegex = |
| | |
| | | ZERO_OR_MORE_WHITESPACE; |
| | | |
| | | /** |
| | | * Regular expression used to match one or more target rules. The patern is |
| | | * Regular expression used to match one or more target rules. The pattern is |
| | | * part of a general ACI verification. |
| | | */ |
| | | public static final String targetsRegex = "(" + targetRegex + ")*"; |
| | | |
| | | /* |
| | | /** |
| | | * Rights that are skipped for certain target evaluations. |
| | | * The test is use the skipRights array is: |
| | | * |
| | |
| | | * If both are true, than the target match test returns true |
| | | * for this ACI. |
| | | */ |
| | | |
| | | private static final int skipRights = (ACI_ADD | ACI_DELETE | ACI_PROXY); |
| | | private static final int skipRights = ACI_ADD | ACI_DELETE | ACI_PROXY; |
| | | |
| | | /** |
| | | * Creates an ACI target from the specified arguments. All of these |
| | |
| | | */ |
| | | public static boolean isTargetFilterApplicable(Aci aci, |
| | | AciTargetMatchContext matchCtx) { |
| | | boolean ret=true; |
| | | TargetFilter targetFilter=aci.getTargets().getTargetFilter(); |
| | | if(targetFilter != null) |
| | | ret=targetFilter.isApplicable(matchCtx); |
| | | return ret; |
| | | return targetFilter.isApplicable(matchCtx); |
| | | return true; |
| | | } |
| | | |
| | | /** |
| | |
| | | */ |
| | | public static boolean isTargetControlApplicable(Aci aci, |
| | | AciTargetMatchContext matchCtx) { |
| | | boolean ret=false; |
| | | TargetControl targetControl=aci.getTargets().getTargetControl(); |
| | | if(targetControl != null) |
| | | ret=targetControl.isApplicable(matchCtx); |
| | | return ret; |
| | | return targetControl.isApplicable(matchCtx); |
| | | return false; |
| | | } |
| | | |
| | | /** |
| | |
| | | */ |
| | | public static boolean isExtOpApplicable(Aci aci, |
| | | AciTargetMatchContext matchCtx) { |
| | | boolean ret=false; |
| | | ExtOp extOp=aci.getTargets().getExtOp(); |
| | | if(extOp != null) |
| | | ret=extOp.isApplicable(matchCtx); |
| | | return ret; |
| | | return extOp.isApplicable(matchCtx); |
| | | return false; |
| | | } |
| | | |
| | | |
| | |
| | | /** |
| | | * Main target isApplicable method. This method performs the target keyword |
| | | * match functionality, which allows for directory entry "targeting" using |
| | | * the specifed ACI, ACI targets class and DN. |
| | | * the specified ACI, ACI targets class and DN. |
| | | * |
| | | * @param aci The ACI to match the target against. |
| | | * @param targets The targets to use in this evaluation. |
| | | * @param entryDN The DN to use in this evaluation. |
| | | * @return True if the ACI matched the target and DN. |
| | | */ |
| | | |
| | | public static boolean isTargetApplicable(Aci aci, |
| | | AciTargets targets, DN entryDN) { |
| | | boolean ret=true; |
| | | DN targetDN=aci.getDN(); |
| | | /* |
| | | * Scoping of the ACI uses either the DN of the entry |
| | |
| | | */ |
| | | if((targets.getTarget() != null) && |
| | | (targets.getTarget().isPattern())) { |
| | | ret=targets.getTarget().matchesPattern(entryDN); |
| | | final boolean ret = targets.getTarget().matchesPattern(entryDN); |
| | | EnumTargetOperator op=targets.getTarget().getOperator(); |
| | | if(op == EnumTargetOperator.NOT_EQUALITY) |
| | | ret=!ret; |
| | | } |
| | | return !ret; |
| | | return ret; |
| | | } |
| | | return true; |
| | | } |
| | | |
| | | |
| | | /** |