1 // ========================================================================
2 // Copyright (c) 2008-2009 Mort Bay Consulting Pty. Ltd.
3 // ------------------------------------------------------------------------
4 // All rights reserved. This program and the accompanying materials
5 // are made available under the terms of the Eclipse Public License v1.0
6 // and Apache License v2.0 which accompanies this distribution.
7 // The Eclipse Public License is available at
8 // http://www.eclipse.org/legal/epl-v10.html
9 // The Apache License v2.0 is available at
10 // http://www.opensource.org/licenses/apache2.0.php
11 // You may elect to redistribute this code under either of these licenses.
12 // ========================================================================
13
14 package org.eclipse.jetty.http.security;
15
16 import java.io.Serializable;
17
18 /* ------------------------------------------------------------ */
19 /**
20 * Describe an auth and/or data constraint.
21 *
22 *
23 */
24 public class Constraint implements Cloneable, Serializable
25 {
26 /* ------------------------------------------------------------ */
27 public final static String __BASIC_AUTH = "BASIC";
28
29 public final static String __FORM_AUTH = "FORM";
30
31 public final static String __DIGEST_AUTH = "DIGEST";
32
33 public final static String __CERT_AUTH = "CLIENT_CERT";
34
35 public final static String __CERT_AUTH2 = "CLIENT-CERT";
36
37 public final static String __SPNEGO_AUTH = "SPNEGO";
38
39 public static boolean validateMethod (String method)
40 {
41 if (method == null)
42 return false;
43 method = method.trim();
44 return (method.equals(__FORM_AUTH)
45 || method.equals(__BASIC_AUTH)
46 || method.equals (__DIGEST_AUTH)
47 || method.equals (__CERT_AUTH)
48 || method.equals(__CERT_AUTH2));
49 }
50
51 /* ------------------------------------------------------------ */
52 public final static int DC_UNSET = -1, DC_NONE = 0, DC_INTEGRAL = 1, DC_CONFIDENTIAL = 2, DC_FORBIDDEN = 3;
53
54 /* ------------------------------------------------------------ */
55 public final static String NONE = "NONE";
56
57 public final static String ANY_ROLE = "*";
58
59 /* ------------------------------------------------------------ */
60 private String _name;
61
62 private String[] _roles;
63
64 private int _dataConstraint = DC_UNSET;
65
66 private boolean _anyRole = false;
67
68 private boolean _authenticate = false;
69
70 /* ------------------------------------------------------------ */
71 /**
72 * Constructor.
73 */
74 public Constraint()
75 {
76 }
77
78 /* ------------------------------------------------------------ */
79 /**
80 * Conveniance Constructor.
81 *
82 * @param name
83 * @param role
84 */
85 public Constraint(String name, String role)
86 {
87 setName(name);
88 setRoles(new String[] { role });
89 }
90
91 /* ------------------------------------------------------------ */
92 @Override
93 public Object clone() throws CloneNotSupportedException
94 {
95 return super.clone();
96 }
97
98 /* ------------------------------------------------------------ */
99 /**
100 * @param name
101 */
102 public void setName(String name)
103 {
104 _name = name;
105 }
106
107 /* ------------------------------------------------------------ */
108 public void setRoles(String[] roles)
109 {
110 _roles = roles;
111 _anyRole = false;
112 if (roles != null)
113 for (int i = roles.length; !_anyRole && i-- > 0;)
114 _anyRole |= ANY_ROLE.equals(roles[i]);
115 }
116
117 /* ------------------------------------------------------------ */
118 /**
119 * @return True if any user role is permitted.
120 */
121 public boolean isAnyRole()
122 {
123 return _anyRole;
124 }
125
126 /* ------------------------------------------------------------ */
127 /**
128 * @return List of roles for this constraint.
129 */
130 public String[] getRoles()
131 {
132 return _roles;
133 }
134
135 /* ------------------------------------------------------------ */
136 /**
137 * @param role
138 * @return True if the constraint contains the role.
139 */
140 public boolean hasRole(String role)
141 {
142 if (_anyRole) return true;
143 if (_roles != null) for (int i = _roles.length; i-- > 0;)
144 if (role.equals(_roles[i])) return true;
145 return false;
146 }
147
148 /* ------------------------------------------------------------ */
149 /**
150 * @param authenticate True if users must be authenticated
151 */
152 public void setAuthenticate(boolean authenticate)
153 {
154 _authenticate = authenticate;
155 }
156
157 /* ------------------------------------------------------------ */
158 /**
159 * @return True if the constraint requires request authentication
160 */
161 public boolean getAuthenticate()
162 {
163 return _authenticate;
164 }
165
166 /* ------------------------------------------------------------ */
167 /**
168 * @return True if authentication required but no roles set
169 */
170 public boolean isForbidden()
171 {
172 return _authenticate && !_anyRole && (_roles == null || _roles.length == 0);
173 }
174
175 /* ------------------------------------------------------------ */
176 /**
177 * @param c Data constrain indicator: 0=DC+NONE, 1=DC_INTEGRAL &
178 * 2=DC_CONFIDENTIAL
179 */
180 public void setDataConstraint(int c)
181 {
182 if (c < 0 || c > DC_CONFIDENTIAL) throw new IllegalArgumentException("Constraint out of range");
183 _dataConstraint = c;
184 }
185
186 /* ------------------------------------------------------------ */
187 /**
188 * @return Data constrain indicator: 0=DC+NONE, 1=DC_INTEGRAL &
189 * 2=DC_CONFIDENTIAL
190 */
191 public int getDataConstraint()
192 {
193 return _dataConstraint;
194 }
195
196 /* ------------------------------------------------------------ */
197 /**
198 * @return True if a data constraint has been set.
199 */
200 public boolean hasDataConstraint()
201 {
202 return _dataConstraint >= DC_NONE;
203 }
204
205 /* ------------------------------------------------------------ */
206 @Override
207 public String toString()
208 {
209 return "SC{" + _name
210 + ","
211 + (_anyRole ? "*" : (_roles == null ? "-" : _roles.toString()))
212 + ","
213 + (_dataConstraint == DC_UNSET ? "DC_UNSET}" : (_dataConstraint == DC_NONE ? "NONE}" : (_dataConstraint == DC_INTEGRAL ? "INTEGRAL}" : "CONFIDENTIAL}")));
214 }
215
216 }