Examples with DelegationEvaluatorImpl com.sun.identity.delegation.DelegationEvaluatorImpl used on opensource projects

Example 11 with DelegationEvaluatorImpl

use of com.sun.identity.delegation.DelegationEvaluatorImpl in project OpenAM by OpenRock.

the class UMUserPasswordResetOptionsModelImpl method isRealmAdmin.

/**
     * Returns <code>true</code> if current user is an realm administrator.
     *
     * @return <code>true</code> if current user is an realm administrator.
     */
public boolean isRealmAdmin() {
    SSOToken token = getUserSSOToken();
    try {
        Set actionNames = new HashSet();
        actionNames.add("MODIFY");
        DelegationEvaluator de = new DelegationEvaluatorImpl();
        DelegationPermission permission = new DelegationPermission(token.getProperty(Constants.ORGANIZATION), "sunAMRealmService", "1.0", "organization", "default", actionNames, null);
        return de.isAllowed(token, permission, null);
    } catch (SSOException e) {
        debug.warning("UserPasswordResetOptionsModelImpl.isRealmAdmin", e);
    } catch (DelegationException e) {
        debug.warning("UserPasswordResetOptionsModelImpl.isRealmAdmin", e);
    }
    return false;
}

Example 12 with DelegationEvaluatorImpl

use of com.sun.identity.delegation.DelegationEvaluatorImpl in project OpenAM by OpenRock.

the class ISAuthorizer method isAuthorized.

/**
     * Returns <code>true</code> if a given log record should be published.
     *
     * @param logName Log name on which operation is to be performed.
     * @param operation The log operation to be performed.
     * @param credential The credential to be authorized.
     * @return <code>true</code> if the credential is authorized.
     */
public boolean isAuthorized(String logName, String operation, Object credential) {
    SSOToken ssoToken = null;
    if (credential instanceof SSOToken) {
        ssoToken = (SSOToken) credential;
    }
    if (ssoToken == null) {
        Debug.error("ISAuthorizer.isAuthorized(): SSO Token is null ");
        return false;
    }
    try {
        String tmpID = ssoToken.getPrincipal().getName();
        if (Debug.messageEnabled()) {
            Debug.message("ISAuthorizer.isAuthorized():logName = " + logName + ", op = " + operation + ", uid = " + tmpID);
        }
        String thisSubConfig = "LogWrite";
        if (operation.equalsIgnoreCase("READ")) {
            thisSubConfig = "LogRead";
        }
        SSOTokenManager ssoMgr = SSOTokenManager.getInstance();
        if (ssoMgr.isValidToken(ssoToken)) {
            Map tmap = new HashMap();
            Set actSet;
            actSet = Collections.singleton(operation);
            try {
                String amRealm = ssoToken.getProperty(Constants.ORGANIZATION);
                DelegationPermission dp = new // realm
                DelegationPermission(// realm
                amRealm, // service name
                "iPlanetAMLoggingService", // version
                "1.0", // config type
                "application", // subConfig name
                thisSubConfig, // actions
                actSet, // extensions
                tmap);
                DelegationEvaluator de = new DelegationEvaluatorImpl();
                if (de.isAllowed(ssoToken, dp, null)) {
                    return true;
                } else {
                    Debug.error(logName + ":ISAuthorizer.isAuthorized():log rqt to " + operation + " by " + tmpID + " denied.");
                }
            } catch (DelegationException dex) {
                String loggedByID = ssoToken.getPrincipal().getName();
                Debug.error("ISAuthorizer.isAuthorized():delegation error: " + "user: " + loggedByID + ", logName = " + logName + ", op = " + operation + ", msg = " + dex.getMessage());
            }
        } else {
            String loggedByID = ssoToken.getPrincipal().getName();
            Debug.error("ISAuthorizer.isAuthorized(): access denied " + "for user : " + loggedByID);
        }
    } catch (SSOException ssoe) {
        Debug.error("ISAuthorizer.isAuthorized(): SSOException: ", ssoe);
    }
    return false;
}