org.springframework.security.access
Interface AccessDecisionVoter

All Known Implementing Classes:

AbstractAclVoter, AclEntryVoter, AuthenticatedVoter, Jsr250Voter, LabelBasedAclVoter, PreInvocationAuthorizationAdviceVoter, RoleHierarchyVoter, RoleVoter, WebExpressionVoter

public interface AccessDecisionVoter

Indicates a class is responsible for voting on authorization decisions.

The coordination of voting (ie polling AccessDecisionVoters, tallying their responses, and making the final authorization decision) is performed by an AccessDecisionManager.

Version:

$Id: AccessDecisionVoter.java 3927 2009-10-06 19:46:44Z ltaylor $

Author:

Ben Alex

Field Summary

static int	ACCESS_ABSTAIN
static int	ACCESS_DENIED
static int	ACCESS_GRANTED

Method Summary

boolean	supports(Class<?> clazz) Indicates whether the AccessDecisionVoter implementation is able to provide access control votes for the indicated secured object type.
boolean	supports(ConfigAttribute attribute) Indicates whether this AccessDecisionVoter is able to vote on the passed ConfigAttribute.
int	vote(Authentication authentication, Object object, Collection<ConfigAttribute> attributes) Indicates whether or not access is granted.

Field Detail

ACCESS_GRANTED

static final int ACCESS_GRANTED

See Also:

Constant Field Values

ACCESS_ABSTAIN

static final int ACCESS_ABSTAIN

See Also:

Constant Field Values

ACCESS_DENIED

static final int ACCESS_DENIED

See Also:

Constant Field Values

Method Detail

supports

boolean supports(ConfigAttribute attribute)

Indicates whether this AccessDecisionVoter is able to vote on the passed ConfigAttribute.

This allows the AbstractSecurityInterceptor to check every configuration attribute can be consumed by the configured AccessDecisionManager and/or RunAsManager and/or AfterInvocationManager.

Parameters:

attribute - a configuration attribute that has been configured against the AbstractSecurityInterceptor

Returns:

true if this AccessDecisionVoter can support the passed configuration attribute

supports

boolean supports(Class<?> clazz)

Indicates whether the AccessDecisionVoter implementation is able to provide access control votes for the indicated secured object type.

Parameters:

clazz - the class that is being queried

Returns:

true if the implementation can process the indicated class

vote

int vote(Authentication authentication,
         Object object,
         Collection<ConfigAttribute> attributes)

Indicates whether or not access is granted.

The decision must be affirmative (ACCESS_GRANTED), negative (ACCESS_DENIED) or the AccessDecisionVoter can abstain (ACCESS_ABSTAIN) from voting. Under no circumstances should implementing classes return any other value. If a weighting of results is desired, this should be handled in a custom AccessDecisionManager instead.

Unless an AccessDecisionVoter is specifically intended to vote on an access control decision due to a passed method invocation or configuration attribute parameter, it must return ACCESS_ABSTAIN. This prevents the coordinating AccessDecisionManager from counting votes from those AccessDecisionVoters without a legitimate interest in the access control decision.

Whilst the method invocation is passed as a parameter to maximise flexibility in making access control decisions, implementing classes must never modify the behaviour of the method invocation (such as calling MethodInvocation.proceed()).

Parameters:

authentication - the caller invoking the method

object - the secured object

attributes - the configuration attributes associated with the method being invoked

Returns:

either ACCESS_GRANTED, ACCESS_ABSTAIN or ACCESS_DENIED