org.springframework.security.access.intercept
Class AfterInvocationProviderManager

java.lang.Object
  org.springframework.security.access.intercept.AfterInvocationProviderManager

All Implemented Interfaces:

InitializingBean, AfterInvocationManager

public class AfterInvocationProviderManager
extends Object
implements AfterInvocationManager, InitializingBean

Provider-based implementation of AfterInvocationManager.

Handles configuration of a bean context defined list of AfterInvocationProviders.

Every AfterInvocationProvider will be polled when the decide(Authentication, Object, Collection, Object) method is called. The Object returned from each provider will be presented to the successive provider for processing. This means each provider must ensure they return the Object, even if they are not interested in the "after invocation" decision (perhaps as the secure object invocation did not include a configuration attribute a given provider is configured to respond to).

Field Summary

protected static org.apache.commons.logging.Log

logger

Constructor Summary

AfterInvocationProviderManager()

Method Summary

void	afterPropertiesSet()
Object	decide(Authentication authentication, Object object, Collection<ConfigAttribute> config, Object returnedObject) Given the details of a secure object invocation including its returned Object, make an access control decision or optionally modify the returned Object.
List<AfterInvocationProvider>	getProviders()
void	setProviders(List<?> newList)
boolean	supports(Class<?> clazz) Iterates through all AfterInvocationProviders and ensures each can support the presented class.
boolean	supports(ConfigAttribute attribute) Indicates whether this AfterInvocationManager is able to process "after invocation" requests presented with the passed ConfigAttribute.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

logger

protected static final org.apache.commons.logging.Log logger

Constructor Detail

AfterInvocationProviderManager

public AfterInvocationProviderManager()

Method Detail

afterPropertiesSet

public void afterPropertiesSet()
                        throws Exception

Specified by:

afterPropertiesSet in interface InitializingBean

Throws:

Exception

decide

public Object decide(Authentication authentication,
                     Object object,
                     Collection<ConfigAttribute> config,
                     Object returnedObject)
              throws AccessDeniedException

Description copied from interface: AfterInvocationManager

Given the details of a secure object invocation including its returned Object, make an access control decision or optionally modify the returned Object.

Specified by:

decide in interface AfterInvocationManager

Parameters:

authentication - the caller that invoked the method

object - the secured object that was called

config - the configuration attributes associated with the secured object that was invoked

returnedObject - the Object that was returned from the secure object invocation

Returns:

the Object that will ultimately be returned to the caller (if an implementation does not wish to modify the object to be returned to the caller, the implementation should simply return the same object it was passed by the returnedObject method argument)

Throws:

AccessDeniedException - if access is denied

getProviders

public List<AfterInvocationProvider> getProviders()

setProviders

public void setProviders(List<?> newList)

supports

public boolean supports(ConfigAttribute attribute)

Description copied from interface: AfterInvocationManager

Indicates whether this AfterInvocationManager is able to process "after invocation" requests presented with the passed ConfigAttribute.

This allows the AbstractSecurityInterceptor to check every configuration attribute can be consumed by the configured AccessDecisionManager and/or RunAsManager and/or AfterInvocationManager.

Specified by:

supports in interface AfterInvocationManager

Parameters:

attribute - a configuration attribute that has been configured against the AbstractSecurityInterceptor

Returns:

true if this AfterInvocationManager can support the passed configuration attribute

supports

public boolean supports(Class<?> clazz)

Iterates through all AfterInvocationProviders and ensures each can support the presented class.

If one or more providers cannot support the presented class, false is returned.

Specified by:

supports in interface AfterInvocationManager

Parameters:

clazz - the secure object class being queries

Returns:

if the AfterInvocationProviderManager can support the secure object class, which requires every one of its AfterInvocationProviders to support the secure object class