1 28 package net.sf.jguard.jee.authorization.http; 29 30 import java.security.AccessControlException ; 31 import java.security.Permission ; 32 import java.security.PrivilegedActionException ; 33 34 import javax.security.auth.Subject ; 35 import javax.servlet.http.HttpServletRequest ; 36 import javax.servlet.http.HttpSession ; 37 38 import net.sf.jguard.core.authorization.policy.AccessControllerUtils; 39 import net.sf.jguard.jee.authentication.http.HttpAuthenticationUtils; 40 import net.sf.jguard.jee.authentication.http.HttpConstants; 41 42 import org.apache.commons.logging.Log; 43 import org.apache.commons.logging.LogFactory; 44 45 public class HttpAccessControllerUtils { 46 47 static public final Log logger = LogFactory.getLog(HttpAccessControllerUtils.class); 48 49 54 public static AccessControllerUtils getAuthorizationUtils(HttpSession session){ 55 AccessControllerUtils authUtils = (AccessControllerUtils)session.getServletContext().getAttribute(HttpConstants.AUTHZ_UTILS); 56 return authUtils; 57 } 58 59 public static void checkPermission(HttpSession session,Permission p)throws AccessControlException , PrivilegedActionException { 60 if(session ==null){ 61 throw new AccessControlException (" user is not yet authenticated ",p); 62 } 63 AccessControllerUtils authZUtils =getAuthorizationUtils(session); 64 Subject subject = HttpAuthenticationUtils.getSubject(session); 65 if(subject == null){ 66 throw new AccessControlException (" user is not yet authenticated ",p); 67 } 68 authZUtils.checkPermission(subject, p); 69 } 70 71 78 public static boolean hasPermission(HttpServletRequest request,Permission p){ 79 boolean result = true; 80 try{ 81 checkPermission(request.getSession(true), p); 82 }catch(AccessControlException ace){ 83 logger.debug(ace.getMessage()); 84 result = false; 85 }catch(PrivilegedActionException pae){ 86 logger.debug(pae.getMessage()); 87 result = false; 88 } 89 90 return result; 91 } 92 93 } 94 | Popular Tags |