role.java

一个完整的XACML工程,学习XACML技术的好例子!

/*
* Copyright (c) 2000-2005, University of Salford
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without 
* modification, are permitted provided that the following conditions are met:
*
* Redistributions of source code must retain the above copyright notice, this 
* list of conditions and the following disclaimer.
* 
* Redistributions in binary form must reproduce the above copyright notice, 
* this list of conditions and the following disclaimer in the documentation 
* and/or other materials provided with the distribution. 
*
* Neither the name of the University of Salford nor the names of its 
* contributors may be used to endorse or promote products derived from this 
* software without specific prior written permission. 
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 
* POSSIBILITY OF SUCH DAMAGE.
*/

package issrg.pba.rbac;

/**
 * This interface represents a Role which is a unit of
 * credential in RBAC. The API does not use this specified interface;
 * it is specified here solely for the purpose of allowing the caller to be 
 * able to extract
 * the values of the roles the user has got. In the general case this is not
 * needed, because the PBAAPI is supposed to deliver the ultimate access
 * decision.
 *
 * <p>However, in case the caller wishes to interrogate the credentials
 * an implementation of the Role interface is required. Then the caller using 
 * the interface
 * may retrieve the type and value of the role and treat the results for their 
 * own purposes:
 *
 * <p><code>
 * Credentials c = getCreds(user);
 * <br>
 * <br>if (c instanceof Role){
 * <br>   Role r = (Role)c;
 * <br>   String type = r.getType();
 * <br>   Object value = r.getValue();
 * <br>   ...// here depending on the type of the Role
 * <br>   // the decision can be made about the value type,
 * <br>   // and then, having the value, the code can use it
 * <br>}else{
 * <br>... // unwind the possibly recursive SetOfSubsets credentials?
 * <br>}
 * </code>
 *
 * @author A Otenko
 * @version 1.0
 */

public interface Role {
  /**
   * Returns the type of the role.
   *
   * @return String type of the role
   */

  public String getRoleType();

  /**
   * Returns the value of the role.
   *
   * @return value of the role
   */

  public Object getRoleValue();
}