casproxydecider.java

acegi_secutity_1.6源码 最好用的安全认证框架

/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.acegisecurity.providers.cas;

import java.util.List;


/**
 * Decides whether a proxy list presented via CAS is trusted or not.
 *
 * <p>
 * CAS 1.0 allowed services to receive a service ticket and then validate it.
 * CAS 2.0 allows services to receive a service ticket and then validate it
 * with a proxy callback URL. The callback will enable the CAS server to
 * authenticate the service. In doing so the service will receive a
 * proxy-granting ticket and a proxy-granting ticket IOU. The IOU is just an
 * internal record that a proxy-granting ticket is due to be received via the
 * callback URL.
 * </p>
 *
 * <p>
 * With a proxy-granting ticket, a service can request the CAS server provides
 * it with a proxy ticket. A proxy ticket is just a service ticket, but the
 * CAS server internally tracks the list (chain) of services used to build the
 * proxy ticket. The proxy ticket is then presented to the target service.
 * </p>
 *
 * <p>
 * If this application is a target service of a proxy ticket, the
 * <code>CasProxyDecider</code> resolves whether or not the proxy list is
 * trusted. Applications should only trust services they allow to impersonate
 * an end user.
 * </p>
 *
 * <p>
 * If this application is a service that should never accept proxy-granting
 * tickets, the implementation should reject tickets that present a proxy list
 * with any members. If the list has no members, it indicates the CAS server
 * directly authenticated the user (ie there are no services which proxied the
 * user authentication).
 * </p>
 *
 * @author Ben Alex
 * @version $Id: CasProxyDecider.java 1784 2007-02-24 21:00:24Z luke_t $
 */
public interface CasProxyDecider {
    //~ Methods ========================================================================================================

    /**
     * Decides whether the proxy list is trusted.
     * <p>Must throw any <code>ProxyUntrustedException</code> if the
     * proxy list is untrusted.</p>
     *
     * @param proxyList the list of proxies to be checked.
     *
     * @throws ProxyUntrustedException DOCUMENT ME!
     */
    void confirmProxyListTrusted(List proxyList)
        throws ProxyUntrustedException;
}