Package com.sun.identity.entitlement

Class LogicalCondition

    • Constructor Detail

      • LogicalCondition

        public LogicalCondition()
        Constructor.

      • LogicalCondition

        public LogicalCondition​(Set<EntitlementCondition> eConditions)
        Constructor.
        Parameters:
        eConditions - wrapped EntitlementCondition(s)

      • LogicalCondition

        public LogicalCondition​(Set<EntitlementCondition> eConditions,
                        String pConditionName)
        Constructor.
        Parameters:
        eConditions - wrapped EntitlementCondition(s)
        pConditionName - subject name as used in OpenAM policy, this is relevant only when UserECondition was created from OpenAM policy Condition

    • Method Detail

      • setState

        public void setState​(String state)
        Sets state of the object
        Parameters:
        state - State of the object encoded as string

      • getState

        public String getState()
        Returns state of the object.
        Returns:
        state of the object encoded as string.

      • evaluate

        public abstract ConditionDecision evaluate​(String realm,
                                           Subject subject,
                                           String resourceName,
                                           Map<String,​Set<String>> environment)
                                    throws EntitlementException
        Returns ConditionDecision of EntitlementCondition evaluation
        Parameters:
        realm - Realm name.
        subject - EntitlementCondition who is under evaluation.
        resourceName - Resource name.
        environment - Environment parameters.
        Returns:
        ConditionDecision of EntitlementCondition evaluation
        Throws:
        EntitlementException - if error occurs.

      • setEConditions

        public void setEConditions​(Set<EntitlementCondition> eConditions)
        Sets the nested EntitlementCondition(s).
        Parameters:
        eConditions - the nested EntitlementCondition(s)

      • markMemberRejected

        protected void markMemberRejected​(org.json.JSONObject rejectedMember)
        Records that a member could not be rebuilt from the state being applied, keeping the member's JSON so that toJSONObject() can write it back out. Subclasses that read the member themselves - NotCondition keeps a single member of its own - have to call this, or a refusal below them stays invisible to hasRejectedMemberInSubtree() and an enclosing NOT negates the resulting failure back into a grant.
        Parameters:
        rejectedMember - the refused member as it appeared in the state, or null when it was not even a JSON object; an empty object is then re-emitted in its place, which the next load refuses again and so keeps the wrapper fail-closed across a save.

      • clearMemberRejection

        protected void clearMemberRejection()
        Clears a recorded refusal. Called whenever the members are redefined wholesale, so that programmatic construction is unaffected by what a previous state string contained.

      • getRejectedMembers

        protected List<org.json.JSONObject> getRejectedMembers()
        Returns the refused members, kept verbatim for re-emission by toJSONObject().
        Returns:
        the refused members; never null.

      • isMemberRejected

        public boolean isMemberRejected()
        Returns whether setState(String) refused a member class name, leaving this wrapper with fewer members than the stored policy declares.

        Any subclass whose evaluation gets weaker as members are dropped must consult this before evaluating: an empty member set is satisfied both in AndCondition and in OrCondition, so the truncated wrapper would grant what the stored policy restricts. AndCondition has to fail on any refusal, OrCondition only when nothing survived - dropping a member from a non-empty OR can only make it stricter. A subclass that negates its member must use hasRejectedMemberInSubtree() instead.

        Returns:
        true if at least one member was rejected.

      • hasRejectedMemberInSubtree

        public boolean hasRejectedMemberInSubtree()
        Returns whether this wrapper, or any logical condition nested below it, had a member class name refused by setState(String).

        isMemberRejected() deliberately reports this wrapper's own refusal only: for AndCondition/OrCondition a refusal further down is already handled where it happened, because the damaged member fails closed and a failing member can only make an AND or an OR stricter. Negation is the exception - NotCondition turns its member's decision around, so the damaged member's fail-closed decision would come back out of the NOT as a grant. It has to look at the whole subtree.

        Returns:
        true if a member was refused anywhere in this subtree.

      • getEConditions

        public Set<EntitlementCondition> getEConditions()
        Returns the nested EntitlementCondition(s).
        Returns:
        the nested EntitlementCondition(s).

      • setPConditionName

        public void setPConditionName​(String pConditionName)
        Sets OpenAM policy Condition name
        Parameters:
        pConditionName - subject name as used in OpenAM policy, this is relevant only when UserECondition was created from OpenAM policy Condition

      • getPConditionName

        public String getPConditionName()
        Returns OpenAM policy Condition name
        Returns:
        subject name as used in OpenAM policy, this is relevant only when UserECondition was created from OpenAM policy Condition

      • toJSONObject

        public org.json.JSONObject toJSONObject()
                                 throws org.json.JSONException
        Returns JSONObject mapping of the object
        Returns:
        JSONObject mapping of the object
        Throws:
        org.json.JSONException - if can not map to JSONObject

      • toString

        public String toString()
        Returns string representation of the object
        Overrides:
        toString in class Object
        Returns:
        string representation of the object

      • equals

        public boolean equals​(Object obj)
        Returns true if the passed in object is equal to this object
        Overrides:
        equals in class EntitlementConditionAdaptor
        Parameters:
        obj - object to check for equality
        Returns:
        true if the passed in object is equal to this object