Package com.sun.identity.entitlement

Class NotCondition

java.lang.Object

com.sun.identity.entitlement.EntitlementConditionAdaptor

com.sun.identity.entitlement.LogicalCondition

com.sun.identity.entitlement.NotCondition

All Implemented Interfaces:

EntitlementCondition

public class NotCondition
extends LogicalCondition

This class wrapped on an Entitlement Condition object to provide boolean NOT. Membership of NotCondition is satisfied in the user is not a member of the nested EntitlementCondition. We @JsonIgnore getEConditions and setEConditions (NOTE the 's' on the end) so that we don't indicate via JSON schema exposed that we take multiple condition types. We extend LogicalCondition but ensure that we are only allowing a single EntitlementCondition to be referenced by this class.

Constructor Summary

Constructors

Constructor	Description
NotCondition()	Constructs NotCondition
NotCondition(EntitlementCondition eCondition)	Constructs NotCondition
NotCondition(EntitlementCondition eConditions, String pConditionName)	Constructs NotCondition.

Method Summary

Modifier and Type	Method	Description
boolean	equals(Object obj)	Returns true if the passed in object is equal to this object
ConditionDecision	evaluate(String realm, Subject subject, String resourceName, Map<String,Set<String>> environment)	Returns ConditionDecision of EntitlementCondition evaluation
EntitlementCondition	getECondition()	Returns the nested EntitlementCondition(s).
Set<EntitlementCondition>	getEConditions()	Returns the nested EntitlementCondition(s).
String	getPConditionName()	Returns OpenAM policy Condition name
String	getState()	Returns state of the object.
int	hashCode()	Returns hash code of the object
boolean	hasRejectedMemberInSubtree()	Returns whether this wrapper, or any logical condition nested below it, had a member class name refused by LogicalCondition.setState(String).
void	setECondition(EntitlementCondition eCondition)	Sets the nested EntitlementCondition(s).
void	setEConditions(Set<EntitlementCondition> eConditions)	Sets the nested EntitlementCondition(s).
void	setPConditionName(String pConditionName)	Sets OpenAM policy Condition name
void	setState(String state)	Sets state of the object
org.json.JSONObject	toJSONObject()	Returns JSONObject mapping of the object
String	toString()	Returns string representation of the object
void	validate()	Checks that this condition is configured correctly.

Methods inherited from class com.sun.identity.entitlement.LogicalCondition

clearMemberRejection, getRejectedMembers, isMemberRejected, markMemberRejected

Methods inherited from class com.sun.identity.entitlement.EntitlementConditionAdaptor

getDisplayType, init, setDisplayType, setState, toJSONObject

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Constructor Detail

NotCondition

public NotCondition()

Constructs NotCondition

NotCondition

public NotCondition(EntitlementCondition eCondition)

Constructs NotCondition

Parameters:

eCondition - wrapped EntitlementCondition(s)

NotCondition

public NotCondition(EntitlementCondition eConditions,
                    String pConditionName)

Constructs NotCondition.

Parameters:

eConditions - wrapped EntitlementCondition(s)

pConditionName - subject name as used in OpenAM policy, this is relevant only when UserECondition was created from OpenAM policy Condition

Method Detail

setState

public void setState(String state)

Sets state of the object

Specified by:

setState in interface EntitlementCondition

Overrides:

setState in class LogicalCondition

Parameters:

state - State of the object encoded as string

getState

public String getState()

Returns state of the object.

Specified by:

getState in interface EntitlementCondition

Overrides:

getState in class LogicalCondition

Returns:

state of the object encoded as string.

evaluate

public ConditionDecision evaluate(String realm,
                                  Subject subject,
                                  String resourceName,
                                  Map<String,Set<String>> environment)
                           throws EntitlementException

Returns ConditionDecision of EntitlementCondition evaluation

Specified by:

evaluate in interface EntitlementCondition

Specified by:

evaluate in class LogicalCondition

Parameters:

realm - Realm name.

subject - EntitlementCondition who is under evaluation.

resourceName - Resource name.

environment - Environment parameters.

Returns:

ConditionDecision of EntitlementCondition evaluation

Throws:

EntitlementException - if error occurs.

setECondition

public void setECondition(EntitlementCondition eCondition)

Sets the nested EntitlementCondition(s).

Parameters:

eCondition - the nested EntitlementCondition(s)

getECondition

public EntitlementCondition getECondition()

Returns the nested EntitlementCondition(s).

Returns:

the nested EntitlementCondition(s).

setEConditions

public void setEConditions(Set<EntitlementCondition> eConditions)

Sets the nested EntitlementCondition(s).

Overrides:

setEConditions in class LogicalCondition

Parameters:

eConditions - the nested EntitlementCondition(s)

getEConditions

public Set<EntitlementCondition> getEConditions()

Returns the nested EntitlementCondition(s).

Overrides:

getEConditions in class LogicalCondition

Returns:

the nested EntitlementCondition(s).

hasRejectedMemberInSubtree

public boolean hasRejectedMemberInSubtree()

Returns whether this wrapper, or any logical condition nested below it, had a member class name refused by LogicalCondition.setState(String).

LogicalCondition.isMemberRejected() deliberately reports this wrapper's own refusal only: for AndCondition/OrCondition a refusal further down is already handled where it happened, because the damaged member fails closed and a failing member can only make an AND or an OR stricter. Negation is the exception - NotCondition turns its member's decision around, so the damaged member's fail-closed decision would come back out of the NOT as a grant. It has to look at the whole subtree.

A NotCondition with no member at all counts as damaged too, not only one whose member setState(String) refused. Its own evaluate(java.lang.String, javax.security.auth.Subject, java.lang.String, java.util.Map<java.lang.String, java.util.Set<java.lang.String>>) already fails on the missing member, but an enclosing NotCondition would negate that failure into a grant. The two are indistinguishable from the outside anyway: a policy stored by a version that dropped the refused member instead of re-emitting it comes back with the member simply absent, and a NOT without a member is not a policy statement that validate() accepts in the first place.

Overrides:

hasRejectedMemberInSubtree in class LogicalCondition

Returns:

true if a member was refused anywhere in this subtree.

setPConditionName

public void setPConditionName(String pConditionName)

Sets OpenAM policy Condition name

Overrides:

setPConditionName in class LogicalCondition

Parameters:

pConditionName - subject name as used in OpenAM policy, this is relevant only when UserECondition was created from OpenAM policy Condition

getPConditionName

public String getPConditionName()

Returns OpenAM policy Condition name

Overrides:

getPConditionName in class LogicalCondition

Returns:

subject name as used in OpenAM policy, this is relevant only when UserECondition was created from OpenAM policy Condition

toJSONObject

public org.json.JSONObject toJSONObject()
                                 throws org.json.JSONException

Returns JSONObject mapping of the object

Overrides:

toJSONObject in class LogicalCondition

Returns:

JSONObject mapping of the object

Throws:

org.json.JSONException - if can not map to JSONObject

toString

public String toString()

Returns string representation of the object

Overrides:

toString in class LogicalCondition

Returns:

string representation of the object

equals

public boolean equals(Object obj)

Returns true if the passed in object is equal to this object

Overrides:

equals in class LogicalCondition

Parameters:

obj - object to check for equality

Returns:

true if the passed in object is equal to this object

hashCode

public int hashCode()

Returns hash code of the object

Overrides:

hashCode in class LogicalCondition

Returns:

hash code of the object

validate

public void validate()
              throws EntitlementException

Description copied from interface: EntitlementCondition

Checks that this condition is configured correctly. Throws EntitlementException if not with an informative message to display to the user creating/updating the policy.

Specified by:

validate in interface EntitlementCondition

Overrides:

validate in class LogicalCondition

Throws:

EntitlementException - if the configuration state is not valid.