Package com.sun.identity.entitlement

Class NotSubject

java.lang.Object

com.sun.identity.entitlement.LogicalSubject

com.sun.identity.entitlement.NotSubject

All Implemented Interfaces:

EntitlementSubject

public class NotSubject
extends LogicalSubject

This class wrapped on an Entitlement Subject object to provide boolean NOT. Membership of NotSubject is satisfied in the user is not a member of the nested EntitlementSubject. We @JsonIgnore getESubjects and setESubjects (NOTE the 's' on the end) so that we don't indicate via JSON schema exposed that we take multiple subject types. We extend LogicalSubject but ensure that we are only allowing a single EntitlementSubject to be referenced by this class.

Constructor Summary

Constructors

Constructor	Description
NotSubject()	Constructs NotSubject
NotSubject(EntitlementSubject eSubject)	Constructs NotSubject
NotSubject(EntitlementSubject eSubject, String pSubjectName)	Constructs NotSubject

Method Summary

Modifier and Type	Method	Description
boolean	equals(Object obj)	Returns true if the passed in object is equal to this object
SubjectDecision	evaluate(String realm, SubjectAttributesManager mgr, Subject subject, String resourceName, Map<String,Set<String>> environment)	Returns SubjectDecision of EntitlementSubject evaluation.
EntitlementSubject	getESubject()	Returns nested EntitlementSubject.
Set<EntitlementSubject>	getESubjects()	Returns the nested EntitlementSubject(s)
String	getPSubjectName()	Returns OpenAM policy Subject name
Set<String>	getRequiredAttributeNames()	Returns required attribute names.
Map<String,Set<String>>	getSearchIndexAttributes()	Returns search index attributes.
String	getState()	Returns state of the object.
int	hashCode()	Returns hash code of the object
boolean	hasRejectedMemberInSubtree()	Returns whether this wrapper, or any logical subject nested below it, had a member class name refused by LogicalSubject.setState(String).
boolean	isIdentity()	Returns true is this subject is an identity object.
void	setESubject(EntitlementSubject eSubject)	Sets nested EntitlementSubject.
void	setESubjects(Set<EntitlementSubject> eSubjects)	Sets the nested EntitlementSubject(s)
void	setPSubjectName(String pSubjectName)	Sets OpenAM policy Subject name
void	setState(String state)	Sets state of the object
org.json.JSONObject	toJSONObject()	Returns JSONObject mapping of the object
String	toString()	Returns string representation of the object.

Methods inherited from class com.sun.identity.entitlement.LogicalSubject

clearMemberRejection, getRejectedMembers, isMemberRejected, markMemberRejected

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Constructor Detail

NotSubject

public NotSubject()

Constructs NotSubject

NotSubject

public NotSubject(EntitlementSubject eSubject)

Constructs NotSubject

Parameters:

eSubject - nested EntitlementSubject

NotSubject

public NotSubject(EntitlementSubject eSubject,
                  String pSubjectName)

Constructs NotSubject

Parameters:

eSubject - eSubject nested EntitlementSubject

pSubjectName - subject name as used in OpenAM policy, this is relevant only when NotrESubject was created from OpenAM policy Subject

Method Detail

setState

public void setState(String state)

Sets state of the object

Specified by:

setState in interface EntitlementSubject

Overrides:

setState in class LogicalSubject

Parameters:

state - State of the object encoded as string

getState

public String getState()

Returns state of the object.

Specified by:

getState in interface EntitlementSubject

Overrides:

getState in class LogicalSubject

Returns:

state of the object encoded as string.

evaluate

public SubjectDecision evaluate(String realm,
                                SubjectAttributesManager mgr,
                                Subject subject,
                                String resourceName,
                                Map<String,Set<String>> environment)
                         throws EntitlementException

Returns SubjectDecision of EntitlementSubject evaluation.

Parameters:

realm - Realm name.

subject - EntitlementSubject who is under evaluation.

resourceName - Resource name.

environment - Environment parameters.

Returns:

SubjectDecision of EntitlementSubject evaluation

Throws:

EntitlementException - if any errors occur.

setESubject

public void setESubject(EntitlementSubject eSubject)

Sets nested EntitlementSubject.

Parameters:

eSubject - nested EntitlementSubject.

setESubjects

public void setESubjects(Set<EntitlementSubject> eSubjects)

Sets the nested EntitlementSubject(s)

Overrides:

setESubjects in class LogicalSubject

Parameters:

eSubjects - the nested EntitlementSubject(s)

getESubject

public EntitlementSubject getESubject()

Returns nested EntitlementSubject.

Returns:

nested EntitlementSubject.

getESubjects

public Set<EntitlementSubject> getESubjects()

Returns the nested EntitlementSubject(s)

Overrides:

getESubjects in class LogicalSubject

Returns:

the nested EntitlementSubject(s)

hasRejectedMemberInSubtree

public boolean hasRejectedMemberInSubtree()

Returns whether this wrapper, or any logical subject nested below it, had a member class name refused by LogicalSubject.setState(String).

LogicalSubject.isMemberRejected() deliberately reports this wrapper's own refusal only: for AndSubject/OrSubject a refusal further down is already handled where it happened, because the damaged member denies and a denying member can only make an AND or an OR stricter. Negation is the exception - NotSubject turns its member's decision around, so the damaged member's deny would come back out of the NOT as a match. It has to look at the whole subtree.

A NotSubject with no member at all counts as damaged too, not only one whose member setState(String) refused. Its own evaluate(java.lang.String, com.sun.identity.entitlement.SubjectAttributesManager, javax.security.auth.Subject, java.lang.String, java.util.Map<java.lang.String, java.util.Set<java.lang.String>>) already denies on the missing member, but an enclosing NotSubject would negate that deny into a match for everyone. The two are indistinguishable from the outside anyway: a policy stored by a version that dropped the refused member instead of re-emitting it comes back with the member simply absent, and a NOT without a member is not a policy statement to begin with - it already denies on its own.

Overrides:

hasRejectedMemberInSubtree in class LogicalSubject

Returns:

true if a member was refused anywhere in this subtree.

setPSubjectName

public void setPSubjectName(String pSubjectName)

Sets OpenAM policy Subject name

Overrides:

setPSubjectName in class LogicalSubject

Parameters:

pSubjectName - subject name as used in OpenAM policy, this is relevant only when NotrESubject was created from OpenAM policy Subject

getPSubjectName

public String getPSubjectName()

Returns OpenAM policy Subject name

Overrides:

getPSubjectName in class LogicalSubject

Returns:

subject name as used in OpenAM policy, this is relevant only when NotrESubject was created from OpenAM policy Subject

toJSONObject

public org.json.JSONObject toJSONObject()
                                 throws org.json.JSONException

Returns JSONObject mapping of the object

Overrides:

toJSONObject in class LogicalSubject

Returns:

JSONObject mapping of the object

Throws:

org.json.JSONException - if can not map to JSONObject

toString

public String toString()

Returns string representation of the object.

Overrides:

toString in class LogicalSubject

Returns:

string representation of the object.

equals

public boolean equals(Object obj)

Returns true if the passed in object is equal to this object

Overrides:

equals in class LogicalSubject

Parameters:

obj - object to check for equality

Returns:

true if the passed in object is equal to this object

hashCode

public int hashCode()

Returns hash code of the object

Overrides:

hashCode in class LogicalSubject

Returns:

hash code of the object

getSearchIndexAttributes

public Map<String,Set<String>> getSearchIndexAttributes()

Returns search index attributes.

Specified by:

getSearchIndexAttributes in interface EntitlementSubject

Overrides:

getSearchIndexAttributes in class LogicalSubject

Returns:

search index attributes.

getRequiredAttributeNames

public Set<String> getRequiredAttributeNames()

Returns required attribute names.

Specified by:

getRequiredAttributeNames in interface EntitlementSubject

Overrides:

getRequiredAttributeNames in class LogicalSubject

Returns:

required attribute names.

isIdentity

public boolean isIdentity()

Returns true is this subject is an identity object.

Specified by:

isIdentity in interface EntitlementSubject

Overrides:

isIdentity in class LogicalSubject

Returns:

true is this subject is an identity object.