Package com.sun.identity.entitlement

Class PrivilegeChangeNotifier

java.lang.Object

com.sun.identity.entitlement.PrivilegeChangeNotifier

public class PrivilegeChangeNotifier
extends Object

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
class	PrivilegeChangeNotifier.Task

Field Summary

Fields

Modifier and Type	Field	Description
static String	ALLOW_ANY_LISTENER_URL	When set to true, entitlement listener notification URLs are not SSRF-validated (restores the pre-fix behaviour).

Method Summary

Modifier and Type	Method	Description
static PrivilegeChangeNotifier	getInstance()
static boolean	isListenerUrlAllowed(String url)
void	notify(Subject adminSubject, String realm, String applicationName, String privilegeName, Set<String> resources)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

ALLOW_ANY_LISTENER_URL

public static final String ALLOW_ANY_LISTENER_URL

When set to true, entitlement listener notification URLs are not SSRF-validated (restores the pre-fix behaviour). Runtime toggle for deployments whose listener endpoints are hosted on internal addresses. Default false.

See Also:

Constant Field Values

Method Detail

getInstance

public static PrivilegeChangeNotifier getInstance()

isListenerUrlAllowed

public static boolean isListenerUrlAllowed(String url)

Parameters:

url - a candidate entitlement listener notification callback URL.

Returns:

true if the URL may be used — i.e. it is SSRF-safe (http/https, not a loopback/link-local/private/metadata address) or ALLOW_ANY_LISTENER_URL is set.

notify

public void notify(Subject adminSubject,
                   String realm,
                   String applicationName,
                   String privilegeName,
                   Set<String> resources)