JmxPermissionAuthorizer.java

package com.ziesemer.utils.jmx.server.authorization;

import javax.management.ObjectName;

/**
 * <p>Extension of {@link BaseJmxAuthorizer} that additionally allows setting of attributes
 * 		and invocation of non-&quot;read-only&quot; methods (per {@link ReadOnlyInvokeHandler})
 * 		when {@link JmxPermission#INVOKE} is contained in a {@link JmxPermissionPrincipal}.</p>
 * @author Mark A. Ziesemer
 * 	<a href="http://www.ziesemer.com.">&lt;www.ziesemer.com&gt;</a>
 */
public class JmxPermissionAuthorizer extends BaseJmxAuthorizer{
	
	public JmxPermissionAuthorizer(){
		methodHandlers.put("invoke", new PermissionInvokeHandler());
		final PermissionSetAttributeHandler setAttributeHandler = new PermissionSetAttributeHandler();
		methodHandlers.put("setAttribute", setAttributeHandler);
		methodHandlers.put("setAttributes", setAttributeHandler);
	}
	
	protected JmxPermissions getPermissions(final JmxAuthorizeContext ac){
		if(ac.customContext == null){
			ac.customContext = ((JmxPermissionPrincipal)ac.getPrincipal()).getPermissions();
		}
		return (JmxPermissions)ac.customContext;
	}
	
	protected class PermissionInvokeHandler extends ReadOnlyInvokeHandler{
		@Override
		public Object invoke(final JmxAuthorizeContext ac) throws Throwable{
			if(isAllow(ac)){
				return ac.invoke();
			}
			final ObjectName on = (ObjectName)ac.args[0];
			final String methodName = (String)ac.args[1];
			if(getPermissions(ac).implies(JmxPermission.READ_EX)
					&& THREAD_MX_ON.equals(on) && methodName.startsWith("find")){
				return true;
			}
			if(getPermissions(ac).implies(JmxPermission.INVOKE)){
				return logAndExecute(ac);
			}
			throw new SecurityException("Access denied (non-read-only invoke)");
		}
	}
	
	protected class PermissionSetAttributeHandler implements IJmxInvocationAuthorizer{
		public Object invoke(final JmxAuthorizeContext ac) throws Throwable{
			if(getPermissions(ac).implies(JmxPermission.INVOKE)){
				return ac.invoke();
			}
			throw new SecurityException("Access denied (setAttribute(s))");
		}
	}
	
}