553N/A * Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved. 0N/A * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 0N/A * This code is free software; you can redistribute it and/or modify it 0N/A * under the terms of the GNU General Public License version 2 only, as 0N/A * published by the Free Software Foundation. Oracle designates this 0N/A * particular file as subject to the "Classpath" exception as provided 0N/A * by Oracle in the LICENSE file that accompanied this code. 0N/A * This code is distributed in the hope that it will be useful, but WITHOUT 0N/A * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 0N/A * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 0N/A * version 2 for more details (a copy is included in the LICENSE file that 0N/A * accompanied this code). 0N/A * You should have received a copy of the GNU General Public License version 0N/A * 2 along with this work; if not, write to the Free Software Foundation, 553N/A * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 553N/A * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA 0N/A * or visit www.oracle.com if you need additional information or have any 0N/A * This class is used to restrict the usage of the Kerberos 0N/A * delegation model, ie: forwardable and proxiable tickets. 0N/A * The target name of this <code>Permission</code> specifies a pair of 0N/A * kerberos service principals. The first is the subordinate service principal 0N/A * being entrusted to use the TGT. The second service principal designates 0N/A * the target service the subordinate service principal is to 0N/A * interact with on behalf of the initiating KerberosPrincipal. This 0N/A * latter service principal is specified to restrict the use of a 0N/A * For example, to specify the "host" service use of a forwardable TGT the 0N/A * target permission is specified as follows: 0N/A * To give the "backup" service a proxiable nfs service ticket the target permission 0N/A * might be specified: * Create a new <code>DelegationPermission</code> * with the specified subordinate and target principals. * @param principals the name of the subordinate and target principals * @throws NullPointerException if <code>principals</code> is <code>null</code>. * @throws IllegalArgumentException if <code>principals</code> is empty. * Create a new <code>DelegationPermission</code> * with the specified subordinate and target principals. * @param principals the name of the subordinate and target principals * @param actions should be null. * @throws NullPointerException if <code>principals</code> is <code>null</code>. * @throws IllegalArgumentException if <code>principals</code> is empty. * Initialize the DelegationPermission object. (
"service principal [" +
target +
* Checks if this Kerberos delegation permission object "implies" the * If none of the above are true, <code>implies</code> returns false. * @param p the permission to check against. * @return true if the specified permission is implied by this object, * Checks two DelegationPermission objects for equality. * @param obj the object to test for equality with this object. * @return true if <i>obj</i> is a DelegationPermission, and * has the same subordinate and service principal as this. * DelegationPermission object. * Returns the hash code value for this object. * @return a hash code value for this object. * Returns a PermissionCollection object for storing * DelegationPermission objects. * DelegationPermission objects must be stored in a manner that * allows them to be inserted into the collection in any order, but * that also enables the PermissionCollection implies method to * be implemented in an efficient (and consistent) manner. * @return a new PermissionCollection object suitable for storing * WriteObject is called to save the state of the DelegationPermission * to a stream. The actions are serialized, and the superclass * takes care of the name. * readObject is called to restore the state of the * DelegationPermission from a stream. // Read in the action, then initialize the rest public static void main(String args[]) throws Exception { DelegationPermission this_ = new DelegationPermission(args[0]); DelegationPermission that_ = new DelegationPermission(args[1]); System.out.println("-----\n"); System.out.println("this.implies(that) = " + this_.implies(that_)); System.out.println("-----\n"); System.out.println("this = "+this_); System.out.println("-----\n"); System.out.println("that = "+that_); System.out.println("-----\n"); KrbDelegationPermissionCollection nps = new KrbDelegationPermissionCollection(); System.out.println("nps.implies(that) = " + nps.implies(that_)); System.out.println("-----\n"); Enumeration e = nps.elements(); while (e.hasMoreElements()) { (DelegationPermission) e.nextElement(); System.out.println("nps.e = " + x); // Not serialized; see serialization section at end of class. * Check and see if this collection of permissions implies the permissions * expressed in "permission". * @param p the Permission object to compare * @return true if "permission" is a proper subset of a permission in * the collection, false if not. * Adds a permission to the DelegationPermissions. The key for * @param permission the Permission object to add. * @exception IllegalArgumentException - if the permission is not a * @exception SecurityException - if this PermissionCollection object * has been marked readonly throw new SecurityException(
"attempt to add a Permission to a readonly PermissionCollection");
* Returns an enumeration of all the DelegationPermission objects * @return an enumeration of all the DelegationPermission objects. // Convert Iterator into Enumeration // Need to maintain serialization interoperability with earlier releases, // which had the serializable field: // private Vector permissions; * @serialField permissions java.util.Vector * A list of DelegationPermission objects. * @serialData "permissions" field (a Vector containing the DelegationPermissions). * Writes the contents of the perms field out as a Vector for * serialization compatibility with earlier releases. // Don't call out.defaultWriteObject() * Reads in a Vector of DelegationPermissions and saves them in the perms field. // Don't call defaultReadObject() // Read in serialized fields