Package org.gcube.common.security.provider

Class DefaultAuthorizationProvider

java.lang.Object

org.gcube.common.security.provider.DefaultAuthorizationProvider

All Implemented Interfaces:

org.gcube.common.security.factories.AuthorizationProvider

public class DefaultAuthorizationProvider
extends Object
implements org.gcube.common.security.factories.AuthorizationProvider

Default implementation of an authorization provider, obtaining the container's tokens from the D4Science IAM through D4ScienceIAMClient.

The Contexts of the container's client are read from the IAM at most once per refresh interval, whether the previous reading succeeded or failed, and the last Contexts read are kept: a node keeps working with them while the IAM is unreachable, and its requests never wait for the IAM.

Author:

Luca Frosini (ISTI-CNR)

Constructor Summary

Constructors

Constructor	Description
DefaultAuthorizationProvider(SimpleCredentials credentials, String endpoint)	Creates the provider, reading the Contexts from the IAM at most every 5 minutes.
DefaultAuthorizationProvider(SimpleCredentials credentials, String endpoint, int contextsRefreshMinutes)	Creates the provider.

Method Summary

Modifier and Type	Method	Description
Set<String>	getContexts()	Returns the Contexts of the container's client.
SimpleCredentials	getCredentials()	Deprecated.
org.gcube.common.security.secrets.Secret	getSecretForContext(String context)	Returns a secret whose token is restricted to the given Context, requested for the container's client.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

DefaultAuthorizationProvider

public DefaultAuthorizationProvider(SimpleCredentials credentials,
 String endpoint)

Creates the provider, reading the Contexts from the IAM at most every 5 minutes.

Parameters:

credentials - the container's client credentials

endpoint - the IAM token endpoint, or the realm base URL

DefaultAuthorizationProvider

public DefaultAuthorizationProvider(SimpleCredentials credentials,
 String endpoint,
 int contextsRefreshMinutes)

Creates the provider.

Parameters:

credentials - the container's client credentials

endpoint - the IAM token endpoint, or the realm base URL

contextsRefreshMinutes - the minimum time, in minutes, between two readings of the Contexts from the IAM

Method Details

getContexts

public Set<String> getContexts()

Returns the Contexts of the container's client. They are read from the IAM when the refresh interval has elapsed since the last reading and no other reading is in progress; otherwise, and when the reading fails, the last Contexts read are returned. While no Contexts are known yet, a caller waits for the reading in progress, if any, instead of failing.

Specified by:

getContexts in interface org.gcube.common.security.factories.AuthorizationProvider

Returns:

the Contexts of the container's client, possibly empty if the client is a member of none

Throws:

IllegalStateException - if the Contexts are not known yet: no reading has succeeded

getSecretForContext

public org.gcube.common.security.secrets.Secret getSecretForContext(String context)

Returns a secret whose token is restricted to the given Context, requested for the container's client.

Specified by:

getSecretForContext in interface org.gcube.common.security.factories.AuthorizationProvider

Parameters:

context - the Context the token must be restricted to

Returns:

the secret holding the restricted token

Throws:

RuntimeException - if the token cannot be obtained, or if the IAM returns a token not restricted to context, which happens when the client is not a member of it

getCredentials

@Deprecated
public SimpleCredentials getCredentials()

Deprecated.

Specified by:

getCredentials in interface org.gcube.common.security.factories.AuthorizationProvider