Interface IAuthorizationStrategy

All Known Implementing Classes:
AbstractPageAuthorizationStrategy, AbstractRoleAuthorizationStrategy, ActionAuthorizationStrategy, AnnotationsRoleAuthorizationStrategy, CompoundAuthorizationStrategy, MetaDataRoleAuthorizationStrategy, RoleAuthorizationStrategy, SimplePageAuthorizationStrategy

public interface IAuthorizationStrategy

Authorization strategies specify aspect-like constraints on significant actions taken by the framework in a given application. These constraints are guaranteed by the framework to be applied consistently throughout. Violations will result in a security action directed by the strategy, such as the throwing of an AuthorizationException or the filtering out of security-sensitive information.

Wicket 1.2
Eelco Hillenius, Jonathan Locke

Field Summary
static IAuthorizationStrategy ALLOW_ALL
          Implementation of IAuthorizationStrategy that allows everything.
Method Summary
 boolean isActionAuthorized(Component component, Action action)
          Gets whether the given action is permitted.
<T extends Component>
isInstantiationAuthorized(Class<T> componentClass)
          Checks whether an instance of the given component class may be created.

Field Detail


static final IAuthorizationStrategy ALLOW_ALL
Implementation of IAuthorizationStrategy that allows everything.

Method Detail


<T extends Component> boolean isInstantiationAuthorized(Class<T> componentClass)
Checks whether an instance of the given component class may be created. If this method returns false, the IUnauthorizedComponentInstantiationListener that is configured in the security settings will be called. The default implementation of that listener throws a UnauthorizedInstantiationException.

If you wish to implement a strategy that authenticates users which cannot access a given Page (or other Component), you can simply throw a RestartResponseAtInterceptPageException in your implementation of this method.

Type Parameters:
T -
componentClass - The component class to check
Whether the given component may be created


boolean isActionAuthorized(Component component,
                           Action action)
Gets whether the given action is permitted. If it is, this method should return true. If it isn't, this method should either return false or - in case of a serious breach - throw a security exception. Returning is generally preferable over throwing an exception as that doesn't break the normal flow.

component - The component to be acted upon
action - The action to authorize on the component
Whether the given action may be taken on the given component
AuthorizationException - Can be thrown by implementation if action is unauthorized
See Also:
Component.ENABLE, Component.RENDER

Copyright © 2004-2011 Apache Software Foundation. All Rights Reserved.