public interface GlobalAccessControlPolicyCfg extends Configuration
Provides coarse grained access control for all operations, regardless of whether they are destined for local or proxy backends. Global access control policies are applied in addition to ACIs and privileges.
Modifier and Type | Method and Description |
---|---|
void |
addChangeListener(ConfigurationChangeListener<GlobalAccessControlPolicyCfg> listener)
Register to be notified when this Global Access Control Policy is changed.
|
Class<? extends GlobalAccessControlPolicyCfg> |
configurationClass()
Gets the configuration class associated with this Global Access Control Policy.
|
SortedSet<String> |
getAllowedAttribute()
Gets the "allowed-attribute" property.
|
SortedSet<String> |
getAllowedAttributeException()
Gets the "allowed-attribute-exception" property.
|
SortedSet<String> |
getAllowedControl()
Gets the "allowed-control" property.
|
SortedSet<String> |
getAllowedExtendedOperation()
Gets the "allowed-extended-operation" property.
|
SortedSet<AddressMask> |
getConnectionClientAddressEqualTo()
Gets the "connection-client-address-equal-to" property.
|
SortedSet<AddressMask> |
getConnectionClientAddressNotEqualTo()
Gets the "connection-client-address-not-equal-to" property.
|
int |
getConnectionMinimumSsf()
Gets the "connection-minimum-ssf" property.
|
SortedSet<Integer> |
getConnectionPortEqualTo()
Gets the "connection-port-equal-to" property.
|
SortedSet<String> |
getConnectionProtocolEqualTo()
Gets the "connection-protocol-equal-to" property.
|
SortedSet<GlobalAccessControlPolicyCfgDefn.Permission> |
getPermission()
Gets the "permission" property.
|
SortedSet<String> |
getRequestTargetDnEqualTo()
Gets the "request-target-dn-equal-to" property.
|
SortedSet<String> |
getRequestTargetDnNotEqualTo()
Gets the "request-target-dn-not-equal-to" property.
|
SortedSet<String> |
getUserDnEqualTo()
Gets the "user-dn-equal-to" property.
|
SortedSet<String> |
getUserDnNotEqualTo()
Gets the "user-dn-not-equal-to" property.
|
boolean |
isAuthenticationRequired()
Gets the "authentication-required" property.
|
boolean |
isRequestTargetDnEqualToUserDn()
Gets the "request-target-dn-equal-to-user-dn" property.
|
void |
removeChangeListener(ConfigurationChangeListener<GlobalAccessControlPolicyCfg> listener)
Deregister an existing Global Access Control Policy configuration change listener.
|
dn, name
Class<? extends GlobalAccessControlPolicyCfg> configurationClass()
configurationClass
in interface Configuration
void addChangeListener(ConfigurationChangeListener<GlobalAccessControlPolicyCfg> listener)
listener
- The Global Access Control Policy configuration change listener.void removeChangeListener(ConfigurationChangeListener<GlobalAccessControlPolicyCfg> listener)
listener
- The Global Access Control Policy configuration change listener.SortedSet<String> getAllowedAttribute()
Allows clients to read or write the specified attributes, along with their sub-types.
Attributes that are subtypes of listed attributes are implicitly included. In addition, the list of attributes may include the wild-card '*', which represents all user attributes, or the wild-card '+', which represents all operational attributes, or the name of an object class prefixed with '@' to include all attributes defined by the object class.
SortedSet<String> getAllowedAttributeException()
Specifies zero or more attributes which, together with their sub-types, should not be included in the list of allowed attributes.
This property is typically used when the list of attributes specified by the allowed-attribute property is too broad. It is especially useful when creating policies which grant access to all user attributes (*) except certain sensitive attributes, such as userPassword.
SortedSet<String> getAllowedControl()
Allows clients to use the specified LDAP controls.
SortedSet<String> getAllowedExtendedOperation()
Allows clients to use the specified LDAP extended operations.
boolean isAuthenticationRequired()
Restricts the scope of the policy so that it only applies to authenticated users.
SortedSet<AddressMask> getConnectionClientAddressEqualTo()
Restricts the scope of the policy so that it only applies to connections which match at least one of the specified client host names or address masks.
Valid values include a host name, a fully qualified domain name, a domain name, an IP address, or a sub-network with sub-network mask.
SortedSet<AddressMask> getConnectionClientAddressNotEqualTo()
Restricts the scope of the policy so that it only applies to connections which match none of the specified client host names or address masks.
Valid values include a host name, a fully qualified domain name, a domain name, an IP address, or a sub-network with sub-network mask.
int getConnectionMinimumSsf()
Restricts the scope of the policy so that it only applies to connections having the specified minimum security strength factor.
The security strength factor (ssf) pertains to the cipher key strength for connections using DIGEST-MD5, GSSAPI, SSL, or TLS. For example, to require that the connection must have a cipher strength of at least 256 bits, specify a value of 256.
SortedSet<Integer> getConnectionPortEqualTo()
Restricts the scope of the policy so that it only applies to connections to any of the specified ports, for example 1389.
SortedSet<String> getConnectionProtocolEqualTo()
Restricts the scope of the policy so that it only applies to connections which match any of the specified protocols.
SortedSet<GlobalAccessControlPolicyCfgDefn.Permission> getPermission()
Specifies the type of access allowed by this policy.
SortedSet<String> getRequestTargetDnEqualTo()
Restricts the scope of the policy so that it only applies to requests which target entries matching at least one of the specified DN patterns.
Valid DN filters are strings composed of zero or more wildcards and RDN components. A double wildcard ** replaces one or more RDN components (as in uid=dmiller,**,dc=example,dc=com). A simple wildcard * replaces either a whole RDN, or a whole type, or a value substring (as in uid=bj*,ou=people,dc=example,dc=com).
boolean isRequestTargetDnEqualToUserDn()
Restricts the scope of the policy so that it only applies to requests sent by authenticated users where the request's target DN is the same as the DN of the authorized user.
SortedSet<String> getRequestTargetDnNotEqualTo()
Restricts the scope of the policy so that it only applies to requests which target entries matching none of the specified DN patterns.
Valid DN filters are strings composed of zero or more wildcards and RDN components. A double wildcard ** replaces one or more RDN components (as in uid=dmiller,**,dc=example,dc=com). A simple wildcard * replaces either a whole RDN, or a whole type, or a value substring (as in uid=bj*,ou=people,dc=example,dc=com).
SortedSet<String> getUserDnEqualTo()
Restricts the scope of the policy so that it only applies to authenticated users whose authorization DN matches at least one of the specified DN patterns.
Valid DN filters are strings composed of zero or more wildcards and RDN components. A double wildcard ** replaces one or more RDN components (as in uid=dmiller,**,dc=example,dc=com). A simple wildcard * replaces either a whole RDN, or a whole type, or a value substring (as in uid=bj*,ou=people,dc=example,dc=com).
SortedSet<String> getUserDnNotEqualTo()
Restricts the scope of the policy so that it only applies to authenticated users whose authorization DN matches none of the specified DN patterns.
Valid DN filters are strings composed of zero or more wildcards and RDN components. A double wildcard ** replaces one or more RDN components (as in uid=dmiller,**,dc=example,dc=com). A simple wildcard * replaces either a whole RDN, or a whole type, or a value substring (as in uid=bj*,ou=people,dc=example,dc=com).
Copyright 2010-2018 ForgeRock AS.