Chapter 9. Authorization Modules
The following modules provide authorization services:
This is the base authorization module which has to be overridden and provides a facility for delegating to other authorization modules. This base authorization module also provides a
delegateMapproperty to the overriding class, which allows for delegation modules to be declared for specific components. This enables more specialized classes to handle the authorization for each layer, for example
ejb, etc, since the information used to authorize a user may vary between the resources being accessed. For instance, an authorization module may be based on permissions, yet have different permission types for the
ejbresources. By default, the authorization module would be forced to deal with all possible resource and permission types, but configuring the
delegateMapoption allows the module to delegate to specific classes for different resource types. The
delegateMapoption takes a comma-separated list of modules, each of which is prefixed by the component it relates to, for example
When configuring the
delegateMap option, every delegate must implement the
authorize(Resource) method and have it call the
invokeDelegate(Resource) method in same way the provided authorization modules do. Failure to do so will result in the delegate not getting called.
- This is a simple authorization module that always denies an authorization request. No configuration options are available.
- This is a simple authorization module that always permits an authorization request. No configuration options are available.
- This is the default authorization module that delegates decision making to the configured delegates. This module also supports the delegateMap option.
- This is the default web authorization module with the default Tomcat authorization logic, permit all.
This module enforces JACC semantics using two delegates,
WebJACCPolicyModuleDelegatefor web container authorization requests and
EJBJACCPolicyModuleDelegatefor EJB container requests. This module also supports the
This module enforces XACML authorization using two delegates for web and EJB containers,
EJBXACMLPolicyModuleDelegate. It creates a PDP object based on registered policies and evaluates web or EJB requests against it. This module also supports the