com.tivoli.pd.jadmin
Class PDProtObject

java.lang.Object
  com.tivoli.pd.jutil.PDEnvironmentObject
      com.tivoli.pd.jadmin.PDProtObject

All Implemented Interfaces:

java.io.Serializable, java.lang.Cloneable

public class PDProtObject
extends com.tivoli.pd.jutil.PDEnvironmentObject
implements java.lang.Cloneable

Security Access Manager Protected Object class.

Protected objects are objects in the protected namespace that have a single ACL object and/or a single POP object and/or a single authorization rule attached to them. The user of the Admin API can use the protected object to represent an application resource. Access to such a resource can then be controlled by the ACL, POP, and authorization rule that are attached to the corresponding protected object. Each protected object is uniquely identified by its namespace ID.

Unlike the Admin C API, there is no type associated with a protected object. Extended attributes need to be used instead.

Refer to the IBM Security Access Manager for Web Administrator's Guide for more information about protected objects.

Modes: Local,Remote

See Also:

Serialized Form

Nested Class Summary

static class

PDProtObject.AccessData This class encapsulates results returned from the access and multiAccess methods.

Constructor Summary

PDProtObject(PDContext context, java.lang.String id, PDAttrs inData, PDAttrs outData, PDMessages messages)
Constructs a local object of a protected object that already exists in the policy server.

PDProtObject(PDContext context, java.lang.String id, PDAttrs inData, PDAttrs outData, PDMessages messages)
Deprecated. As of IBM Tivoli Access Manager for e-business v5.1, this constructor is replaced with the PDProtObject(PDContext,String,com.tivoli.pd.jutil.PDAttrs,com.tivoli.pd.jutil.PDAttrs,PDMessages) constructor.

Method Summary

static boolean	access(PDContext context, java.lang.String id, java.lang.String permissionStr, PDAttrs appContext, PDProtObject.AccessData outData, PDMessages messages) Checks if the user identity in the input context has the specified access to the specific protected object.
void	attachAcl(PDContext context, java.lang.String aclId, PDMessages messages) Attaches an ACL to a protected object in the policy server, and in this object.
static void	attachAcl(PDContext context, java.lang.String id, java.lang.String aclId, PDMessages messages) Attaches an ACL to a protected object in the policy server.
void	attachAuthzRule(PDContext context, java.lang.String ruleId, PDMessages messages) Attaches an authorization rule to a protected object in the policy server, and in this object.
static void	attachAuthzRule(PDContext context, java.lang.String id, java.lang.String ruleId, PDMessages messages) Attaches an authorization rule to a protected object in the policy server.
void	attachPop(PDContext context, java.lang.String popId, PDMessages messages) Attaches a POP to a protected object in the policy server, and in this object.
static void	attachPop(PDContext context, java.lang.String id, java.lang.String popId, PDMessages messages) Attaches a POP to a protected object in the policy server.
java.lang.Object	clone() Returns a copy of this object.
static void	createProtObject(PDContext context, java.lang.String id, java.lang.String description, boolean isPolicyAttachable, java.lang.String aclId, PDAttrs attributes, PDMessages messages) Deprecated. As of IBM Tivoli Access Manager for e-business v5.1, this method is replaced with the createProtObject(PDContext,String,String,boolean,String,com.tivoli.pd.jutil.PDAttrs,PDMessages) method.
static void	createProtObject(PDContext context, java.lang.String id, java.lang.String description, boolean isPolicyAttachable, java.lang.String aclId, PDAttrs attributes, PDMessages messages) Creates a protected object in the policy server.
void	deleteAttribute(PDContext context, java.lang.String attributeName, PDMessages messages) Deletes the extended attribute for this protected object in the policy server and also in this object.
static void	deleteAttribute(PDContext context, java.lang.String id, java.lang.String attributeName, PDMessages messages) Deletes the extended attribute for a protected object in the policy server.
void	deleteAttributeValue(PDContext context, java.lang.String attributeName, java.lang.String attributeValue, PDMessages messages) Deletes a value for an extended attribute for this protected object in the policy server and also in this object.
static void	deleteAttributeValue(PDContext context, java.lang.String id, java.lang.String attributeName, java.lang.String attributeValue, PDMessages messages) Deletes a value for an extended attribute for a protected object in the policy server.
static void	deleteProtObject(PDContext context, java.lang.String id, PDMessages messages) Deletes a protected object in the policy server.
void	detachAcl(PDContext context, PDMessages messages) Detaches an ACL from a protected object in the policy server, and in this object.
static void	detachAcl(PDContext context, java.lang.String id, PDMessages messages) Detaches an ACL from a protected object in the policy server.
void	detachAuthzRule(PDContext context, PDMessages messages) Detaches an authorization rule from a protected object in the policy server, and in this object.
static void	detachAuthzRule(PDContext context, java.lang.String id, PDMessages messages) Detaches an authorization rule from a protected object in the policy server.
void	detachPop(PDContext context, PDMessages messages) Detaches a POP from a protected object in the policy server, and in this object.
static void	detachPop(PDContext context, java.lang.String id, PDMessages messages) Detaches a POP from a protected object in the policy server.
boolean	equals(java.lang.Object obj) Determines whether this PDProtObject is equivalent to the input object.
static boolean	exists(PDContext context, java.lang.String id, PDMessages messages) Checks if a protected object exists in either the policy database or as an object maintained by an administration service.
PDAcl	getAcl() Deprecated. As of IBM Tivoli Access Manager for e-business v5.1, this method is replaced with the result of getAclId() passed to the PDAcl constructor.
java.lang.String	getAclId() Gets the name of the access control list (ACL) attached to this protected object.
java.util.ArrayList	getAttributeNames() Gets the names of the extended attributes for this protected object.
java.util.ArrayList	getAttributeValues(java.lang.String attributeName) Gets the value(s) of an extended attribute for this protected object.
PDAuthzRule	getAuthzRule() Deprecated. As of IBM Tivoli Access Manager for e-business v5.1, this method is replaced with the result of getAuthzRuleId() passed to the PDAuthzRule constructor.
java.lang.String	getAuthzRuleId() Gets the name of the authorization rule attached to this protected object.
java.lang.String	getDescription() Gets the description of this protected object.
java.lang.String	getEffectiveAclId() Gets the name of the access control list (ACL) that is in effect for this protected object.
java.util.ArrayList	getEffectiveAttributeNames() Gets the names of the effective extended attributes for this protected object.
java.lang.String	getEffectiveAttributeObjectId() Gets the protected object location where the effective extended attribute are defined for this protected object.
java.util.ArrayList	getEffectiveAttributeValues(java.lang.String effectiveAttributeName) Gets the value(s) of an effective extended attribute for this protected object.
java.lang.String	getEffectiveAuthzRuleId() Gets the name of the authorization rule in effect for this protected object.
java.lang.String	getEffectivePopId() Gets the name of the protected object policy (POP) that is in effect for this protected object.
java.lang.String	getId() Gets the name of this protected object.
PDPop	getPop() Deprecated. As of IBM Tivoli Access Manager for e-business v5.1, this method is replaced with the result of getPopId() passed to the PDPop constructor.
java.lang.String	getPopId() Gets the name of the protected object policy (POP) attached to this protected object.
boolean	isPolicyAttachable() Gets the isPolicyAttachable flag of this protected object.
static java.util.ArrayList	listProtObjects(PDContext context, java.lang.String id, PDAttrs inData, PDAttrs outData, PDMessages messages) Returns a list of protected objects under the specified directory in the policy server.
static java.util.ArrayList	listProtObjects(PDContext context, java.lang.String id, PDAttrs inData, PDAttrs outData, PDMessages messages) Deprecated. As of IBM Tivoli Access Manager for e-business v5.1, replaced with the listProtObjects(PDContext,String,com.tivoli.pd.jutil.PDAttrs,com.tivoli.pd.jutil.PDAttrs,PDMessages) method.
static java.util.ArrayList	listProtObjectsByAcl(PDContext context, java.lang.String aclId, PDMessages messages) Returns a list of protected objects that exist in the policy server and have the specified ACL attached.
static java.util.ArrayList	listProtObjectsByAuthzRule(PDContext context, java.lang.String ruleId, PDMessages messages) Returns a list of protected objects that exist in the policy server and have the specified authorization rule attached.
static java.util.ArrayList	listProtObjectsByPop(PDContext context, java.lang.String popId, PDMessages messages) Returns a list of protected objects that exist in the policy server and have the specified POP attached.
static boolean	multiAccess(PDContext context, java.util.ArrayList ids, java.util.ArrayList permissionStrs, java.util.ArrayList appContexts, java.util.ArrayList outDatas, PDMessages messages) Checks if the user identity in the input context has the specified accesses to the specific protected objects.
void	setAttributeValue(PDContext context, java.lang.String attributeName, java.lang.String attributeValue, PDMessages messages) Sets the value of an extended attribute for this protected object in the policy server and also in this object.
static void	setAttributeValue(PDContext context, java.lang.String id, java.lang.String attributeName, java.lang.String attributeValue, PDMessages messages) Sets the value of an extended attribute for a protected object in the policy server.
void	setDescription(PDContext context, java.lang.String newDescription, PDMessages messages) Sets the descriptive string for a protected object in the policy server, and in this object.
static void	setDescription(PDContext context, java.lang.String id, java.lang.String newDescription, PDMessages messages) Sets the descriptive string for a protected object in the policy server.
void	setPolicyAttachable(PDContext context, boolean isPolicyAttachable, PDMessages messages) Sets whether policy can be attached to a protected object in the policy server, and in this object.
static void	setPolicyAttachable(PDContext context, java.lang.String id, boolean isPolicyAttachable, PDMessages messages) Sets whether policy can be attached to a protected object in the policy server.
java.lang.String	toString() Returns a String representation of this object.

Methods inherited from class com.tivoli.pd.jutil.PDEnvironmentObject

getContext, setContext

Methods inherited from class java.lang.Object

getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

PDProtObject

public PDProtObject(PDContext context,
                    java.lang.String id,
                    PDAttrs inData,
                    PDAttrs outData,
                    PDMessages messages)
             throws PDException

Constructs a local object of a protected object that already exists in the policy server.

This constructor is equivalent to the ivadmin_protobj_get2() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

id - name of the protected object to be constructed. Cannot be null.

inData - a PDAttrs object containing pass-thru data with additional information to be communicated to the server. Can be null if no pass-thru data is needed.

outData - in/out parameter; empty PDAttrs on input; may contain pass-thru data (if an AM application server manages this protected object) on output. Can be null if no pass-thru data is expected. However, if null, then any pass-thru data returned by the server will not be returned.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

PDProtObject

public PDProtObject(PDContext context,
                    java.lang.String id,
                    PDAttrs inData,
                    PDAttrs outData,
                    PDMessages messages)
             throws PDException

Deprecated. As of IBM Tivoli Access Manager for e-business v5.1, this constructor is replaced with the PDProtObject(PDContext,String,com.tivoli.pd.jutil.PDAttrs,com.tivoli.pd.jutil.PDAttrs,PDMessages) constructor.

Constructs a local object of a protected object that already exists in the policy server.

This constructor is equivalent to the ivadmin_protobj_get2() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

id - name of the protected object to be constructed. Cannot be null.

inData - a PDAttrs object containing pass-thru data with additional information to be communicated to the server. Can be null if no pass-thru data is needed.

outData - in/out parameter; empty PDAttrs on input; may contain pass-thru data (if an AM application server manages this protected object) on output. Can be null if no pass-thru data is expected. However, if null, then any pass-thru data returned by the server will not be returned.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

Method Detail

setDescription

public void setDescription(PDContext context,
                           java.lang.String newDescription,
                           PDMessages messages)
                    throws PDException

Sets the descriptive string for a protected object in the policy server, and in this object.

This method implements the function provided by the ivadmin_protobj_setdesc() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

newDescription - descriptive string for the protected object. If null, an empty string is assumed. The input parameter is not changed.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

setPolicyAttachable

public void setPolicyAttachable(PDContext context,
                                boolean isPolicyAttachable,
                                PDMessages messages)
                         throws PDException

Sets whether policy can be attached to a protected object in the policy server, and in this object.

This method implements the function provided by the ivadmin_protobj_setpolicyattachable() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

isPolicyAttachable - true, if a policy can be attached to the protected object; false, otherwise.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

attachAcl

public void attachAcl(PDContext context,
                      java.lang.String aclId,
                      PDMessages messages)
               throws PDException

Attaches an ACL to a protected object in the policy server, and in this object. If an ACL is already attached to the protected object in question, the currently-specified ACL replaces the old one.

This method implements the function provided by the ivadmin_protobj_attachacl() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

aclId - name of the ACL to attach. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

detachAcl

public void detachAcl(PDContext context,
                      PDMessages messages)
               throws PDException

Detaches an ACL from a protected object in the policy server, and in this object. Since there can only be one ACL attached at a time to an object, the currently attached ACL is detached. Returns error if there is no ACL attached.

This method implements the function provided by the ivadmin_protobj_detachacl() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

attachPop

public void attachPop(PDContext context,
                      java.lang.String popId,
                      PDMessages messages)
               throws PDException

Attaches a POP to a protected object in the policy server, and in this object. If a POP is already attached to the protected object in question, the currently-specified POP replaces the old one.

This method implements the function provided by the ivadmin_pop_attach() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

popId - name of the POP to attach. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

detachPop

public void detachPop(PDContext context,
                      PDMessages messages)
               throws PDException

Detaches a POP from a protected object in the policy server, and in this object. Since there can only be one POP attached at a time to an object, the currently attached POP is detached. Returns error if there is no POP attached.

This method implements the function provided by the ivadmin_pop_detach() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

attachAuthzRule

public void attachAuthzRule(PDContext context,
                            java.lang.String ruleId,
                            PDMessages messages)
                     throws PDException

Attaches an authorization rule to a protected object in the policy server, and in this object. If an authorization rule is already attached to the protected object in question, the currently-specified authorization rule replaces the old one.

This method implements the function provided by the ivadmin_protobj_attachauthzrule() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

ruleId - name of PDAuthzRule to attach. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

detachAuthzRule

public void detachAuthzRule(PDContext context,
                            PDMessages messages)
                     throws PDException

Detaches an authorization rule from a protected object in the policy server, and in this object. Since there can only be one authorization rule attached at a time to an object, the currently attached authorization rule is detached. Returns error if there is no authorization rule attached.

This method implements the function provided by the ivadmin_protobj_detachauthzrule() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

setAttributeValue

public void setAttributeValue(PDContext context,
                              java.lang.String attributeName,
                              java.lang.String attributeValue,
                              PDMessages messages)
                       throws PDException

Sets the value of an extended attribute for this protected object in the policy server and also in this object.

Creates the attribute if it does not exist, and sets the specified value. If the attribute already exists, adds the specified value as an additional value for this attribute.

This method implements the function provided by the ivadmin_protobj_attrput() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

attributeName - name of the extended attribute. Cannot be null.

attributeValue - string value of the attribute. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

deleteAttribute

public void deleteAttribute(PDContext context,
                            java.lang.String attributeName,
                            PDMessages messages)
                     throws PDException

Deletes the extended attribute for this protected object in the policy server and also in this object. Returns error if the attribute does not exist.

This method implements the function provided by the ivadmin_protobj_attrdelkey() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

attributeName - name of the extended attribute. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

deleteAttributeValue

public void deleteAttributeValue(PDContext context,
                                 java.lang.String attributeName,
                                 java.lang.String attributeValue,
                                 PDMessages messages)
                          throws PDException

Deletes a value for an extended attribute for this protected object in the policy server and also in this object. Returns error if the attribute does not exist.

This method implements the function provided by the ivadmin_protobj_attrdelval() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

attributeName - name of the extended attribute. Cannot be null.

attributeValue - string value of the extended attribute. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

getId

public java.lang.String getId()
                       throws PDException

Gets the name of this protected object.

This method implements the function provided by the ivadmin_protobj_getid() C API.

Returns:

the name of this protected object. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

getDescription

public java.lang.String getDescription()
                                throws PDException

Gets the description of this protected object.

This method implements the function provided by the ivadmin_protobj_getdescription() C API.

Returns:

the description of this protected object. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

isPolicyAttachable

public boolean isPolicyAttachable()
                           throws PDException

Gets the isPolicyAttachable flag of this protected object.

This method implements the function provided by the ivadmin_protobj_getpolicyattachable() C API.

Returns:

true, if a policy can be attached to this protected object; false, otherwise.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

getAcl

public PDAcl getAcl()
             throws PDException

Deprecated. As of IBM Tivoli Access Manager for e-business v5.1, this method is replaced with the result of getAclId() passed to the PDAcl constructor.

Gets the ACL of this protected object.

This method implements the function provided by the ivadmin_protobj_getacl() C API.

Returns:

a PDAcl object attached to this protected object. Returns null if no Acl is currently attached.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

getPop

public PDPop getPop()
             throws PDException

Deprecated. As of IBM Tivoli Access Manager for e-business v5.1, this method is replaced with the result of getPopId() passed to the PDPop constructor.

Gets the POP attached to this protected object.

This method implements the function provided by the ivadmin_protobj_getpop() C API.

Returns:

the PDPop object attached to this protected object. Returns null if no POP is currently attached.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

getAuthzRule

public PDAuthzRule getAuthzRule()
                         throws PDException

Deprecated. As of IBM Tivoli Access Manager for e-business v5.1, this method is replaced with the result of getAuthzRuleId() passed to the PDAuthzRule constructor.

Gets the authorization rule attached to this protected object.

This method implements the function provided by the ivadmin_protobj_getauthzrule() C API.

Returns:

a PDAuthzRule object attached to this protected object. Returns null if no authorization rule is currently attached.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

getAclId

public java.lang.String getAclId()
                          throws PDException

Gets the name of the access control list (ACL) attached to this protected object. If no ACL is attached, null is returned.

This method implements the function provided by the ivadmin_protobj_getaclid() C API.

Returns:

the name of the access control list (ACL) attached to this protected object, or null if no ACL is attached.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

getPopId

public java.lang.String getPopId()
                          throws PDException

Gets the name of the protected object policy (POP) attached to this protected object. If no POP is attached, null is returned.

This method implements the function provided by the ivadmin_protobj_getpopid() C API.

Returns:

the name of the protected object policy (POP) attached to this protected object, or null if no POP is attached.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

getAuthzRuleId

public java.lang.String getAuthzRuleId()
                                throws PDException

Gets the name of the authorization rule attached to this protected object. If no authorization rule is attached, null is returned.

This method implements the function provided by the ivadmin_protobj_getauthzruleid() C API.

Returns:

the name of the authorization rule attached to this protected object, or null if no authorization rule is attached.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

getEffectiveAclId

public java.lang.String getEffectiveAclId()
                                   throws PDException

Gets the name of the access control list (ACL) that is in effect for this protected object. If an ACL is attached directly to this object, then that is the effective ACL. If no ACL is attached directly to this object, then the object heirarchy is traversed upward and the first ACL encountered in the traversal is this object's effective ACL. Since the root of the object hierarchy always has an ACL attached to it, the effective ACL of any protected object will never be null.

This method implements the function provided by the ivadmin_protobj_geteffaclid() C API.

Returns:

the name of the access control list (ACL) that is in effect for this protected object. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

getEffectivePopId

public java.lang.String getEffectivePopId()
                                   throws PDException

Gets the name of the protected object policy (POP) that is in effect for this protected object. If a POP is attached directly to this object, then that is the effective POP. If no POP is attached directly to this object, then the object hierarchy is traversed upward and the first POP encountered in the traversal is this object's effective POP. If no POP is encountered in the traversal, null is returned.

This method implements the function provided by the ivadmin_protobj_geteffpopid() C API.

Returns:

the name of the protected object policy (POP) in effect for this protected object, or null if no POP is in effect.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

getEffectiveAuthzRuleId

public java.lang.String getEffectiveAuthzRuleId()
                                         throws PDException

Gets the name of the authorization rule in effect for this protected object. If an authorization is attached directly to this object, then that is the effective rule. If no authorization rule is attached directly to this object, then the object hierarchy is traversed upward and the first authorization rule encountered in the traversal is this object's effective rule. If no authorization rule is encountered in the traversal, null is returned.

This method implements the function provided by the ivadmin_protobj_geteffauthzruleid() C API.

Returns:

the name of the authorization rule in effect for this protected object, or null if no authorization rule is in effect.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

getAttributeNames

public java.util.ArrayList getAttributeNames()
                                      throws PDException

Gets the names of the extended attributes for this protected object.

This method implements the function provided by the ivadmin_protobj_attrlist() C API.

Returns:

an ArrayList of strings that represent the names of the extended attributes of this protected object. Empty ArrayList if this object has no extended attributes.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

getEffectiveAttributeNames

public java.util.ArrayList getEffectiveAttributeNames()
                                               throws PDException

Gets the names of the effective extended attributes for this protected object.

This method implements the function provided by the ivadmin_protobj_effattrlist() C API.

Returns:

an ArrayList of strings that represent the names of the effective extended attributes of this protected object. Empty ArrayList if this object has no extended attributes.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

getAttributeValues

public java.util.ArrayList getAttributeValues(java.lang.String attributeName)
                                       throws PDException

Gets the value(s) of an extended attribute for this protected object.

This method implements the function provided by the ivadmin_protobj_attrget() C API.

Parameters:

attributeName - name of the extended attribute

Returns:

an ArrayList of strings that represent the values for the specified extended attribute of this protected object. Empty ArrayList if there are no values for the specified attribute name.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

getEffectiveAttributeValues

public java.util.ArrayList getEffectiveAttributeValues(java.lang.String effectiveAttributeName)
                                                throws PDException

Gets the value(s) of an effective extended attribute for this protected object.

This method implements the function provided by the ivadmin_protobj_effattrget() C API.

Parameters:

effectiveAttributeName - name of the effective extended attribute

Returns:

an ArrayList of strings that represent the values for the specified effective extended attribute of this protected object. Empty ArrayList if there are no values for the specified attribute name.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

getEffectiveAttributeObjectId

public java.lang.String getEffectiveAttributeObjectId()
                                               throws PDException

Gets the protected object location where the effective extended attribute are defined for this protected object.

This method implements part of the function provided by the ivadmin_protobj_effattrget() C API.

Returns:

parent objectName where the extended attributes are defined. For the case where the protected object the method is operating on, has the extended attributes defined for it, this object name will be returned. If there are no extended attributes, null is returned.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

toString

public java.lang.String toString()

Returns a String representation of this object.

Overrides:

toString in class java.lang.Object

clone

public java.lang.Object clone()

Returns a copy of this object.

Overrides:

clone in class java.lang.Object

equals

public boolean equals(java.lang.Object obj)

Determines whether this PDProtObject is equivalent to the input object.

Overrides:

equals in class java.lang.Object

exists

public static boolean exists(PDContext context,
                             java.lang.String id,
                             PDMessages messages)
                      throws PDException

Checks if a protected object exists in either the policy database or as an object maintained by an administration service. Some protected "objects" that can be listed and shown do not really exist. Rather, they serve as placeholders in the protected object hierarchy.

This method is equivalent to the ivadmin_protobj_exists() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

id - name of the protected "object". Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Returns:

true, if the object exists in either the policy database or as an object maintained by an administration service; false, otherwise.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

access

public static boolean access(PDContext context,
                             java.lang.String id,
                             java.lang.String permissionStr,
                             PDAttrs appContext,
                             PDProtObject.AccessData outData,
                             PDMessages messages)
                      throws PDException

Checks if the user identity in the input context has the specified access to the specific protected object. Note that this method results in a remote call to the pdacld server, irregardless of the mode.

This method is equivalent to the ivadmin_protobj_access() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

id - name of the protected object. Cannot be null.

permissionStr - permission string (eg Tvx). Cannot be null.

appContext - a PDAttrs object containing pass-through data with additional information to be communicated to the server. Can be null if no pass-thru data is needed.

outData - in/out parameter; empty PDProtObject.AccessData object on input; Cannot be null. PDProtObject.AccessData object on output. Accessor methods in PDProtObject.AccessData class can be used to get the access results.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Returns:

true, if the access call succeeds; false, otherwise.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

multiAccess

public static boolean multiAccess(PDContext context,
                                  java.util.ArrayList ids,
                                  java.util.ArrayList permissionStrs,
                                  java.util.ArrayList appContexts,
                                  java.util.ArrayList outDatas,
                                  PDMessages messages)
                           throws PDException

Checks if the user identity in the input context has the specified accesses to the specific protected objects.

This method is equivalent to the ivadmin_protobj_multiAccess() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

ids - list of protected object names. Cannot be null.

permissionStrs - list of permission strings (for example, Tvx). Cannot be null.

appContexts - Specifies an Arraylist of PDAttrs objects containing pass-through data with additional information to be communicated to the server. Can be null if no pass-thru data is needed.

outDatas - in/out parameter; empty ArrayList on input; Cannot be null. Contains the statuses of the access queries in a list of PDProtObject.AccessData objects on output. Accessor methods in the AccessData class can be used to get the access results.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

The length of all the input arrays should be the same.

Returns:

true, if the multiAccess call succeeds; false, otherwise.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

createProtObject

public static void createProtObject(PDContext context,
                                    java.lang.String id,
                                    java.lang.String description,
                                    boolean isPolicyAttachable,
                                    java.lang.String aclId,
                                    PDAttrs attributes,
                                    PDMessages messages)
                             throws PDException

Deprecated. As of IBM Tivoli Access Manager for e-business v5.1, this method is replaced with the createProtObject(PDContext,String,String,boolean,String,com.tivoli.pd.jutil.PDAttrs,PDMessages) method.

Creates a protected object in the policy server.

This method is equivalent to the ivadmin_protobj_create() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

id - name of the protected object. A valid name needs to start with the name of an existing PDProtObjectSpace followed by a forward slash and one or more characters. Cannot be null.

description - description of the protected object. If null, an empty string is assumed. The input parameter is not changed.

isPolicyAttachable - can policy be attached to this protected object?

aclId - name of the ACL to be attached. Will be supported in the future. For now, pass a null value for this parameter. Use the attachAcl() method to set the ACL for the protected object.

attributes - a PDAttrs extended attributes for this protected object. Will be supported in the future. For now, pass a null value for this parameter. Use the setAttributeValue() method to set the attributes for the protected object.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

createProtObject

public static void createProtObject(PDContext context,
                                    java.lang.String id,
                                    java.lang.String description,
                                    boolean isPolicyAttachable,
                                    java.lang.String aclId,
                                    PDAttrs attributes,
                                    PDMessages messages)
                             throws PDException

Creates a protected object in the policy server.

This method is equivalent to the ivadmin_protobj_create() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

id - name of the protected object. A valid name needs to start with the name of an existing PDProtObjectSpace followed by a forward slash and one or more characters. Cannot be null.

description - description of the protected object. If null, an empty string is assumed. The input parameter is not changed.

isPolicyAttachable - can policy be attached to this protected object?

aclId - name of the ACL to be attached. Will be supported in the future. For now, pass a null value for this parameter. Use the attachAcl() method to set the ACL for the protected object.

attributes - extended attributes for this protected object. Will be supported in the future. For now, pass a null value for this parameter. Use the setAttributeValue() method to set the attributes for the protected object.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

listProtObjects

public static java.util.ArrayList listProtObjects(PDContext context,
                                                  java.lang.String id,
                                                  PDAttrs inData,
                                                  PDAttrs outData,
                                                  PDMessages messages)
                                           throws PDException

Returns a list of protected objects under the specified directory in the policy server. It only returns objects immediately under this directory and does not include subdirectories.

This method is equivalent to the ivadmin_protobj_list3() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

id - Parent directory within the protected objectspace. Cannot be null.

inData - a PDAttrs object containing pass-thru data with additional information to be communicated to the server.

outData - in/out parameter; empty PDAttrs on input; may contain pass-thru data (if an AM application server manages this protected object directory) on output. Can be null if no pass-thru data is expected. However, if null, then any pass-thru data returned by the server will not be returned.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Returns:

an ArrayList of Strings that represent the names of all the protected objects under the specified directory. Empty ArrayList if no such protected objects exist.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

listProtObjects

public static java.util.ArrayList listProtObjects(PDContext context,
                                                  java.lang.String id,
                                                  PDAttrs inData,
                                                  PDAttrs outData,
                                                  PDMessages messages)
                                           throws PDException

Deprecated. As of IBM Tivoli Access Manager for e-business v5.1, replaced with the listProtObjects(PDContext,String,com.tivoli.pd.jutil.PDAttrs,com.tivoli.pd.jutil.PDAttrs,PDMessages) method.

Returns a list of protected objects under the specified directory in the policy server. It only returns objects immediately under this directory and does not include subdirectories.

This method is equivalent to the ivadmin_protobj_list3() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

id - Parent directory within the protected objectspace. Cannot be null.

inData - Specifies a PDAttrs object containing pass-thru data with additional information to be communicated to the server.

outData - in/out parameter; empty PDAttrs on input; may contain pass-thru data (if an AM application server manages this protected object directory) on output. Can be null if no pass-thru data is expected. However, if null, then any pass-thru data returned by the server will not be returned.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Returns:

an ArrayList of Strings that represent the names of all the protected objects under the specified directory. Empty ArrayList if no such protected objects exist.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

listProtObjectsByAcl

public static java.util.ArrayList listProtObjectsByAcl(PDContext context,
                                                       java.lang.String aclId,
                                                       PDMessages messages)
                                                throws PDException

Returns a list of protected objects that exist in the policy server and have the specified ACL attached.

This method is equivalent to the ivadmin_protobj_listbyacl() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

aclId - name of the ACL. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Returns:

an ArrayList of Strings that represent the names of all the protected objects that have the specified ACL attached to them. Empty ArrayList if no such protected objects exist.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

listProtObjectsByPop

public static java.util.ArrayList listProtObjectsByPop(PDContext context,
                                                       java.lang.String popId,
                                                       PDMessages messages)
                                                throws PDException

Returns a list of protected objects that exist in the policy server and have the specified POP attached.

This method is equivalent to the ivadmin_pop_find() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

popId - name of the Pop. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Returns:

an ArrayList of Strings that represent the names of all the protected objects that have the specified POP attached to them. Empty ArrayList if no such protected objects exist.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

listProtObjectsByAuthzRule

public static java.util.ArrayList listProtObjectsByAuthzRule(PDContext context,
                                                             java.lang.String ruleId,
                                                             PDMessages messages)
                                                      throws PDException

Returns a list of protected objects that exist in the policy server and have the specified authorization rule attached.

This method is equivalent to the ivadmin_protobj_listbyauthzrule() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

ruleId - name of the authorization rule. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Returns:

an ArrayList of Strings that represent the names of all the protected objects that have the specified authorization rule (PDAuthzRule) attached to them. Empty ArrayList if no such protected objects exist.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

deleteProtObject

public static void deleteProtObject(PDContext context,
                                    java.lang.String id,
                                    PDMessages messages)
                             throws PDException

Deletes a protected object in the policy server.

This method is equivalent to the ivadmin_protobj_delete() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

id - name of the protected object to be deleted. A valid name is that of a protected object that already exists. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

setDescription

public static void setDescription(PDContext context,
                                  java.lang.String id,
                                  java.lang.String newDescription,
                                  PDMessages messages)
                           throws PDException

Sets the descriptive string for a protected object in the policy server.

This method implements the function provided by the ivadmin_protobj_setdesc() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

id - name of the protected object. Cannot be null.

newDescription - Descriptive string for the protected object. If null, an empty string is assumed. The input parameter is not changed.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

setPolicyAttachable

public static void setPolicyAttachable(PDContext context,
                                       java.lang.String id,
                                       boolean isPolicyAttachable,
                                       PDMessages messages)
                                throws PDException

Sets whether policy can be attached to a protected object in the policy server.

This method implements the function provided by the ivadmin_protobj_setpolicyattachable() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

id - name of the protected object. Cannot be null.

isPolicyAttachable - true, if a policy can be attached to the protected object; false, otherwise.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

attachAcl

public static void attachAcl(PDContext context,
                             java.lang.String id,
                             java.lang.String aclId,
                             PDMessages messages)
                      throws PDException

Attaches an ACL to a protected object in the policy server. If an ACL is already attached to the protected object in question, the currently-specified ACL replaces the old one.

This method implements the function provided by the ivadmin_protobj_attachacl() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

id - name of the protected object. Cannot be null.

aclId - name of the ACL to attach. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

detachAcl

public static void detachAcl(PDContext context,
                             java.lang.String id,
                             PDMessages messages)
                      throws PDException

Detaches an ACL from a protected object in the policy server. Since there can only be one ACL attached at a time to an object, the currently attached ACL is detached. Returns error if there is no ACL attached.

This method implements the function provided by the ivadmin_protobj_detachacl() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

id - name of the protected object. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

attachPop

public static void attachPop(PDContext context,
                             java.lang.String id,
                             java.lang.String popId,
                             PDMessages messages)
                      throws PDException

Attaches a POP to a protected object in the policy server. If a POP is already attached to the protected object in question, the currently-specified POP replaces the old one.

This method implements the function provided by the ivadmin_pop_attach() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

id - name of the protected object. Cannot be null.

popId - name of the POP to attach. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

detachPop

public static void detachPop(PDContext context,
                             java.lang.String id,
                             PDMessages messages)
                      throws PDException

Detaches a POP from a protected object in the policy server. Since there can only be one POP attached at a time to an object, the currently attached POP is detached. Returns error if there is no POP attached.

This method implements the function provided by the ivadmin_pop_detach() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

id - name of the protected object. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

attachAuthzRule

public static void attachAuthzRule(PDContext context,
                                   java.lang.String id,
                                   java.lang.String ruleId,
                                   PDMessages messages)
                            throws PDException

Attaches an authorization rule to a protected object in the policy server. If an authorization rule is already attached to the protected object in question, the currently-specified authorization rule replaces the old one.

This method implements the function provided by the ivadmin_protobj_attachauthzrule() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

id - name of the protected object. Cannot be null.

ruleId - name of the PDAuthzRule to attach. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

detachAuthzRule

public static void detachAuthzRule(PDContext context,
                                   java.lang.String id,
                                   PDMessages messages)
                            throws PDException

Detaches an authorization rule from a protected object in the policy server. Since there can only be one authorization rule attached at a time to an object, the currently attached authorization rule is detached. Returns error if there is no authorization rule attached.

This method implements the function provided by the ivadmin_protobj_detachauthzrule() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

id - name of the protected object. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

setAttributeValue

public static void setAttributeValue(PDContext context,
                                     java.lang.String id,
                                     java.lang.String attributeName,
                                     java.lang.String attributeValue,
                                     PDMessages messages)
                              throws PDException

Sets the value of an extended attribute for a protected object in the policy server.

Creates the attribute if it does not exist, and sets the specified value. If the attribute already exists, adds the specified value as an additional value for this attribute.

This method implements the function provided by the ivadmin_protobj_attrput() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

id - name of the protected object. Cannot be null.

attributeName - name of the extended attribute. Cannot be null.

attributeValue - string value of the attribute. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

deleteAttribute

public static void deleteAttribute(PDContext context,
                                   java.lang.String id,
                                   java.lang.String attributeName,
                                   PDMessages messages)
                            throws PDException

Deletes the extended attribute for a protected object in the policy server. Returns error if the attribute does not exist.

This method implements the function provided by the ivadmin_protobj_attrdelkey() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

id - name of the protected object. Cannot be null.

attributeName - name of the extended attribute. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.

deleteAttributeValue

public static void deleteAttributeValue(PDContext context,
                                        java.lang.String id,
                                        java.lang.String attributeName,
                                        java.lang.String attributeValue,
                                        PDMessages messages)
                                 throws PDException

Deletes a value for an extended attribute for a protected object in the policy server. Returns error if the attribute does not exist.

This method implements the function provided by the ivadmin_protobj_attrdelval() C API.

Parameters:

context - PDContext to be used to communicate with the policy server. Cannot be null.

id - name of the protected object. Cannot be null.

attributeName - name of the extended attribute. Cannot be null.

attributeValue - value of the extended attribute. Cannot be null.

messages - in/out parameter; empty PDMessages on input; may contain zero or more informational or warning messages on output. Cannot be null.

Throws:

PDException - if an error occurs. This exception may contain error and message codes defined in the product Error Message Reference document.