// ensure an authorization policy
AsnOperation operation = context.getOperation();
if (operation.getAuthPolicy() == null) {
String msg = "An authorization policy was not configured.";
throw new ConfigurationException(msg);
}
// check the user, ensure an authenticated user if required
User user = context.getRequestContext().getUser();
boolean userWasAuthenticated = false;
if ((user != null) && user.getAuthenticationStatus().getWasAuthenticated()) {
userWasAuthenticated = true;
}
if (operation.getAuthPolicy().getAuthenticationRequired() && !userWasAuthenticated) {
throw new NotAuthorizedException("Not authorized.");
}
// determine the principals
AsnPrincipals principals = null;
boolean isWrite = false;
if (action.equals(AsnAuthorizer.ACTION_CREATE)) {
isWrite = true;
principals = operation.getAuthPolicy().getCreatePrincipals();
if (principals == null) {
String msg = "Create principals were not configured.";
throw new ConfigurationException(msg);
}
} else if (action.equals(AsnAuthorizer.ACTION_DELETE)) {
isWrite = true;
principals = operation.getAuthPolicy().getDeletePrincipals();
if (principals == null) {
String msg = "Delete principals were not configured.";
throw new ConfigurationException(msg);
}
} else if (action.equals(AsnAuthorizer.ACTION_ENABLE) ||
action.equals(AsnAuthorizer.ACTION_DISABLE)) {
isWrite = true;
principals = operation.getAuthPolicy().getEnableDisablePrincipals();
if (principals == null) {
String msg = "Enable/Disable principals were not configured.";
throw new ConfigurationException(msg);
}
} else if (action.equals(AsnAuthorizer.ACTION_QUERY)) {
principals = operation.getAuthPolicy().getQueryPrincipals();
if (principals == null) {
String msg = "Query principals were not configured.";
throw new ConfigurationException(msg);
}
} else if (action.equals(AsnAuthorizer.ACTION_UPDATE)) {
isWrite = true;
principals = operation.getAuthPolicy().getQueryPrincipals();
if (principals == null) {
String msg = "Query principals were not configured.";
throw new ConfigurationException(msg);
}
}
// hard check to ensure an authenticated user for any modifications
// (regardless of configuration)