|
|||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | ||||||||
SUMMARY: INNER | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |
Defines the interface to security constraints.
Method Summary | |
SecurityConstraint |
reduceBy(SecurityConstraint c)
Returns the smallest representable subset of this constraint that contains the intersection of this constraint with the specified constraint, or null if there is no intersection. |
Method Detail |
public SecurityConstraint reduceBy(SecurityConstraint c)
null
if there is no intersection. If there
is no intersection, the two constraints are said to conflict. If
c2
is a subset of (or equal to) c1
, the
result of c1.reduceBy(c2)
is equal to c2
.
In general, most developers do not need to be concerned with the detailed semantics of this method; it is primarily intended for use within the framework to reduce complex combinations of constraints into simpler forms for interpretation by security providers.
This method is idempotent (c.reduceBy(c)
is equal to
c
) and stable (if c1.reduceBy(c2)
is equal
to non-null
c3
, then both
c1.reduceBy(c3)
and c3.reduceBy(c2)
are equal
to c3
). For constraints that are instances of the same
class (using the element type if a constraint is a
ConstraintAlternatives
instance), this
method is both commutative (c1.reduceBy(c2)
is equal to
c2.reduceBy(c1)
) and, for constraints that do not conflict,
associative (c1.reduceBy(c2).reduceBy(c3)
is equal to
c1.reduceBy(c2.reduceBy(c3))
). For constraints that are
instances of different classes, this method might not be commutative or
associative, but it is commutative if the constraints conflict.
As an example of non-commutativity,
Integrity.YES.reduceBy(Delegation.YES)
is equal to
Integrity.YES
but
Delegation.YES.reduceBy(Integrity.YES)
is equal to
Delegation.YES
.
As an example of non-associativity, suppose p1
is a
Principal
instance of type t1
and
p2
is a Principal
instance of type
t2
. Let minT{t1}
represent a
ClientMinPrincipalType
instance containing
t1
, let maxP{p1,p2}
represent a
ClientMaxPrincipal
instance containing p1
and
p2
, and let minP{p2}
represent a
ClientMinPrincipal
instance containing p2
.
Then minT{t1}.reduceBy(maxP{p1,p2}).reduceBy(minP{p2})
is
equal to minP{p1}.reduceBy(minP{p2})
which in turn is
equal to minP{p1,p2}
, that is, a
ClientMinPrincipal
instance containing both
p1
and p2
. But grouped the other way,
minT{t1}.reduceBy(maxP{p1,p2}.reduceBy(minP{p2}))
is equal
to minT{t1}.reduceBy(maxP{p1,p2})
which in turn is equal
to minP{p1}
, that is, a ClientMinPrincipal
instance containing just p1
.
For any two constraint classes t1
and t2
,
neither of which are ConstraintAlternatives
, there is some
class t
(which can be t1
, t2
, or
some class other than ConstraintAlternatives
) such that
for any instance c1
of t1
and any instance
c2
of t2
, the result of
c1.reduceBy(c2)
may be null
, an instance of
t
, or c2
. In most cases, only one or two of
the three results is actually possible. For any instance
c1
of t1
and any
ConstraintAlternatives
instance c2
containing instances of t2
, the result of
c1.reduceBy(c2)
may be null
, an instance of
t
, a ConstraintAlternatives
instance
containing instances of t
, an element of c2
,
or a ConstraintAlternatives
instance containing elements
of c2
.
For any constraint instance c1
and any
ConstraintAlternatives
instance c2
,
the result of c1.reduceBy(c2)
is obtained as follows. A
collection is formed from the non-null
values returned by
c1.reduceBy(e2)
for each element e2
of
c2
. If all of the values are null
, the value
returned by this method is null
. If the collection
contains constraints of different type, then individual constraints
are replaced as necessary with superset constraints to obtain a
collection of homogeneous type. The value returned by this method is
then the result of calling ConstraintAlternatives.create
with the collection.
c
- a constraintnull
if
there is no intersection
|
|||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | ||||||||
SUMMARY: INNER | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |