java.rmi.constraint
Interface SecurityConstraint

All Known Subinterfaces:
RelativeTimeConstraint
All Known Implementing Classes:
ClientAuthentication, ClientMaxPrincipal, ClientMaxPrincipalType, ClientMinPrincipal, ClientMinPrincipalType, Confidentiality, Delegation, DelegationAbsoluteTime, Integrity, ServerAuthentication, ServerMinPrincipal

public interface SecurityConstraint

Defines the interface to security constraints.

Since:
1.4

Method Summary
 SecurityConstraint reduceBy(SecurityConstraint c)
          Returns the smallest representable subset of this constraint that contains the intersection of this constraint with the specified constraint, or null if there is no intersection.
 

Method Detail

reduceBy

public SecurityConstraint reduceBy(SecurityConstraint c)
Returns the smallest representable subset of this constraint that contains the intersection of this constraint with the specified constraint, or null if there is no intersection. If there is no intersection, the two constraints are said to conflict. If c2 is a subset of (or equal to) c1, the result of c1.reduceBy(c2) is equal to c2.

In general, most developers do not need to be concerned with the detailed semantics of this method; it is primarily intended for use within the framework to reduce complex combinations of constraints into simpler forms for interpretation by security providers.

This method is idempotent (c.reduceBy(c) is equal to c) and stable (if c1.reduceBy(c2) is equal to non-null c3, then both c1.reduceBy(c3) and c3.reduceBy(c2) are equal to c3). For constraints that are instances of the same class (using the element type if a constraint is a ConstraintAlternatives instance), this method is both commutative (c1.reduceBy(c2) is equal to c2.reduceBy(c1)) and, for constraints that do not conflict, associative (c1.reduceBy(c2).reduceBy(c3) is equal to c1.reduceBy(c2.reduceBy(c3))). For constraints that are instances of different classes, this method might not be commutative or associative, but it is commutative if the constraints conflict.

As an example of non-commutativity, Integrity.YES.reduceBy(Delegation.YES) is equal to Integrity.YES but Delegation.YES.reduceBy(Integrity.YES) is equal to Delegation.YES.

As an example of non-associativity, suppose p1 is a Principal instance of type t1 and p2 is a Principal instance of type t2. Let minT{t1} represent a ClientMinPrincipalType instance containing t1, let maxP{p1,p2} represent a ClientMaxPrincipal instance containing p1 and p2, and let minP{p2} represent a ClientMinPrincipal instance containing p2. Then minT{t1}.reduceBy(maxP{p1,p2}).reduceBy(minP{p2}) is equal to minP{p1}.reduceBy(minP{p2}) which in turn is equal to minP{p1,p2}, that is, a ClientMinPrincipal instance containing both p1 and p2. But grouped the other way, minT{t1}.reduceBy(maxP{p1,p2}.reduceBy(minP{p2})) is equal to minT{t1}.reduceBy(maxP{p1,p2}) which in turn is equal to minP{p1}, that is, a ClientMinPrincipal instance containing just p1.

For any two constraint classes t1 and t2, neither of which are ConstraintAlternatives, there is some class t (which can be t1, t2, or some class other than ConstraintAlternatives) such that for any instance c1 of t1 and any instance c2 of t2, the result of c1.reduceBy(c2) may be null, an instance of t, or c2. In most cases, only one or two of the three results is actually possible. For any instance c1 of t1 and any ConstraintAlternatives instance c2 containing instances of t2, the result of c1.reduceBy(c2) may be null, an instance of t, a ConstraintAlternatives instance containing instances of t, an element of c2, or a ConstraintAlternatives instance containing elements of c2.

For any constraint instance c1 and any ConstraintAlternatives instance c2, the result of c1.reduceBy(c2) is obtained as follows. A collection is formed from the non-null values returned by c1.reduceBy(e2) for each element e2 of c2. If all of the values are null, the value returned by this method is null. If the collection contains constraints of different type, then individual constraints are replaced as necessary with superset constraints to obtain a collection of homogeneous type. The value returned by this method is then the result of calling ConstraintAlternatives.create with the collection.

Parameters:
c - a constraint
Returns:
the smallest representable subset of this constraint that intersects with the specified constraint, or null if there is no intersection


Copyright © 2000 Sun Microsystems, Inc. All rights reserved