<map:pipelines> <map:pipeline> <map:match pattern="**"> <map:act type="authorizer"> <map:parameter name="log" value="off"/> <!-- URI history per client --> <map:parameter name="public" value="identify;authenticate"/> <map:parameter name="concrete-authorizer" value="org.apache.lenya.cms.ac.PMLAuthorizer"/> <!--<map:parameter name="concrete-authorizer" value="org.oasis-open.xacml.Authorizer"/>--> <map:match pattern="identify"> <map:generate/> <map:transform src="stylesheets/login.xsl"/> <map:serialize/> </map:match"> <map:match pattern="authenticate"> <map:act type="authenticator"> <map:parameter name="log" value="on"/> <map:parameter name="concrete-authenticator" value="org.apache.lenya.cms.ac.IMLAuthenticator"/> <!--<map:parameter name="concrete-authenticator" value="org.apache.lenya.cms.ac.LDAPAuthenticator"/>--> <map:redirect-to uri="{protected_destination}" session="true"/> </map:act> <map:redirect-to uri="identify" session="true"/> </map:match"> <!-- you finally made it --> <map:match pattern="**"> <map:read src="resources/html/permission-granted.html" mime-type="text/html"/> </map:match"> </map:act> <map:redirect-to uri="identify" session="true"/> </map:match> </map:pipeline> </map:pipelines>
The authorizer should be exchangeable.
<?xml version"1.0"?> <policy> <object match="/"> <subjects> <machine ip="127.0.0.1"> <actions> <read/> </actions> </machine> <user id="levi"> <actions> <read/> </actions> </user> <group id="useradministrator"> <actions> <read/> <write/> </actions> </group> </subjects> </object> <object match="/identity/password"> <subjects> <user id="levi"> <actions> <write/> </actions> </user> </subjects> </object> </policy>
The authenticator should be exchangeable.
Example 1: org.apache.lenya.cms.ac.IMLAuthenticator (donald.iml)
Example 2: org.apache.lenya.cms.ac.LDAPAuthenticator (LDAP on central server)
The authenticator should be able to negotiate the encryption method with the requestor.
The authenticator should be able to communicate with the authorizer.
This is for instance necessary in the case of conditional authorization:
Example: For the user "levi" all requests shall be logged by the authorizer.
For the user "anonymous" only "permission denied requests" shall be logged.
<?xml version"1.0"?> <identity> <password type="md5">sdsdsds6868fy8678sd68</password> <comment>Levi Brucker</comment> <groups> <group>editor</group> </groups> <expire> <year>2001</year> </expire> </identity>