SubjectDelegator.java 文件源码

public synchronized AccessControlContext
    delegatedContext(AccessControlContext authenticatedACC,
                     Subject delegatedSubject,
                     boolean removeCallerContext)
        throws SecurityException {

    if (principalsCache == null || accCache == null) {
        principalsCache =
                new CacheMap<Subject, Principal[]>(PRINCIPALS_CACHE_SIZE);
        accCache =
                new CacheMap<Subject, AccessControlContext>(ACC_CACHE_SIZE);
    }

    // Retrieve the principals for the given
    // delegated subject from the cache
    //
    Principal[] delegatedPrincipals = principalsCache.get(delegatedSubject);

    // Convert the set of principals stored in the
    // delegated subject into an array of principals
    // and store it in the cache
    //
    if (delegatedPrincipals == null) {
        delegatedPrincipals =
            delegatedSubject.getPrincipals().toArray(new Principal[0]);
        principalsCache.put(delegatedSubject, delegatedPrincipals);
    }

    // Retrieve the access control context for the
    // given delegated subject from the cache
    //
    AccessControlContext delegatedACC = accCache.get(delegatedSubject);

    // Build the access control context to be used
    // when executing code as the delegated subject
    // and store it in the cache
    //
    if (delegatedACC == null) {
        if (removeCallerContext) {
            delegatedACC =
                JMXSubjectDomainCombiner.getDomainCombinerContext(
                                                          delegatedSubject);
        } else {
            delegatedACC =
                JMXSubjectDomainCombiner.getContext(delegatedSubject);
        }
        accCache.put(delegatedSubject, delegatedACC);
    }

    // Check if the subject delegation permission allows the
    // authenticated subject to assume the identity of each
    // principal in the delegated subject
    //
    final Principal[] dp = delegatedPrincipals;
    PrivilegedAction<Void> action =
        new PrivilegedAction<Void>() {
            public Void run() {
                for (int i = 0 ; i < dp.length ; i++) {
                    final String pname =
                        dp[i].getClass().getName() + "." + dp[i].getName();
                    Permission sdp =
                        new SubjectDelegationPermission(pname);
                    AccessController.checkPermission(sdp);
                }
                return null;
            }
        };
    AccessController.doPrivileged(action, authenticatedACC);

    return delegatedACC;
}