Package com.identityworksllc.iiq.common.access

Class CommonAccessChecks

java.lang.Object

com.identityworksllc.iiq.common.access.CommonAccessChecks

public class CommonAccessChecks
extends Object

Implements some common access checks that are more complex than a straightforward implementation.

Constructor Summary

Constructors

Constructor	Description
CommonAccessChecks(sailpoint.api.SailPointContext context, sailpoint.object.Identity source)	Constructs a new CommonAccessChecks utility with the given context and identity
CommonAccessChecks(sailpoint.rest.plugin.BasePluginResource pluginResource)	Constructs a new CommonAccessChecks utility with the given existing BasePluginResource.

Method Summary

Modifier and Type	Method	Description
boolean	canSeeLinkField(sailpoint.object.Identity target, String applicationName, String fieldName)	Returns true if the logged in user is allowed to view the specific field on the specified account, owned by the specified person.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

CommonAccessChecks

public CommonAccessChecks(sailpoint.api.SailPointContext context,
                          sailpoint.object.Identity source)

Constructs a new CommonAccessChecks utility with the given context and identity

Parameters:

context - The IIQ context

source - The requesting / subject Identity

CommonAccessChecks

public CommonAccessChecks(sailpoint.rest.plugin.BasePluginResource pluginResource)

Constructs a new CommonAccessChecks utility with the given existing BasePluginResource.

Parameters:

pluginResource - The plugin resource

Method Detail

canSeeLinkField

public boolean canSeeLinkField(sailpoint.object.Identity target,
                               String applicationName,
                               String fieldName)
                        throws sailpoint.tools.GeneralException

Returns true if the logged in user is allowed to view the specific field on the specified account, owned by the specified person.

This will check three different criteria:

• view:account:(application):field:(field)
• view:account:field:(field)
• view:account:(application)

If the first criteria exists explicitly (i.e., not via a substring), it is authoritative and the other two are skipped.

Otherwise, both the second and third criteria must allow access.

Parameters:

target - The owner of the account

applicationName - The name of the application

fieldName - The field name on the application

Returns:

True if the subject Identity can see the given field on the given account type

Throws:

sailpoint.tools.GeneralException - if anything fails during the check