A Subject represents a grouping of related information
for a single entity, such as a person.
Such information includes the Subject's identities as well as
its security-related attributes
(passwords and cryptographic keys, for example).
Subjects may potentially have multiple identities.
Each identity is represented as a Principal
within the Subject. Principals simply bind names to a
Subject. For example, a Subject that happens
to be a person, Alice, might have two Principals:
one which binds "Alice Bar", the name on her driver license,
to the Subject, and another which binds,
"999-99-9999", the number on her student identification card,
to the Subject. Both Principals refer to the same
Subject even though each has a different name.
A Subject may also own security-related attributes,
which are referred to as credentials.
Sensitive credentials that require special protection, such as
private cryptographic keys, are stored within a private credential
Set. Credentials intended to be shared, such as
public key certificates or Kerberos server tickets are stored
within a public credential Set.
To retrieve all the Principals associated with a Subject,
invoke the getPrincipals method. To retrieve
all the public or private credentials belonging to a Subject,
invoke the getPublicCredentials method or
getPrivateCredentials method, respectively.
To modify the returned Set of Principals and credentials,
use the methods defined in the Set class.
For example:
Subject subject;
Principal principal;
Object credential;
// add a Principal and credential to the Subject
subject.getPrincipals().add(principal);
subject.getPublicCredentials().add(credential);
This Subject class implements Serializable.
While the Principals associated with the Subject are serialized,
the credentials associated with the Subject are not.
Note that the java.security.Principal class
does not implement Serializable. Therefore, all concrete
Principal implementations associated with Subjects
must implement Serializable.
The following methods in this class for user-based authorization that are dependent on Security Manager APIs are deprecated for removal:
getSubject(AccessControlContext)
doAs(Subject, PrivilegedAction)
doAs(Subject, PrivilegedExceptionAction)
doAsPrivileged(Subject, PrivilegedAction, AccessControlContext)
doAsPrivileged(Subject, PrivilegedExceptionAction, AccessControlContext)
current() and callAs(Subject, Callable)
are replacements for these methods, where current is equivalent to
getSubject(AccessController.getContext()) (as originally specified)
and callAs is similar to doAs except that the
input type and exceptions thrown are slightly different.
A doAs or callAs call
binds a Subject object to the period of execution of an action,
and the subject can be retrieved using the current method inside
the action. This subject can be inherited by child threads if they are
started and terminate within the execution of its parent thread using
structured concurrency.
java.security.Principal , java.security.DomainCombiner
| Modifier and Type | Class and Description |
|---|---|
| private class | Subject.
This class implements a |
| private static class |
| Modifier and Type | Field and Description |
|---|---|
| private static final ProtectionDomain[] | |
| private static final int | |
| pack-priv Set | principals
A |
| private static final int | |
| pack-priv transient Set | |
| private static final int | |
| pack-priv transient Set | pubCredentials
Sets that provide a view of all of this Subject's Credentials |
| private volatile boolean | readOnly
Whether this Subject is read-only |
| private static final ScopedValue | |
| private static final long |
| Access | Constructor and Description |
|---|---|
| public | Subject()
Create an instance of a |
| public | Subject(boolean
true if the readOnly, Set<? extends Principal> Subject is to be read-only,
and false otherwise.the principals, Set<?> Set of Principals
to be associated with this Subject.the pubCredentials, Set<?> Set of public credentials
to be associated with this Subject.the privCredentials)Set of private credentials
to be associated with this Subject.Create an instance of a |
| Modifier and Type | Method and Description |
|---|---|
| public static < the type of value returned by the T> Tcall method
of action | Returns: the value returned by thecall method of actionthe subject, final Callable<T> Subject that the specified action
will run as. This parameter may be null.the code to be run with action)subject as its current
subject. Must not be null.Executes a |
| private static <E> LinkedList | collectionNullClean(Collection<? extends E>
A coll)Collection to be tested for null referencesTests for null-clean collections (both non-null reference and no null elements) |
| public static Subject | Returns: the current subject, ornull if a current subject is
not installed or the current subject is set to null.Returns the current subject. |
| public static < the type of the value returned by the PrivilegedAction's
T> Trun method. | Returns: the value returned by the PrivilegedAction'srun method.the subject, final PrivilegedAction<T> Subject that the specified
action will run as. This parameter
may be null.the code to be run as the specified
action)Subject.
Deprecated
for removal since 18. This method originally performed the specified
PrivilegedAction with privileges enabled.
Perform work as a particular |
| public static < the type of the value returned by the
PrivilegedExceptionAction's T> Trun method. | Returns: the value returned by the PrivilegedExceptionAction'srun method.the subject, final PrivilegedExceptionAction<T> Subject that the specified
action will run as. This parameter
may be null.the code to be run as the specified
action)Subject.
Deprecated
for removal since 18. This method originally performed the specified
PrivilegedExceptionAction with privileges enabled.
Perform work as a particular |
| public static < the type of the value returned by the PrivilegedAction's
T> Trun method. | Returns: the value returned by the PrivilegedAction'srun method.the subject, final PrivilegedAction<T> Subject that the specified
action will run as. This parameter
may be null.the code to be run as the specified
action, final AccessControlContext Subject.ignored acc)
Deprecated
for removal since 17. This method originally performed the specified
PrivilegedAction with privileges enabled and restricted
by the specified AccessControlContext.
Perform work as a particular |
| public static < the type of the value returned by the
PrivilegedExceptionAction's T> Trun method. | Returns: the value returned by the PrivilegedExceptionAction'srun method.the subject, final PrivilegedExceptionAction<T> Subject that the specified
action will run as. This parameter
may be null.the code to be run as the specified
action, final AccessControlContext Subject.ignored acc)
Deprecated
for removal since 17. This method originally performed the specified
PrivilegedExceptionAction with privileges enabled and
restricted by the specified AccessControlContext.
Perform work as a particular |
| public boolean | Returns: true if the specified Object is equal to thisSubject.Object to be compared for equality with this
o)Subject.Overrides java. Compares the specified Object with this |
| private int | |
| public Set | Returns: theSet of Principals associated with this
Subject.Return the |
| public < the type of the class modeled by T extends Principal> Setc | Returns: aSet of Principals that are instances of the
specified Class.the returned c)Set of Principals will all be
instances of this class.Return a |
| public Set | Returns: aSet of private credentials held by this
Subject.Return the |
| public < the type of the class modeled by T> Setc | Returns: aSet of private credentials that are instances
of the specified Class.the returned c)Set of private credentials will all be
instances of this class.Return a |
| public Set | Returns: aSet of public credentials held by this
Subject.Return the |
| public < the type of the class modeled by T> Setc | Returns: aSet of public credentials that are instances
of the specified Class.the returned c)Set of public credentials will all be
instances of this class.Return a |
| public static Subject | Returns: n/aignored acc)
Deprecated
for removal since 17. This method used to get the subject associated with the
provided
AccessControlContext, which was only useful in
conjunction with the Security Manager,
which is no longer supported.
Throws |
| public int | Returns: a hashcode for thisSubjectOverrides java. Returns a hashcode for this |
| public boolean | Returns: true if thisSubject is read-only, false otherwise.Query whether this |
| private void | readObject(ObjectInputStream
the s)ObjectInputStream from which data is readReads this object from a stream (i.e., deserializes it) |
| public void | |
| public String | Returns: the String representation of thisSubject.Overrides java. Return the String representation of this |
| private void | writeObject(ObjectOutputStream
the oos)ObjectOutputStream to which data is writtenWrites this object out to a stream (i.e., serializes it). |
| NULL_PD_ARRAY | back to summary |
|---|---|
| private static final ProtectionDomain[] NULL_PD_ARRAY | |
| PRINCIPAL_SET | back to summary |
|---|---|
| private static final int PRINCIPAL_SET | |
| principals | back to summary |
|---|---|
| pack-priv Set<Principal> principals A
| |
| PRIV_CREDENTIAL_SET | back to summary |
|---|---|
| private static final int PRIV_CREDENTIAL_SET | |
| privCredentials | back to summary |
|---|---|
| pack-priv transient Set<Object> privCredentials | |
| PUB_CREDENTIAL_SET | back to summary |
|---|---|
| private static final int PUB_CREDENTIAL_SET | |
| pubCredentials | back to summary |
|---|---|
| pack-priv transient Set<Object> pubCredentials Sets that provide a view of all of this Subject's Credentials | |
| readOnly | back to summary |
|---|---|
| private volatile boolean readOnly Whether this Subject is read-only | |
| SCOPED_SUBJECT | back to summary |
|---|---|
| private static final ScopedValue<Subject> SCOPED_SUBJECT | |
| serialVersionUID | back to summary |
|---|---|
| private static final long serialVersionUID
| |
| Subject | back to summary |
|---|---|
| public Subject() Create an instance of a The newly constructed Sets check whether this | |
| Subject | back to summary |
|---|---|
| public Subject(boolean readOnly, Set<? extends Principal> principals, Set<?> pubCredentials, Set<?> privCredentials) Create an instance of a The Principals and credentials from the specified Sets
are copied into newly constructed Sets.
These newly created Sets check whether this
| |
| callAs | back to summary |
|---|---|
| public static <T> T callAs(final Subject subject, final Callable<T> action) throws CompletionException Executes a This method launches
| |
| collectionNullClean | back to summary |
|---|---|
| private static <E> LinkedList Tests for null-clean collections (both non-null reference and no null elements)
| |
| current | back to summary |
|---|---|
| public static Subject current() Returns the current subject. The current subject is installed by the This method returns the
| |
| doAs | back to summary |
|---|---|
| public static <T> T doAs(final Subject subject, final PrivilegedAction<T> action)
Deprecated for removal since 18. This method originally performed the specified
Perform work as a particular This method launches
| |
| doAs | back to summary |
|---|---|
| public static <T> T doAs(final Subject subject, final PrivilegedExceptionAction<T> action) throws PrivilegedActionException
Deprecated for removal since 18. This method originally performed the specified
Perform work as a particular This method launches
| |
| doAsPrivileged | back to summary |
|---|---|
| public static <T> T doAsPrivileged(final Subject subject, final PrivilegedAction<T> action, final AccessControlContext acc)
Deprecated for removal since 17. This method originally performed the specified
Perform work as a particular This method launches
| |
| doAsPrivileged | back to summary |
|---|---|
| public static <T> T doAsPrivileged(final Subject subject, final PrivilegedExceptionAction<T> action, final AccessControlContext acc) throws PrivilegedActionException
Deprecated for removal since 17. This method originally performed the specified
Perform work as a particular This method launches
| |
| equals | back to summary |
|---|---|
| public boolean equals(Object o) Overrides java. Compares the specified Object with this | |
| getCredHashCode | back to summary |
|---|---|
| private int getCredHashCode(Object o) get a credential's hashcode | |
| getPrincipals | back to summary |
|---|---|
| public Set Return the The returned | |
| getPrincipals | back to summary |
|---|---|
| public <T extends Principal> Set Return a The returned
| |
| getPrivateCredentials | back to summary |
|---|---|
| public Set Return the The returned | |
| getPrivateCredentials | back to summary |
|---|---|
| public <T> Set Return a The returned
| |
| getPublicCredentials | back to summary |
|---|---|
| public Set Return the The returned | |
| getPublicCredentials | back to summary |
|---|---|
| public <T> Set Return a The returned
| |
| getSubject | back to summary |
|---|---|
| public static Subject getSubject(final AccessControlContext acc)
Deprecated for removal since 17. This method used to get the subject associated with the
provided Throws
| |
| hashCode | back to summary |
|---|---|
| public int hashCode() Overrides java. Returns a hashcode for this
| |
| isReadOnly | back to summary |
|---|---|
| public boolean isReadOnly() Query whether this
| |
| readObject | back to summary |
|---|---|
| private void readObject(ObjectInputStream s) throws IOException, ClassNotFoundException Reads this object from a stream (i.e., deserializes it)
| |
| setReadOnly | back to summary |
|---|---|
| public void setReadOnly() Set this Modifications (additions and removals) to this Subject's
Subsequent attempts to modify the Subject's | |
| toString | back to summary |
|---|---|
| public String toString() Overrides java. Return the String representation of this | |
| writeObject | back to summary |
|---|---|
| private void writeObject(ObjectOutputStream oos) throws IOException Writes this object out to a stream (i.e., serializes it).
| |
Set which returns only
members that are an instance of a specified Class.
| Modifier and Type | Field and Description |
|---|---|
| private final Class | |
| private final Set | |
| private final int |
| Modifier and Type | Method and Description |
|---|---|
| public boolean | add(T o)
Overrides java. Implements java. Adds the specified element to this set if it is not already present (optional operation). |
| public Iterator | iterator()
Implements abstract java. Implements java. Returns an iterator over the elements in this set. |
| private void | |
| public int | size()
Implements abstract java. Implements java. Returns the number of elements in this set (its cardinality). |
| c | back to summary |
|---|---|
| private final Class<T> c | |
| set | back to summary |
|---|---|
| private final Set<T> set | |
| which | back to summary |
|---|---|
| private final int which | |
| ClassSet | back to summary |
|---|---|
| pack-priv ClassSet(int which, Class<T> c) | |
| add | back to summary |
|---|---|
| public boolean add(T o) Overrides java. Implements java. Doc from java. Adds the specified element to this set if it is not already present
(optional operation). More formally, adds the specified element
The stipulation above does not imply that sets must accept all
elements; sets may refuse to add any particular element, including
| |
| iterator | back to summary |
|---|---|
| public Iterator Implements abstract java. Implements java. Doc from java. Returns an iterator over the elements in this set. The elements are returned in no particular order (unless this set is an instance of some class that provides a guarantee).
| |
| populateSet | back to summary |
|---|---|
private void populateSet()
| |
| size | back to summary |
|---|---|
| public int size() Implements abstract java. Implements java. Doc from java. Returns the number of elements in this set (its cardinality). If this
set contains more than
| |
| Modifier and Type | Field and Description |
|---|---|
| pack-priv LinkedList | |
| private static final ObjectStreamField[] | |
| private static final long | |
| pack-priv Subject | |
| private int |
| Access | Constructor and Description |
|---|---|
| pack-priv | |
| pack-priv |
| Modifier and Type | Method and Description |
|---|---|
| public boolean | add(E o)
Implements java. Adds the specified element to this set if it is not already present (optional operation). |
| public boolean | addAll(Collection<? extends E> c)
Implements java. Adds all of the elements in the specified collection to this set if they're not already present (optional operation). |
| public void | clear()
Implements java. Removes all of the elements from this set (optional operation). |
| public boolean | contains(Object o)
Implements java. Returns |
| public boolean | containsAll(Collection<?> c)
Implements java. Returns |
| public boolean | equals(Object o)
Overrides java. Implements java. Compares the specified object with this set for equality. |
| public int | hashCode()
Overrides java. Implements java. Returns the hash code value for this set. |
| public boolean | |
| public Iterator | |
| private void | readObject(ObjectInputStream
the ois)ObjectInputStream from which data is readRestores the state of this object from the stream. |
| public boolean | remove(Object o)
Implements java. Removes the specified element from this set if it is present (optional operation). |
| public boolean | removeAll(Collection<?> c)
Implements java. Removes from this set all of its elements that are contained in the specified collection (optional operation). |
| public boolean | retainAll(Collection<?> c)
Implements java. Retains only the elements in this set that are contained in the specified collection (optional operation). |
| public int | |
| public Object[] | toArray()
Implements java. Returns an array containing all of the elements in this set. |
| public <T> T[] | toArray(T[] a)
Implements java. Returns an array containing all of the elements in this set; the runtime type of the returned array is that of the specified array. |
| private void | writeObject(ObjectOutputStream
the oos)ObjectOutputStream to which data is writtenWrites this object out to a stream (i.e., serializes it). |
| elements | back to summary |
|---|---|
| pack-priv LinkedList<E> elements | |
| serialPersistentFields | back to summary |
|---|---|
private static final ObjectStreamField[] serialPersistentFields
| |
| serialVersionUID | back to summary |
|---|---|
| private static final long serialVersionUID
| |
| subject | back to summary |
|---|---|
| pack-priv Subject subject | |
| which | back to summary |
|---|---|
| private int which | |
| SecureSet | back to summary |
|---|---|
| pack-priv SecureSet(Subject subject, int which) | |
| SecureSet | back to summary |
|---|---|
| pack-priv SecureSet(Subject subject, int which, LinkedList<E> list) | |
| add | back to summary |
|---|---|
| public boolean add(E o) Implements java. Doc from java. Adds the specified element to this set if it is not already present
(optional operation). More formally, adds the specified element
The stipulation above does not imply that sets must accept all
elements; sets may refuse to add any particular element, including
| |
| addAll | back to summary |
|---|---|
| public boolean addAll(Collection<? extends E> c) Implements java. Doc from java. Adds all of the elements in the specified collection to this set if
they're not already present (optional operation). If the specified
collection is also a set, the | |
| clear | back to summary |
|---|---|
| public void clear() Implements java. Doc from java. Removes all of the elements from this set (optional operation). The set will be empty after this call returns. | |
| contains | back to summary |
|---|---|
| public boolean contains(Object o) Implements java. Doc from java. Returns | |
| containsAll | back to summary |
|---|---|
| public boolean containsAll(Collection<?> c) Implements java. Doc from java. Returns | |
| equals | back to summary |
|---|---|
| public boolean equals(Object o) Overrides java. Implements java. Doc from java. Compares the specified object with this set for equality. Returns
| |
| hashCode | back to summary |
|---|---|
| public int hashCode() Overrides java. Implements java. Doc from java. Returns the hash code value for this set. The hash code of a set is
defined to be the sum of the hash codes of the elements in the set,
where the hash code of a
| |
| isEmpty | back to summary |
|---|---|
| public boolean isEmpty() Implements java. Doc from java. Returns | |
| iterator | back to summary |
|---|---|
| public Iterator Implements java. Doc from java. Returns an iterator over the elements in this set. The elements are returned in no particular order (unless this set is an instance of some class that provides a guarantee). | |
| readObject | back to summary |
|---|---|
| private void readObject(ObjectInputStream ois) throws IOException, ClassNotFoundException Restores the state of this object from the stream.
| |
| remove | back to summary |
|---|---|
| public boolean remove(Object o) Implements java. Doc from java. Removes the specified element from this set if it is present
(optional operation). More formally, removes an element | |
| removeAll | back to summary |
|---|---|
| public boolean removeAll(Collection<?> c) Implements java. Doc from java. Removes from this set all of its elements that are contained in the specified collection (optional operation). If the specified collection is also a set, this operation effectively modifies this set so that its value is the asymmetric set difference of the two sets. | |
| retainAll | back to summary |
|---|---|
| public boolean retainAll(Collection<?> c) Implements java. Doc from java. Retains only the elements in this set that are contained in the specified collection (optional operation). In other words, removes from this set all of its elements that are not contained in the specified collection. If the specified collection is also a set, this operation effectively modifies this set so that its value is the intersection of the two sets. | |
| size | back to summary |
|---|---|
| public int size() Implements java. Doc from java. Returns the number of elements in this set (its cardinality). If this
set contains more than | |
| toArray | back to summary |
|---|---|
| public Object[] toArray() Implements java. Doc from java. Returns an array containing all of the elements in this set. If this set makes any guarantees as to what order its elements are returned by its iterator, this method must return the elements in the same order. The returned array will be "safe" in that no references to it are maintained by this set. (In other words, this method must allocate a new array even if this set is backed by an array). The caller is thus free to modify the returned array. This method acts as bridge between array-based and collection-based APIs. | |
| toArray | back to summary |
|---|---|
| public <T> T[] toArray(T[] a) Implements java. Doc from java. Returns an array containing all of the elements in this set; the runtime type of the returned array is that of the specified array. If the set fits in the specified array, it is returned therein. Otherwise, a new array is allocated with the runtime type of the specified array and the size of this set. If this set fits in the specified array with room to spare
(i.e., the array has more elements than this set), the element in
the array immediately following the end of the set is set to
If this set makes any guarantees as to what order its elements are returned by its iterator, this method must return the elements in the same order. Like the Suppose
String[] y = x.toArray(new String[0]);
Note that toArray(new Object[0]) is identical in function to
toArray().
| |
| writeObject | back to summary |
|---|---|
| private void writeObject(ObjectOutputStream oos) throws IOException Writes this object out to a stream (i.e., serializes it).
| |