UnrestrictedMethodAuthorizer (Apache Geode 1.12.8)
Date: 2022-01-10

org.apache.geode.cache.query.security

## Class UnrestrictedMethodAuthorizer

- java.lang.Object
- - org.apache.geode.cache.query.security.UnrestrictedMethodAuthorizer

- All Implemented Interfaces:
    MethodInvocationAuthorizer

      public final class UnrestrictedMethodAuthorizer
      extends Object
      implements MethodInvocationAuthorizer

  An immutable and thread-safe `MethodInvocationAuthorizer` that allows any method execution as long as the target object does not belong to a Geode package, or does belong but it's marked as safe (see `RestrictedMethodAuthorizer.isAllowedGeodeMethod(Method, Object)`).

  Some known dangerous methods, like `Object.getClass()`, are also rejected by this authorizer implementation, no matter whether the target object belongs to Geode or not (see `RestrictedMethodAuthorizer.isPermanentlyForbiddenMethod(Method, Object)`).

  This authorizer implementation addresses only three of the four known security risks: `Java Reflection`, `Cache Modification` and `Region Modification`.

  The `Region Entry Modification` security risk still exists: users with the `DATA:READ:RegionName` privilege will be able to execute ANY method (even mutators) on the objects stored within the region and on instances used as bind parameters of the OQL, so this authorizer implementation must be used with extreme care.

  Usage of this authorizer implementation is only recommended for secured clusters on which only trusted users and applications have access to the OQL engine. It might also be used on clusters on which the entries stored are immutable.

  See Also:
    `Cache`, `MethodInvocationAuthorizer`, `RestrictedMethodAuthorizer`

- - ### Constructor Summary

    Constructors
    Constructor and Description
    `UnrestrictedMethodAuthorizer(Cache cache)` Creates a `UnrestrictedMethodAuthorizer` object and initializes it so it can be safely used in a multi-threaded environment.
    `UnrestrictedMethodAuthorizer(RestrictedMethodAuthorizer restrictedMethodAuthorizer)` Creates a `UnrestrictedMethodAuthorizer` object and initializes it so it can be safely used in a multi-threaded environment.

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `boolean` | `authorize(Method method, Object target)` Executes the authorization logic to determine whether the `method` is allowed to be executed on the `target` object instance.

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

    - ### Methods inherited from interface org.apache.geode.cache.query.security.MethodInvocationAuthorizer

      `initialize`

- - ### Constructor Detail

    - #### UnrestrictedMethodAuthorizer

          public UnrestrictedMethodAuthorizer(Cache cache)

      Creates a `UnrestrictedMethodAuthorizer` object and initializes it so it can be safely used in a multi-threaded environment.

      Applications can use this constructor as part of the initialization for custom authorizers (see `Declarable.initialize(Cache, Properties)`), when using a declarative approach.
      Parameters:
        `cache` - the `Cache` instance that owns this authorizer, required in order to configure the default `RestrictedMethodAuthorizer`.

    - #### UnrestrictedMethodAuthorizer

          public UnrestrictedMethodAuthorizer(RestrictedMethodAuthorizer restrictedMethodAuthorizer)

      Creates a `UnrestrictedMethodAuthorizer` object and initializes it so it can be safely used in a multi-threaded environment.

      Parameters:
        `restrictedMethodAuthorizer` - the default `RestrictedMethodAuthorizer` to use.

  - ### Method Detail

    - #### authorize

          public boolean authorize(Method method,
                                   Object target)

      Executes the authorization logic to determine whether the `method` is allowed to be executed on the `target` object instance. If the `target` object is an instance of `Region`, this methods also ensures that the user has the `DATA:READ` permission granted for the target `Region`.

      Specified by:
        `authorize` in interface `MethodInvocationAuthorizer`
      Parameters:
        `method` - the `Method` that should be authorized.
        `target` - the `Object` on which the `Method` will be executed.
      Returns:
        `true` if the `method` can be executed on on the `target` instance, `false` otherwise.
      See Also:
        `MethodInvocationAuthorizer`