Author: shane.bryzak(a)jboss.com Date: 2008-09-14 22:21:57 -0400 (Sun, 14 Sep 2008) New Revision: 8993 Modified: trunk/doc/Seam_Reference_Guide/en-US/Security.xml Log: added description for sequence diagram Modified: trunk/doc/Seam_Reference_Guide/en-US/Security.xml =================================================================== --- trunk/doc/Seam_Reference_Guide/en-US/Security.xml 2008-09-15 01:49:00 UTC (rev 8992) +++ trunk/doc/Seam_Reference_Guide/en-US/Security.xml 2008-09-15 02:21:57 UTC (rev 8993) @@ -811,8 +811,8 @@ algorithm to be specified for password hashing. Possible values for <literal>hash</literal> are <literal>md5</literal>, <literal>sha</literal> and <literal>none</literal>. E.g: </para> - - <programlisting role="JAVA"><![CDATA[@UserPassword(hash = "md5") + + <programlisting role="JAVA"><![CDATA[@UserPassword(hash = "md5") public String getPasswordHash() { return passwordHash; }]]></programlisting> @@ -3225,6 +3225,42 @@ </imageobject> </mediaobject> + <itemizedlist> + <listitem> + <para> + 1. A permission check is initiated somewhere (either in code or via an EL + expression) resulting in a call to <literal>Identity.hasPermission()</literal>. + </para> + </listitem> + <listitem> + <para> + 1.1. <literal>Identity</literal> invokes + <literal>PermissionMapper.resolvePermission()</literal>, passing in the + permission to be resolved. + </para> + </listitem> + <listitem> + <para> + 1.1.1. <literal>PermissionMapper</literal> maintains a <literal>Map</literal> of + <literal>ResolverChain</literal> instances, keyed by class. It uses this map + to locate the correct <literal>ResolverChain</literal> for the permission's + target object. Once it has the correct <literal>ResolverChain</literal>, it + retrieves the list of <literal>PermissionResolver</literal>s it contains via + a call to <literal>ResolverChain.getResolvers()</literal>. + </para> + </listitem> + <listitem> + <para> + 1.1.2. For each <literal>PermissionResolver</literal> in the <literal>ResolverChain</literal>, + the <literal>PermissionMapper</literal> invokes its <literal>hasPermission()</literal> method, + passing in the permission instance to be checked. If any of the <literal>PermissionResolver</literal>s + return <literal>true</literal>, then the permission check has succeeded and the + <literal>PermissionMapper</literal> also returns <literal>true</literal> to <literal>Identity</literal>. + If none of the <literal>PermissionResolver</literal>s return true, then the permission check + has failed. + </para> + </listitem> + </itemizedlist> </sect2>