T - the PluginConfiguration class for this implementation of
IdentityMappingPluginpublic interface RuleInterceptor<T extends PluginConfiguration> extends RequestInterceptor, ResponseInterceptor, DescribesUIConfigurable, ConfigurablePlugin<T>
RuleInterceptor is the runtime instantiation of a Rule defined in the Administrative API. It can be used
to apply custom access control logic to the request or response of a HTTP transaction as well as modifying the
request or response of the transaction.
A RuleInterceptor is a configurable plugin Service Provider Interface (SPI). The documentation for the
the com.pingidentity.pa.sdk.plugins package defines the general implementation of a configurable plugin.
This documentation includes the plugin-specific guidelines for creating a valid RuleInterceptor.
RuleInterceptor must be annotated with the Rule annotation.
RuleInterceptor should be placed in a
META-INF/services/com.pingidentity.pa.sdk.policy.RuleInterceptor resource file that is packaged in the
jar containing the compiled class for the implementation. This signals to PingAccess that the class is a
valid RuleInterceptor implementation.
com.pingidentity.pa.sdk.plugins
documentation, a RuleInterceptor has the following additional responsibilities:
RuleInterceptor operates on a HTTP transaction by interacting with the
Exchange and its contained objects. Supporting classes can be found
within com.pingidentity.pa.sdk.http.
The RequestInterceptor.handleRequest(Exchange) method is invoked to allow the RuleInterceptor to
apply access control policy to the HTTP request.
The ResponseInterceptor.handleResponse(Exchange) method is invoked to allow the RuleInterceptor to
apply processing policy to the HTTP response.
RuleInterceptor provides functionality to produce error responses in the event that the policy applied
to a request indicates the request should be denied. This is provided by the ErrorHandlingCallback
instance returned from the getErrorHandlingCallback() method. The
ErrorHandlingCallback is invoked when PingAccess determines the RuleInterceptor should generate
an error response. The com.pingidentity.pa.sdk.policy.error documentation describes the
ErrorHandlingCallback implementations provided by the SDK.
If a RuleInterceptor returns
Outcome.RETURN from its RequestInterceptor.handleRequest(Exchange)
method or throws AccessException from its RequestInterceptor.handleRequest(Exchange) method,
this does not imply that processing of the HTTP transaction will stop in all cases. For example, if the
RuleInterceptor is invoked within an "Any" RuleSet, the access denial from the
RuleInterceptor will be ignored if other RuleInterceptors within the RuleSet allow access.
com.pingidentity.pa.sdk.plugins| Modifier and Type | Method and Description |
|---|---|
ErrorHandlingCallback |
getErrorHandlingCallback()
Provides an instance of
ErrorHandlingCallback that renders errors if the
RuleInterceptor is selected to render errors. |
handleRequesthandleResponsegetConfigurationFieldsconfigure, getConfigurationErrorHandlingCallback getErrorHandlingCallback()
ErrorHandlingCallback that renders errors if the
RuleInterceptor is selected to render errors.ErrorHandlingCallbackCopyright 2023 Ping Identity Corp. All rights reserved.