Interface AlternateScopeResolver

All Known Implementing Classes:
AlternateScopeResolverHolder
Functional Interface:
This is a functional interface and can therefore be used as the assignment target for a lambda expression or method reference.
@FunctionalInterface public interface AlternateScopeResolver
Pluggable, authorization-agnostic policy that maps a DENIED action to an alternate Scope at which it should be re-checked (e.g. the metadata service maps a tenant lkc scope to its physical cluster pkc scope). Returning Optional.empty() means "no fallback".

Implementations only choose the alternate scope; they perform no authorization and cannot change the resource or operation being checked. The authorizer (EmbeddedAuthorizer.alternateScope(RequestContext, Action) -> base re-check) owns the actual re-check and the monotonic DENIED -> ALLOWED invariant; only the scope changes on the re-check.

Used by ConfluentProvider for the late-bound metadata-service policy. Subclasses with a statically-known fallback (e.g. CpcAuthorizer) override EmbeddedAuthorizer.alternateScope(RequestContext, Action) directly instead.

  • Method Summary

    Modifier and Type
    Method
    Description
    Optional<io.confluent.security.authorizer.Scope>
    resolve(RequestContext ctx, Action deniedAction)