public class JaspiAuthenticator extends LoginAuthenticator
Authenticator.AuthConfiguration, Authenticator.Factory
Modifier and Type | Field and Description |
---|---|
private boolean |
_allowLazyAuthentication |
private javax.security.auth.message.config.ServerAuthConfig |
_authConfig |
private java.util.Map |
_authProperties |
private ServletCallbackHandler |
_callbackHandler |
private IdentityService |
_identityService |
private javax.security.auth.Subject |
_serviceSubject |
private static Logger |
LOG |
_loginService
Constructor and Description |
---|
JaspiAuthenticator(javax.security.auth.message.config.ServerAuthConfig authConfig,
java.util.Map authProperties,
ServletCallbackHandler callbackHandler,
javax.security.auth.Subject serviceSubject,
boolean allowLazyAuthentication,
IdentityService identityService) |
Modifier and Type | Method and Description |
---|---|
java.lang.String |
getAuthMethod() |
UserIdentity |
login(java.lang.String username,
java.lang.Object password,
javax.servlet.ServletRequest request)
If the UserIdentity is not null after this method calls
LoginService.login(String,Object,ServletRequest) , it
is assumed that the user is fully authenticated and we need to change the session id to prevent
session fixation vulnerability. |
boolean |
secureResponse(JaspiMessageInfo messageInfo,
Authentication validatedUser) |
boolean |
secureResponse(javax.servlet.ServletRequest req,
javax.servlet.ServletResponse res,
boolean mandatory,
Authentication.User validatedUser)
is response secure
|
void |
setConfiguration(Authenticator.AuthConfiguration configuration)
Configure the Authenticator
|
Authentication |
validateRequest(JaspiMessageInfo messageInfo) |
Authentication |
validateRequest(javax.servlet.ServletRequest request,
javax.servlet.ServletResponse response,
boolean mandatory)
Validate a request
|
getLoginService, logout, prepareRequest, renewSession
private static final Logger LOG
private final javax.security.auth.message.config.ServerAuthConfig _authConfig
private final java.util.Map _authProperties
private final ServletCallbackHandler _callbackHandler
private final javax.security.auth.Subject _serviceSubject
private final boolean _allowLazyAuthentication
private final IdentityService _identityService
public JaspiAuthenticator(javax.security.auth.message.config.ServerAuthConfig authConfig, java.util.Map authProperties, ServletCallbackHandler callbackHandler, javax.security.auth.Subject serviceSubject, boolean allowLazyAuthentication, IdentityService identityService)
public void setConfiguration(Authenticator.AuthConfiguration configuration)
Authenticator
setConfiguration
in interface Authenticator
setConfiguration
in class LoginAuthenticator
configuration
- the configurationpublic java.lang.String getAuthMethod()
public Authentication validateRequest(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, boolean mandatory) throws ServerAuthException
Authenticator
request
- The requestresponse
- The responsemandatory
- True if authentication is mandatory.Authentication.User
. If a response has
been sent by the Authenticator (which can be done for both successful and unsuccessful authentications), then the result will
implement Authentication.ResponseSent
. If Authentication is not mandatory, then a
Authentication.Deferred
may be returned.ServerAuthException
- if unable to validate requestpublic boolean secureResponse(javax.servlet.ServletRequest req, javax.servlet.ServletResponse res, boolean mandatory, Authentication.User validatedUser) throws ServerAuthException
Authenticator
req
- the requestres
- the responsemandatory
- if security is mandatorvalidatedUser
- the user that was validatedServerAuthException
- if unable to test responsepublic UserIdentity login(java.lang.String username, java.lang.Object password, javax.servlet.ServletRequest request)
LoginAuthenticator
LoginService.login(String,Object,ServletRequest)
, it
is assumed that the user is fully authenticated and we need to change the session id to prevent
session fixation vulnerability. If the UserIdentity is not necessarily fully
authenticated, then subclasses must override this method and
determine when the UserIdentity IS fully authenticated and renew the session id.login
in class LoginAuthenticator
username
- the username of the client to be authenticatedpassword
- the user's credentialrequest
- the inbound request that needs authenticationLoginAuthenticator.login(java.lang.String, java.lang.Object, javax.servlet.ServletRequest)
public Authentication validateRequest(JaspiMessageInfo messageInfo) throws ServerAuthException
ServerAuthException
public boolean secureResponse(JaspiMessageInfo messageInfo, Authentication validatedUser) throws ServerAuthException
ServerAuthException