View Javadoc

    1   /* Copyright 2004 Acegi Technology Pty Limited
    2    *
    3    * Licensed under the Apache License, Version 2.0 (the "License");
    4    * you may not use this file except in compliance with the License.
    5    * You may obtain a copy of the License at
    6    *
    7    *     http://www.apache.org/licenses/LICENSE-2.0
    8    *
    9    * Unless required by applicable law or agreed to in writing, software
    10   * distributed under the License is distributed on an "AS IS" BASIS,
    11   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12   * See the License for the specific language governing permissions and
    13   * limitations under the License.
    14   */
    15
    16  package org.acegisecurity.ui.basicauth;
    17
    18  import org.acegisecurity.AuthenticationException;
    19  import org.acegisecurity.intercept.web.AuthenticationEntryPoint;
    20
    21  import org.springframework.beans.factory.InitializingBean;
    22
    23  import java.io.IOException;
    24
    25  import javax.servlet.ServletException;
    26  import javax.servlet.ServletRequest;
    27  import javax.servlet.ServletResponse;
    28  import javax.servlet.http.HttpServletResponse;
    29
    30
    31  /***
    32   * Used by the <code>SecurityEnforcementFilter</code> to commence
    33   * authentication via the {@link BasicProcessingFilter}.
    34   *
    35   * <P>
    36   * Once a user agent is authenticated using BASIC authentication, logout
    37   * requires that the browser be closed or an unauthorized (401) header be
    38   * sent. The simplest way of achieving the latter is to call the {@link
    39   * #commence(ServletRequest, ServletResponse)} method below. This will
    40   * indicate to the browser its credentials are no longer authorized, causing
    41   * it to prompt the user to login again.
    42   * </p>
    43   *
    44   * @author Ben Alex
    45   * @version $Id: BasicProcessingFilterEntryPoint.java,v 1.4 2005/11/17 00:56:48 benalex Exp $
    46   */
    47  public class BasicProcessingFilterEntryPoint implements AuthenticationEntryPoint,
    48      InitializingBean {
    49      //~ Instance fields ========================================================
    50
    51      private String realmName;
    52
    53      //~ Methods ================================================================
    54
    55      public void setRealmName(String realmName) {
    56          this.realmName = realmName;
    57      }
    58
    59      public String getRealmName() {
    60          return realmName;
    61      }
    62
    63      public void afterPropertiesSet() throws Exception {
    64          if ((realmName == null) || "".equals(realmName)) {
    65              throw new IllegalArgumentException("realmName must be specified");
    66          }
    67      }
    68
    69      public void commence(ServletRequest request, ServletResponse response,
    70          AuthenticationException authException)
    71          throws IOException, ServletException {
    72          HttpServletResponse httpResponse = (HttpServletResponse) response;
    73          httpResponse.addHeader("WWW-Authenticate",
    74              "Basic realm=\"" + realmName + "\"");
    75          httpResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED,
    76              authException.getMessage());
    77      }
    78  }