Overview | Package | Class | Use | Tree | Deprecated | Index | Help
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD

## org.acegisecurity.intercept
Class AbstractSecurityInterceptor

    java.lang.Object
      org.acegisecurity.intercept.AbstractSecurityInterceptor

All Implemented Interfaces:
  InitializingBean, ApplicationEventPublisherAware, MessageSourceAware

Direct Known Subclasses:
  AspectJSecurityInterceptor, FilterSecurityInterceptor, MethodSecurityInterceptor

    public abstract class AbstractSecurityInterceptor

extends Object
implements InitializingBean, ApplicationEventPublisherAware, MessageSourceAware

Abstract class that implements security interception for secure objects.

The `AbstractSecurityInterceptor` will ensure the proper startup configuration of the security interceptor. It will also implement the proper handling of secure object invocations, being:

1. Obtain the `Authentication` object from the `SecurityContextHolder`.
2. Determine if the request relates to a secured or public invocation by looking up the secure object request against the `ObjectDefinitionSource`.
3. For an invocation that is secured (there is a `ConfigAttributeDefinition` for the secure object invocation):
   1. If either the `Authentication.isAuthenticated()` returns `false`, or the `alwaysReauthenticate` is `true`, authenticate the request against the configured `AuthenticationManager`. When authenticated, replace the `Authentication` object on the `SecurityContextHolder` with the returned value.
   2. Authorize the request against the configured `AccessDecisionManager`.
   3. Perform any run-as replacement via the configured `RunAsManager`.
   4. Pass control back to the concrete subclass, which will actually proceed with executing the object. A `InterceptorStatusToken` is returned so that after the subclass has finished proceeding with execution of the object, its finally clause can ensure the `AbstractSecurityInterceptor` is re-called and tidies up correctly.
   5. The concrete subclass will re-call the `AbstractSecurityInterceptor` via the `afterInvocation(InterceptorStatusToken, Object)` method.
   6. If the `RunAsManager` replaced the `Authentication` object, return the `SecurityContextHolder` to the object that existed after the call to `AuthenticationManager`.
   7. If an `AfterInvocationManager` is defined, invoke the invocation manager and allow it to replace the object due to be returned to the caller.
4. For an invocation that is public (there is no `ConfigAttributeDefinition` for the secure object invocation):
   1. As described above, the concrete subclass will be returned an `InterceptorStatusToken` which is subsequently re-presented to the `AbstractSecurityInterceptor` after the secure object has been executed. The `AbstractSecurityInterceptor` will take no further action when its `afterInvocation(InterceptorStatusToken, Object)` is called.
5. Control again returns to the concrete subclass, along with the `Object` that should be returned to the caller. The subclass will then return that result or exception to the original caller.

Field Summary
`protected static org.apache.commons.logging.Log` | `logger`
`protected MessageSourceAccessor` | `messages`

Constructor Summary
`AbstractSecurityInterceptor()`

Method Summary
`protected Object` | `afterInvocation(InterceptorStatusToken token, Object returnedObject)` Completes the work of the `AbstractSecurityInterceptor` after the secure object invocation has been complete
`void` | `afterPropertiesSet()`
`protected InterceptorStatusToken` | `beforeInvocation(Object object)`
`AccessDecisionManager` | `getAccessDecisionManager()`
`AfterInvocationManager` | `getAfterInvocationManager()`
`AuthenticationManager` | `getAuthenticationManager()`
`RunAsManager` | `getRunAsManager()`
`abstract Class` | `getSecureObjectClass()` Indicates the type of secure objects the subclass will be presenting to the abstract parent for processing.
`boolean` | `isAlwaysReauthenticate()`
`boolean` | `isRejectPublicInvocations()`
`boolean` | `isValidateConfigAttributes()`
`abstract ObjectDefinitionSource` | `obtainObjectDefinitionSource()`
`void` | `setAccessDecisionManager(AccessDecisionManager accessDecisionManager)`
`void` | `setAfterInvocationManager(AfterInvocationManager afterInvocationManager)`
`void` | `setAlwaysReauthenticate(boolean alwaysReauthenticate)` Indicates whether the `AbstractSecurityInterceptor` should ignore the `Authentication.isAuthenticated()` property.
`void` | `setApplicationEventPublisher(ApplicationEventPublisher eventPublisher)`
`void` | `setAuthenticationManager(AuthenticationManager newManager)`
`void` | `setMessageSource(MessageSource messageSource)`
`void` | `setRejectPublicInvocations(boolean rejectPublicInvocations)` By rejecting public invocations (and setting this property to `true`), essentially you are ensuring that every secure object invocation advised by `AbstractSecurityInterceptor` has a configuration attribute defined.
`void` | `setRunAsManager(RunAsManager runAsManager)`
`void` | `setValidateConfigAttributes(boolean validateConfigAttributes)`

Methods inherited from class java.lang.Object
`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

Field Detail

### logger

    protected static final org.apache.commons.logging.Log logger

### messages

    protected MessageSourceAccessor messages

Constructor Detail

### AbstractSecurityInterceptor

    public AbstractSecurityInterceptor()

Method Detail

### afterInvocation

    protected Object afterInvocation(InterceptorStatusToken token,
                                     Object returnedObject)

  Completes the work of the `AbstractSecurityInterceptor` after the secure object invocation has been complete

  Parameters:
    `token` - as returned by the `beforeInvocation(Object)`} method
    `returnedObject` - any object returned from the secure object invocation (may be`null`)
  Returns:
    the object the secure object invocation should ultimately return to its caller (may be `null`)

### afterPropertiesSet

    public void afterPropertiesSet()
                            throws Exception

  Specified by:
    `afterPropertiesSet` in interface `InitializingBean`
  Throws:
    `Exception`

### beforeInvocation

    protected InterceptorStatusToken beforeInvocation(Object object)

### getAccessDecisionManager

    public AccessDecisionManager getAccessDecisionManager()

### getAfterInvocationManager

    public AfterInvocationManager getAfterInvocationManager()

### getAuthenticationManager

    public AuthenticationManager getAuthenticationManager()

### getRunAsManager

    public RunAsManager getRunAsManager()

### getSecureObjectClass

    public abstract Class getSecureObjectClass()

  Indicates the type of secure objects the subclass will be presenting to the abstract parent for processing. This is used to ensure collaborators wired to the `AbstractSecurityInterceptor` all support the indicated secure object class.

  Returns:
    the type of secure object the subclass provides services for

### isAlwaysReauthenticate

    public boolean isAlwaysReauthenticate()

### isRejectPublicInvocations

    public boolean isRejectPublicInvocations()

### isValidateConfigAttributes

    public boolean isValidateConfigAttributes()

### obtainObjectDefinitionSource

    public abstract ObjectDefinitionSource obtainObjectDefinitionSource()

### setAccessDecisionManager

    public void setAccessDecisionManager(AccessDecisionManager accessDecisionManager)

### setAfterInvocationManager

    public void setAfterInvocationManager(AfterInvocationManager afterInvocationManager)

### setAlwaysReauthenticate

    public void setAlwaysReauthenticate(boolean alwaysReauthenticate)

  Indicates whether the `AbstractSecurityInterceptor` should ignore the `Authentication.isAuthenticated()` property. Defaults to `false`, meaning by default the `Authentication.isAuthenticated()` property is trusted and re-authentication will not occur if the principal has already been authenticated.

  Parameters:
    `alwaysReauthenticate` - `true` to force `AbstractSecurityInterceptor` to disregard the value of `Authentication.isAuthenticated()` and always re-authenticate the request (defaults to `false`).

### setApplicationEventPublisher

    public void setApplicationEventPublisher(ApplicationEventPublisher eventPublisher)

  Specified by:
    `setApplicationEventPublisher` in interface `ApplicationEventPublisherAware`

### setAuthenticationManager

    public void setAuthenticationManager(AuthenticationManager newManager)

### setMessageSource

    public void setMessageSource(MessageSource messageSource)

  Specified by:
    `setMessageSource` in interface `MessageSourceAware`

### setRejectPublicInvocations

    public void setRejectPublicInvocations(boolean rejectPublicInvocations)

  By rejecting public invocations (and setting this property to `true`), essentially you are ensuring that every secure object invocation advised by `AbstractSecurityInterceptor` has a configuration attribute defined. This is useful to ensure a "fail safe" mode where undeclared secure objects will be rejected and configuration omissions detected early. An `IllegalArgumentException` will be thrown by the `AbstractSecurityInterceptor` if you set this property to `true` and an attempt is made to invoke a secure object that has no configuration attributes.

  Parameters:
    `rejectPublicInvocations` - set to `true` to reject invocations of secure objects that have no configuration attributes (by default it is `true` which treats undeclared secure objects as "public" or unauthorized)

### setRunAsManager

    public void setRunAsManager(RunAsManager runAsManager)

### setValidateConfigAttributes

    public void setValidateConfigAttributes(boolean validateConfigAttributes)

Overview | Package | Class | Use | Tree | Deprecated | Index | Help
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD

Copyright © 2004-2005 Acegi Technology Pty Limited. All Rights Reserved.