View Javadoc

    1   /* Copyright 2004, 2005 Acegi Technology Pty Limited
    2    *
    3    * Licensed under the Apache License, Version 2.0 (the "License");
    4    * you may not use this file except in compliance with the License.
    5    * You may obtain a copy of the License at
    6    *
    7    *     http://www.apache.org/licenses/LICENSE-2.0
    8    *
    9    * Unless required by applicable law or agreed to in writing, software
    10   * distributed under the License is distributed on an "AS IS" BASIS,
    11   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12   * See the License for the specific language governing permissions and
    13   * limitations under the License.
    14   */
    15
    16  package org.acegisecurity.wrapper;
    17
    18  import org.acegisecurity.Authentication;
    19  import org.acegisecurity.AuthenticationTrustResolver;
    20  import org.acegisecurity.AuthenticationTrustResolverImpl;
    21  import org.acegisecurity.context.SecurityContextHolder;
    22  import org.acegisecurity.userdetails.UserDetails;
    23
    24  import java.security.Principal;
    25
    26  import javax.servlet.http.HttpServletRequest;
    27  import javax.servlet.http.HttpServletRequestWrapper;
    28
    29
    30  /***
    31   * An Acegi Security-aware <code>HttpServletRequestWrapper</code>, which uses
    32   * the <code>SecurityContext</code>-defined <code>Authentication</code> object
    33   * for {@link SecurityContextHolderAwareRequestWrapper#isUserInRole(java.lang.String)}
    34   * and {@link javax.servlet.http.HttpServletRequestWrapper#getRemoteUser()}
    35   * responses.
    36   *
    37   * @author Orlando Garcia Carmona
    38   * @author Ben Alex
    39   * @version $Id: SecurityContextHolderAwareRequestWrapper.java,v 1.3 2005/11/29 13:10:11 benalex Exp $
    40   */
    41  public class SecurityContextHolderAwareRequestWrapper extends HttpServletRequestWrapper {
    42      //~ Instance fields ========================================================
    43
    44      private AuthenticationTrustResolver authenticationTrustResolver = new AuthenticationTrustResolverImpl();
    45
    46      //~ Constructors ===========================================================
    47
    48      public SecurityContextHolderAwareRequestWrapper(HttpServletRequest request) {
    49          super(request);
    50      }
    51
    52      //~ Methods ================================================================
    53
    54      /***
    55       * Returns the principal's name, as obtained from the
    56       * <code>SecurityContextHolder</code>. Properly handles both
    57       * <code>String</code>-based and <code>UserDetails</code>-based
    58       * principals.
    59       *
    60       * @return the username or <code>null</code> if unavailable
    61       */
    62      public String getRemoteUser() {
    63          Authentication auth = getAuthentication();
    64
    65          if ((auth == null) || (auth.getPrincipal() == null)) {
    66              return null;
    67          }
    68
    69          if (auth.getPrincipal() instanceof UserDetails) {
    70              return ((UserDetails) auth.getPrincipal()).getUsername();
    71          }
    72
    73          return auth.getPrincipal().toString();
    74      }
    75
    76      /***
    77       * Simple searches for an exactly matching {@link
    78       * GrantedAuthority#getAuthority()}.
    79       *
    80       * <p>
    81       * Will always return <code>false</code> if the <code>SecurityContextHolder</code>
    82       * contains an <code>Authentication</code> with
    83       * <code>null</code><code>principal</code> and/or
    84       * <code>GrantedAuthority[]</code> objects.
    85       * </p>
    86       *
    87       * @param role the <code>GrantedAuthority</code><code>String</code>
    88       *        representation to check for
    89       *
    90       * @return <code>true</code> if an <b>exact</b> (case sensitive) matching
    91       *         granted authority is located, <code>false</code> otherwise
    92       */
    93      public boolean isUserInRole(String role) {
    94          return isGranted(role);
    95      }
    96
    97      /***
    98       * Returns the <code>Authentication</code> (which is a subclass of
    99       * <code>Principal</code>), or <code>null</code> if unavailable.
    100      *
    101      * @return the <code>Authentication</code>, or <code>null</code>
    102      */
    103     public Principal getUserPrincipal() {
    104         Authentication auth = getAuthentication();
    105
    106         if ((auth == null) || (auth.getPrincipal() == null)) {
    107             return null;
    108         }
    109
    110         return auth;
    111     }
    112
    113     /***
    114      * Obtain the current active <code>Authentication</code>
    115      *
    116      * @return the authentication object or <code>null</code>
    117      */
    118     private Authentication getAuthentication() {
    119         Authentication auth = SecurityContextHolder.getContext()
    120                                                    .getAuthentication();
    121
    122         if (!authenticationTrustResolver.isAnonymous(auth)) {
    123             return auth;
    124         }
    125
    126         return null;
    127     }
    128
    129     private boolean isGranted(String role) {
    130         Authentication auth = getAuthentication();
    131
    132         if ((auth == null) || (auth.getPrincipal() == null)
    133             || (auth.getAuthorities() == null)) {
    134             return false;
    135         }
    136
    137         for (int i = 0; i < auth.getAuthorities().length; i++) {
    138             if (role.equals(auth.getAuthorities()[i].getAuthority())) {
    139                 return true;
    140             }
    141         }
    142
    143         return false;
    144     }
    145 }