View Javadoc

    1   /* Copyright 2004, 2005 Acegi Technology Pty Limited
    2    *
    3    * Licensed under the Apache License, Version 2.0 (the "License");
    4    * you may not use this file except in compliance with the License.
    5    * You may obtain a copy of the License at
    6    *
    7    *     http://www.apache.org/licenses/LICENSE-2.0
    8    *
    9    * Unless required by applicable law or agreed to in writing, software
    10   * distributed under the License is distributed on an "AS IS" BASIS,
    11   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12   * See the License for the specific language governing permissions and
    13   * limitations under the License.
    14   */
    15
    16  package org.acegisecurity.ui.cas;
    17
    18  import org.acegisecurity.Authentication;
    19  import org.acegisecurity.AuthenticationException;
    20  import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
    21  import org.acegisecurity.ui.AbstractProcessingFilter;
    22  import org.acegisecurity.ui.WebAuthenticationDetails;
    23
    24  import javax.servlet.FilterConfig;
    25  import javax.servlet.ServletException;
    26  import javax.servlet.http.HttpServletRequest;
    27
    28
    29  /***
    30   * Processes a CAS service ticket.
    31   *
    32   * <p>
    33   * A service ticket consists of an opaque ticket string. It arrives at this
    34   * filter by the user's browser successfully authenticating using CAS, and
    35   * then receiving a HTTP redirect to a <code>service</code>. The opaque ticket
    36   * string is presented in the <code>ticket</code> request parameter. This
    37   * filter monitors the <code>service</code> URL so it can receive the service
    38   * ticket and process it. The CAS server knows which <code>service</code> URL
    39   * to use via the {@link ServiceProperties#getService()} method.
    40   * </p>
    41   *
    42   * <p>
    43   * Processing the service ticket involves creating a
    44   * <code>UsernamePasswordAuthenticationToken</code> which uses {@link
    45   * #CAS_STATEFUL_IDENTIFIER} for the <code>principal</code> and the opaque
    46   * ticket string as the <code>credentials</code>.
    47   * </p>
    48   *
    49   * <p>
    50   * The configured <code>AuthenticationManager</code> is expected to provide a
    51   * provider that can recognise
    52   * <code>UsernamePasswordAuthenticationToken</code>s containing this special
    53   * <code>principal</code> name, and process them accordingly by validation
    54   * with the CAS server.
    55   * </p>
    56   *
    57   * <p>
    58   * <b>Do not use this class directly.</b> Instead configure
    59   * <code>web.xml</code> to use the {@link
    60   * org.acegisecurity.util.FilterToBeanProxy}.
    61   * </p>
    62   *
    63   * @author Ben Alex
    64   * @version $Id: CasProcessingFilter.java,v 1.6 2005/11/17 00:55:49 benalex Exp $
    65   */
    66  public class CasProcessingFilter extends AbstractProcessingFilter {
    67      //~ Static fields/initializers =============================================
    68
    69      /***
    70       * Used to identify a CAS request for a stateful user agent, such as a web
    71       * browser.
    72       */
    73      public static final String CAS_STATEFUL_IDENTIFIER = "_cas_stateful_";
    74
    75      /***
    76       * Used to identify a CAS request for a stateless user agent, such as a
    77       * remoting protocol client (eg Hessian, Burlap, SOAP etc). Results in a
    78       * more aggressive caching strategy being used, as the absence of a
    79       * <code>HttpSession</code> will result in a new authentication attempt on
    80       * every request.
    81       */
    82      public static final String CAS_STATELESS_IDENTIFIER = "_cas_stateless_";
    83
    84      //~ Methods ================================================================
    85
    86      /***
    87       * This filter by default responds to
    88       * <code>/j_acegi_cas_security_check</code>.
    89       *
    90       * @return the default
    91       */
    92      public String getDefaultFilterProcessesUrl() {
    93          return "/j_acegi_cas_security_check";
    94      }
    95
    96      public Authentication attemptAuthentication(HttpServletRequest request)
    97          throws AuthenticationException {
    98          String username = CAS_STATEFUL_IDENTIFIER;
    99          String password = request.getParameter("ticket");
    100
    101         if (password == null) {
    102             password = "";
    103         }
    104
    105         UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username,
    106                 password);
    107         authRequest.setDetails(new WebAuthenticationDetails(request));
    108
    109         return this.getAuthenticationManager().authenticate(authRequest);
    110     }
    111
    112     public void init(FilterConfig filterConfig) throws ServletException {}
    113 }