View Javadoc

    1   /* Copyright 2004, 2005 Acegi Technology Pty Limited
    2    *
    3    * Licensed under the Apache License, Version 2.0 (the "License");
    4    * you may not use this file except in compliance with the License.
    5    * You may obtain a copy of the License at
    6    *
    7    *     http://www.apache.org/licenses/LICENSE-2.0
    8    *
    9    * Unless required by applicable law or agreed to in writing, software
    10   * distributed under the License is distributed on an "AS IS" BASIS,
    11   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12   * See the License for the specific language governing permissions and
    13   * limitations under the License.
    14   */
    15
    16  package org.acegisecurity.ui.webapp;
    17
    18  import org.acegisecurity.Authentication;
    19  import org.acegisecurity.AuthenticationException;
    20  import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
    21  import org.acegisecurity.ui.AbstractProcessingFilter;
    22  import org.acegisecurity.ui.WebAuthenticationDetails;
    23
    24  import javax.servlet.FilterConfig;
    25  import javax.servlet.ServletException;
    26  import javax.servlet.http.HttpServletRequest;
    27
    28
    29  /***
    30   * Processes an authentication form.
    31   *
    32   * <p>
    33   * Login forms must present two parameters to this filter: a username and
    34   * password. The parameter names to use are contained in the static fields
    35   * {@link #ACEGI_SECURITY_FORM_USERNAME_KEY} and {@link
    36   * #ACEGI_SECURITY_FORM_PASSWORD_KEY}.
    37   * </p>
    38   *
    39   * <P>
    40   * <B>Do not use this class directly.</B> Instead configure
    41   * <code>web.xml</code> to use the {@link
    42   * org.acegisecurity.util.FilterToBeanProxy}.
    43   * </p>
    44   *
    45   * @author Ben Alex
    46   * @author Colin Sampaleanu
    47   * @version $Id: AuthenticationProcessingFilter.java,v 1.13 2005/11/17 00:55:50 benalex Exp $
    48   */
    49  public class AuthenticationProcessingFilter extends AbstractProcessingFilter {
    50      //~ Static fields/initializers =============================================
    51
    52      public static final String ACEGI_SECURITY_FORM_USERNAME_KEY = "j_username";
    53      public static final String ACEGI_SECURITY_FORM_PASSWORD_KEY = "j_password";
    54      public static final String ACEGI_SECURITY_LAST_USERNAME_KEY = "ACEGI_SECURITY_LAST_USERNAME";
    55
    56      //~ Methods ================================================================
    57
    58      /***
    59       * This filter by default responds to <code>/j_acegi_security_check</code>.
    60       *
    61       * @return the default
    62       */
    63      public String getDefaultFilterProcessesUrl() {
    64          return "/j_acegi_security_check";
    65      }
    66
    67      public Authentication attemptAuthentication(HttpServletRequest request)
    68          throws AuthenticationException {
    69          String username = obtainUsername(request);
    70          String password = obtainPassword(request);
    71
    72          if (username == null) {
    73              username = "";
    74          }
    75
    76          if (password == null) {
    77              password = "";
    78          }
    79
    80          UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username,
    81                  password);
    82
    83          // Allow subclasses to set the "details" property
    84          setDetails(request, authRequest);
    85
    86          // Place the last username attempted into HttpSession for views
    87          request.getSession().setAttribute(ACEGI_SECURITY_LAST_USERNAME_KEY,
    88              username);
    89
    90          return this.getAuthenticationManager().authenticate(authRequest);
    91      }
    92
    93      public void init(FilterConfig filterConfig) throws ServletException {}
    94
    95      /***
    96       * Provided so that subclasses may configure what is put into the
    97       * authentication request's details property. The default implementation
    98       * simply constructs {@link WebAuthenticationDetails}.
    99       *
    100      * @param request that an authentication request is being created for
    101      * @param authRequest the authentication request object that should have
    102      *        its details set
    103      */
    104     protected void setDetails(HttpServletRequest request,
    105         UsernamePasswordAuthenticationToken authRequest) {
    106         authRequest.setDetails(new WebAuthenticationDetails(request));
    107     }
    108
    109     /***
    110      * Enables subclasses to override the composition of the password, such as
    111      * by including additional values and a separator.
    112      *
    113      * <p>
    114      * This might be used for example if a postcode/zipcode was required in
    115      * addition to the password. A delimiter such as a pipe (|) should be used
    116      * to separate the password and extended value(s). The
    117      * <code>AuthenticationDao</code> will need to generate the expected
    118      * password in a corresponding manner.
    119      * </p>
    120      *
    121      * @param request so that request attributes can be retrieved
    122      *
    123      * @return the password that will be presented in the
    124      *         <code>Authentication</code> request token to the
    125      *         <code>AuthenticationManager</code>
    126      */
    127     protected String obtainPassword(HttpServletRequest request) {
    128         return request.getParameter(ACEGI_SECURITY_FORM_PASSWORD_KEY);
    129     }
    130
    131     /***
    132      * Enables subclasses to override the composition of the username, such as
    133      * by including additional values and a separator.
    134      *
    135      * @param request so that request attributes can be retrieved
    136      *
    137      * @return the username that will be presented in the
    138      *         <code>Authentication</code> request token to the
    139      *         <code>AuthenticationManager</code>
    140      */
    141     protected String obtainUsername(HttpServletRequest request) {
    142         return request.getParameter(ACEGI_SECURITY_FORM_USERNAME_KEY);
    143     }
    144 }