Overview | Package | Class | Use | Tree | Deprecated | Index | Help
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD

## org.acegisecurity.intercept.web
Class SecurityEnforcementFilter

    java.lang.Object
      org.acegisecurity.intercept.web.SecurityEnforcementFilter

All Implemented Interfaces:
  javax.servlet.Filter, InitializingBean

    public class SecurityEnforcementFilter

extends Object
implements javax.servlet.Filter, InitializingBean

Wraps requests to the `FilterSecurityInterceptor`.

This filter is necessary because it provides the bridge between incoming requests and the `FilterSecurityInterceptor` instance.

If an `AuthenticationException` is detected, the filter will launch the `authenticationEntryPoint`. This allows common handling of authentication failures originating from any subclass of `AbstractSecurityInterceptor`.

If an `AccessDeniedException` is detected, the filter will determine whether or not the user is an anonymous user. If they are an anonymous user, the `authenticationEntryPoint` will be launched. If they are not an anonymous user, the filter will respond with a `HttpServletResponse.SC_FORBIDDEN` (403 error). In addition, the `AccessDeniedException` itself will be placed in the `HttpSession` attribute keyed against `ACEGI_SECURITY_ACCESS_DENIED_EXCEPTION_KEY` (to allow access to the stack trace etc). Again, this allows common access denied handling irrespective of the originating security interceptor.

To use this filter, it is necessary to specify the following properties:

- `filterSecurityInterceptor` indicates the `FilterSecurityInterceptor` to delegate HTTP security decisions to.
- `authenticationEntryPoint` indicates the handler that should commence the authentication process if an `AuthenticationException` is detected. Note that this may also switch the current protocol from http to https for an SSL login.
- `portResolver` is used to determine the "real" port that a request was received on.

Do not use this class directly. Instead configure `web.xml` to use the `FilterToBeanProxy`.

Version:
  $Id: SecurityEnforcementFilter.java,v 1.22 2005/11/25 04:38:18 benalex Exp $
Author:
  Ben Alex, colin sampaleanu

Field Summary
`static String` | `ACEGI_SECURITY_ACCESS_DENIED_EXCEPTION_KEY`

Constructor Summary
`SecurityEnforcementFilter()`

Method Summary
`void` | `afterPropertiesSet()`
`void` | `destroy()`
`void` | `doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain)`
`AuthenticationEntryPoint` | `getAuthenticationEntryPoint()`
`AuthenticationTrustResolver` | `getAuthenticationTrustResolver()`
`FilterSecurityInterceptor` | `getFilterSecurityInterceptor()`
`PortResolver` | `getPortResolver()`
`void` | `init(javax.servlet.FilterConfig filterConfig)`
`boolean` | `isCreateSessionAllowed()` If `true`, indicates that `SecurityEnforcementFilter` is permitted to store the target URL and exception information in the `HttpSession` (the default).
`protected void` | `sendAccessDeniedError(FilterInvocation fi, AccessDeniedException accessDenied)`
`protected void` | `sendStartAuthentication(FilterInvocation fi, AuthenticationException reason)`
`void` | `setAuthenticationEntryPoint(AuthenticationEntryPoint authenticationEntryPoint)`
`void` | `setAuthenticationTrustResolver(AuthenticationTrustResolver authenticationTrustResolver)`
`void` | `setCreateSessionAllowed(boolean createSessionAllowed)`
`void` | `setFilterSecurityInterceptor(FilterSecurityInterceptor filterSecurityInterceptor)`
`void` | `setPortResolver(PortResolver portResolver)`

Methods inherited from class java.lang.Object
`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

Field Detail

### ACEGI_SECURITY_ACCESS_DENIED_EXCEPTION_KEY

    public static final String ACEGI_SECURITY_ACCESS_DENIED_EXCEPTION_KEY

See Also:
  Constant Field Values

Constructor Detail

### SecurityEnforcementFilter

    public SecurityEnforcementFilter()

Method Detail

### setAuthenticationEntryPoint

    public void setAuthenticationEntryPoint(AuthenticationEntryPoint authenticationEntryPoint)

### getAuthenticationEntryPoint

    public AuthenticationEntryPoint getAuthenticationEntryPoint()

### setAuthenticationTrustResolver

    public void setAuthenticationTrustResolver(AuthenticationTrustResolver authenticationTrustResolver)

### isCreateSessionAllowed

    public boolean isCreateSessionAllowed()

  If `true`, indicates that `SecurityEnforcementFilter` is permitted to store the target URL and exception information in the `HttpSession` (the default). In situations where you do not wish to unnecessarily create `HttpSession`s - because the user agent will know the failed URL, such as with BASIC or Digest authentication - you may wish to set this property to `false`. Remember to also set the `HttpSessionContextIntegrationFilter.allowSessionCreation` to `false` if you set this property to `false`.

  Returns:
    `true` if the `HttpSession` will be used to store information about the failed request, `false` if the `HttpSession` will not be used

### setCreateSessionAllowed

    public void setCreateSessionAllowed(boolean createSessionAllowed)

### getAuthenticationTrustResolver

    public AuthenticationTrustResolver getAuthenticationTrustResolver()

### setFilterSecurityInterceptor

    public void setFilterSecurityInterceptor(FilterSecurityInterceptor filterSecurityInterceptor)

### getFilterSecurityInterceptor

    public FilterSecurityInterceptor getFilterSecurityInterceptor()

### setPortResolver

    public void setPortResolver(PortResolver portResolver)

### getPortResolver

    public PortResolver getPortResolver()

### afterPropertiesSet

    public void afterPropertiesSet()
                            throws Exception

  Specified by:
    `afterPropertiesSet` in interface `InitializingBean`
  Throws:
    `Exception`

### destroy

    public void destroy()

  Specified by:
    `destroy` in interface `javax.servlet.Filter`

### doFilter

    public void doFilter(javax.servlet.ServletRequest request,
                         javax.servlet.ServletResponse response,
                         javax.servlet.FilterChain chain)
                  throws IOException,
                         javax.servlet.ServletException

  Specified by:
    `doFilter` in interface `javax.servlet.Filter`
  Throws:
    `IOException`
    `javax.servlet.ServletException`

### init

    public void init(javax.servlet.FilterConfig filterConfig)
              throws javax.servlet.ServletException

  Specified by:
    `init` in interface `javax.servlet.Filter`
  Throws:
    `javax.servlet.ServletException`

### sendAccessDeniedError

    protected void sendAccessDeniedError(FilterInvocation fi,
                                         AccessDeniedException accessDenied)
                                  throws javax.servlet.ServletException,
                                         IOException

  Throws:
    `javax.servlet.ServletException`
    `IOException`

### sendStartAuthentication

    protected void sendStartAuthentication(FilterInvocation fi,
                                           AuthenticationException reason)
                                    throws javax.servlet.ServletException,
                                           IOException

  Throws:
    `javax.servlet.ServletException`
    `IOException`

Overview | Package | Class | Use | Tree | Deprecated | Index | Help
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD

Copyright © 2004-2005 Acegi Technology Pty Limited. All Rights Reserved.