Overview | Package | Class | Use | Tree | Deprecated | Index | Help
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD

## org.acegisecurity.ui
Class AbstractProcessingFilter

    java.lang.Object
      org.acegisecurity.ui.AbstractProcessingFilter

All Implemented Interfaces:
  javax.servlet.Filter, InitializingBean, ApplicationEventPublisherAware, MessageSourceAware

Direct Known Subclasses:
  AuthenticationProcessingFilter, CasProcessingFilter

    public abstract class AbstractProcessingFilter

extends Object
implements javax.servlet.Filter, InitializingBean, ApplicationEventPublisherAware, MessageSourceAware

Abstract processor of browser-based HTTP-based authentication requests.

This filter is responsible for processing authentication requests. If authentication is successful, the resulting `Authentication` object will be placed into the `SecurityContext`, which is guaranteed to have already been created by an earlier filter.

If authentication fails, the `AuthenticationException` will be placed into the `HttpSession` with the attribute defined by `ACEGI_SECURITY_LAST_EXCEPTION_KEY`.

To use this filter, it is necessary to specify the following properties:

- `defaultTargetUrl` indicates the URL that should be used for redirection if the `HttpSession` attribute named `ACEGI_SECURITY_TARGET_URL_KEY` does not indicate the target URL once authentication is completed successfully. eg: `/`. This will be treated as relative to the web-app's context path, and should include the leading `/`.
- `authenticationFailureUrl` indicates the URL that should be used for redirection if the authentication request fails. eg: `/login.jsp?login_error=1`.
- `filterProcessesUrl` indicates the URL that this filter will respond to. This parameter varies by subclass.
- `alwaysUseDefaultTargetUrl` causes successful authentication to always redirect to the `defaultTargetUrl`, even if the `HttpSession` attribute named `ACEGI_SECURITY_TARGET_URL_KEY` defines the intended target URL.

To configure this filter to redirect to specific pages as the result of specific `AuthenticationException`s you can do the following. Configure the `exceptionMappings` property in your application xml. This property is a java.util.Properties object that maps a fully-qualified exception class name to a redirection url target.
For example:
`<property name="exceptionMappings">
<props>
<prop> key="org.acegisecurity.BadCredentialsException">/bad_credentials.jsp</prop>
</props>
</property>
`
The example above would redirect all `BadCredentialsException`s thrown, to a page in the web-application called /bad_credentials.jsp.

Any `AuthenticationException` thrown that cannot be matched in the `exceptionMappings` will be redirected to the `authenticationFailureUrl`

If authentication is successful, an `InteractiveAuthenticationSuccessEvent` will be published to the application context. No events will be published if authentication was unsuccessful, because this would generally be recorded via an `AuthenticationManager`-specific application event.

Field Summary
`static String` | `ACEGI_SECURITY_LAST_EXCEPTION_KEY`
`static String` | `ACEGI_SECURITY_TARGET_URL_KEY`
`protected static org.apache.commons.logging.Log` | `logger`
`protected MessageSourceAccessor` | `messages`

Constructor Summary
`AbstractProcessingFilter()`

Method Summary
`void` | `afterPropertiesSet()`
`abstract Authentication` | `attemptAuthentication(javax.servlet.http.HttpServletRequest request)` Performs actual authentication.
`void` | `destroy()` Does nothing.
`void` | `doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain)`
`String` | `getAuthenticationFailureUrl()`
`AuthenticationManager` | `getAuthenticationManager()`
`abstract String` | `getDefaultFilterProcessesUrl()` Specifies the default `filterProcessesUrl` for the implementation.
`String` | `getDefaultTargetUrl()`
`Properties` | `getExceptionMappings()`
`String` | `getFilterProcessesUrl()`
`RememberMeServices` | `getRememberMeServices()`
`void` | `init(javax.servlet.FilterConfig arg0)` Does nothing.
`boolean` | `isAlwaysUseDefaultTargetUrl()`
`boolean` | `isContinueChainBeforeSuccessfulAuthentication()`
`protected void` | `onPreAuthentication(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)`
`protected void` | `onSuccessfulAuthentication(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, Authentication authResult)`
`protected void` | `onUnsuccessfulAuthentication(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)`
`protected boolean` | `requiresAuthentication(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)` Indicates whether this filter should attempt to process a login request for the current invocation.
`void` | `setAlwaysUseDefaultTargetUrl(boolean alwaysUseDefaultTargetUrl)`
`void` | `setApplicationEventPublisher(ApplicationEventPublisher eventPublisher)`
`void` | `setAuthenticationFailureUrl(String authenticationFailureUrl)`
`void` | `setAuthenticationManager(AuthenticationManager authenticationManager)`
`void` | `setContinueChainBeforeSuccessfulAuthentication(boolean continueChainBeforeSuccessfulAuthentication)`
`void` | `setDefaultTargetUrl(String defaultTargetUrl)`
`void` | `setExceptionMappings(Properties exceptionMappings)`
`void` | `setFilterProcessesUrl(String filterProcessesUrl)`
`void` | `setMessageSource(MessageSource messageSource)`
`void` | `setRememberMeServices(RememberMeServices rememberMeServices)`
`protected void` | `successfulAuthentication(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, Authentication authResult)`
`protected void` | `unsuccessfulAuthentication(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, AuthenticationException failed)`

Methods inherited from class java.lang.Object
`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

Field Detail

### ACEGI_SECURITY_TARGET_URL_KEY

    public static final String ACEGI_SECURITY_TARGET_URL_KEY

See Also:
  Constant Field Values

### ACEGI_SECURITY_LAST_EXCEPTION_KEY

    public static final String ACEGI_SECURITY_LAST_EXCEPTION_KEY

See Also:
  Constant Field Values

### logger

    protected static final org.apache.commons.logging.Log logger

### messages

    protected MessageSourceAccessor messages

Constructor Detail

### AbstractProcessingFilter

    public AbstractProcessingFilter()

Method Detail

### afterPropertiesSet

    public void afterPropertiesSet()
                            throws Exception

  Specified by:
    `afterPropertiesSet` in interface `InitializingBean`
  Throws:
    `Exception`

### attemptAuthentication

    public abstract Authentication attemptAuthentication(javax.servlet.http.HttpServletRequest request)
                                                  throws AuthenticationException

  Performs actual authentication.

  Parameters:
    `request` - from which to extract parameters and perform the authentication
  Returns:
    the authenticated user
  Throws:
    `AuthenticationException` - if authentication fails

### destroy

    public void destroy()

  Does nothing. We use IoC container lifecycle services instead.

  Specified by:
    `destroy` in interface `javax.servlet.Filter`

### doFilter

    public void doFilter(javax.servlet.ServletRequest request,
                         javax.servlet.ServletResponse response,
                         javax.servlet.FilterChain chain)
                  throws IOException,
                         javax.servlet.ServletException

  Specified by:
    `doFilter` in interface `javax.servlet.Filter`
  Throws:
    `IOException`
    `javax.servlet.ServletException`

### getAuthenticationFailureUrl

    public String getAuthenticationFailureUrl()

### getAuthenticationManager

    public AuthenticationManager getAuthenticationManager()

### getDefaultFilterProcessesUrl

    public abstract String getDefaultFilterProcessesUrl()

  Specifies the default `filterProcessesUrl` for the implementation.

  Returns:
    the default `filterProcessesUrl`

### getDefaultTargetUrl

    public String getDefaultTargetUrl()

### getExceptionMappings

    public Properties getExceptionMappings()

### getFilterProcessesUrl

    public String getFilterProcessesUrl()

### getRememberMeServices

    public RememberMeServices getRememberMeServices()

### init

    public void init(javax.servlet.FilterConfig arg0)
              throws javax.servlet.ServletException

  Does nothing. We use IoC container lifecycle services instead.

  Specified by:
    `init` in interface `javax.servlet.Filter`
  Parameters:
    `arg0` - ignored
  Throws:
    `javax.servlet.ServletException` - ignored

### isAlwaysUseDefaultTargetUrl

    public boolean isAlwaysUseDefaultTargetUrl()

### isContinueChainBeforeSuccessfulAuthentication

    public boolean isContinueChainBeforeSuccessfulAuthentication()

### onPreAuthentication

    protected void onPreAuthentication(javax.servlet.http.HttpServletRequest request,
                                       javax.servlet.http.HttpServletResponse response)
                                throws IOException

  Throws:
    `IOException`

### onSuccessfulAuthentication

    protected void onSuccessfulAuthentication(javax.servlet.http.HttpServletRequest request,
                                              javax.servlet.http.HttpServletResponse response,
                                              Authentication authResult)
                                       throws IOException

  Throws:
    `IOException`

### onUnsuccessfulAuthentication

    protected void onUnsuccessfulAuthentication(javax.servlet.http.HttpServletRequest request,
                                                javax.servlet.http.HttpServletResponse response)
                                         throws IOException

  Throws:
    `IOException`

### requiresAuthentication

    protected boolean requiresAuthentication(javax.servlet.http.HttpServletRequest request,
                                             javax.servlet.http.HttpServletResponse response)

  Indicates whether this filter should attempt to process a login request for the current invocation.

  It strips any parameters from the "path" section of the request URL (such as the jsessionid parameter in http://host/myapp/index.html;jsessionid=blah) before matching against the `filterProcessesUrl` property.

  Subclasses may override for special requirements, such as Tapestry integration.

  Parameters:
    `request` - as received from the filter chain
    `response` - as received from the filter chain
  Returns:
    `true` if the filter should attempt authentication, `false` otherwise

### setAlwaysUseDefaultTargetUrl

    public void setAlwaysUseDefaultTargetUrl(boolean alwaysUseDefaultTargetUrl)

### setApplicationEventPublisher

    public void setApplicationEventPublisher(ApplicationEventPublisher eventPublisher)

  Specified by:
    `setApplicationEventPublisher` in interface `ApplicationEventPublisherAware`

### setAuthenticationFailureUrl

    public void setAuthenticationFailureUrl(String authenticationFailureUrl)

### setAuthenticationManager

    public void setAuthenticationManager(AuthenticationManager authenticationManager)

### setContinueChainBeforeSuccessfulAuthentication

    public void setContinueChainBeforeSuccessfulAuthentication(boolean continueChainBeforeSuccessfulAuthentication)

### setDefaultTargetUrl

    public void setDefaultTargetUrl(String defaultTargetUrl)

### setExceptionMappings

    public void setExceptionMappings(Properties exceptionMappings)

### setFilterProcessesUrl

    public void setFilterProcessesUrl(String filterProcessesUrl)

### setMessageSource

    public void setMessageSource(MessageSource messageSource)

  Specified by:
    `setMessageSource` in interface `MessageSourceAware`

### setRememberMeServices

    public void setRememberMeServices(RememberMeServices rememberMeServices)

### successfulAuthentication

    protected void successfulAuthentication(javax.servlet.http.HttpServletRequest request,
                                            javax.servlet.http.HttpServletResponse response,
                                            Authentication authResult)
                                     throws IOException

  Throws:
    `IOException`

### unsuccessfulAuthentication

    protected void unsuccessfulAuthentication(javax.servlet.http.HttpServletRequest request,
                                              javax.servlet.http.HttpServletResponse response,
                                              AuthenticationException failed)
                                       throws IOException

  Throws:
    `IOException`

Overview | Package | Class | Use | Tree | Deprecated | Index | Help
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD

Copyright © 2004-2005 Acegi Technology Pty Limited. All Rights Reserved.