org.acegisecurity.ui.rememberme.TokenBasedRememberMeServices
|
||||||||||
| PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
| SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD | |||||||||
java.lang.Object
public class TokenBasedRememberMeServices
Identifies previously remembered users by a Base-64 encoded cookie.
This implementation does not rely on an external database, so is attractive
for simple applications. The cookie will be valid for a specific period
from the date of the last loginSuccess(HttpServletRequest,
HttpServletResponse, Authentication). As per the interface contract, this
method will only be called when the principal completes a successful
interactive authentication. As such the time period commences from the last
authentication attempt where they furnished credentials - not the time
period they last logged in via remember-me. The implementation will only
send a remember-me token if the parameter defined by setParameter(String) is present.
An UserDetailsService is required
by this implementation, so that it can construct a valid
Authentication from the returned UserDetails. This is also necessary so that the
user's password is available and can be checked as part of the encoded
cookie.
The cookie encoded by this implementation adopts the following form:
username + ":" + expiryTime + ":" + Md5Hex(username + ":" +
expiryTime + ":" + password + ":" + key) .
As such, if the user changes their password any remember-me token will be invalidated. Equally, the system administrator may invalidate every remember-me token on issue by changing the key. This provides some reasonable approaches to recovering from a remember-me token being left on a public machine (eg kiosk system, Internet cafe etc). Most importantly, at no time is the user's password ever sent to the user agent, providing an important security safeguard. Unfortunately the username is necessary in this implementation (as we do not want to rely on a database for remember-me services) and as such high security applications should be aware of this occasionally undesired disclosure of a valid username.
This is a basic remember-me implementation which is suitable for many applications. However, we recommend a database-based implementation if you require a more secure remember-me approach.
By default the tokens will be valid for 14 days from the last successful
authentication attempt. This can be changed using #setTokenValiditySeconds(int).
| Field Summary | |
|---|---|
static String |
ACEGI_SECURITY_HASHED_REMEMBER_ME_COOKIE_KEY
|
static String |
DEFAULT_PARAMETER
|
protected static org.apache.commons.logging.Log |
logger
|
| Constructor Summary | |
|---|---|
TokenBasedRememberMeServices()
|
|
| Method Summary | |
|---|---|
void |
afterPropertiesSet()
|
Authentication |
autoLogin(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response)
This method will be called whenever the SecurityContextHolder does
not contain an Authentication and the Acegi Security
system wishes to provide an implementation with an opportunity to
authenticate the request using remember-me capabilities. |
String |
getKey()
|
String |
getParameter()
|
long |
getTokenValiditySeconds()
|
UserDetailsService |
getUserDetailsService()
|
void |
loginFail(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response)
Called whenever an interactive authentication attempt was made, but the credentials supplied by the user were missing or otherwise invalid. |
void |
loginSuccess(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response,
Authentication successfulAuthentication)
Called whenever an interactive authentication attempt is successful. |
protected javax.servlet.http.Cookie |
makeCancelCookie()
|
protected javax.servlet.http.Cookie |
makeValidCookie(long expiryTime,
String tokenValueBase64)
|
void |
setKey(String key)
|
void |
setParameter(String parameter)
|
void |
setTokenValiditySeconds(long tokenValiditySeconds)
|
void |
setUserDetailsService(UserDetailsService authenticationDao)
|
| Methods inherited from class java.lang.Object |
|---|
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
| Field Detail |
|---|
public static final String ACEGI_SECURITY_HASHED_REMEMBER_ME_COOKIE_KEY
public static final String DEFAULT_PARAMETER
protected static final org.apache.commons.logging.Log logger
| Constructor Detail |
|---|
public TokenBasedRememberMeServices()
| Method Detail |
|---|
public void setUserDetailsService(UserDetailsService authenticationDao)
public UserDetailsService getUserDetailsService()
public void setKey(String key)
public String getKey()
public void setParameter(String parameter)
public String getParameter()
public void setTokenValiditySeconds(long tokenValiditySeconds)
public long getTokenValiditySeconds()
public void afterPropertiesSet()
throws Exception
afterPropertiesSet in interface InitializingBeanException
public Authentication autoLogin(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response)
RememberMeServicesSecurityContextHolder does
not contain an Authentication and the Acegi Security
system wishes to provide an implementation with an opportunity to
authenticate the request using remember-me capabilities. Acegi Security
makes no attempt whatsoever to determine whether the browser has
requested remember-me services or presented a valid cookie. Such
determinations are left to the implementation. If a browser has
presented an unauthorised cookie for whatever reason, it should be
silently ignored and invalidated using the
HttpServletResponse object.
The returned Authentication must be acceptable to AuthenticationManager or AuthenticationProvider defined by the
web application. It is recommended RememberMeAuthenticationToken
be used in most cases, as it has a corresponding authentication
provider.
autoLogin in interface RememberMeServicesrequest - to look for a remember-me token withinresponse - to change, cancel or modify the remember-me token
null if the
request should not be authenticated
public void loginFail(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response)
RememberMeServicesHttpServletRequest.
loginFail in interface RememberMeServicesrequest - that contained an invalid authentication requestresponse - to change, cancel or modify the remember-me token
public void loginSuccess(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response,
Authentication successfulAuthentication)
RememberMeServicesHttpServletResponse, although this is not recommended.
Instead, implementations should typically look for a request parameter
that indicates the browser has presented an explicit request for
authentication to be remembered, such as the presence of a HTTP POST
parameter.
loginSuccess in interface RememberMeServicesrequest - that contained the valid authentication requestresponse - to change, cancel or modify the remember-me tokensuccessfulAuthentication - representing the successfully
authenticated principalprotected javax.servlet.http.Cookie makeCancelCookie()
protected javax.servlet.http.Cookie makeValidCookie(long expiryTime,
String tokenValueBase64)
|
||||||||||
| PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
| SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD | |||||||||