View Javadoc

1   /* Copyright 2004, 2005 Acegi Technology Pty Limited
2    *
3    * Licensed under the Apache License, Version 2.0 (the "License");
4    * you may not use this file except in compliance with the License.
5    * You may obtain a copy of the License at
6    *
7    *     http://www.apache.org/licenses/LICENSE-2.0
8    *
9    * Unless required by applicable law or agreed to in writing, software
10   * distributed under the License is distributed on an "AS IS" BASIS,
11   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12   * See the License for the specific language governing permissions and
13   * limitations under the License.
14   */
15  
16  package org.acegisecurity.adapters;
17  
18  import org.acegisecurity.Authentication;
19  import org.acegisecurity.context.SecurityContextHolder;
20  
21  import org.apache.commons.logging.Log;
22  import org.apache.commons.logging.LogFactory;
23  
24  import java.io.IOException;
25  
26  import java.security.Principal;
27  
28  import javax.servlet.Filter;
29  import javax.servlet.FilterChain;
30  import javax.servlet.FilterConfig;
31  import javax.servlet.ServletException;
32  import javax.servlet.ServletRequest;
33  import javax.servlet.ServletResponse;
34  import javax.servlet.http.HttpServletRequest;
35  
36  
37  /***
38   * Populates <code>SecurityContext</code> with the <code>Authentication</code>
39   * obtained from the container's
40   * <code>HttpServletRequest.getUserPrincipal()</code>.
41   * 
42   * <p>
43   * Use this filter with container adapters only.
44   * </p>
45   * 
46   * <p>
47   * This filter <b>never</b> preserves the <code>Authentication</code> on the
48   * <code>SecurityContext</code> - it is replaced every request.
49   * </p>
50   * 
51   * <p>
52   * See {@link org.acegisecurity.context.HttpSessionContextIntegrationFilter}
53   * for further information.
54   * </p>
55   *
56   * @author Ben Alex
57   * @version $Id: HttpRequestIntegrationFilter.java,v 1.11 2005/11/17 00:55:49 benalex Exp $
58   */
59  public class HttpRequestIntegrationFilter implements Filter {
60      //~ Static fields/initializers =============================================
61  
62      private static final Log logger = LogFactory.getLog(HttpRequestIntegrationFilter.class);
63  
64      //~ Methods ================================================================
65  
66      /***
67       * Does nothing. We use IoC container lifecycle services instead.
68       */
69      public void destroy() {}
70  
71      public void doFilter(ServletRequest request, ServletResponse response,
72          FilterChain chain) throws IOException, ServletException {
73          if (request instanceof HttpServletRequest) {
74              Principal principal = ((HttpServletRequest) request)
75                  .getUserPrincipal();
76  
77              if ((principal != null) && principal instanceof Authentication) {
78                  SecurityContextHolder.getContext().setAuthentication((Authentication) principal);
79  
80                  if (logger.isDebugEnabled()) {
81                      logger.debug(
82                          "SecurityContextHolder updated with Authentication from container: '"
83                          + principal + "'");
84                  }
85              } else {
86                  if (logger.isDebugEnabled()) {
87                      logger.debug(
88                          "SecurityContextHolder not set with new Authentication as Principal was: '"
89                          + principal + "'");
90                  }
91              }
92          } else {
93              throw new IllegalArgumentException(
94                  "Only HttpServletRequest is acceptable");
95          }
96  
97          chain.doFilter(request, response);
98      }
99  
100     /***
101      * Does nothing. We use IoC container lifecycle services instead.
102      *
103      * @param arg0 ignored
104      *
105      * @throws ServletException ignored
106      */
107     public void init(FilterConfig arg0) throws ServletException {}
108 }