View Javadoc

1   /* Copyright 2004 Acegi Technology Pty Limited
2    *
3    * Licensed under the Apache License, Version 2.0 (the "License");
4    * you may not use this file except in compliance with the License.
5    * You may obtain a copy of the License at
6    *
7    *     http://www.apache.org/licenses/LICENSE-2.0
8    *
9    * Unless required by applicable law or agreed to in writing, software
10   * distributed under the License is distributed on an "AS IS" BASIS,
11   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12   * See the License for the specific language governing permissions and
13   * limitations under the License.
14   */
15  
16  package org.acegisecurity.ui.basicauth;
17  
18  import org.acegisecurity.AuthenticationException;
19  import org.acegisecurity.intercept.web.AuthenticationEntryPoint;
20  
21  import org.springframework.beans.factory.InitializingBean;
22  
23  import java.io.IOException;
24  
25  import javax.servlet.ServletException;
26  import javax.servlet.ServletRequest;
27  import javax.servlet.ServletResponse;
28  import javax.servlet.http.HttpServletResponse;
29  
30  
31  /***
32   * Used by the <code>SecurityEnforcementFilter</code> to commence
33   * authentication via the {@link BasicProcessingFilter}.
34   * 
35   * <P>
36   * Once a user agent is authenticated using BASIC authentication, logout
37   * requires that the browser be closed or an unauthorized (401) header be
38   * sent. The simplest way of achieving the latter is to call the {@link
39   * #commence(ServletRequest, ServletResponse)} method below. This will
40   * indicate to the browser its credentials are no longer authorized, causing
41   * it to prompt the user to login again.
42   * </p>
43   *
44   * @author Ben Alex
45   * @version $Id: BasicProcessingFilterEntryPoint.java,v 1.4 2005/11/17 00:56:48 benalex Exp $
46   */
47  public class BasicProcessingFilterEntryPoint implements AuthenticationEntryPoint,
48      InitializingBean {
49      //~ Instance fields ========================================================
50  
51      private String realmName;
52  
53      //~ Methods ================================================================
54  
55      public void setRealmName(String realmName) {
56          this.realmName = realmName;
57      }
58  
59      public String getRealmName() {
60          return realmName;
61      }
62  
63      public void afterPropertiesSet() throws Exception {
64          if ((realmName == null) || "".equals(realmName)) {
65              throw new IllegalArgumentException("realmName must be specified");
66          }
67      }
68  
69      public void commence(ServletRequest request, ServletResponse response,
70          AuthenticationException authException)
71          throws IOException, ServletException {
72          HttpServletResponse httpResponse = (HttpServletResponse) response;
73          httpResponse.addHeader("WWW-Authenticate",
74              "Basic realm=\"" + realmName + "\"");
75          httpResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED,
76              authException.getMessage());
77      }
78  }