public class HttpMessageContextWrapper extends Object implements HttpMessageContext
All methods default to calling the wrapped object.
Constructor and Description |
---|
HttpMessageContextWrapper(HttpMessageContext httpMessageContext) |
Modifier and Type | Method and Description |
---|---|
void |
cleanClientSubject()
Convenience method to clean the subject associated with this context.
|
AuthenticationStatus |
doNothing()
Instructs the container to "do nothing".
|
AuthenticationStatus |
forward(String path)
Forwards to another resource (Jakarta Servlet, Jakarta Server Pages file, or HTML file) on the server.
|
AuthenticationParameters |
getAuthParameters()
Returns the parameters that were provided with the SecurityContext#authenticate(AuthParameters) call.
|
Principal |
getCallerPrincipal()
Gets the Principal set by a call to notifyContainerAboutLogin().
|
Subject |
getClientSubject()
Returns the subject for which authentication is to take place.
|
Set<String> |
getGroups()
Gets the groups set by a call to notifyContainerAboutLogin().
|
CallbackHandler |
getHandler()
Returns the low level Jakarta Authentication handler that the runtime provided when creating this
HttpMessageContext , and which this context uses to communicate the authentication details to the runtime. |
javax.security.auth.message.MessageInfo |
getMessageInfo()
Returns the the low level Jakarta Authentication message info instance for the current request.
|
javax.servlet.http.HttpServletRequest |
getRequest()
Returns the request object associated with the current request.
|
javax.servlet.http.HttpServletResponse |
getResponse()
Returns the response object associated with the current request.
|
HttpMessageContext |
getWrapped() |
boolean |
isAuthenticationRequest()
Checks if the current call to an authentication mechanism is the result from the
application calling
SecurityContext.authenticate(HttpServletRequest, HttpServletResponse, AuthenticationParameters) |
boolean |
isProtected()
Checks if the currently requested resource is protected or not.
|
boolean |
isRegisterSession()
Check if the runtime has been asked to register an authentication session duing the current request.
|
AuthenticationStatus |
notifyContainerAboutLogin(CredentialValidationResult result)
Convenience method intended to pass the
CredentialValidationResult result of an
identity store directly on to the container. |
AuthenticationStatus |
notifyContainerAboutLogin(Principal principal,
Set<String> roles)
Asks the container to register the given caller principal and groups in order to make
them available to the application for use with
SecurityContext.isCallerInRole(String) etc. |
AuthenticationStatus |
notifyContainerAboutLogin(String username,
Set<String> roles)
Asks the container to register the given caller name and groups in order to make
them available to the application for use with
SecurityContext.isCallerInRole(String) etc. |
AuthenticationStatus |
redirect(String location)
Sets the response status to SC_FOUND 302 (Found)
|
AuthenticationStatus |
responseNotFound()
Sets the response status to 404 (not found).
|
AuthenticationStatus |
responseUnauthorized()
Sets the response status to 401 (unauthorized).
|
void |
setRegisterSession(String callerName,
Set<String> groups)
Asks the runtime to register an authentication session.
|
void |
setRequest(javax.servlet.http.HttpServletRequest request)
Sets the request object.
|
void |
setResponse(javax.servlet.http.HttpServletResponse response)
Set the response object.
|
HttpMessageContext |
withRequest(javax.servlet.http.HttpServletRequest request)
Sets the request object.
|
public HttpMessageContextWrapper(HttpMessageContext httpMessageContext)
public HttpMessageContext getWrapped()
public boolean isProtected()
HttpMessageContext
web.xml
.isProtected
in interface HttpMessageContext
public boolean isAuthenticationRequest()
HttpMessageContext
SecurityContext.authenticate(HttpServletRequest, HttpServletResponse, AuthenticationParameters)
If SecurityContext#authenticate was not called, the authentication mechanism may have been invoked by the container at the start of a request.
isAuthenticationRequest
in interface HttpMessageContext
public boolean isRegisterSession()
HttpMessageContext
isRegisterSession
in interface HttpMessageContext
public void setRegisterSession(String callerName, Set<String> groups)
HttpMessageContext
HttpAuthenticationMechanism
has to manually re-authenticate with the runtime at the start of each request.setRegisterSession
in interface HttpMessageContext
callerName
- the caller name for which authentication should be be rememberedgroups
- the groups for which authentication should be remembered.public void cleanClientSubject()
HttpMessageContext
Cleaning this subject is done as defined by the Servlet Container Profile of Jakarta Authentication
for the ServerAuthModule#cleanSubject method and the
HttpAuthenticationMechanism.cleanSubject(HttpServletRequest, HttpServletResponse, HttpMessageContext)
method defined by this specification.
cleanClientSubject
in interface HttpMessageContext
public AuthenticationParameters getAuthParameters()
HttpMessageContext
getAuthParameters
in interface HttpMessageContext
public CallbackHandler getHandler()
HttpMessageContext
HttpMessageContext
, and which this context uses to communicate the authentication details to the runtime.
Note: This is a low level object that most higher level code would not need to use directly.
getHandler
in interface HttpMessageContext
public javax.security.auth.message.MessageInfo getMessageInfo()
HttpMessageContext
Note: This is a low level object that most higher level code would not need to use directly.
getMessageInfo
in interface HttpMessageContext
public Subject getClientSubject()
HttpMessageContext
Note: This is a low level object that most higher level code would not need to use directly.
getClientSubject
in interface HttpMessageContext
public javax.servlet.http.HttpServletRequest getRequest()
HttpMessageContext
getRequest
in interface HttpMessageContext
public void setRequest(javax.servlet.http.HttpServletRequest request)
HttpMessageContext
setRequest
in interface HttpMessageContext
request
- the request object to be setpublic HttpMessageContext withRequest(javax.servlet.http.HttpServletRequest request)
HttpMessageContext
withRequest
in interface HttpMessageContext
request
- the request object to be set.public javax.servlet.http.HttpServletResponse getResponse()
HttpMessageContext
getResponse
in interface HttpMessageContext
public void setResponse(javax.servlet.http.HttpServletResponse response)
HttpMessageContext
setResponse
in interface HttpMessageContext
response
- the response object to be set.public AuthenticationStatus redirect(String location)
HttpMessageContext
As a convenience this method returns SEND_CONTINUE, so this method can be used in
one fluent return statement from an HttpAuthenticationMechanism
redirect
in interface HttpMessageContext
location
- the location to redirect toAuthenticationStatus.SEND_CONTINUE
HttpServletResponse.sendRedirect(String)
public AuthenticationStatus forward(String path)
HttpMessageContext
As a convenience this method returns SEND_CONTINUE, so this method can be used in
one fluent return statement from an HttpAuthenticationMechanism
forward
in interface HttpMessageContext
path
- a String specifying the pathname to the resource.AuthenticationStatus.SEND_CONTINUE
RequestDispatcher.forward(javax.servlet.ServletRequest, javax.servlet.ServletResponse)
public AuthenticationStatus responseUnauthorized()
HttpMessageContext
As a convenience this method returns SEND_FAILURE, so this method can be used in
one fluent return statement from an HttpAuthenticationMechanism
responseUnauthorized
in interface HttpMessageContext
AuthenticationStatus.SEND_FAILURE
public AuthenticationStatus responseNotFound()
HttpMessageContext
As a convenience this method returns SEND_FAILURE, so this method can be used in
one fluent return statement from an HttpAuthenticationMechanism
responseNotFound
in interface HttpMessageContext
AuthenticationStatus.SEND_FAILURE
public AuthenticationStatus notifyContainerAboutLogin(String username, Set<String> roles)
HttpMessageContext
SecurityContext.isCallerInRole(String)
etc.
Note that after this call returned, the authenticated identity will not be immediately active. This will only take place (should no errors occur) after the authentication mechanism in which this call takes place returns control back to the container (runtime).
As a convenience this method returns SUCCESS, so this method can be used in
one fluent return statement from an HttpAuthenticationMechanism
notifyContainerAboutLogin
in interface HttpMessageContext
username
- the caller name that will become the caller principalroles
- the groups associated with the caller principalAuthenticationStatus.SUCCESS
public AuthenticationStatus notifyContainerAboutLogin(Principal principal, Set<String> roles)
HttpMessageContext
SecurityContext.isCallerInRole(String)
etc.
Note that this call may result in the container establishing two caller principals to represent the caller's identity -- the Principal provided here as the principal parameter, and a second principal used as the container's representation of the caller identity. A second principal is added only if the container uses a different Principal type to represent the caller. If the types are the same, only one Principal is added.
If a second principal is added, the value returned by Principal.getName()
will be the same for both principals.
When two principals are added, the container's caller principal is returned from
SecurityContext.getCallerPrincipal()
, and the principal supplied here
as a parameter can be retrieved using SecurityContext.getPrincipalsByType(Class)
.
When only one is added, it is returned by SecurityContext.getCallerPrincipal()
.
Note that after this call returned, the authenticated identity will not be immediately active. This will only take place (should no errors occur) after the authentication mechanism in which this call takes place returns control back to the container (runtime).
As a convenience this method returns SUCCESS, so this method can be used in
one fluent return statement from an HttpAuthenticationMechanism
notifyContainerAboutLogin
in interface HttpMessageContext
principal
- the Principal that will become the caller principalroles
- the groups associated with the caller principalAuthenticationStatus.SUCCESS
public AuthenticationStatus notifyContainerAboutLogin(CredentialValidationResult result)
HttpMessageContext
CredentialValidationResult
result of an
identity store directly on to the container.
If the outcome from the given CredentialValidationResult.getStatus()
equals
CredentialValidationResult.Status.VALID
, the CallerPrincipal
and groups are obtained from the
CredentialValidationResult
and passed into
HttpMessageContext.notifyContainerAboutLogin(Principal, Set)
.
If the outcome from the given CredentialValidationResult.getStatus()
is not
equal to CredentialValidationResult.Status.VALID
a failure result is returned.
notifyContainerAboutLogin
in interface HttpMessageContext
result
- a CredentialValidationResult which is inspected for its status and from which the principal and groups
are taken.AuthenticationStatus.SUCCESS
if CredentialValidationResult.getStatus()
equals CredentialValidationResult.Status.VALID
otherwise AuthenticationStatus.SEND_FAILURE
public AuthenticationStatus doNothing()
HttpMessageContext
When intending to do nothing, a Jakarta Security authentication mechanism has to indicate this explicitly via its return value.
As a convenience this method returns NOT_DONE, so this method can be used in
one fluent return statement from an HttpAuthenticationMechanism
doNothing
in interface HttpMessageContext
AuthenticationStatus.NOT_DONE
public Principal getCallerPrincipal()
HttpMessageContext
getCallerPrincipal
in interface HttpMessageContext
public Set<String> getGroups()
HttpMessageContext
getGroups
in interface HttpMessageContext
Comments to: es-dev@eclipse.org.
Copyright © 2019 Eclipse Foundation. All rights reserved.
Use is subject to license terms.