Connection
- Type for connection object to your toolCredentials
- Type for credentials for your tool. (e.g. UsernamePasswordCredentials)public abstract class AbstractAdapterCredentialsFilter<Credentials,Connection> extends Object implements javax.servlet.Filter
With this credentitals filter:
Once user entered credentials via HTTP Basic auth or OAuth, it
is passed to a callback method getCredentialsFromRequest(HttpServletRequest)
or getCredentialsForOAuth(String, String)
so that your implementation
can build a Credentials object from the given data.
And then, next callback method login(Object, HttpServletRequest)
is invoked for
authenticate the credentials and building connection to your back-end tool.
Concrete types of the credentials and the connection can be specified as type
parameters of this class.
While processing a request, the credentials and the connection are available
as attributes of the request. Your subsequent process such as HttpServlet.service(ServletRequest, ServletResponse)
can extract and use them for accessing your tool. You can use getConnector(HttpServletRequest)
and getCredentials(HttpServletRequest)
to retrieve them from the request.
You have to subclass this class and give implementations for the following methods:
login(Object, HttpServletRequest)
getCredentialsFromRequest(HttpServletRequest)
getCredentialsForOAuth(String, String)
isAdminSession(String, Object, HttpServletRequest)
createConsumerStore()
logout(Object, HttpSession)
(optional)
<filter> <display-name>[YOUR FILTER CLASS NAME (MyFilter)]</display-name> <filter-name>[YOUR FILTER CLASS NAME (MyFilter)]</filter-name> <filter-class>[FULLY QUALIFIED YOUR FILTER CLASS NAME (com.example.MyFilter)]</filter-class> </filter> <filter-mapping> <filter-name>[YOUR FILTER CLASS NAME (MyFilter)]</filter-name> <url-pattern>/services/*</url-pattern> </filter-mapping>
Modifier and Type | Field and Description |
---|---|
static String |
ADMIN_SESSION_ATTRIBUTE |
static String |
CONNECTOR_ATTRIBUTE |
static String |
CREDENTIALS_ATTRIBUTE |
static String |
JAZZ_INVALID_EXPIRED_TOKEN_OAUTH_PROBLEM |
static String |
OAUTH_EMPTY_TOKEN_KEY |
Modifier | Constructor and Description |
---|---|
protected |
AbstractAdapterCredentialsFilter(String displayName,
String realm)
Constructor
|
Modifier and Type | Method and Description |
---|---|
protected abstract ConsumerStore |
createConsumerStore()
Invoked from this class to create
ConsumerStore for OAuth keys. |
void |
destroy() |
protected void |
doChainDoFilterWithConnector(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response,
javax.servlet.FilterChain chain,
Connection connector)
The default implementation is:
|
void |
doFilter(javax.servlet.ServletRequest servletRequest,
javax.servlet.ServletResponse servletResponse,
javax.servlet.FilterChain chain)
Check for OAuth or BasicAuth credentials and challenge if not found.
|
static <T> T |
getConnector(javax.servlet.http.HttpServletRequest request)
get Connector assigned to this request
The connector should be placed in the session by the CredentialsFilter servlet filter
|
static <T> T |
getCredentials(javax.servlet.http.HttpServletRequest request)
Get Credentials for this session
|
protected abstract Credentials |
getCredentialsForOAuth(String id,
String password)
Create a Credentials object from given user id and password.
|
protected abstract Credentials |
getCredentialsFromRequest(javax.servlet.http.HttpServletRequest request)
Extract credentials from the request and return it.
|
protected String |
getDisplayName() |
protected String |
getOAuthRealm() |
void |
init(javax.servlet.FilterConfig filterConfig) |
protected abstract boolean |
isAdminSession(String id,
Connection session,
javax.servlet.http.HttpServletRequest request)
Tell if this is an admin session.
|
protected abstract Connection |
login(Credentials crdentials,
javax.servlet.http.HttpServletRequest request)
Create connection to your tool using the given credentials, and returns the connection.
|
protected void |
logout(Connection loginSession,
javax.servlet.http.HttpSession session)
Logout
|
public static final String CONNECTOR_ATTRIBUTE
public static final String CREDENTIALS_ATTRIBUTE
public static final String ADMIN_SESSION_ATTRIBUTE
public static final String JAZZ_INVALID_EXPIRED_TOKEN_OAUTH_PROBLEM
public static final String OAUTH_EMPTY_TOKEN_KEY
protected abstract Credentials getCredentialsFromRequest(javax.servlet.http.HttpServletRequest request) throws UnauthorizedException
request
- HttpServletRequest
UnauthorizedException
- iff no login credentials associated to the request.protected abstract Credentials getCredentialsForOAuth(String id, String password)
For OAuth two-legged request, the id
is set to OAUTH_EMPTY_TOKEN_KEY
object. Implementor can compare the value using ==
to identify the request.
In the request the consumer key is set to the password
. So you might find a functional
user associated to the consumer key with the value.
id
- user id or OAUTH_EMPTY_TOKEN_KEY
password
- password or OAuth consumer keyprotected abstract Connection login(Credentials crdentials, javax.servlet.http.HttpServletRequest request) throws UnauthorizedException, javax.servlet.ServletException
crdentials
- credentials for loginrequest
- HttpServletRequest
UnauthorizedException
- credentials is invalidjavax.servlet.ServletException
- other exceptional situationprotected void logout(Connection loginSession, javax.servlet.http.HttpSession session)
loginSession
- session
- protected abstract boolean isAdminSession(String id, Connection session, javax.servlet.http.HttpServletRequest request)
id
- session
- request
- protected abstract ConsumerStore createConsumerStore() throws Exception
ConsumerStore
for OAuth keys.
Typical implementation can be:
return new FileSystemConsumerStore("YourOAuthStore.xml");
Exception
public static <T> T getConnector(javax.servlet.http.HttpServletRequest request)
request
- public static <T> T getCredentials(javax.servlet.http.HttpServletRequest request)
request
- protected String getOAuthRealm()
protected String getDisplayName()
public void destroy()
destroy
in interface javax.servlet.Filter
public void doFilter(javax.servlet.ServletRequest servletRequest, javax.servlet.ServletResponse servletResponse, javax.servlet.FilterChain chain) throws IOException, javax.servlet.ServletException
doFilter
in interface javax.servlet.Filter
IOException
javax.servlet.ServletException
protected void doChainDoFilterWithConnector(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, javax.servlet.FilterChain chain, Connection connector) throws IOException, javax.servlet.ServletException
request.setAttribute(CONNECTOR_ATTRIBUTE, connector); chain.doFilter(request, response);Subclass may invoke the
chain.doFilter()
directly instead of invoking super method.request
- HttpServletRequest
response
- HttpServletResponse
chain
- FilterChain
connector
- Connection
to be used for processing rest of the chain (i.e. REST request)IOException
javax.servlet.ServletException
public void init(javax.servlet.FilterConfig filterConfig) throws javax.servlet.ServletException
init
in interface javax.servlet.Filter
javax.servlet.ServletException
Copyright © 2020. All rights reserved.