io.apiman.common.servlet

Class AuthenticationFilter

java.lang.Object

io.apiman.common.servlet.AuthenticationFilter

All Implemented Interfaces:

javax.servlet.Filter

public class AuthenticationFilter
extends Object
implements javax.servlet.Filter

A simple implementation of an authentication filter - uses the APIMan AuthToken concept to implement the equivalent of bearer token authentication. This filter supports both AuthToken's as well as standard BASIC authentication. The latter is implemented by delegating to the container.

Author:

eric.wittmann@redhat.com

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
protected static class	AuthenticationFilter.Creds Models inbound basic auth credentials (user/password).

Constructor Summary

Constructors

Constructor and Description
AuthenticationFilter() Constructor.

Method Summary

Methods

Modifier and Type	Method and Description
protected Set<String>	defaultAllowedIssuers()
protected String	defaultKeyAlias()
protected String	defaultKeyPassword()
protected String	defaultKeystorePassword()
protected String	defaultKeystorePath()
protected String	defaultRealm()
protected boolean	defaultSignatureRequired()
protected boolean	defaultWrapRequest()
void	destroy()
protected void	doBasicAuth(AuthenticationFilter.Creds credentials, javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, javax.servlet.FilterChain chain) Handle BASIC authentication.
void	doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain)
protected void	doFilterChain(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain, io.apiman.common.auth.AuthPrincipal principal) Further process the filter chain.
protected void	doTokenAuth(io.apiman.common.auth.AuthToken token, javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, javax.servlet.FilterChain chain) Implements token based authentication.
void	init(javax.servlet.FilterConfig config)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AuthenticationFilter

public AuthenticationFilter()

Constructor.

Method Detail

init

public void init(javax.servlet.FilterConfig config)
          throws javax.servlet.ServletException

Specified by:

init in interface javax.servlet.Filter

Throws:

javax.servlet.ServletException

See Also:

Filter.init(javax.servlet.FilterConfig)

defaultKeystorePassword

protected String defaultKeystorePassword()

Returns:

the default keystore password

defaultKeyAlias

protected String defaultKeyAlias()

Returns:

the default key alias

defaultKeyPassword

protected String defaultKeyPassword()

Returns:

the default key password

defaultKeystorePath

protected String defaultKeystorePath()

Returns:

the default value of keystorePath

defaultSignatureRequired

protected boolean defaultSignatureRequired()

Returns:

the default value of signatureRequired

defaultWrapRequest

protected boolean defaultWrapRequest()

Returns:

the default value of wrapRequest

defaultAllowedIssuers

protected Set<String> defaultAllowedIssuers()

Returns:

the default set of allowed issuers

defaultRealm

protected String defaultRealm()

Returns:

the default realm

doFilter

public void doFilter(javax.servlet.ServletRequest request,
            javax.servlet.ServletResponse response,
            javax.servlet.FilterChain chain)
              throws IOException,
                     javax.servlet.ServletException

Specified by:

doFilter in interface javax.servlet.Filter

Throws:

IOException

javax.servlet.ServletException

See Also:

Filter.doFilter(javax.servlet.ServletRequest, javax.servlet.ServletResponse, javax.servlet.FilterChain)

doBasicAuth

protected void doBasicAuth(AuthenticationFilter.Creds credentials,
               javax.servlet.http.HttpServletRequest request,
               javax.servlet.http.HttpServletResponse response,
               javax.servlet.FilterChain chain)
                    throws IOException,
                           javax.servlet.ServletException

Handle BASIC authentication. Delegates this to the container by invoking 'login' on the inbound http servlet request object.

Parameters:

credentials - the credentials

request - the http servlet request

response - the http servlet respose

chain - the filter chain

Throws:

IOException - when I/O failure occurs in filter chain

javax.servlet.ServletException - when servlet exception occurs during auth

doTokenAuth

protected void doTokenAuth(io.apiman.common.auth.AuthToken token,
               javax.servlet.http.HttpServletRequest request,
               javax.servlet.http.HttpServletResponse response,
               javax.servlet.FilterChain chain)
                    throws IOException,
                           javax.servlet.ServletException

Implements token based authentication. This simply creates a principal from the AuthToken and then calls doFilterChain.

Parameters:

token - the token

request - the request

response - the response

chain - the filterchain

Throws:

IOException - when I/O failure occurs in filter chain

javax.servlet.ServletException - when servlet exception occurs during auth

doFilterChain

protected void doFilterChain(javax.servlet.ServletRequest request,
                 javax.servlet.ServletResponse response,
                 javax.servlet.FilterChain chain,
                 io.apiman.common.auth.AuthPrincipal principal)
                      throws IOException,
                             javax.servlet.ServletException

Further process the filter chain.

Parameters:

request - the request

response - the response

chain - the filter chain

principal - the auth principal

Throws:

IOException - when I/O failure occurs in filter chain

javax.servlet.ServletException - when servlet exception occurs during auth

destroy

public void destroy()

Specified by:

destroy in interface javax.servlet.Filter

See Also:

Filter.destroy()