Package com.avoka.fc.core.security

Class SSOAuthenticationFilter

java.lang.Object

org.springframework.web.filter.GenericFilterBean

com.avoka.fc.core.security.SSOAuthenticationFilter

All Implemented Interfaces:

Filter, org.springframework.beans.factory.Aware, org.springframework.beans.factory.BeanNameAware, org.springframework.beans.factory.DisposableBean, org.springframework.beans.factory.InitializingBean, org.springframework.context.ApplicationEventPublisherAware, org.springframework.context.EnvironmentAware, org.springframework.core.env.EnvironmentCapable, org.springframework.web.context.ServletContextAware

public class SSOAuthenticationFilter
extends org.springframework.web.filter.GenericFilterBean
implements org.springframework.context.ApplicationEventPublisherAware

Provides an SSO Filter to perform pre-authentication processing. This class is derived from the Spring AbstractPreAuthenticatedProcessingFilter class.

Since:

3.5.0

See Also:

AbstractPreAuthenticatedProcessingFilter, PreAuthenticatedAuthenticationToken

Constructor Summary

Constructors

Constructor	Description
SSOAuthenticationFilter()

Method Summary

Modifier and Type	Method	Description
void	afterPropertiesSet()	Check whether all required properties have been set.
protected boolean	doAuthenticate(HttpServletRequest request, HttpServletResponse response)
void	doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)	Try to authenticate a pre-authenticated user with Spring Security if the user has not yet been authenticated.
protected org.springframework.security.authentication.AuthenticationDetailsSource<HttpServletRequest,?>	getAuthenticationDetailsSource()
protected SSOAuthenticationToken	getAuthenticationToken(HttpServletRequest request)	Return the SSOAuthenticationToken for the request.
protected Object	getPreAuthenticatedCredentials(HttpServletRequest request)	Override to extract the credentials (if applicable) from the current request.
protected Object	getPreAuthenticatedPrincipal(HttpServletRequest request)	Override to extract the principal information from the current request
SecurityLogger	getSecurityLogger()	Return the service logger.
protected SecurityManager	getSecurityManager(Portal portal)	Return the security manager for the portal.
protected boolean	isRevalidationRequired(HttpServletRequest request, org.springframework.security.core.Authentication currentUserAuthentication, Portal portal, SecurityManager securityManager)	Return the true if for the request requires revalidation
protected boolean	isSSOFilterEnabled(HttpServletRequest request, Portal portal)	Return true if the SSO Filter is enabled.
protected boolean	onSuccessContinueProcessingScript(HttpServletRequest request, HttpServletResponse response)	Return true if continue processing successful for the request.
protected boolean	requiresAuthentication(HttpServletRequest request, Portal portal)
void	setApplicationEventPublisher(org.springframework.context.ApplicationEventPublisher anApplicationEventPublisher)	Set the application event publisher to the specified value
void	setAuthenticationDetailsSource(org.springframework.security.authentication.AuthenticationDetailsSource<HttpServletRequest,?> authenticationDetailsSource)	Set the authentication details source to the specified value
void	setAuthenticationProvider(org.springframework.security.authentication.AuthenticationProvider authenticationProvider)	Set the authentication provider to the specified value
void	setFilterPattern(String filterPattern)	Set the filter pattern to apply requests apply SSO Authentication to.
protected void	successfulAuthentication(HttpServletRequest request, HttpServletResponse response, org.springframework.security.core.Authentication authResult)	Puts the Authentication instance returned by the authentication manager into the secure context.
protected void	unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, org.springframework.security.core.AuthenticationException failed)	Ensures the authentication object in the secure context is set to null when authentication fails.

Methods inherited from class org.springframework.web.filter.GenericFilterBean

addRequiredProperty, createEnvironment, destroy, getEnvironment, getFilterConfig, getFilterName, getServletContext, init, initBeanWrapper, initFilterBean, setBeanName, setEnvironment, setServletContext

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SSOAuthenticationFilter

public SSOAuthenticationFilter()

Method Detail

afterPropertiesSet

public void afterPropertiesSet()

Check whether all required properties have been set.

Specified by:

afterPropertiesSet in interface org.springframework.beans.factory.InitializingBean

Overrides:

afterPropertiesSet in class org.springframework.web.filter.GenericFilterBean

doFilter

public void doFilter(ServletRequest servletRequest,
                     ServletResponse servletResponse,
                     FilterChain filterChain)
              throws IOException,
                     ServletException

Try to authenticate a pre-authenticated user with Spring Security if the user has not yet been authenticated.

Specified by:

doFilter in interface Filter

Parameters:

servletRequest - the servlet request

servletResponse - the servlet response

filterChain - the filter chain

Throws:

IOException - if an I/O error occurs

ServletException - if a servlet exception occurs

See Also:

Filter.doFilter(ServletRequest, ServletResponse, FilterChain)

setFilterPattern

public void setFilterPattern(String filterPattern)

Set the filter pattern to apply requests apply SSO Authentication to.

Parameters:

filterPattern - the filter pattern to apply requests apply SSO Authentication to

setApplicationEventPublisher

public void setApplicationEventPublisher(org.springframework.context.ApplicationEventPublisher anApplicationEventPublisher)

Set the application event publisher to the specified value

Specified by:

setApplicationEventPublisher in interface org.springframework.context.ApplicationEventPublisherAware

Parameters:

anApplicationEventPublisher - the new event publisher

See Also:

AbstractPreAuthenticatedProcessingFilter

setAuthenticationDetailsSource

public void setAuthenticationDetailsSource(org.springframework.security.authentication.AuthenticationDetailsSource<HttpServletRequest,?> authenticationDetailsSource)

Set the authentication details source to the specified value

Parameters:

authenticationDetailsSource - the authentication details source (required)

See Also:

AbstractPreAuthenticatedProcessingFilter

setAuthenticationProvider

public void setAuthenticationProvider(org.springframework.security.authentication.AuthenticationProvider authenticationProvider)

Set the authentication provider to the specified value

Parameters:

authenticationProvider - the authentication provider

See Also:

AbstractPreAuthenticatedProcessingFilter

getSecurityLogger

public SecurityLogger getSecurityLogger()

Return the service logger.

Returns:

the service logger

Since:

17.10.0

getAuthenticationDetailsSource

protected org.springframework.security.authentication.AuthenticationDetailsSource<HttpServletRequest,?> getAuthenticationDetailsSource()

See Also:

AbstractPreAuthenticatedProcessingFilter

successfulAuthentication

protected void successfulAuthentication(HttpServletRequest request,
                                        HttpServletResponse response,
                                        org.springframework.security.core.Authentication authResult)

Puts the Authentication instance returned by the authentication manager into the secure context.

unsuccessfulAuthentication

protected void unsuccessfulAuthentication(HttpServletRequest request,
                                          HttpServletResponse response,
                                          org.springframework.security.core.AuthenticationException failed)

Ensures the authentication object in the secure context is set to null when authentication fails.

Caches the failure exception as a request attribute

getPreAuthenticatedPrincipal

protected Object getPreAuthenticatedPrincipal(HttpServletRequest request)

Override to extract the principal information from the current request

getPreAuthenticatedCredentials

protected Object getPreAuthenticatedCredentials(HttpServletRequest request)

Override to extract the credentials (if applicable) from the current request. Should not return null for a valid principal, though some implementations may return a dummy value.

isSSOFilterEnabled

protected boolean isSSOFilterEnabled(HttpServletRequest request,
                                     Portal portal)

Return true if the SSO Filter is enabled.

Returns:

true if the SSO Filter is enabled

doAuthenticate

protected boolean doAuthenticate(HttpServletRequest request,
                                 HttpServletResponse response)
                          throws RedirectException

Throws:

RedirectException

See Also:

AbstractPreAuthenticatedProcessingFilter

requiresAuthentication

protected boolean requiresAuthentication(HttpServletRequest request,
                                         Portal portal)

See Also:

AbstractPreAuthenticatedProcessingFilter

getSecurityManager

protected SecurityManager getSecurityManager(Portal portal)

Return the security manager for the portal.

Parameters:

portal - the request portal

Returns:

the security manager for the request

Since:

3.6.0

getAuthenticationToken

protected SSOAuthenticationToken getAuthenticationToken(HttpServletRequest request)
                                                 throws RedirectException

Return the SSOAuthenticationToken for the request.

Parameters:

request - the servlet request

Returns:

the SSOAuthenticationToken for the request

Throws:

RedirectException

onSuccessContinueProcessingScript

protected boolean onSuccessContinueProcessingScript(HttpServletRequest request,
                                                    HttpServletResponse response)

Return true if continue processing successful for the request.

Parameters:

request - the servlet request

response - the servlet response

Returns:

true if continue processing successful for the request

isRevalidationRequired

protected boolean isRevalidationRequired(HttpServletRequest request,
                                         org.springframework.security.core.Authentication currentUserAuthentication,
                                         Portal portal,
                                         SecurityManager securityManager)
                                  throws RedirectException

Return the true if for the request requires revalidation

Parameters:

request - the servlet request

currentUserAuthentication - the current SpringSecurity Authentication token

portal - the request portal

securityManager - the current security manager

Returns:

the true if for the request requires revalidation

Throws:

RedirectException

Since:

4.3.2