org.apache.brooklyn.rest.security.provider

Class AbstractSecurityProvider

java.lang.Object

org.apache.brooklyn.rest.security.provider.AbstractSecurityProvider

All Implemented Interfaces:

SecurityProvider

Direct Known Subclasses:

BrooklynUserWithRandomPasswordSecurityProvider, ExplicitUsersSecurityProvider, LdapSecurityProvider

public abstract class AbstractSecurityProvider
extends java.lang.Object
implements SecurityProvider

Provides default implementations of isAuthenticated(HttpSession) and logout(HttpSession).

Nested Class Summary

Nested classes/interfaces inherited from interface org.apache.brooklyn.rest.security.provider.SecurityProvider

SecurityProvider.SecurityProviderDeniedAuthentication

Constructor Summary

Constructors

Constructor and Description
AbstractSecurityProvider()

Method Summary

Modifier and Type	Method and Description
boolean	isAuthenticated(javax.servlet.http.HttpSession session) If user supplied a value session, this passes that in so the SecurityProvider can check whether the user has previously authenticated, e.g.
boolean	logout(javax.servlet.http.HttpSession session) Will get invoked on explicit REST API callback.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apache.brooklyn.rest.security.provider.SecurityProvider

authenticate, requiresUserPass

Constructor Detail

AbstractSecurityProvider

public AbstractSecurityProvider()

Method Detail

isAuthenticated

public boolean isAuthenticated(javax.servlet.http.HttpSession session)

Description copied from interface: SecurityProvider

If user supplied a value session, this passes that in so the SecurityProvider can check whether the user has previously authenticated, e.g. via an HttpSession.setAttribute(String, Object) done by SecurityProvider.authenticate(HttpServletRequest, Supplier, String, String).

Note that this will be the MultiSessionAttributeAdapter.getPreferredSession().

If the user didn't request a session or they requested a session which is not known here, the argument will be null.

Specified by:

isAuthenticated in interface SecurityProvider

logout

public boolean logout(javax.servlet.http.HttpSession session)

Description copied from interface: SecurityProvider

Will get invoked on explicit REST API callback. The preferred session according to MultiSessionAttributeAdapter will be passed, just as for other methods here.

Implementations here may remove any provider-specific attributes which cache authentication (although the session will be invalidated so that may be overkill).

Specified by:

logout in interface SecurityProvider