org.apache.brooklyn.rest.security.provider

Class DelegatingSecurityProvider

java.lang.Object

org.apache.brooklyn.rest.security.provider.DelegatingSecurityProvider

All Implemented Interfaces:

SecurityProvider

public class DelegatingSecurityProvider
extends java.lang.Object
implements SecurityProvider

Nested Class Summary

Nested classes/interfaces inherited from interface org.apache.brooklyn.rest.security.provider.SecurityProvider

SecurityProvider.SecurityProviderDeniedAuthentication

Constructor Summary

Constructors

Constructor and Description
DelegatingSecurityProvider(ManagementContext mgmt)

Method Summary

Modifier and Type	Method and Description
boolean	authenticate(javax.servlet.http.HttpServletRequest request, java.util.function.Supplier<javax.servlet.http.HttpSession> sessionSupplierOnSuccess, java.lang.String user, java.lang.String pass) Perform the authentication.
static SecurityProvider	createSecurityProviderInstance(ManagementContext mgmt, java.lang.Class<? extends SecurityProvider> clazz)
SecurityProvider	getDelegate()
boolean	isAuthenticated(javax.servlet.http.HttpSession session) If user supplied a value session, this passes that in so the SecurityProvider can check whether the user has previously authenticated, e.g.
static SecurityProvider	loadProviderFromBundle(ManagementContext mgmt, org.osgi.framework.BundleContext bundleContext, java.lang.String symbolicName, java.lang.String version, java.lang.String className)
boolean	logout(javax.servlet.http.HttpSession session) Will get invoked on explicit REST API callback.
boolean	requiresUserPass() whether this provider requires a user/pass; if this returns false, the framework can send null/null as the user/pass to #authenticate(HttpSession, String, String), and should do that if user/pass info is not immediately available (ie for things like oauth, the framework should not require basic auth if this method returns false)
java.lang.String	toString()

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

DelegatingSecurityProvider

public DelegatingSecurityProvider(ManagementContext mgmt)

Method Detail

getDelegate

public SecurityProvider getDelegate()

loadProviderFromBundle

public static SecurityProvider loadProviderFromBundle(ManagementContext mgmt,
                                                      org.osgi.framework.BundleContext bundleContext,
                                                      java.lang.String symbolicName,
                                                      java.lang.String version,
                                                      java.lang.String className)

createSecurityProviderInstance

public static SecurityProvider createSecurityProviderInstance(ManagementContext mgmt,
                                                              java.lang.Class<? extends SecurityProvider> clazz)
                                                       throws java.lang.NoSuchMethodException,
                                                              java.lang.InstantiationException,
                                                              java.lang.IllegalAccessException,
                                                              java.lang.reflect.InvocationTargetException

Throws:

java.lang.NoSuchMethodException

java.lang.InstantiationException

java.lang.IllegalAccessException

java.lang.reflect.InvocationTargetException

isAuthenticated

public boolean isAuthenticated(javax.servlet.http.HttpSession session)

Description copied from interface: SecurityProvider

If user supplied a value session, this passes that in so the SecurityProvider can check whether the user has previously authenticated, e.g. via an HttpSession.setAttribute(String, Object) done by SecurityProvider.authenticate(HttpServletRequest, Supplier, String, String).

Note that this will be the MultiSessionAttributeAdapter.getPreferredSession().

If the user didn't request a session or they requested a session which is not known here, the argument will be null.

Specified by:

isAuthenticated in interface SecurityProvider

authenticate

public boolean authenticate(javax.servlet.http.HttpServletRequest request,
                            java.util.function.Supplier<javax.servlet.http.HttpSession> sessionSupplierOnSuccess,
                            java.lang.String user,
                            java.lang.String pass)
                     throws SecurityProvider.SecurityProviderDeniedAuthentication

Description copied from interface: SecurityProvider

Perform the authentication. If SecurityProvider.requiresUserPass() returns false, user/pass may be null; otherwise the framework will guarantee the basic auth is in effect and these values are set. The provider should not send a response but should throw SecurityProvider.SecurityProviderDeniedAuthentication if a custom response is required. It can include a response in that exception, e.g. to provide more information or supply a redirect.

It should not create a session via HttpServletRequest.getSession(), especially if auth is not successful (easy for DOS attack to chew up memory), and even on auth it should use the Supplier given here to get a session (that will create a session) to install. (Note that this will return the MultiSessionAttributeAdapter.getPreferredSession(), not the request's local session.)

On successful auth this method may HttpSession.setAttribute(String, Object) so that SecurityProvider.isAuthenticated(HttpSession) can return quickly on subsequent requests. If so, see SecurityProvider.logout(HttpSession) about clearing those values.

Specified by:

authenticate in interface SecurityProvider

Throws:

SecurityProvider.SecurityProviderDeniedAuthentication

logout

public boolean logout(javax.servlet.http.HttpSession session)

Description copied from interface: SecurityProvider

Will get invoked on explicit REST API callback. The preferred session according to MultiSessionAttributeAdapter will be passed, just as for other methods here.

Implementations here may remove any provider-specific attributes which cache authentication (although the session will be invalidated so that may be overkill).

Specified by:

logout in interface SecurityProvider

requiresUserPass

public boolean requiresUserPass()

Description copied from interface: SecurityProvider

whether this provider requires a user/pass; if this returns false, the framework can send null/null as the user/pass to #authenticate(HttpSession, String, String), and should do that if user/pass info is not immediately available (ie for things like oauth, the framework should not require basic auth if this method returns false)

Specified by:

requiresUserPass in interface SecurityProvider

toString

public java.lang.String toString()

Overrides:

toString in class java.lang.Object