org.finra.herd.app.security

Class HttpHeaderAuthenticationFilter

java.lang.Object

org.springframework.web.filter.GenericFilterBean

org.finra.herd.app.security.HttpHeaderAuthenticationFilter

All Implemented Interfaces:

javax.servlet.Filter, org.springframework.beans.factory.Aware, org.springframework.beans.factory.BeanNameAware, org.springframework.beans.factory.DisposableBean, org.springframework.beans.factory.InitializingBean, org.springframework.context.EnvironmentAware, org.springframework.core.env.EnvironmentCapable, org.springframework.web.context.ServletContextAware

public class HttpHeaderAuthenticationFilter
extends org.springframework.web.filter.GenericFilterBean

A Spring pre-authentication filter that works with Http headers.

Field Summary

Fields inherited from class org.springframework.web.filter.GenericFilterBean

logger

Constructor Summary

Constructors

Constructor and Description
HttpHeaderAuthenticationFilter(org.springframework.security.authentication.AuthenticationManager authenticationManager, ApplicationUserBuilder applicationUserBuilder)

Method Summary

Modifier and Type	Method and Description
void	doFilter(javax.servlet.ServletRequest servletRequest, javax.servlet.ServletResponse servletResponse, javax.servlet.FilterChain filterChain) Perform pre-authentication processing.
void	doHttpFilter(javax.servlet.http.HttpServletRequest servletRequest, javax.servlet.http.HttpServletResponse servletResponse, javax.servlet.FilterChain filterChain) Perform pre-authentication processing for Http Servlets.
protected Date	getExistingSessionInitTime() Gets the existing session init time.
protected ApplicationUser	getExistingUser() Gets the existing user.
protected String	getExistingUserId() Gets the existing user Id.
protected void	invalidateUser(javax.servlet.http.HttpServletRequest servletRequest, boolean invalidateSession) Invalidates a user by invalidating their session and removing them from the security context holder.
protected void	processUserNotLoggedIn(javax.servlet.http.HttpServletRequest servletRequest) Perform processing when the user is not logged in.
protected void	successfulAuthentication(org.springframework.security.core.Authentication authResult) Puts the Authentication instance returned by the authentication manager into the secure context.
protected void	unsuccessfulAuthentication(javax.servlet.http.HttpServletRequest servletRequest, org.springframework.security.core.AuthenticationException authenticationException) Ensures the authentication object in the secure context is set to null when authentication fails.

Methods inherited from class org.springframework.web.filter.GenericFilterBean

addRequiredProperty, afterPropertiesSet, createEnvironment, destroy, getEnvironment, getFilterConfig, getFilterName, getServletContext, init, initBeanWrapper, initFilterBean, setBeanName, setEnvironment, setServletContext

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

HttpHeaderAuthenticationFilter

public HttpHeaderAuthenticationFilter(org.springframework.security.authentication.AuthenticationManager authenticationManager,
                                      ApplicationUserBuilder applicationUserBuilder)

Method Detail

doFilter

public void doFilter(javax.servlet.ServletRequest servletRequest,
                     javax.servlet.ServletResponse servletResponse,
                     javax.servlet.FilterChain filterChain)
              throws IOException,
                     javax.servlet.ServletException

Perform pre-authentication processing. This method delegates to doHttpFilter.

Parameters:

servletRequest - the servlet request.

servletResponse - the servlet response.

filterChain - the filter chain.

Throws:

IOException - if an IO exception was encountered.

javax.servlet.ServletException - if a servlet exception was encountered.

doHttpFilter

public void doHttpFilter(javax.servlet.http.HttpServletRequest servletRequest,
                         javax.servlet.http.HttpServletResponse servletResponse,
                         javax.servlet.FilterChain filterChain)
                  throws IOException,
                         javax.servlet.ServletException

Perform pre-authentication processing for Http Servlets.

Parameters:

servletRequest - the servlet request.

servletResponse - the servlet response.

filterChain - the filter chain.

Throws:

IOException - when an exception is thrown executing the next filter in chain.

javax.servlet.ServletException - if a servlet exception was encountered.

processUserNotLoggedIn

protected void processUserNotLoggedIn(javax.servlet.http.HttpServletRequest servletRequest)

Perform processing when the user is not logged in.

Parameters:

servletRequest - the servlet request.

invalidateUser

protected void invalidateUser(javax.servlet.http.HttpServletRequest servletRequest,
                              boolean invalidateSession)

Invalidates a user by invalidating their session and removing them from the security context holder.

Parameters:

servletRequest - the servlet request.

invalidateSession - flag to indicate whether the Http Session should be invalidated or not.

getExistingUserId

protected String getExistingUserId()

Gets the existing user Id.

Returns:

the existing user Id, session Id, or null if no existing user is present.

getExistingSessionInitTime

protected Date getExistingSessionInitTime()

Gets the existing session init time.

Returns:

the existing session init time or null if no existing user is present.

getExistingUser

protected ApplicationUser getExistingUser()

Gets the existing user.

Returns:

the existing user or null if no existing user is present.

successfulAuthentication

protected void successfulAuthentication(org.springframework.security.core.Authentication authResult)

Puts the Authentication instance returned by the authentication manager into the secure context.

Parameters:

authResult - the authorization result.

unsuccessfulAuthentication

protected void unsuccessfulAuthentication(javax.servlet.http.HttpServletRequest servletRequest,
                                          org.springframework.security.core.AuthenticationException authenticationException)

Ensures the authentication object in the secure context is set to null when authentication fails.

Parameters:

servletRequest - the servlet request.

authenticationException - the authentication exception.