Package org.nuxeo.ecm.platform.ui.web.auth

Class NuxeoAuthenticationFilter

  • All Implemented Interfaces:
    javax.servlet.Filter
    public class NuxeoAuthenticationFilter
extends Object
implements javax.servlet.Filter
    Servlet filter handling Nuxeo authentication (JAAS + EJB).

    Also handles logout and identity switch.

    Author:
    Thierry Delprat, Bogdan Stefanescu, Anahide Tchertchian, Florent Guillaume

    • Constructor Detail

      • NuxeoAuthenticationFilter

        public NuxeoAuthenticationFilter()

    • Method Detail

      • destroy

        public void destroy()
        Specified by:
        destroy in interface javax.servlet.Filter

      • logAuthenticationAttempt

        protected boolean logAuthenticationAttempt​(UserIdentificationInfo userInfo,
                                           boolean success)

      • switchUser

        protected boolean switchUser​(javax.servlet.ServletRequest request,
                             javax.servlet.ServletResponse response,
                             javax.servlet.FilterChain chain)
                      throws IOException
        Throws:
        IOException

      • doFilter

        public void doFilter​(javax.servlet.ServletRequest request,
                     javax.servlet.ServletResponse response,
                     javax.servlet.FilterChain chain)
              throws IOException,
                     javax.servlet.ServletException
        Specified by:
        doFilter in interface javax.servlet.Filter
        Throws:
        IOException
        javax.servlet.ServletException

      • doFilterInternal

        public void doFilterInternal​(javax.servlet.ServletRequest request,
                             javax.servlet.ServletResponse response,
                             javax.servlet.FilterChain chain)
                      throws IOException,
                             javax.servlet.ServletException
        Throws:
        IOException
        javax.servlet.ServletException

      • retrieveIdentityFromCache

        protected static CachableUserIdentificationInfo retrieveIdentityFromCache​(javax.servlet.http.HttpServletRequest httpRequest)

      • getAnonymousId

        protected String getAnonymousId()

      • doInitIfNeeded

        protected void doInitIfNeeded()
                       throws javax.servlet.ServletException
        Throws:
        javax.servlet.ServletException

      • init

        public void init​(javax.servlet.FilterConfig config)
          throws javax.servlet.ServletException
        Specified by:
        init in interface javax.servlet.Filter
        Throws:
        javax.servlet.ServletException

      • saveRequestedURLBeforeRedirect

        public boolean saveRequestedURLBeforeRedirect​(javax.servlet.http.HttpServletRequest httpRequest,
                                              javax.servlet.http.HttpServletResponse httpResponse)
        Save requested URL before redirecting to login form.

        Returns true if target url is a valid startup page.

      • getRequestedUrl

        public static String getRequestedUrl​(javax.servlet.http.HttpServletRequest request)
        The requested URL is like the requested page BUT is not decoded AND also includes the query string (except without conversation id).

      • getSavedRequestedURL

        protected static String getSavedRequestedURL​(javax.servlet.http.HttpServletRequest httpRequest,
                                             javax.servlet.http.HttpServletResponse httpResponse)

      • isStartPageValid

        protected boolean isStartPageValid​(String startPage)

      • handleLogout

        protected boolean handleLogout​(javax.servlet.ServletRequest request,
                               javax.servlet.ServletResponse response,
                               CachableUserIdentificationInfo cachedUserInfo)
                        throws javax.servlet.ServletException
        Throws:
        javax.servlet.ServletException

      • isCallbackURLValid

        protected boolean isCallbackURLValid​(String callbackURL,
                                     String baseURL)
        Since:
        10.3

      • initUnAuthenticatedURLPrefix

        protected void initUnAuthenticatedURLPrefix()

      • bypassAuth

        protected boolean bypassAuth​(javax.servlet.http.HttpServletRequest httpRequest)

      • getRequestedPage

        public static String getRequestedPage​(javax.servlet.ServletRequest request)

      • getRequestedPage

        protected static String getRequestedPage​(javax.servlet.http.HttpServletRequest httpRequest)

      • handleLoginPrompt

        protected boolean handleLoginPrompt​(javax.servlet.http.HttpServletRequest httpRequest,
                                    javax.servlet.http.HttpServletResponse httpResponse)

      • handleLogin

        protected boolean handleLogin​(javax.servlet.http.HttpServletRequest httpRequest,
                              javax.servlet.http.HttpServletResponse httpResponse)

      • buildUnauthorizedResponse

        protected void buildUnauthorizedResponse​(javax.servlet.http.HttpServletRequest req,
                                         javax.servlet.http.HttpServletResponse resp)

      • handleRetrieveIdentity

        protected UserIdentificationInfo handleRetrieveIdentity​(javax.servlet.http.HttpServletRequest httpRequest,
                                                        javax.servlet.http.HttpServletResponse httpResponse)

      • loginAs

        public static NuxeoLoginContext loginAs​(String username)
                                 throws LoginException
        Does a forced login as the given user. Bypasses all authentication checks.
        Parameters:
        username - the user name
        Returns:
        the login context, which MUST be used for logout in a finally block
        Throws:
        LoginException

      • getPrincipalCheckingAuth

        protected Principal getPrincipalCheckingAuth​(UserIdentificationInfo userIdent,
                                             javax.servlet.http.HttpServletRequest request)
        Creates a principal, checking authentication from the UserIdentificationInfo credentials.
        Since:
        11.1

      • checkRequestedURL

        protected void checkRequestedURL​(javax.servlet.ServletRequest request)
        Checks if the "requestedUrl" request parameter is an absolute URL, in which case, throws a NuxeoException with a 400 status code.
        Since:
        11.5