Package org.springframework.security.web.jaasapi

Class JaasApiIntegrationFilter

java.lang.Object

org.springframework.web.filter.GenericFilterBean

org.springframework.security.web.jaasapi.JaasApiIntegrationFilter

All Implemented Interfaces:

jakarta.servlet.Filter, org.springframework.beans.factory.Aware, org.springframework.beans.factory.BeanNameAware, org.springframework.beans.factory.DisposableBean, org.springframework.beans.factory.InitializingBean, org.springframework.context.EnvironmentAware, org.springframework.core.env.EnvironmentCapable, org.springframework.web.context.ServletContextAware

public class JaasApiIntegrationFilter
extends org.springframework.web.filter.GenericFilterBean

A Filter which attempts to obtain a JAAS Subject and continue the FilterChain running as that Subject.

By using this Filter in conjunction with Spring's JaasAuthenticationProvider both Spring's SecurityContext and a JAAS Subject can be populated simultaneously. This is useful when integrating with code that requires a JAAS Subject to be populated.

See Also:

• doFilter(ServletRequest, ServletResponse, FilterChain)
• obtainSubject(ServletRequest)

Field Summary

Fields inherited from class org.springframework.web.filter.GenericFilterBean

logger

Constructor Summary

Constructors

Constructor	Description
JaasApiIntegrationFilter()

Method Summary

Modifier and Type	Method	Description
final void	doFilter(jakarta.servlet.ServletRequest request, jakarta.servlet.ServletResponse response, jakarta.servlet.FilterChain chain)	Attempts to obtain and run as a JAAS Subject using obtainSubject(ServletRequest).
protected Subject	obtainSubject(jakarta.servlet.ServletRequest request)	Obtains the Subject to run as or null if no Subject is available.
final void	setCreateEmptySubject(boolean createEmptySubject)	Sets createEmptySubject.
void	setSecurityContextHolderStrategy(org.springframework.security.core.context.SecurityContextHolderStrategy securityContextHolderStrategy)	Sets the SecurityContextHolderStrategy to use.

Methods inherited from class org.springframework.web.filter.GenericFilterBean

addRequiredProperty, afterPropertiesSet, createEnvironment, destroy, getEnvironment, getFilterConfig, getFilterName, getServletContext, init, initBeanWrapper, initFilterBean, setBeanName, setEnvironment, setServletContext

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

JaasApiIntegrationFilter

public JaasApiIntegrationFilter()

Method Details

doFilter

public final void doFilter(jakarta.servlet.ServletRequest request,
 jakarta.servlet.ServletResponse response,
 jakarta.servlet.FilterChain chain)
                    throws jakarta.servlet.ServletException,
IOException

Attempts to obtain and run as a JAAS Subject using obtainSubject(ServletRequest).

If the Subject is null and createEmptySubject is true, an empty, writeable Subject is used. This allows for the Subject to be populated at the time of login. If the Subject is null, the FilterChain continues with no additional processing. If the Subject is not null , the FilterChain is ran with Subject.doAs(Subject, PrivilegedExceptionAction) in conjunction with the Subject obtained.

Throws:

jakarta.servlet.ServletException

IOException

obtainSubject

protected Subject obtainSubject(jakarta.servlet.ServletRequest request)

Obtains the Subject to run as or null if no Subject is available.

The default implementation attempts to obtain the Subject from the SecurityContext's Authentication. If it is of type JaasAuthenticationToken and is authenticated, the Subject is returned from it. Otherwise, null is returned.

Parameters:

request - the current ServletRequest

Returns:

the Subject to run as or null if no Subject is available.

setCreateEmptySubject

public final void setCreateEmptySubject(boolean createEmptySubject)

Sets createEmptySubject. If the value is true, and obtainSubject(ServletRequest) returns null, an empty, writeable Subject is created instead. Otherwise no Subject is used. The default is false.

Parameters:

createEmptySubject - the new value

setSecurityContextHolderStrategy

public void setSecurityContextHolderStrategy(org.springframework.security.core.context.SecurityContextHolderStrategy securityContextHolderStrategy)

Sets the SecurityContextHolderStrategy to use. The default action is to use the SecurityContextHolderStrategy stored in SecurityContextHolder.

Since:

5.8