public abstract class BaseLoginFilter extends Object implements javax.servlet.Filter
If the authentication is successful, the user will be redirected by the filter to the URL given by the session attribute at SecurityFilter.ORIGINAL_URL_KEY.
If this URL doesn't exist, it will look for a parameter 'os_destination' to use as the redirected URL instead.
If neither is found, it is assumed that the page will check the authorisation status and handle redirection itself.
From the any other filter in the request, or the servlet/JSP/action which processes the request, you can look up the status of the authorisation attempt. The status is a String request attribute, with the key 'os_authstatus'.
The possible statuses are:
| Modifier and Type | Field and Description |
|---|---|
static String |
AUTHENTICATION_ERROR_TYPE |
static String |
LOGIN_ERROR |
static String |
LOGIN_FAILED |
static String |
LOGIN_NOATTEMPT |
static String |
LOGIN_SUCCESS |
static String |
OS_AUTHSTATUS_KEY |
| Constructor and Description |
|---|
BaseLoginFilter() |
| Modifier and Type | Method and Description |
|---|---|
void |
destroy() |
void |
doFilter(javax.servlet.ServletRequest servletRequest,
javax.servlet.ServletResponse servletResponse,
javax.servlet.FilterChain filterChain) |
protected AuthenticationContext |
getAuthenticationContext() |
protected Authenticator |
getAuthenticator() |
protected ElevatedSecurityGuard |
getElevatedSecurityGuard() |
protected SecurityConfig |
getSecurityConfig() |
void |
init(javax.servlet.FilterConfig config) |
protected boolean |
isAbsoluteUrl(String url) |
abstract String |
login(javax.servlet.http.HttpServletRequest httpServletRequest,
javax.servlet.http.HttpServletResponse httpServletResponse)
Performs the actual authentication (if required) and returns the status code.
|
protected boolean |
redirectToOriginalDestination(javax.servlet.http.HttpServletRequest httpServletRequest,
javax.servlet.http.HttpServletResponse httpServletResponse)
Redirect the response to the original destination if present
|
public static final String LOGIN_SUCCESS
public static final String LOGIN_FAILED
public static final String LOGIN_ERROR
public static final String LOGIN_NOATTEMPT
public static final String OS_AUTHSTATUS_KEY
public static final String AUTHENTICATION_ERROR_TYPE
public void init(javax.servlet.FilterConfig config)
init in interface javax.servlet.Filterpublic void destroy()
destroy in interface javax.servlet.Filterpublic void doFilter(javax.servlet.ServletRequest servletRequest,
javax.servlet.ServletResponse servletResponse,
javax.servlet.FilterChain filterChain)
throws IOException,
javax.servlet.ServletException
doFilter in interface javax.servlet.FilterIOExceptionjavax.servlet.ServletExceptionpublic abstract String login(javax.servlet.http.HttpServletRequest httpServletRequest, javax.servlet.http.HttpServletResponse httpServletResponse)
The possible statuses are:
When there is an error on login, implementations should set a request attribute with name
AUTHENTICATION_ERROR_TYPE and a type of AuthenticationErrorType in
order to indicate the type of error.
httpServletRequest - the HTTP request in playhttpServletResponse - the HTTP response in playprotected boolean redirectToOriginalDestination(javax.servlet.http.HttpServletRequest httpServletRequest,
javax.servlet.http.HttpServletResponse httpServletResponse)
throws IOException
httpServletRequest - the HTTP request in playhttpServletResponse - the HTTP response in playIOException - If the redirect throws IOException. See HttpServletResponse.sendRedirect(String)protected boolean isAbsoluteUrl(String url)
protected Authenticator getAuthenticator()
protected ElevatedSecurityGuard getElevatedSecurityGuard()
protected SecurityConfig getSecurityConfig()
protected AuthenticationContext getAuthenticationContext()
Copyright © 2018 Atlassian. All rights reserved.