Class WebSecurityHelper


  • public class WebSecurityHelper
    extends java.lang.Object
    Provides methods to perform security functions for web applications.
    Since:
    WAS 8.0
    • Method Summary

      All Methods Static Methods Concrete Methods 
      Modifier and Type Method Description
      static java.lang.String getJwtCookieName()
      Extracts the JWT cookie name for use on downstream web invocations.
      static javax.servlet.http.Cookie getSSOCookieFromSSOToken()
      Extracts the Single Sign-On (SSO) token from the subject of the current thread and builds an SSO cookie out of it and builds an SSO cookie out of it for use on downstream web invocations.
      static javax.servlet.http.Cookie getSSOCookieFromSSOTokenWithoutAttrs​(java.lang.String... removeAttributes)
      Extracts the Single Sign-On (SSO) token from the subject of the current thread and builds an SSO cookie out of it.
      static java.lang.String getSSOCookieName()
      Extracts the SSO cookie name for use on downstream web invocations.
      • Methods inherited from class java.lang.Object

        equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
    • Constructor Detail

      • WebSecurityHelper

        public WebSecurityHelper()
    • Method Detail

      • getSSOCookieFromSSOToken

        public static javax.servlet.http.Cookie getSSOCookieFromSSOToken()
                                                                  throws java.lang.Exception
        Extracts the Single Sign-On (SSO) token from the subject of the current thread and builds an SSO cookie out of it and builds an SSO cookie out of it for use on downstream web invocations. The caller must check for a null return value.

        Return null if there is an invalid or expired SSO token, no subject on the current thread, no SSO token in subject or no webAppSecurityConfig object. If the returned value is not null, use Cookie methods getName() and getValue() to set the Cookie header on an HTTP request with header value of Cookie.getName()=Cookie.getValue()

        Returns:
        An object of type javax.servlet.http.Cookie. May return null
        Throws:
        java.lang.Exception
      • getSSOCookieFromSSOTokenWithoutAttrs

        public static javax.servlet.http.Cookie getSSOCookieFromSSOTokenWithoutAttrs​(java.lang.String... removeAttributes)
                                                                              throws java.lang.Exception
        Extracts the Single Sign-On (SSO) token from the subject of the current thread and builds an SSO cookie out of it. The new SSO token does not include the attributes specified in the removeAttributes parameter for use on downstream web invocations. The caller must check for a null return value. The security permission WebSphereRuntimePermission("updateToken") is needed when security manager is enabled.

        Return null if there is an invalid or expired SSO token, no subject on the current thread, no SSO token in subject or no webAppSecurityConfig object. If the returned value is not null, use Cookie methods getName() and getValue() to set the Cookie header on an HTTP request with header value of Cookie.getName()=Cookie.getValue()

        Parameters:
        String - ... A list of attributes to be removed from the SSO token. If no attributes is specified, all the attributes are kept.
        Returns:
        An object of type javax.servlet.http.Cookie. May return null
        Throws:
        java.lang.Exception - If SecurityManager exists and does not permit token update.

        For example: 1) To remove the custom cache key AttributeNameConstants.WSCREDENTIAL_CACHE_KEY from SSO token: Cookie cookie = getSSOCookieFromSSOToken(AttributeNameConstants.WSCREDENTIAL_CACHE_KEY); 2) To keep all attributes in SSO token: Cookie cookie = getSSOCookieFromSSOToken();

      • getSSOCookieName

        public static java.lang.String getSSOCookieName()
                                                 throws java.lang.Exception
        Extracts the SSO cookie name for use on downstream web invocations. Return null when the service is not started or activated.
        Returns:
        a String.
        Throws:
        java.lang.Exception
      • getJwtCookieName

        public static java.lang.String getJwtCookieName()
        Extracts the JWT cookie name for use on downstream web invocations. Return null when the service is not started or activated.
        Returns:
        a String.