Package org.apache.catalina.authenticator

Class FormAuthenticator

    • Field Detail

      • characterEncoding

        protected java.lang.String characterEncoding
        Character encoding to use to read the username and password parameters from the request. If not set, the encoding of the request body will be used.

      • landingPage

        protected java.lang.String landingPage
        Landing page to use if a user tries to access the login page directly or if the session times out during login. If not set, error responses will be sent instead.

      • authenticationSessionTimeout

        protected int authenticationSessionTimeout
        If the authentication process creates a session, this is the maximum session timeout (in seconds) during the authentication process. Once authentication is complete, the default session timeout will apply. Sessions that exist before the authentication process starts will retain their original session timeout throughout.

    • Constructor Detail

      • FormAuthenticator

        public FormAuthenticator()
        Creates a new FormAuthenticator instance.

    • Method Detail

      • getCharacterEncoding

        public java.lang.String getCharacterEncoding()
        Return the character encoding to use to read the username and password.
        Returns:
        The name of the character encoding

      • setCharacterEncoding

        public void setCharacterEncoding​(java.lang.String encoding)
        Set the character encoding to be used to read the username and password.
        Parameters:
        encoding - The name of the encoding to use

      • getLandingPage

        public java.lang.String getLandingPage()
        Return the landing page to use when FORM auth is mis-used.
        Returns:
        The path to the landing page relative to the web application root

      • setLandingPage

        public void setLandingPage​(java.lang.String landingPage)
        Set the landing page to use when the FORM auth is mis-used.
        Parameters:
        landingPage - The path to the landing page relative to the web application root

      • getAuthenticationSessionTimeout

        public int getAuthenticationSessionTimeout()
        Returns the maximum session timeout to be used during authentication if the authentication process creates a session.
        Returns:
        the maximum session timeout to be used during authentication if the authentication process creates a session

      • setAuthenticationSessionTimeout

        public void setAuthenticationSessionTimeout​(int authenticationSessionTimeout)
        Configures the maximum session timeout to be used during authentication if the authentication process creates a session.
        Parameters:
        authenticationSessionTimeout - The maximum session timeout to use during authentication if the authentication process creates a session

      • doAuthenticate

        protected boolean doAuthenticate​(Request request,
                                 HttpServletResponse response)
                          throws java.io.IOException
        Description copied from class: AuthenticatorBase
        Provided for subclasses to implement their specific authentication mechanism.
        Specified by:
        doAuthenticate in class AuthenticatorBase
        Parameters:
        request - The request that triggered the authentication
        response - The response associated with the request
        Returns:
        true if the user was authenticated, otherwise false, in which case an authentication challenge will have been written to the response
        Throws:
        java.io.IOException - If an I/O problem occurred during the authentication process

      • getAuthMethod

        protected java.lang.String getAuthMethod()
        Description copied from class: AuthenticatorBase
        Return the authentication method, which is vendor-specific and not defined by HttpServletRequest.
        Specified by:
        getAuthMethod in class AuthenticatorBase
        Returns:
        the authentication method, which is vendor-specific and not defined by HttpServletRequest.

      • register

        protected void register​(Request request,
                        HttpServletResponse response,
                        java.security.Principal principal,
                        java.lang.String authType,
                        java.lang.String username,
                        java.lang.String password,
                        boolean alwaysUseSession,
                        boolean cache)
        Description copied from class: AuthenticatorBase
        Register an authenticated Principal and authentication type in our request, in the current session (if there is one), and with our SingleSignOn valve, if there is one. Set the appropriate cookie to be returned.
        Overrides:
        register in class AuthenticatorBase
        Parameters:
        request - The servlet request we are processing
        response - The servlet response we are generating
        principal - The authenticated Principal to be registered
        authType - The authentication type to be registered
        username - Username used to authenticate (if any)
        password - Password used to authenticate (if any)
        alwaysUseSession - Should a session always be used once a user is authenticated?
        cache - Should we cache authenticated Principals if the request is part of an HTTP session?

      • forwardToLoginPage

        protected void forwardToLoginPage​(Request request,
                                  HttpServletResponse response,
                                  LoginConfig config)
                           throws java.io.IOException
        Called to forward to the login page
        Parameters:
        request - Request we are processing
        response - Response we are populating
        config - Login configuration describing how authentication should be performed
        Throws:
        java.io.IOException - If the forward to the login page fails and the call to HttpServletResponse.sendError(int, String) throws an IOException

      • forwardToErrorPage

        protected void forwardToErrorPage​(Request request,
                                  HttpServletResponse response,
                                  LoginConfig config)
                           throws java.io.IOException
        Called to forward to the error page
        Parameters:
        request - Request we are processing
        response - Response we are populating
        config - Login configuration describing how authentication should be performed
        Throws:
        java.io.IOException - If the forward to the error page fails and the call to HttpServletResponse.sendError(int, String) throws an IOException

      • matchRequest

        protected boolean matchRequest​(Request request)
        Checks if the given request matches the saved request from a previous form authentication flow.
        Parameters:
        request - The request to check
        Returns:
        true if the request matches the saved one

      • matchRequest

        protected boolean matchRequest​(Request request,
                               boolean strict)
        Does this request match the saved one (so that it must be the redirect we signaled after successful authentication?)
        Parameters:
        request - The request to be verified
        strict - true to check for a valid Principal and valid Session ID, false to only check for a valid saved request and matching URI
        Returns:
        true if the requests matched the saved one

      • restoreRequest

        protected AuthenticatorBase.AuthenticationResult restoreRequest​(Request request,
                                                                Session session)
                                                         throws java.io.IOException
        Restore the original request from information stored in our session. If the original request is no longer present (because the session timed out), it will be treated as a failure to restore the request.
        Parameters:
        request - The request to be restored
        session - The session containing the saved information
        Returns:
        the status of the FORM authentication process based on whether the original request could be restored
        Throws:
        java.io.IOException - if an IO error occurred during the process

      • saveRequest

        protected void saveRequest​(Request request,
                           Session session)
                    throws java.io.IOException
        Save the original request information into our session.
        Parameters:
        request - The request to be saved
        session - The session to contain the saved information
        Throws:
        java.io.IOException - if an IO error occurred during the process

      • savedRequestURL

        protected java.lang.String savedRequestURL​(Session session)
        Return the request URI (with the corresponding query string, if any) from the saved request so that we can redirect to it.
        Parameters:
        session - Our current session
        Returns:
        the original request URL