public abstract class LoginAuthenticator extends java.lang.Object implements Authenticator
Authenticator.AuthConfiguration, Authenticator.Factory
Modifier and Type | Field and Description |
---|---|
protected IdentityService |
_identityService |
protected LoginService |
_loginService |
Modifier | Constructor and Description |
---|---|
protected |
LoginAuthenticator() |
Modifier and Type | Method and Description |
---|---|
LoginService |
getLoginService() |
UserIdentity |
login(java.lang.String username,
java.lang.Object password,
javax.servlet.ServletRequest servletRequest)
If the UserIdentity is not null after this method calls
LoginService.login(String, Object, ServletRequest) , it
is assumed that the user is fully authenticated and we need to change the session id to prevent
session fixation vulnerability. |
void |
logout(javax.servlet.ServletRequest request) |
void |
prepareRequest(javax.servlet.ServletRequest request)
Called prior to validateRequest.
|
protected javax.servlet.http.HttpSession |
renewSession(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response)
Change the session id.
|
void |
setConfiguration(Authenticator.AuthConfiguration configuration)
Configure the Authenticator
|
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
getAuthMethod, secureResponse, validateRequest
protected LoginService _loginService
protected IdentityService _identityService
public void prepareRequest(javax.servlet.ServletRequest request)
Authenticator
prepareRequest
in interface Authenticator
request
- the request to manipulatepublic UserIdentity login(java.lang.String username, java.lang.Object password, javax.servlet.ServletRequest servletRequest)
LoginService.login(String, Object, ServletRequest)
, it
is assumed that the user is fully authenticated and we need to change the session id to prevent
session fixation vulnerability. If the UserIdentity is not necessarily fully
authenticated, then subclasses must override this method and
determine when the UserIdentity IS fully authenticated and renew the session id.username
- the username of the client to be authenticatedpassword
- the user's credentialservletRequest
- the inbound request that needs authenticationpublic void logout(javax.servlet.ServletRequest request)
public void setConfiguration(Authenticator.AuthConfiguration configuration)
Authenticator
setConfiguration
in interface Authenticator
configuration
- the configurationpublic LoginService getLoginService()
protected javax.servlet.http.HttpSession renewSession(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)
Authenticator.AuthConfiguration.isSessionRenewedOnAuthentication()
returns true.
request
- the requestresponse
- the responseCopyright © 1995–2020 Webtide. All rights reserved.