|
| |
|
| java.lang.Object
 org.acegisecurity.intercept.AbstractSecurityInterceptor
All known Subclasses: org.acegisecurity.intercept.web.FilterSecurityInterceptor, org.acegisecurity.intercept.method.aspectj.AspectJSecurityInterceptor, org.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor,
| AbstractSecurityInterceptor | | abstract public class AbstractSecurityInterceptor implements InitializingBean,ApplicationEventPublisherAware,MessageSourceAware(Code) | | Abstract class that implements security interception for secure objects.
The AbstractSecurityInterceptor will ensure the proper startup
configuration of the security interceptor. It will also implement the proper
handling of secure object invocations, being:
- Obtain the
Authentication object from the
SecurityContextHolder .
- Determine if the request relates to a secured or public invocation by
looking up the secure object request against the
ObjectDefinitionSource .
- For an invocation that is secured (there is a
ConfigAttributeDefinition for the secure object invocation):
- If either the
org.acegisecurity.Authentication.isAuthenticated returns
false, or the
AbstractSecurityInterceptor.alwaysReauthenticate is
true, authenticate the request against the configured
AuthenticationManager . When authenticated, replace the
Authentication object on the
SecurityContextHolder with the returned value.
- Authorize the request against the configured
AccessDecisionManager .
- Perform any run-as replacement via the configured
RunAsManager .
- Pass control back to the concrete subclass, which will actually proceed
with executing the object. A
InterceptorStatusToken is returned so
that after the subclass has finished proceeding with execution of the object,
its finally clause can ensure the
AbstractSecurityInterceptor
is re-called and tidies up correctly.
- The concrete subclass will re-call the
AbstractSecurityInterceptor via the
AbstractSecurityInterceptor.afterInvocation(InterceptorStatusToken,Object) method.
- If the
RunAsManager replaced the
Authentication object, return the
SecurityContextHolder to the object that existed after the
call to AuthenticationManager.
- If an
AfterInvocationManager is defined, invoke the
invocation manager and allow it to replace the object due to be returned to
the caller.
- For an invocation that is public (there is no
ConfigAttributeDefinition for the secure object invocation):
- As described above, the concrete subclass will be returned an
InterceptorStatusToken which is subsequently re-presented to
the AbstractSecurityInterceptor after the secure object has
been executed. The AbstractSecurityInterceptor will take no
further action when its
AbstractSecurityInterceptor.afterInvocation(InterceptorStatusToken,Object) is called.
- Control again returns to the concrete subclass, along with the
Object that should be returned to the caller. The subclass
will then return that result or exception to the original caller.
author:
Ben Alex
version:
$Id: AbstractSecurityInterceptor.java 1790 2007-03-30 18:27:19Z
version:
luke_t $ |
| Field Summary | |
| final protected static Log | logger
| | protected MessageSourceAccessor | messages
|
| logger | | final protected static Log logger(Code) | | |
| messages | | protected MessageSourceAccessor messages(Code) | | |
| afterInvocation | | protected Object afterInvocation(InterceptorStatusToken token, Object returnedObject)(Code) | | Completes the work of the AbstractSecurityInterceptor
after the secure object invocation has been complete
Parameters:
token - as returned by the AbstractSecurityInterceptor.beforeInvocation(Object)}method
Parameters:
returnedObject - any object returned from the secure objectinvocation (may benull) the object the secure object invocation should ultimately returnto its caller (may be null) |
| getSecureObjectClass | | abstract public Class getSecureObjectClass()(Code) | | Indicates the type of secure objects the subclass will be presenting to
the abstract parent for processing. This is used to ensure collaborators
wired to the AbstractSecurityInterceptor all support the
indicated secure object class.
the type of secure object the subclass provides services for |
| isAlwaysReauthenticate | | public boolean isAlwaysReauthenticate()(Code) | | |
| isRejectPublicInvocations | | public boolean isRejectPublicInvocations()(Code) | | |
| isValidateConfigAttributes | | public boolean isValidateConfigAttributes()(Code) | | |
| setAlwaysReauthenticate | | public void setAlwaysReauthenticate(boolean alwaysReauthenticate)(Code) | | Indicates whether the AbstractSecurityInterceptor should
ignore the
Authentication.isAuthenticated property. Defaults to
false, meaning by default the
Authentication.isAuthenticated() property is trusted and
re-authentication will not occur if the principal has already been
authenticated.
Parameters:
alwaysReauthenticate - true to forceAbstractSecurityInterceptor to disregard the value ofAuthentication.isAuthenticated() and alwaysre-authenticate the request (defaults to false). |
| setApplicationEventPublisher | | public void setApplicationEventPublisher(ApplicationEventPublisher applicationEventPublisher)(Code) | | |
| setMessageSource | | public void setMessageSource(MessageSource messageSource)(Code) | | |
| setRejectPublicInvocations | | public void setRejectPublicInvocations(boolean rejectPublicInvocations)(Code) | | By rejecting public invocations (and setting this property to
true), essentially you are ensuring that every secure
object invocation advised by AbstractSecurityInterceptor
has a configuration attribute defined. This is useful to ensure a "fail
safe" mode where undeclared secure objects will be rejected and
configuration omissions detected early. An
IllegalArgumentException will be thrown by the
AbstractSecurityInterceptor if you set this property to
true and an attempt is made to invoke a secure object that
has no configuration attributes.
Parameters:
rejectPublicInvocations - set to true to rejectinvocations of secure objects that have no configuration attributes (bydefault it is false which treats undeclared secure objectsas "public" or unauthorized) |
| setValidateConfigAttributes | | public void setValidateConfigAttributes(boolean validateConfigAttributes)(Code) | | |
|
|
|