| org.apache.catalina.authenticator |
|
This package contains Authenticator implementations for the
various supported authentication methods (BASIC, DIGEST, and FORM). In
addition, there is a convenience base class,
AuthenticatorBase, for customized Authenticator
implementations.
If you are using the standard context configuration class
(org.apache.catalina.startup.ContextConfig) to configure the
Authenticator associated with a particular context, you can register the Java
class to be used for each possible authentication method by modifying the
following Properties file:
src/share/org/apache/catalina/startup/Authenticators.properties
Each of the standard implementations extends a common base class
(AuthenticatorBase), which is configured by setting the
following JavaBeans properties (with default values in square brackets):
- cache - Should we cache authenticated Principals (thus avoiding
per-request lookups in our underyling
Realm) if this request
is part of an HTTP session? [true]
- debug - Debugging detail level for this component. [0]
The standard authentication methods that are currently provided include:
- BasicAuthenticator - Implements HTTP BASIC authentication, as
described in RFC 2617.
- DigestAuthenticator - Implements HTTP DIGEST authentication, as
described in RFC 2617.
- FormAuthenticator - Implements FORM-BASED authentication, as
described in the Servlet API Specification, version 2.2.
|
| Java Source File Name | Type | Comment |
| AuthenticatorBase.java | Class | Basic implementation of the Valve interface that enforces the
<security-constraint> elements in the web application
deployment descriptor. |
| BasicAuthenticator.java | Class | An Authenticator and Valve implementation of HTTP BASIC
Authentication, as outlined in RFC 2617: "HTTP Authentication: Basic
and Digest Access Authentication."
author:
Craig R. |
| Constants.java | Class | |
| DigestAuthenticator.java | Class | An Authenticator and Valve implementation of HTTP DIGEST
Authentication (see RFC 2069).
author:
Craig R. |
| FormAuthenticator.java | Class | An Authenticator and Valve implementation of FORM BASED
Authentication, as described in the Servlet API Specification, Version 2.2.
author:
Craig R. |
| NonLoginAuthenticator.java | Class | An Authenticator and Valve implementation that checks
only security constraints not involving user authentication.
author:
Craig R. |
| SavedRequest.java | Class | Object that saves the critical information from a request so that
form-based authentication can reproduce it once the user has been
authenticated.
IMPLEMENTATION NOTE - It is assumed that this object is accessed
only from the context of a single thread, so no synchronization around
internal collection classes is performed.
FIXME - Currently, this object has no mechanism to save or
restore the data content of the request, although it does save
request parameters so that a POST transaction can be faithfully
duplicated.
author:
Craig R. |
| SingleSignOn.java | Class | A Valve that supports a "single sign on" user experience,
where the security identity of a user who successfully authenticates to one
web application is propogated to other web applications in the same
security domain. |
| SingleSignOnEntry.java | Class | A class that represents entries in the cache of authenticated users.
This is necessary to make it available to
AuthenticatorBase subclasses that need it in order to perform
reauthentications when SingleSignOn is in use.
author:
B Stansberry, based on work by Craig R. |
| SSLAuthenticator.java | Class | An Authenticator and Valve implementation of authentication
that utilizes SSL certificates to identify client users.
author:
Craig R. |