| java.lang.Object
 com.ecyrd.jspwiki.auth.AuthenticationManager
| AuthenticationManager | | final public class AuthenticationManager (Code) | | Manages authentication activities for a WikiEngine: user login, logout, and
credential refreshes. This class uses JAAS to determine how users log in.
author:
Andrew Jaquith
author:
Janne Jalkanen
author:
Erik Bunn
since:
2.3 |
| Method Summary | |
| final public synchronized void | addWikiEventListener(WikiEventListener listener)
Registers a WikiEventListener with this instance. | | final public static boolean | allowsCookieAssertions()
Determines whether this WikiEngine allows users to assert identities using
cookies instead of passwords. | | final public static boolean | allowsCookieAuthentication()
Determines whether this WikiEngine allows users to authenticate using
cookies instead of passwords. | | final protected static URL | findConfigFile(WikiEngine engine, String name)
Looks up and obtains a configuration file inside the WEB-INF folder of a
wiki webapp. | | final protected void | fireEvent(int type, Principal principal, Object target)
Fires a WikiSecurityEvent of the provided type, Principal and target Object
to all registered listeners. | | final public void | initialize(WikiEngine engine, Properties props)
Creates an AuthenticationManager instance for the given WikiEngine and
the specified set of properties. | | final public boolean | isContainerAuthenticated()
Returns true if this WikiEngine uses container-managed authentication.
This method is used primarily for cosmetic purposes in the JSP tier, and
performs no meaningful security function per se. | | final public static boolean | isRolePrincipal(Principal principal)
Determines whether the supplied Principal is a "role principal". | | final public static boolean | isUserPrincipal(Principal principal)
Determines whether the supplied Principal is a "user principal". | | final public boolean | login(HttpServletRequest request)
Logs in the user by attempting to populate a WikiSession Subject from
a web servlet request. | | final public boolean | login(WikiSession session, String username, String password)
Attempts to perform a WikiSession login for the given username/password
combination. | | final public void | logout(HttpServletRequest request)
Logs the user out by retrieving the WikiSession associated with the
HttpServletRequest and unbinding all of the Subject's Principals,
except for
Role.ALL ,
Role.ANONYMOUS . | | final public synchronized void | removeWikiEventListener(WikiEventListener listener)
Un-registers a WikiEventListener with this instance. |
| COOKIE_AUTHENTICATION_MODULE | | final public static String COOKIE_AUTHENTICATION_MODULE(Code) | | The name of the built-in cookie authentication module
|
| COOKIE_MODULE | | final public static String COOKIE_MODULE(Code) | | The name of the built-in cookie assertion module
|
| LOGIN_CONTAINER | | final public static String LOGIN_CONTAINER(Code) | | The JAAS application name for the web container authentication stack.
|
| LOGIN_CUSTOM | | final public static String LOGIN_CUSTOM(Code) | | The JAAS application name for the JSPWiki custom authentication stack.
|
| PROP_SECURITY | | final public static String PROP_SECURITY(Code) | | This property determines whether we use JSPWiki authentication or not.
Possible values are AUTH_JAAS or AUTH_CONTAINER.
|
| PROP_STOREIPADDRESS | | final public static String PROP_STOREIPADDRESS(Code) | | If this jspwiki.properties property is true, logs the IP address of the editor on saving.
|
| SECURITY_CONTAINER | | final protected static String SECURITY_CONTAINER(Code) | | Just to provide compatibility with the old versions. The same
as SECURITY_OFF.
|
| SECURITY_JAAS | | final public static String SECURITY_JAAS(Code) | | Value specifying that the user wants to use the built-in JAAS-based system
|
| SECURITY_OFF | | final public static String SECURITY_OFF(Code) | | Value specifying that the user wants to use the container-managed security, just like
in JSPWiki 2.2.
|
| log | | final protected static Logger log(Code) | | |
| m_isJaasConfiguredAtStartup | | protected boolean m_isJaasConfiguredAtStartup(Code) | | Was JAAS login config already set before we startd up?
|
| addWikiEventListener | | final public synchronized void addWikiEventListener(WikiEventListener listener)(Code) | | Registers a WikiEventListener with this instance.
This is a convenience method.
Parameters:
listener - the event listener |
| allowsCookieAssertions | | final public static boolean allowsCookieAssertions()(Code) | | Determines whether this WikiEngine allows users to assert identities using
cookies instead of passwords. This is determined by inspecting
the LoginConfiguration for application JSPWiki-container.
true if cookies are allowed |
| allowsCookieAuthentication | | final public static boolean allowsCookieAuthentication()(Code) | | Determines whether this WikiEngine allows users to authenticate using
cookies instead of passwords. This is determined by inspecting
the LoginConfiguration for application JSPWiki-container.
true if cookies are allowed for authentication
since:
2.5.62 |
| findConfigFile | | final protected static URL findConfigFile(WikiEngine engine, String name)(Code) | | Looks up and obtains a configuration file inside the WEB-INF folder of a
wiki webapp.
Parameters:
engine - the wiki engine
Parameters:
name - the file to obtain, e.g., jspwiki.policy the URL to the file |
| fireEvent | | final protected void fireEvent(int type, Principal principal, Object target)(Code) | | Fires a WikiSecurityEvent of the provided type, Principal and target Object
to all registered listeners.
See Also: com.ecyrd.jspwiki.event.WikiSecurityEvent
Parameters:
type - the event type to be fired
Parameters:
principal - the subject of the event, which may be null
Parameters:
target - the changed Object, which may be null |
| initialize | | final public void initialize(WikiEngine engine, Properties props) throws WikiException(Code) | | Creates an AuthenticationManager instance for the given WikiEngine and
the specified set of properties. All initialization for the modules is
done here.
Parameters:
engine - the wiki engine
Parameters:
props - the properties used to initialize the wiki engine
throws:
WikiException - if the AuthenticationManager cannot be initialized |
| isContainerAuthenticated | | final public boolean isContainerAuthenticated()(Code) | | Returns true if this WikiEngine uses container-managed authentication.
This method is used primarily for cosmetic purposes in the JSP tier, and
performs no meaningful security function per se. Delegates to
com.ecyrd.jspwiki.auth.authorize.WebContainerAuthorizer.isContainerAuthorized ,
if used as the external authorizer; otherwise, returns false.
true if the wiki's authentication is managed bythe container, false otherwise |
| login | | final public boolean login(HttpServletRequest request) throws WikiSecurityException(Code) | | Logs in the user by attempting to populate a WikiSession Subject from
a web servlet request. This method leverages container-managed authentication.
This method logs in the user if the user's status is "unknown" to the
WikiSession, or if the Http servlet container's authentication status has
changed. This method assumes that the HttpServletRequest is not null; otherwise,
an IllegalStateException is thrown. This method is a privileged action;
the caller must posess the (name here) permission.
If request is null, or the WikiSession
cannot be located for this request, this method throws an
IllegalStateException .
methods return null
Parameters:
request - servlet request for this user the result of the login operation: true if the user logged insuccessfully; false otherwise
throws:
com.ecyrd.jspwiki.auth.WikiSecurityException - if the Authorizer or UserManager cannot be obtained
since:
2.3 |
| login | | final public boolean login(WikiSession session, String username, String password) throws WikiSecurityException(Code) | | Attempts to perform a WikiSession login for the given username/password
combination. This is custom authentication.
Parameters:
session - the current wiki session; may not be null.
Parameters:
username - The user name. This is a login name, not a WikiName. Inmost cases they are the same, but in some cases, they mightnot be.
Parameters:
password - The password true, if the username/password is valid
throws:
com.ecyrd.jspwiki.auth.WikiSecurityException - if the Authorizer or UserManager cannot be obtained |
| logout | | final public void logout(HttpServletRequest request)(Code) | | Logs the user out by retrieving the WikiSession associated with the
HttpServletRequest and unbinding all of the Subject's Principals,
except for
Role.ALL ,
Role.ANONYMOUS .
is a cheap-and-cheerful way to do it without invoking JAAS LoginModules.
The logout operation will also flush the JSESSIONID cookie from
the user's browser session, if it was set.
Parameters:
request - the current HTTP request |
| removeWikiEventListener | | final public synchronized void removeWikiEventListener(WikiEventListener listener)(Code) | | Un-registers a WikiEventListener with this instance.
This is a convenience method.
Parameters:
listener - the event listener |
|
|