1 /* 2 * Licensed to the Apache Software Foundation (ASF) under one 3 * or more contributor license agreements. See the NOTICE file 4 * distributed with this work for additional information 5 * regarding copyright ownership. The ASF licenses this file 6 * to you under the Apache License, Version 2.0 (the 7 * "License"); you may not use this file except in compliance 8 * with the License. You may obtain a copy of the License at 9 * 10 * http://www.apache.org/licenses/LICENSE-2.0 11 * 12 * Unless required by applicable law or agreed to in writing, 13 * software distributed under the License is distributed on an 14 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 15 * KIND, either express or implied. See the License for the 16 * specific language governing permissions and limitations 17 * under the License. 18 */ 19 package org.apache.shiro.authz.aop; 20 21 import java.lang.annotation.Annotation; 22 23 import org.apache.shiro.authz.AuthorizationException; 24 import org.apache.shiro.authz.UnauthenticatedException; 25 import org.apache.shiro.authz.annotation.RequiresUser; 26 27 28 /** 29 * Checks to see if a @{@link org.apache.shiro.authz.annotation.RequiresUser RequiresUser} annotation 30 * is declared, and if so, ensures the calling <code>Subject</code> is <em>either</em> 31 * {@link org.apache.shiro.subject.Subject#isAuthenticated() authenticated} <b><em>or</em></b> remembered via remember 32 * me services before allowing access. 33 * <p> 34 * This annotation essentially ensures that <code>subject.{@link org.apache.shiro.subject.Subject#getPrincipal() getPrincipal()} != null</code>. 35 * 36 * @since 0.9.0 37 */ 38 public class UserAnnotationHandler extends AuthorizingAnnotationHandler { 39 40 /** 41 * Default no-argument constructor that ensures this handler looks for 42 * 43 * {@link org.apache.shiro.authz.annotation.RequiresUser RequiresUser} annotations. 44 */ 45 public UserAnnotationHandler() { 46 super(RequiresUser.class); 47 } 48 49 /** 50 * Ensures that the calling <code>Subject</code> is a <em>user</em>, that is, they are <em>either</code> 51 * {@link org.apache.shiro.subject.Subject#isAuthenticated() authenticated} <b><em>or</em></b> remembered via remember 52 * me services before allowing access, and if not, throws an 53 * <code>AuthorizingException</code> indicating access is not allowed. 54 * 55 * @param a the RequiresUser annotation to check 56 * @throws org.apache.shiro.authz.AuthorizationException 57 * if the calling <code>Subject</code> is not authenticated or remembered via rememberMe services. 58 */ 59 public void assertAuthorized(Annotation a) throws AuthorizationException { 60 if (a instanceof RequiresUser && getSubject().getPrincipal() == null) { 61 throw new UnauthenticatedException("Attempting to perform a user-only operation. The current Subject is " + 62 "not a user (they haven't been authenticated or remembered from a previous login). " + 63 "Access denied."); 64 } 65 } 66 }