1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19 package org.apache.shiro.web.filter.authc;
20
21 import org.apache.shiro.authc.AuthenticationException;
22 import org.apache.shiro.authc.AuthenticationToken;
23 import org.apache.shiro.authc.UsernamePasswordToken;
24 import org.apache.shiro.authz.UnauthenticatedException;
25 import org.apache.shiro.subject.Subject;
26
27 import javax.servlet.ServletException;
28 import javax.servlet.ServletRequest;
29 import javax.servlet.ServletResponse;
30 import java.io.IOException;
31 import java.util.Arrays;
32
33
34
35
36
37
38
39 public abstract class AuthenticatingFilter extends AuthenticationFilter {
40 public static final String PERMISSIVE = "permissive";
41
42
43
44 protected boolean executeLogin(ServletRequest request, ServletResponse response) throws Exception {
45 AuthenticationToken token = createToken(request, response);
46 if (token == null) {
47 String msg = "createToken method implementation returned null. A valid non-null AuthenticationToken " +
48 "must be created in order to execute a login attempt.";
49 throw new IllegalStateException(msg);
50 }
51 try {
52 Subject subject = getSubject(request, response);
53 subject.login(token);
54 return onLoginSuccess(token, subject, request, response);
55 } catch (AuthenticationException e) {
56 return onLoginFailure(token, e, request, response);
57 }
58 }
59
60 protected abstract AuthenticationToken createToken(ServletRequest request, ServletResponse response) throws Exception;
61
62 protected AuthenticationToken createToken(String username, String password,
63 ServletRequest request, ServletResponse response) {
64 boolean rememberMe = isRememberMe(request);
65 String host = getHost(request);
66 return createToken(username, password, rememberMe, host);
67 }
68
69 protected AuthenticationToken createToken(String username, String password,
70 boolean rememberMe, String host) {
71 return new UsernamePasswordToken(username, password, rememberMe, host);
72 }
73
74 protected boolean onLoginSuccess(AuthenticationToken token, Subject subject,
75 ServletRequest request, ServletResponse response) throws Exception {
76 return true;
77 }
78
79 protected boolean onLoginFailure(AuthenticationToken token, AuthenticationException e,
80 ServletRequest request, ServletResponse response) {
81 return false;
82 }
83
84
85
86
87
88
89
90
91
92
93 protected String getHost(ServletRequest request) {
94 return request.getRemoteHost();
95 }
96
97
98
99
100
101
102
103
104
105
106
107
108
109 protected boolean isRememberMe(ServletRequest request) {
110 return false;
111 }
112
113
114
115
116
117
118
119
120
121 @Override
122 protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
123 return super.isAccessAllowed(request, response, mappedValue) ||
124 (!isLoginRequest(request, response) && isPermissive(mappedValue));
125 }
126
127
128
129
130
131
132 protected boolean isPermissive(Object mappedValue) {
133 if(mappedValue != null) {
134 String[] values = (String[]) mappedValue;
135 return Arrays.binarySearch(values, PERMISSIVE) >= 0;
136 }
137 return false;
138 }
139
140
141
142
143
144 @Override
145 protected void cleanup(ServletRequest request, ServletResponse response, Exception existing) throws ServletException, IOException {
146 if (existing instanceof UnauthenticatedException || (existing instanceof ServletException && existing.getCause() instanceof UnauthenticatedException))
147 {
148 try {
149 onAccessDenied(request, response);
150 existing = null;
151 } catch (Exception e) {
152 existing = e;
153 }
154 }
155 super.cleanup(request, response, existing);
156
157 }
158 }