org.nuxeo.ecm.platform.ui.web.auth.plugins

Class WebServicesAuthenticator

java.lang.Object

org.nuxeo.ecm.platform.ui.web.auth.plugins.WebServicesAuthenticator

All Implemented Interfaces:

NuxeoAuthenticationPlugin

public class WebServicesAuthenticator
extends Object
implements NuxeoAuthenticationPlugin

The Web Service Servlet needs no login prompt and / or authentiocation.

I see 2 different scenarios:

1. The client application is a standalone application. It connects to WS with the real credentials and keeps a session only for WS. It has nothing to do with the Web Application or whatsoever. Initially client comes to MainEntrancePoint and tries to get a Stateful WebService (actual WS perfoming the job). NuxeoAuthenticationFilter (NAF) finds no authentication data in message. It has to let the request pass and not forward the request to login page. The WS makes the authentication based on user credentials.
2. The client application reuses a Web Session or uses another mechanism to hold a HTTP Session (the SSO case). Client comes to MainEntrancePoint and tries to gets a Stateful WebService (actual WS perfoming the job) calling a different method (no user/pass). NAF finds the authentication data in message this time. It establishes the JAAS context and forwards the request on chain. The WS is not doing authentication anymore, but relies on the JAAS context already established.Further, the same will apply while communicating with SFWS. The SFWS relies on JAAS Login Context established by NAF, while the Core Session is managed internally. The SFWS will be able to work only if the JAAS context is kept valid (the Web Session is on).

This plugin has to only block the login form for the requests addressed to WS. The requests are identified by the prefix of the URL.

Author:

rux

Field Summary

Fields

Modifier and Type	Field and Description
protected String	skipURL

Constructor Summary

Constructors

Constructor and Description
WebServicesAuthenticator()

Method Summary

Modifier and Type	Method and Description
List<String>	getUnAuthenticatedURLPrefix() Returns the list of prefix for unauthenticated URLs, typically the URLs associated to login prompt.
Boolean	handleLoginPrompt(javax.servlet.http.HttpServletRequest httpRequest, javax.servlet.http.HttpServletResponse httpResponse, String baseURL) Handles the Login Prompt.
UserIdentificationInfo	handleRetrieveIdentity(javax.servlet.http.HttpServletRequest httpRequest, javax.servlet.http.HttpServletResponse httpResponse) Retrieves user identification information from the request.
void	initPlugin(Map<String,String> parameters) Initializes the Plugin from parameters set in the XML descriptor.
Boolean	needLoginPrompt(javax.servlet.http.HttpServletRequest httpRequest) Defines if the authentication plugin needs to do a login prompt.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

skipURL

protected String skipURL

Constructor Detail

WebServicesAuthenticator

public WebServicesAuthenticator()

Method Detail

getUnAuthenticatedURLPrefix

public List<String> getUnAuthenticatedURLPrefix()

Description copied from interface: NuxeoAuthenticationPlugin

Returns the list of prefix for unauthenticated URLs, typically the URLs associated to login prompt.

Specified by:

getUnAuthenticatedURLPrefix in interface NuxeoAuthenticationPlugin

handleLoginPrompt

public Boolean handleLoginPrompt(javax.servlet.http.HttpServletRequest httpRequest,
                                 javax.servlet.http.HttpServletResponse httpResponse,
                                 String baseURL)

Description copied from interface: NuxeoAuthenticationPlugin

Handles the Login Prompt.

Specified by:

handleLoginPrompt in interface NuxeoAuthenticationPlugin

Parameters:

httpRequest - the request

httpResponse - the response

Returns:

true if AuthFilter must stop execution (ie: login prompt generated a redirect), false otherwise

handleRetrieveIdentity

public UserIdentificationInfo handleRetrieveIdentity(javax.servlet.http.HttpServletRequest httpRequest,
                                                     javax.servlet.http.HttpServletResponse httpResponse)

Description copied from interface: NuxeoAuthenticationPlugin

Retrieves user identification information from the request.

Specified by:

handleRetrieveIdentity in interface NuxeoAuthenticationPlugin

Parameters:

httpRequest - the request

httpResponse - the response

initPlugin

public void initPlugin(Map<String,String> parameters)

Description copied from interface: NuxeoAuthenticationPlugin

Initializes the Plugin from parameters set in the XML descriptor.

Specified by:

initPlugin in interface NuxeoAuthenticationPlugin

needLoginPrompt

public Boolean needLoginPrompt(javax.servlet.http.HttpServletRequest httpRequest)

Description copied from interface: NuxeoAuthenticationPlugin

Defines if the authentication plugin needs to do a login prompt.

Specified by:

needLoginPrompt in interface NuxeoAuthenticationPlugin

Returns:

true if LoginPrompt is used