Tomcat 10.1.19 · org.apache.catalina.authenticator.FormAuthenticator

Modifier and Type	Field and Description
protected int	authenticationSessionTimeout If the authentication process creates a session, this is the maximum session timeout (in seconds) during the authentication process.
protected String	characterEncoding Character encoding to use to read the username and password parameters from the request.
protected String	landingPage Landing page to use if a user tries to access the login page directly or if the session times out during login.
private final Log	log Hides org.apache.catalina.authenticator.AuthenticatorBase.log.

Access	Constructor and Description
public	FormAuthenticator()

Method Summary

Modifier and Type	Method and Description
protected boolean	doAuthenticate(Request Request we are processing request, HttpServletResponse Response we are creating response) Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.doAuthenticate. Authenticate the user making this request, based on the specified login configuration.
protected void	forwardToErrorPage(Request Request we are processing request, HttpServletResponse Response we are populating response, LoginConfig Login configuration describing how authentication should be performed config) Called to forward to the error page
protected void	forwardToLoginPage(Request Request we are processing request, HttpServletResponse Response we are populating response, LoginConfig Login configuration describing how authentication should be performed config) Called to forward to the login page
public int	Returns: the maximum session timeout to be used during authentication if the authentication process creates a session getAuthenticationSessionTimeout() Returns the maximum session timeout to be used during authentication if the authentication process creates a session.
protected String	getAuthMethod() Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.getAuthMethod. Return the authentication method, which is vendor-specific and not defined by HttpServletRequest.
public String	Returns: The name of the character encoding getCharacterEncoding() Return the character encoding to use to read the user name and password.
public String	Returns: The path to the landing page relative to the web application root getLandingPage() Return the landing page to use when FORM auth is mis-used.
protected boolean	isContinuationRequired(Request The request currently being processed request) Overrides org.apache.catalina.authenticator.AuthenticatorBase.isContinuationRequired. Does this authenticator require that `authenticate(Request, HttpServletResponse)` is called to continue an authentication process that started in a previous request?
protected boolean	Returns: `true` if the requests matched the saved one matchRequest(Request The request to be verified request) Does this request match the saved one (so that it must be the redirect we signaled after successful authentication?
protected void	register(Request The servlet request we are processing request, HttpServletResponse The servlet response we are generating response, Principal The authenticated Principal to be registered principal, String The authentication type to be registered authType, String Username used to authenticate (if any) username, String Password used to authenticate (if any) password, boolean Should a session always be used once a user is authenticated? alwaysUseSession, boolean Should we cache authenticated Principals if the request is part of an HTTP session? cache) Overrides org.apache.catalina.authenticator.AuthenticatorBase.register. Register an authenticated Principal and authentication type in our request, in the current session (if there is one), and with our SingleSignOn valve, if there is one.
protected boolean	Returns: `true` if the request was successfully restored restoreRequest(Request The request to be restored request, Session The session containing the saved information session) Restore the original request from information stored in our session.
protected String	Returns: the original request URL savedRequestURL(Session Our current session session) Return the request URI (with the corresponding query string, if any) from the saved request so that we can redirect to it.
protected void	saveRequest(Request The request to be saved request, Session The session to contain the saved information session) Save the original request information into our session.
public void	setAuthenticationSessionTimeout(int The maximum session timeout to use duriing authentication if the authentication process creates a session authenticationSessionTimeout) Configures the maximum session timeout to be used during authentication if the authentication process creates a session.
public void	setCharacterEncoding(String The name of the encoding to use encoding) Set the character encoding to be used to read the user name and password.
public void	setLandingPage(String The path to the landing page relative to the web application root landingPage) Set the landing page to use when the FORM auth is mis-used.

authenticationSessionTimeout	back to summary
protected int authenticationSessionTimeout If the authentication process creates a session, this is the maximum session timeout (in seconds) during the authentication process. Once authentication is complete, the default session timeout will apply. Sessions that exist before the authentication process starts will retain their original session timeout throughout.

characterEncoding	back to summary
protected String characterEncoding Character encoding to use to read the username and password parameters from the request. If not set, the encoding of the request body will be used.

landingPage	back to summary
protected String landingPage Landing page to use if a user tries to access the login page directly or if the session times out during login. If not set, error responses will be sent instead.

log	back to summary
private final Log log Hides org.apache.catalina.authenticator.AuthenticatorBase.log.

FormAuthenticator	back to summary
public FormAuthenticator()

Method Detail

doAuthenticate back to summary

doAuthenticate	back to summary
protected boolean doAuthenticate(Request request, HttpServletResponse response) throws IOException Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.doAuthenticate. Authenticate the user making this request, based on the specified login configuration. Return `true` if any specified constraint has been satisfied, or `false` if we have created a response challenge already. Parameters request:Request Request we are processing response:HttpServletResponse Response we are creating Returns:boolean Doc from org.apache.catalina.authenticator.AuthenticatorBase.doAuthenticate. `true` if the the user was authenticated, otherwise `false`, in which case an authentication challenge will have been written to the response Annotations @Override Exceptions IOException: if an input/output error occurs

protected boolean doAuthenticate(Request request, HttpServletResponse response) throws IOException

Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.doAuthenticate.

Authenticate the user making this request, based on the specified login configuration. Return true if any specified constraint has been satisfied, or false if we have created a response challenge already.

Parameters

request:Request: Request we are processing
response:HttpServletResponse: Response we are creating

Returns:boolean

Doc from org.apache.catalina.authenticator.AuthenticatorBase.doAuthenticate.

true if the the user was authenticated, otherwise false, in which case an authentication challenge will have been written to the response

Annotations

@Override

Exceptions

IOException:: if an input/output error occurs

forwardToErrorPage back to summary

forwardToErrorPage	back to summary
protected void forwardToErrorPage(Request request, HttpServletResponse response, LoginConfig config) throws IOException Called to forward to the error page Parameters request:Request Request we are processing response:HttpServletResponse Response we are populating config:LoginConfig Login configuration describing how authentication should be performed Exceptions IOException: If the forward to the error page fails and the call to `HttpServletResponse#sendError(int, String)` throws an `IOException`

protected void forwardToErrorPage(Request request, HttpServletResponse response, LoginConfig config) throws IOException

Called to forward to the error page

Parameters

request:Request: Request we are processing
response:HttpServletResponse: Response we are populating
config:LoginConfig: Login configuration describing how authentication should be performed

Exceptions

IOException:: If the forward to the error page fails and the call to HttpServletResponse#sendError(int, String) throws an IOException

forwardToLoginPage back to summary

forwardToLoginPage	back to summary
protected void forwardToLoginPage(Request request, HttpServletResponse response, LoginConfig config) throws IOException Called to forward to the login page Parameters request:Request Request we are processing response:HttpServletResponse Response we are populating config:LoginConfig Login configuration describing how authentication should be performed Exceptions IOException: If the forward to the login page fails and the call to `HttpServletResponse#sendError(int, String)` throws an `IOException`

protected void forwardToLoginPage(Request request, HttpServletResponse response, LoginConfig config) throws IOException

Called to forward to the login page

Parameters

request:Request: Request we are processing
response:HttpServletResponse: Response we are populating
config:LoginConfig: Login configuration describing how authentication should be performed

Exceptions

IOException:: If the forward to the login page fails and the call to HttpServletResponse#sendError(int, String) throws an IOException

getAuthenticationSessionTimeout	back to summary
public int getAuthenticationSessionTimeout() Returns the maximum session timeout to be used during authentication if the authentication process creates a session. Returns:int the maximum session timeout to be used during authentication if the authentication process creates a session

getAuthenticationSessionTimeout

back to summary

public int getAuthenticationSessionTimeout()

Returns the maximum session timeout to be used during authentication if the authentication process creates a session.

Returns:int: the maximum session timeout to be used during authentication if the authentication process creates a session

getAuthMethod	back to summary
protected String getAuthMethod() Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.getAuthMethod. Doc from org.apache.catalina.authenticator.AuthenticatorBase.getAuthMethod. Return the authentication method, which is vendor-specific and not defined by HttpServletRequest. Returns:String the authentication method, which is vendor-specific and not defined by HttpServletRequest. Annotations @Override

getAuthMethod

back to summary

protected String getAuthMethod()

Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.getAuthMethod.

Doc from org.apache.catalina.authenticator.AuthenticatorBase.getAuthMethod.

Return the authentication method, which is vendor-specific and not defined by HttpServletRequest.

Returns:String

the authentication method, which is vendor-specific and not defined by HttpServletRequest.

Annotations

@Override

getCharacterEncoding	back to summary
public String getCharacterEncoding() Return the character encoding to use to read the user name and password. Returns:String The name of the character encoding

getCharacterEncoding

back to summary

public String getCharacterEncoding()

Return the character encoding to use to read the user name and password.

Returns:String: The name of the character encoding

getLandingPage	back to summary
public String getLandingPage() Return the landing page to use when FORM auth is mis-used. Returns:String The path to the landing page relative to the web application root

getLandingPage

back to summary

public String getLandingPage()

Return the landing page to use when FORM auth is mis-used.

Returns:String: The path to the landing page relative to the web application root

isContinuationRequired back to summary

isContinuationRequired	back to summary
protected boolean isContinuationRequired(Request request) Overrides org.apache.catalina.authenticator.AuthenticatorBase.isContinuationRequired. Doc from org.apache.catalina.authenticator.AuthenticatorBase.isContinuationRequired. Does this authenticator require that `authenticate(Request, HttpServletResponse)` is called to continue an authentication process that started in a previous request? Parameters request:Request The request currently being processed Returns:boolean `true` if authenticate() must be called, otherwise `false` Annotations @Override

protected boolean isContinuationRequired(Request request)

Overrides org.apache.catalina.authenticator.AuthenticatorBase.isContinuationRequired.

Doc from org.apache.catalina.authenticator.AuthenticatorBase.isContinuationRequired.

Does this authenticator require that authenticate(Request, HttpServletResponse) is called to continue an authentication process that started in a previous request?

Parameters

request:Request: The request currently being processed

Returns:boolean

true if authenticate() must be called, otherwise false

Annotations

@Override

matchRequest back to summary

matchRequest	back to summary
protected boolean matchRequest(Request request) Does this request match the saved one (so that it must be the redirect we signaled after successful authentication? Parameters request:Request The request to be verified Returns:boolean `true` if the requests matched the saved one

protected boolean matchRequest(Request request)

Does this request match the saved one (so that it must be the redirect we signaled after successful authentication?

Parameters

request:Request: The request to be verified

Returns:boolean

true if the requests matched the saved one

register	back to summary
protected void register(Request request, HttpServletResponse response, Principal principal, String authType, String username, String password, boolean alwaysUseSession, boolean cache) Overrides org.apache.catalina.authenticator.AuthenticatorBase.register. Doc from org.apache.catalina.authenticator.AuthenticatorBase.register. Register an authenticated Principal and authentication type in our request, in the current session (if there is one), and with our SingleSignOn valve, if there is one. Set the appropriate cookie to be returned. Parameters request:Request The servlet request we are processing response:HttpServletResponse The servlet response we are generating principal:Principal The authenticated Principal to be registered authType:String The authentication type to be registered username:String Username used to authenticate (if any) password:String Password used to authenticate (if any) alwaysUseSession:boolean Should a session always be used once a user is authenticated? cache:boolean Should we cache authenticated Principals if the request is part of an HTTP session? Annotations @Override

back to summary

protected void register(Request request, HttpServletResponse response, Principal principal, String authType, String username, String password, boolean alwaysUseSession, boolean cache)

Overrides org.apache.catalina.authenticator.AuthenticatorBase.register.

Doc from org.apache.catalina.authenticator.AuthenticatorBase.register.

Register an authenticated Principal and authentication type in our request, in the current session (if there is one), and with our SingleSignOn valve, if there is one. Set the appropriate cookie to be returned.

Parameters

request:Request: The servlet request we are processing
response:HttpServletResponse: The servlet response we are generating
principal:Principal: The authenticated Principal to be registered
authType:String: The authentication type to be registered
username:String: Username used to authenticate (if any)
password:String: Password used to authenticate (if any)
alwaysUseSession:boolean: Should a session always be used once a user is authenticated?
cache:boolean: Should we cache authenticated Principals if the request is part of an HTTP session?

Annotations

@Override

restoreRequest back to summary

restoreRequest	back to summary
protected boolean restoreRequest(Request request, Session session) throws IOException Restore the original request from information stored in our session. If the original request is no longer present (because the session timed out), return `false`; otherwise, return `true`. Parameters request:Request The request to be restored session:Session The session containing the saved information Returns:boolean `true` if the request was successfully restored Exceptions IOException: if an IO error occurred during the process

protected boolean restoreRequest(Request request, Session session) throws IOException

Restore the original request from information stored in our session. If the original request is no longer present (because the session timed out), return false; otherwise, return true.

Parameters

request:Request: The request to be restored
session:Session: The session containing the saved information

Returns:boolean

true if the request was successfully restored

Exceptions

IOException:: if an IO error occurred during the process

savedRequestURL	back to summary
protected String savedRequestURL(Session session) Return the request URI (with the corresponding query string, if any) from the saved request so that we can redirect to it. Parameters session:Session Our current session Returns:String the original request URL

savedRequestURL

back to summary

protected String savedRequestURL(Session session)

Return the request URI (with the corresponding query string, if any) from the saved request so that we can redirect to it.

Parameters

session:Session: Our current session

Returns:String

the original request URL

saveRequest	back to summary
protected void saveRequest(Request request, Session session) throws IOException Save the original request information into our session. Parameters request:Request The request to be saved session:Session The session to contain the saved information Exceptions IOException: if an IO error occurred during the process

saveRequest

back to summary

protected void saveRequest(Request request, Session session) throws IOException

Save the original request information into our session.

Parameters

request:Request: The request to be saved
session:Session: The session to contain the saved information

Exceptions

IOException:: if an IO error occurred during the process

setAuthenticationSessionTimeout	back to summary
public void setAuthenticationSessionTimeout(int authenticationSessionTimeout) Configures the maximum session timeout to be used during authentication if the authentication process creates a session. Parameters authenticationSessionTimeout:int The maximum session timeout to use duriing authentication if the authentication process creates a session

setAuthenticationSessionTimeout

back to summary

public void setAuthenticationSessionTimeout(int authenticationSessionTimeout)

Configures the maximum session timeout to be used during authentication if the authentication process creates a session.

Parameters

authenticationSessionTimeout:int: The maximum session timeout to use duriing authentication if the authentication process creates a session

setCharacterEncoding	back to summary
public void setCharacterEncoding(String encoding) Set the character encoding to be used to read the user name and password. Parameters encoding:String The name of the encoding to use

setCharacterEncoding

back to summary

public void setCharacterEncoding(String encoding)

Set the character encoding to be used to read the user name and password.

Parameters

encoding:String: The name of the encoding to use

setLandingPage	back to summary
public void setLandingPage(String landingPage) Set the landing page to use when the FORM auth is mis-used. Parameters landingPage:String The path to the landing page relative to the web application root

setLandingPage

back to summary

public void setLandingPage(String landingPage)

Set the landing page to use when the FORM auth is mis-used.

Parameters

landingPage:String: The path to the landing page relative to the web application root

public Class FormAuthenticator

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail