Top Description Fields Constructors Methods
org.apache.catalina.authenticator

public final Class NonLoginAuthenticator

extends AuthenticatorBase
Class Inheritance
Imports
java.io.IOException, jakarta.servlet.http.HttpServletResponse, org.apache.catalina.connector.Request
An Authenticator and Valve implementation that checks only security constraints not involving user authentication.
Author
Craig R. McClanahan

Field Summary

Inherited from org.apache.catalina.authenticator.AuthenticatorBase:
alwaysUseSessionAUTH_HEADER_NAMEcachechangeSessionIdOnAuthenticationcontextdisableProxyCachingjaspicCallbackHandlerClassREALM_NAMEsecurePagesWithPragmasecureRandomAlgorithmsecureRandomClasssecureRandomProvidersendAuthInfoResponseHeaderssessionIdGeneratorsmsso

Constructor Summary

AccessConstructor and Description
public
NonLoginAuthenticator()

Method Summary

Modifier and TypeMethod and Description
protected boolean

Returns:

boolean to indicate whether the user is authenticated
doAuthenticate(Request
Request we are processing
request, HttpServletResponse
Response we are creating
response)

Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.doAuthenticate.

Authenticate the user making this request, based on the fact that no login-config has been defined for the container.

protected String
getAuthMethod()

Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.getAuthMethod.

Return the authentication method, which is vendor-specific and not defined by HttpServletRequest.

Inherited from org.apache.catalina.authenticator.AuthenticatorBase:
allowCorsPreflightBypassassociateauthenticatechangeSessionIDcheckForCachedAuthenticationdoLogingetAllowCorsPreflightgetAlwaysUseSessiongetCachegetChangeSessionIdOnAuthenticationgetContainergetDisableProxyCachinggetJaspicCallbackHandlerClassgetRealmNamegetSecurePagesWithPragmagetSecureRandomAlgorithmgetSecureRandomClassgetSecureRandomProviderinvokeisContinuationRequiredisPreemptiveAuthPossibleisSendAuthInfoResponseHeadersloginlogoutnotifyreauthenticateFromSSOregisterregistersetAllowCorsPreflightsetAlwaysUseSessionsetCachesetChangeSessionIdOnAuthenticationsetContainersetDisableProxyCachingsetJaspicCallbackHandlerClasssetSecurePagesWithPragmasetSecureRandomAlgorithmsetSecureRandomClasssetSecureRandomProvidersetSendAuthInfoResponseHeadersstartInternalstopInternal

Constructor Detail

NonLoginAuthenticatorback to summary
public NonLoginAuthenticator()

Method Detail

doAuthenticateback to summary
protected boolean doAuthenticate(Request request, HttpServletResponse response) throws IOException

Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.doAuthenticate.

Authenticate the user making this request, based on the fact that no login-config has been defined for the container.

This implementation means "login the user even though there is no self-contained way to establish a security Principal for that user".

This method is called by the AuthenticatorBase super class to establish a Principal for the user BEFORE the container security constraints are examined, i.e. it is not yet known whether the user will eventually be permitted to access the requested resource. Therefore, it is necessary to always return true to indicate the user has not failed authentication.

There are two cases:

  • without SingleSignon: a Session instance does not yet exist and there is no auth-method to authenticate the user, so leave Request's Principal as null. Note: AuthenticatorBase will later examine the security constraints to determine whether the resource is accessible by a user without a security Principal and Role (i.e. unauthenticated).
  • with SingleSignon: if the user has already authenticated via another container (using its own login configuration), then associate this Session with the SSOEntry so it inherits the already-established security Principal and associated Roles. Note: This particular session will become a full member of the SingleSignOnEntry Session collection and so will potentially keep the SSOE "alive", even if all the other properly authenticated Sessions expire first... until it expires too.
Parameters
request:Request

Request we are processing

response:HttpServletResponse

Response we are creating

Returns:boolean

boolean to indicate whether the user is authenticated

Annotations
@Override
Exceptions
IOException:
if an input/output error occurs
getAuthMethodback to summary
protected String getAuthMethod()

Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.getAuthMethod.

Doc from org.apache.catalina.authenticator.AuthenticatorBase.getAuthMethod.

Return the authentication method, which is vendor-specific and not defined by HttpServletRequest.

Returns:String

the authentication method, which is vendor-specific and not defined by HttpServletRequest.

Annotations
@Override