Top Description Fields Constructors Methods
org.apache.catalina.authenticator

public Class SSLAuthenticator

extends AuthenticatorBase
Class Inheritance
Imports
java.io.IOException, java.security.Principal, java.security.cert.X509Certificate, jakarta.servlet.http.HttpServletRequest, .HttpServletResponse, org.apache.catalina.Container, .Context, .Engine, .Globals, .Host, .LifecycleException, org.apache.catalina.connector.Connector, .Request, org.apache.coyote.ActionCode, .UpgradeProtocol, org.apache.juli.logging.Log, .LogFactory, org.apache.tomcat.util.net.Constants, .SSLHostConfig
An Authenticator and Valve implementation of authentication that utilizes SSL certificates to identify client users.
Author
Craig R. McClanahan

Field Summary

Modifier and TypeField and Description
private final Log
log

Hides org.apache.catalina.authenticator.AuthenticatorBase.log.

Inherited from org.apache.catalina.authenticator.AuthenticatorBase:
alwaysUseSessionAUTH_HEADER_NAMEcachechangeSessionIdOnAuthenticationcontextdisableProxyCachingjaspicCallbackHandlerClassREALM_NAMEsecurePagesWithPragmasecureRandomAlgorithmsecureRandomClasssecureRandomProvidersendAuthInfoResponseHeaderssessionIdGeneratorsmsso

Constructor Summary

AccessConstructor and Description
public
SSLAuthenticator()

Method Summary

Modifier and TypeMethod and Description
protected boolean
doAuthenticate(Request
Request we are processing
request, HttpServletResponse
Response we are creating
response)

Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.doAuthenticate.

Authenticate the user by checking for the existence of a certificate chain, validating it against the trust manager for the connector and then validating the user's identity against the configured Realm.

protected String
getAuthMethod()

Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.getAuthMethod.

Return the authentication method, which is vendor-specific and not defined by HttpServletRequest.

protected X509Certificate[]

Returns:

The X509 certificate chain if found, null otherwise.
getRequestCertificates(final Request
Request to be processed
request)

Look for the X509 certificate chain in the Request under the key jakarta.servlet.request.X509Certificate.

protected boolean
isPreemptiveAuthPossible(Request
The request to check for credentials
request)

Overrides org.apache.catalina.authenticator.AuthenticatorBase.isPreemptiveAuthPossible.

Can the authenticator perform preemptive authentication for the given request?

protected void
startInternal()

Overrides org.apache.catalina.authenticator.AuthenticatorBase.startInternal.

Start this component and implement the requirements of org.apache.catalina.util.LifecycleBase#startInternal().

Inherited from org.apache.catalina.authenticator.AuthenticatorBase:
allowCorsPreflightBypassassociateauthenticatechangeSessionIDcheckForCachedAuthenticationdoLogingetAllowCorsPreflightgetAlwaysUseSessiongetCachegetChangeSessionIdOnAuthenticationgetContainergetDisableProxyCachinggetJaspicCallbackHandlerClassgetRealmNamegetSecurePagesWithPragmagetSecureRandomAlgorithmgetSecureRandomClassgetSecureRandomProviderinvokeisContinuationRequiredisSendAuthInfoResponseHeadersloginlogoutnotifyreauthenticateFromSSOregisterregistersetAllowCorsPreflightsetAlwaysUseSessionsetCachesetChangeSessionIdOnAuthenticationsetContainersetDisableProxyCachingsetJaspicCallbackHandlerClasssetSecurePagesWithPragmasetSecureRandomAlgorithmsetSecureRandomClasssetSecureRandomProvidersetSendAuthInfoResponseHeadersstopInternal

Field Detail

logback to summary
private final Log log

Hides org.apache.catalina.authenticator.AuthenticatorBase.log.

Constructor Detail

SSLAuthenticatorback to summary
public SSLAuthenticator()

Method Detail

doAuthenticateback to summary
protected boolean doAuthenticate(Request request, HttpServletResponse response) throws IOException

Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.doAuthenticate.

Authenticate the user by checking for the existence of a certificate chain, validating it against the trust manager for the connector and then validating the user's identity against the configured Realm.

Parameters
request:Request

Request we are processing

response:HttpServletResponse

Response we are creating

Returns:boolean

Doc from org.apache.catalina.authenticator.AuthenticatorBase.doAuthenticate.

true if the the user was authenticated, otherwise false, in which case an authentication challenge will have been written to the response

Annotations
@Override
Exceptions
IOException:
if an input/output error occurs
getAuthMethodback to summary
protected String getAuthMethod()

Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.getAuthMethod.

Doc from org.apache.catalina.authenticator.AuthenticatorBase.getAuthMethod.

Return the authentication method, which is vendor-specific and not defined by HttpServletRequest.

Returns:String

the authentication method, which is vendor-specific and not defined by HttpServletRequest.

Annotations
@Override
getRequestCertificatesback to summary
protected X509Certificate[] getRequestCertificates(final Request request) throws IllegalStateException

Look for the X509 certificate chain in the Request under the key jakarta.servlet.request.X509Certificate. If not found, trigger extracting the certificate chain from the Coyote request.

Parameters
request:Request

Request to be processed

Returns:X509Certificate[]

The X509 certificate chain if found, null otherwise.

isPreemptiveAuthPossibleback to summary
protected boolean isPreemptiveAuthPossible(Request request)

Overrides org.apache.catalina.authenticator.AuthenticatorBase.isPreemptiveAuthPossible.

Doc from org.apache.catalina.authenticator.AuthenticatorBase.isPreemptiveAuthPossible.

Can the authenticator perform preemptive authentication for the given request?

Parameters
request:Request

The request to check for credentials

Returns:boolean

true if preemptive authentication is possible, otherwise false

Annotations
@Override
startInternalback to summary
protected void startInternal() throws LifecycleException

Overrides org.apache.catalina.authenticator.AuthenticatorBase.startInternal.

Doc from org.apache.catalina.valves.ValveBase.startInternal.

Start this component and implement the requirements of org.apache.catalina.util.LifecycleBase#startInternal().

Annotations
@Override
Exceptions
LifecycleException:
if this component detects a fatal error that prevents this component from being used