Top Description Inners Fields Constructors Methods
org.apache.catalina.realm

public Class CombinedRealm

extends RealmBase
Class Inheritance
Known Direct Subclasses
org.apache.catalina.realm.LockOutRealm
Imports
java.security.Principal, java.security.cert.X509Certificate, java.util.ArrayList, .Iterator, .List, javax.management.ObjectName, org.apache.catalina.Container, .CredentialHandler, .Lifecycle, .LifecycleException, .Realm, .Wrapper, org.apache.juli.logging.Log, .LogFactory, org.ietf.jgss.GSSContext, .GSSCredential, .GSSException, .GSSName
Realm implementation that contains one or more realms. Authentication is attempted for each realm in the order they were configured. If any realm authenticates the user then the authentication succeeds. When combining realms usernames should be unique across all combined realms.

Nested and Inner Type Summary

Modifier and TypeClass and Description
private class
CombinedRealm.CombinedRealmCredentialHandler

Field Summary

Modifier and TypeField and Description
private static final Log
log

Hides org.apache.catalina.realm.RealmBase.log.

protected final List<Realm>
realms

The list of Realms contained by this Realm.

Inherited from org.apache.catalina.realm.RealmBase:
allRolesModecontainercontainerLogrealmPathsmstripRealmForGsssupportUSER_ATTRIBUTES_DELIMITERUSER_ATTRIBUTES_WILDCARDuserAttributesuserAttributesListvalidatex509UsernameRetrieverx509UsernameRetrieverClassName

Constructor Summary

AccessConstructor and Description
public
CombinedRealm()

Method Summary

Modifier and TypeMethod and Description
public void
addRealm(Realm
realm which should be wrapped by the combined realm
theRealm)

Add a realm to the list of realms that will be used to authenticate users.

public Principal
authenticate(String
Username of the Principal to look up
username, String
Digest which has been submitted by the client
clientDigest, String
Unique (or supposedly unique) token which has been used for this request
nonce, String
the nonce counter
nc, String
the client chosen nonce
cnonce, String
the "quality of protection" (nc and cnonce will only be used, if qop is not null).
qop, String
Realm name
realmName, String
Second digest calculated as digest(Method + ":" + uri)
digestA2, String
The message digest algorithm to use
algorithm)

Overrides org.apache.catalina.realm.RealmBase.authenticate.

Overrides default org.apache.catalina.Realm.authenticate.

Try to authenticate with the specified username, which matches the digest calculated using the given parameters using the method described in RFC 7616.

public Principal
authenticate(String
Username of the Principal to look up
username)

Overrides org.apache.catalina.realm.RealmBase.authenticate.

Implements org.apache.catalina.Realm.authenticate.

Try to authenticate with the specified username.

public Principal
authenticate(String
Username of the Principal to look up
username, String
Password or other credentials to use in authenticating this username
credentials)

Overrides org.apache.catalina.realm.RealmBase.authenticate.

Implements org.apache.catalina.Realm.authenticate.

Try to authenticate using the specified username and credentials.

public Principal
authenticate(X509Certificate[]
Array of client certificates, with the first one in the array being the certificate of the client itself.
certs)

Overrides org.apache.catalina.realm.RealmBase.authenticate.

Implements org.apache.catalina.Realm.authenticate.

Try to authenticate using a chain of X509Certificates.

public Principal
authenticate(GSSContext
The gssContext processed by the Authenticator.
gssContext, boolean
Should the realm attempt to store the delegated credentials in the returned Principal?
storeCred)

Overrides org.apache.catalina.realm.RealmBase.authenticate.

Implements org.apache.catalina.Realm.authenticate.

Try to authenticate using a GSSContext.

public Principal
authenticate(GSSName
The GSSName of the principal to look up
gssName, GSSCredential
The GSSCredential of the principal, may be null
gssCredential)

Overrides org.apache.catalina.realm.RealmBase.authenticate.

Implements org.apache.catalina.Realm.authenticate.

Try to authenticate using a GSSName.

public void
backgroundProcess()

Overrides org.apache.catalina.realm.RealmBase.backgroundProcess.

Implements org.apache.catalina.Realm.backgroundProcess.

Delegate the backgroundProcess call to all sub-realms.

protected void
destroyInternal()

Overrides org.apache.catalina.util.LifecycleMBeanBase.destroyInternal.

Ensure child Realms are destroyed when this Realm is destroyed.

public Realm[]

Returns:

the list of Realms contained by this Realm.
getNestedRealms()

protected String
getPassword(String
The user name
username)

Implements abstract org.apache.catalina.realm.RealmBase.getPassword.

Get the password for the specified user.

protected Principal
getPrincipal(String
The user name
username)

Implements abstract org.apache.catalina.realm.RealmBase.getPrincipal.

Get the principal associated with the specified user.

public ObjectName[]

Returns:

the set of Realms that this Realm is wrapping
getRealms()

public boolean
hasRole(Wrapper
wrapper context for evaluating role
wrapper, Principal
Principal for whom the role is to be checked
principal, String
Security role to be checked
role)

Overrides org.apache.catalina.realm.RealmBase.hasRole.

Implements org.apache.catalina.Realm.hasRole.

Check if the specified Principal has the specified security role, within the context of this Realm.

public boolean
isAvailable()

Overrides default org.apache.catalina.Realm.isAvailable.

Return the availability of the realm for authentication.

public void
setContainer(Container
The Container instance with which this instance is to be associated, or null to disassociate this instance from any Container
container)

Overrides org.apache.catalina.realm.RealmBase.setContainer.

Implements org.apache.catalina.Contained.setContainer.

Set the Container with which this instance is associated.

public void
setCredentialHandler(CredentialHandler
the CredentialHandler to use
credentialHandler)

Overrides org.apache.catalina.realm.RealmBase.setCredentialHandler.

Implements org.apache.catalina.Realm.setCredentialHandler.

Set the CredentialHandler to be used by this Realm.

protected void
startInternal()

Overrides org.apache.catalina.realm.RealmBase.startInternal.

Prepare for the beginning of active use of the public methods of this component and implement the requirements of org.apache.catalina.util.LifecycleBase#startInternal().

protected void
stopInternal()

Overrides org.apache.catalina.realm.RealmBase.stopInternal.

Gracefully terminate the active use of the public methods of this component and implement the requirements of org.apache.catalina.util.LifecycleBase#stopInternal().

Inherited from org.apache.catalina.realm.RealmBase:
addPropertyChangeListenerauthenticatefindSecurityConstraintsgetAllRolesModegetContainergetCredentialHandlergetDigestgetDigestgetDomainInternalgetObjectNameKeyPropertiesgetPrincipalgetPrincipalgetRealmPathgetRealmSuffixgetServergetTransportGuaranteeRedirectStatusgetUserAttributesgetValidategetX509UsernameRetrieverClassNamehasMessageDigesthasResourcePermissionhasRoleInternalhasUserDataPermissioninitInternalisStripRealmForGssmainparseUserAttributesremovePropertyChangeListenersetAllRolesModesetRealmPathsetStripRealmForGsssetTransportGuaranteeRedirectStatussetUserAttributessetValidatesetX509UsernameRetrieverClassNametoString

Field Detail

logback to summary
private static final Log log

Hides org.apache.catalina.realm.RealmBase.log.

realmsback to summary
protected final List<Realm> realms

The list of Realms contained by this Realm.

Constructor Detail

CombinedRealmback to summary
public CombinedRealm()

Method Detail

addRealmback to summary
public void addRealm(Realm theRealm)

Add a realm to the list of realms that will be used to authenticate users.

Parameters
theRealm:Realm

realm which should be wrapped by the combined realm

authenticateback to summary
public Principal authenticate(String username, String clientDigest, String nonce, String nc, String cnonce, String qop, String realmName, String digestA2, String algorithm)

Overrides org.apache.catalina.realm.RealmBase.authenticate.

Overrides default org.apache.catalina.Realm.authenticate.

Doc from org.apache.catalina.Realm.authenticate.

Try to authenticate with the specified username, which matches the digest calculated using the given parameters using the method described in RFC 7616.

The default implementation calls authenticate(String, String, String, String, String, String, String, String) for backwards compatibility which effectively forces the use of MD5 regardless of the algorithm specified in the call to this method.

Implementations are expected to override the default implementation and take account of the algorithm parameter.

Parameters
username:String

Username of the Principal to look up

clientDigest:String

Digest which has been submitted by the client

nonce:String

Unique (or supposedly unique) token which has been used for this request

nc:String

the nonce counter

cnonce:String

the client chosen nonce

qop:String

the "quality of protection" (nc and cnonce will only be used, if qop is not null).

realmName:String

Realm name

digestA2:String

Second digest calculated as digest(Method + ":" + uri)

algorithm:String

The message digest algorithm to use

Returns:Principal

the associated principal, or null if there is none.

Annotations
@Override
authenticateback to summary
public Principal authenticate(String username)

Overrides org.apache.catalina.realm.RealmBase.authenticate.

Implements org.apache.catalina.Realm.authenticate.

Doc from org.apache.catalina.Realm.authenticate.

Try to authenticate with the specified username.

Parameters
username:String

Username of the Principal to look up

Returns:Principal

the associated principal, or null if none is associated.

Annotations
@Override
authenticateback to summary
public Principal authenticate(String username, String credentials)

Overrides org.apache.catalina.realm.RealmBase.authenticate.

Implements org.apache.catalina.Realm.authenticate.

Doc from org.apache.catalina.Realm.authenticate.

Try to authenticate using the specified username and credentials.

Parameters
username:String

Username of the Principal to look up

credentials:String

Password or other credentials to use in authenticating this username

Returns:Principal

the associated principal, or null if there is none

Annotations
@Override
authenticateback to summary
public Principal authenticate(X509Certificate[] certs)

Overrides org.apache.catalina.realm.RealmBase.authenticate.

Implements org.apache.catalina.Realm.authenticate.

Doc from org.apache.catalina.Realm.authenticate.

Try to authenticate using a chain of X509Certificates.

Parameters
certs:X509Certificate[]

Array of client certificates, with the first one in the array being the certificate of the client itself.

Returns:Principal

the associated principal, or null if there is none

Annotations
@Override
authenticateback to summary
public Principal authenticate(GSSContext gssContext, boolean storeCred)

Overrides org.apache.catalina.realm.RealmBase.authenticate.

Implements org.apache.catalina.Realm.authenticate.

Doc from org.apache.catalina.Realm.authenticate.

Try to authenticate using a GSSContext.

Parameters
gssContext:GSSContext

The gssContext processed by the Authenticator.

storeCred:boolean

Should the realm attempt to store the delegated credentials in the returned Principal?

Returns:Principal

the associated principal, or null if there is none

Annotations
@Override
authenticateback to summary
public Principal authenticate(GSSName gssName, GSSCredential gssCredential)

Overrides org.apache.catalina.realm.RealmBase.authenticate.

Implements org.apache.catalina.Realm.authenticate.

Doc from org.apache.catalina.Realm.authenticate.

Try to authenticate using a GSSName.

Parameters
gssName:GSSName

The GSSName of the principal to look up

gssCredential:GSSCredential

The GSSCredential of the principal, may be null

Returns:Principal

the associated principal, or null if there is none

Annotations
@Override
backgroundProcessback to summary
public void backgroundProcess()

Overrides org.apache.catalina.realm.RealmBase.backgroundProcess.

Implements org.apache.catalina.Realm.backgroundProcess.

Delegate the backgroundProcess call to all sub-realms.

Annotations
@Override
destroyInternalback to summary
protected void destroyInternal() throws LifecycleException

Overrides org.apache.catalina.util.LifecycleMBeanBase.destroyInternal.

Ensure child Realms are destroyed when this Realm is destroyed.

Annotations
@Override
Exceptions
LifecycleException:

Doc from org.apache.catalina.util.LifecycleBase.destroyInternal.

If the destruction fails

getNestedRealmsback to summary
public Realm[] getNestedRealms()
Returns:Realm[]

the list of Realms contained by this Realm.

getPasswordback to summary
protected String getPassword(String username)

Implements abstract org.apache.catalina.realm.RealmBase.getPassword.

Doc from org.apache.catalina.realm.RealmBase.getPassword.

Get the password for the specified user.

Parameters
username:String

The user name

Returns:String

the password associated with the given principal's user name.

Annotations
@Override
getPrincipalback to summary
protected Principal getPrincipal(String username)

Implements abstract org.apache.catalina.realm.RealmBase.getPrincipal.

Doc from org.apache.catalina.realm.RealmBase.getPrincipal.

Get the principal associated with the specified user.

Parameters
username:String

The user name

Returns:Principal

the Principal associated with the given user name.

Annotations
@Override
getRealmsback to summary
public ObjectName[] getRealms()
Returns:ObjectName[]

the set of Realms that this Realm is wrapping

hasRoleback to summary
public boolean hasRole(Wrapper wrapper, Principal principal, String role)

Overrides org.apache.catalina.realm.RealmBase.hasRole.

Implements org.apache.catalina.Realm.hasRole.

Doc from org.apache.catalina.realm.RealmBase.hasRole.

Check if the specified Principal has the specified security role, within the context of this Realm.

This method or hasRoleInternal(Principal, String) can be overridden by Realm implementations, but the default is adequate when an instance of GenericPrincipal is used to represent authenticated Principals from this Realm.

Parameters
wrapper:Wrapper

Doc from org.apache.catalina.Realm.hasRole.

wrapper context for evaluating role

principal:Principal

Doc from org.apache.catalina.Realm.hasRole.

Principal for whom the role is to be checked

role:String

Doc from org.apache.catalina.Realm.hasRole.

Security role to be checked

Returns:boolean

Doc from org.apache.catalina.Realm.hasRole.

true if the specified Principal has the specified security role, within the context of this Realm; otherwise return false.

Annotations
@Override
isAvailableback to summary
public boolean isAvailable()

Overrides default org.apache.catalina.Realm.isAvailable.

Doc from org.apache.catalina.Realm.isAvailable.

Return the availability of the realm for authentication.

Returns:boolean

true if the realm is able to perform authentication

Annotations
@Override
setContainerback to summary
public void setContainer(Container container)

Overrides org.apache.catalina.realm.RealmBase.setContainer.

Implements org.apache.catalina.Contained.setContainer.

Doc from org.apache.catalina.Contained.setContainer.

Set the Container with which this instance is associated.

Parameters
container:Container

The Container instance with which this instance is to be associated, or null to disassociate this instance from any Container

Annotations
@Override
setCredentialHandlerback to summary
public void setCredentialHandler(CredentialHandler credentialHandler)

Overrides org.apache.catalina.realm.RealmBase.setCredentialHandler.

Implements org.apache.catalina.Realm.setCredentialHandler.

Doc from org.apache.catalina.Realm.setCredentialHandler.

Set the CredentialHandler to be used by this Realm.

Parameters
credentialHandler:CredentialHandler

the CredentialHandler to use

Annotations
@Override
startInternalback to summary
protected void startInternal() throws LifecycleException

Overrides org.apache.catalina.realm.RealmBase.startInternal.

Doc from org.apache.catalina.realm.RealmBase.startInternal.

Prepare for the beginning of active use of the public methods of this component and implement the requirements of org.apache.catalina.util.LifecycleBase#startInternal().

Annotations
@Override
Exceptions
LifecycleException:
if this component detects a fatal error that prevents this component from being used
stopInternalback to summary
protected void stopInternal() throws LifecycleException

Overrides org.apache.catalina.realm.RealmBase.stopInternal.

Doc from org.apache.catalina.realm.RealmBase.stopInternal.

Gracefully terminate the active use of the public methods of this component and implement the requirements of org.apache.catalina.util.LifecycleBase#stopInternal().

Annotations
@Override
Exceptions
LifecycleException:
if this component detects a fatal error that needs to be reported
org.apache.catalina.realm back to summary

private Class CombinedRealm.CombinedRealmCredentialHandler

extends Object
implements CredentialHandler
Class Inheritance
  • java.lang.Object
  • org.apache.catalina.realm.CombinedRealm.CombinedRealmCredentialHandler
All Implemented Interfaces
org.apache.catalina.CredentialHandler

Constructor Summary

AccessConstructor and Description
private
CombinedRealmCredentialHandler()

Method Summary

Modifier and TypeMethod and Description
public boolean
matches(String
User provided credentials
inputCredentials, String
Credentials stored in the Realm
storedCredentials)

Implements org.apache.catalina.CredentialHandler.matches.

Checks to see if the input credentials match the stored credentials

public String
mutate(String
User provided credentials
inputCredentials)

Implements org.apache.catalina.CredentialHandler.mutate.

Generates the equivalent stored credentials for the given input credentials.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Constructor Detail

CombinedRealmCredentialHandlerback to summary
private CombinedRealmCredentialHandler()

Method Detail

matchesback to summary
public boolean matches(String inputCredentials, String storedCredentials)

Implements org.apache.catalina.CredentialHandler.matches.

Doc from org.apache.catalina.CredentialHandler.matches.

Checks to see if the input credentials match the stored credentials

Parameters
inputCredentials:String

User provided credentials

storedCredentials:String

Credentials stored in the Realm

Returns:boolean

true if the inputCredentials match the storedCredentials, otherwise false

Annotations
@Override
mutateback to summary
public String mutate(String inputCredentials)

Implements org.apache.catalina.CredentialHandler.mutate.

Doc from org.apache.catalina.CredentialHandler.mutate.

Generates the equivalent stored credentials for the given input credentials.

Parameters
inputCredentials:String

User provided credentials

Returns:String

The equivalent stored credentials for the given input credentials

Annotations
@Override