Top Description Fields Constructors Methods
org.apache.tomcat.util.descriptor.web

public Class SecurityConstraint

extends XmlEncodingBase
implements Serializable
Class Inheritance
All Implemented Interfaces
java.io.Serializable
Imports
java.io.Serializable, java.nio.charset.Charset, java.util.ArrayList, .Arrays, .Collection, .HashMap, .HashSet, .List, .Map, .Set, jakarta.servlet.HttpConstraintElement, .HttpMethodConstraintElement, .ServletSecurityElement, jakarta.servlet.annotation.ServletSecurity, .ServletSecurity.EmptyRoleSemantic, org.apache.juli.logging.Log, org.apache.tomcat.util.res.StringManager
Representation of a security constraint element for a web application, as represented in a <security-constraint> element in the deployment descriptor.

Warning

It is assumed that instances of this class will be created and modified only within the context of a single thread, before the instance is made visible to the remainder of the application. After that, only read access is expected. Therefore, none of the read and write access within this class is synchronized.

Author
Craig R. McClanahan

Field Summary

Modifier and TypeField and Description
private boolean
allRoles

Was the "all roles" wildcard - ROLE_ALL_ROLES - included in the authorization constraints for this security constraint?

private boolean
authConstraint

Was an authorization constraint included in this security constraint?

private boolean
authenticatedUsers

Was the "all authenticated users" wildcard - ROLE_ALL_AUTHENTICATED_USERS - included in the authorization constraints for this security constraint?

private String[]
authRoles

The set of roles permitted to access resources protected by this security constraint.

private SecurityCollection[]
collections

The set of web resource collections protected by this security constraint.

private String
displayName

The display name of this security constraint.

public static final String
ROLE_ALL_AUTHENTICATED_USERS

public static final String
ROLE_ALL_ROLES

private static final long
serialVersionUID

private static final StringManager
sm

private String
userConstraint

The user data constraint for this security constraint.

Constructor Summary

AccessConstructor and Description
public
SecurityConstraint()

Construct a new security constraint instance with default values.

Method Summary

Modifier and TypeMethod and Description
public void
addAuthRole(String
Role name to be added
authRole)

Add an authorization role, which is a role name that will be permitted access to the resources protected by this security constraint.

public void
addCollection(SecurityCollection
The new web resource collection
collection)

Add a new web resource collection to those protected by this security constraint.

private static SecurityConstraint
createConstraint(HttpConstraintElement element, String urlPattern, boolean alwaysCreate)

public static SecurityConstraint[]

Returns:

The (possibly zero length) array of constraints that are the equivalent to the input
createConstraints(ServletSecurityElement
The element to be converted
element, String
The url pattern that the element should be applied to
urlPattern)

Convert a ServletSecurityElement to an array of SecurityConstraint(s).

public boolean

Returns:

true if the specified role is permitted access to the resources protected by this security constraint.
findAuthRole(String
Role name to be checked
role)

Check a role.

public String[]

Returns:

the roles array
findAuthRoles()

Return the set of roles that are permitted access to the resources protected by this security constraint.

public SecurityCollection

Returns:

the collection
findCollection(String
Web resource collection name to return
name)

Return the web resource collection for the specified name, if any; otherwise, return null.

public SecurityCollection[]

Returns:

the collections array
findCollections()

Return all of the web resource collections protected by this security constraint.

public static SecurityConstraint[]
findUncoveredHttpMethods(SecurityConstraint[] constraints, boolean denyUncoveredHttpMethods, Log log)

public boolean

Returns:

true if all roles
getAllRoles()

Was the "all roles" wildcard included in this authentication constraint?

public boolean

Returns:

true if this needs authorization
getAuthConstraint()

Return the authorization constraint present flag for this security constraint.

public boolean

Returns:

true if all authenticated users
getAuthenticatedUsers()

Was the "all authenticated users" wildcard included in this authentication constraint?

public String

Returns:

the display name of this security constraint.
getDisplayName()

public String

Returns:

the user constraint
getUserConstraint()

Return the user data constraint for this security constraint.

private static void
handleOmittedMethods(Set<String> omittedMethods, String pattern, boolean denyUncoveredHttpMethods, List<SecurityConstraint> newConstraints, Log log)

public boolean

Returns:

true if the specified context-relative URI (and associated HTTP method) are protected by this security constraint.
included(String
Context-relative URI to check
uri, String
Request method being used
method)

Check if the constraint applies to a URI and method.

private boolean
matchPattern(String
Context-relative request path to be checked (must start with '/')
path, String
URL pattern to be compared against
pattern)

Does the specified request path match the specified URL pattern?

public void
removeAuthRole(String
Role name to be removed
authRole)

Remove the specified role from the set of roles permitted to access the resources protected by this security constraint.

public void
removeCollection(SecurityCollection
Web resource collection to be removed
collection)

Remove the specified web resource collection from those protected by this security constraint.

public void
setAuthConstraint(boolean
The new value
authConstraint)

Set the authorization constraint present flag for this security constraint.

public void
setCharset(Charset charset)

Overrides org.apache.tomcat.util.descriptor.web.XmlEncodingBase.setCharset.

public void
setDisplayName(String
The new value
displayName)

Set the display name of this security constraint.

public void
setUserConstraint(String
The new user data constraint
userConstraint)

Set the user data constraint for this security constraint.

public String
toString()

Overrides java.lang.Object.toString.

Return a String representation of this security constraint.

public void
treatAllAuthenticatedUsersAsApplicationRole()

Called in the unlikely event that an application defines a role named "**".

Inherited from org.apache.tomcat.util.descriptor.web.XmlEncodingBase:
getCharset

Field Detail

allRolesback to summary
private boolean allRoles

Was the "all roles" wildcard - ROLE_ALL_ROLES - included in the authorization constraints for this security constraint?

authConstraintback to summary
private boolean authConstraint

Was an authorization constraint included in this security constraint? This is necessary to distinguish the case where an auth-constraint with no roles (signifying no direct access at all) was requested, versus a lack of auth-constraint which implies no access control checking.

authenticatedUsersback to summary
private boolean authenticatedUsers

Was the "all authenticated users" wildcard - ROLE_ALL_AUTHENTICATED_USERS - included in the authorization constraints for this security constraint?

authRolesback to summary
private String[] authRoles

The set of roles permitted to access resources protected by this security constraint.

collectionsback to summary
private SecurityCollection[] collections

The set of web resource collections protected by this security constraint.

displayNameback to summary
private String displayName

The display name of this security constraint.

ROLE_ALL_AUTHENTICATED_USERSback to summary
public static final String ROLE_ALL_AUTHENTICATED_USERS
ROLE_ALL_ROLESback to summary
public static final String ROLE_ALL_ROLES
serialVersionUIDback to summary
private static final long serialVersionUID
smback to summary
private static final StringManager sm
userConstraintback to summary
private String userConstraint

The user data constraint for this security constraint. Must be NONE, INTEGRAL, or CONFIDENTIAL.

Constructor Detail

SecurityConstraintback to summary
public SecurityConstraint()

Construct a new security constraint instance with default values.

Method Detail

addAuthRoleback to summary
public void addAuthRole(String authRole)

Add an authorization role, which is a role name that will be permitted access to the resources protected by this security constraint.

Parameters
authRole:String

Role name to be added

addCollectionback to summary
public void addCollection(SecurityCollection collection)

Add a new web resource collection to those protected by this security constraint.

Parameters
collection:SecurityCollection

The new web resource collection

createConstraintback to summary
private static SecurityConstraint createConstraint(HttpConstraintElement element, String urlPattern, boolean alwaysCreate)
createConstraintsback to summary
public static SecurityConstraint[] createConstraints(ServletSecurityElement element, String urlPattern)

Convert a ServletSecurityElement to an array of SecurityConstraint(s).

Parameters
element:ServletSecurityElement

The element to be converted

urlPattern:String

The url pattern that the element should be applied to

Returns:SecurityConstraint[]

The (possibly zero length) array of constraints that are the equivalent to the input

findAuthRoleback to summary
public boolean findAuthRole(String role)

Check a role.

Parameters
role:String

Role name to be checked

Returns:boolean

true if the specified role is permitted access to the resources protected by this security constraint.

findAuthRolesback to summary
public String[] findAuthRoles()

Return the set of roles that are permitted access to the resources protected by this security constraint. If none have been defined, a zero-length array is returned (which implies that all authenticated users are permitted access).

Returns:String[]

the roles array

findCollectionback to summary
public SecurityCollection findCollection(String name)

Return the web resource collection for the specified name, if any; otherwise, return null.

Parameters
name:String

Web resource collection name to return

Returns:SecurityCollection

the collection

findCollectionsback to summary
public SecurityCollection[] findCollections()

Return all of the web resource collections protected by this security constraint. If there are none, a zero-length array is returned.

Returns:SecurityCollection[]

the collections array

findUncoveredHttpMethodsback to summary
public static SecurityConstraint[] findUncoveredHttpMethods(SecurityConstraint[] constraints, boolean denyUncoveredHttpMethods, Log log)
getAllRolesback to summary
public boolean getAllRoles()

Was the "all roles" wildcard included in this authentication constraint?

Returns:boolean

true if all roles

getAuthConstraintback to summary
public boolean getAuthConstraint()

Return the authorization constraint present flag for this security constraint.

Returns:boolean

true if this needs authorization

getAuthenticatedUsersback to summary
public boolean getAuthenticatedUsers()

Was the "all authenticated users" wildcard included in this authentication constraint?

Returns:boolean

true if all authenticated users

getDisplayNameback to summary
public String getDisplayName()
Returns:String

the display name of this security constraint.

getUserConstraintback to summary
public String getUserConstraint()

Return the user data constraint for this security constraint.

Returns:String

the user constraint

handleOmittedMethodsback to summary
private static void handleOmittedMethods(Set<String> omittedMethods, String pattern, boolean denyUncoveredHttpMethods, List<SecurityConstraint> newConstraints, Log log)
includedback to summary
public boolean included(String uri, String method)

Check if the constraint applies to a URI and method.

Parameters
uri:String

Context-relative URI to check

method:String

Request method being used

Returns:boolean

true if the specified context-relative URI (and associated HTTP method) are protected by this security constraint.

matchPatternback to summary
private boolean matchPattern(String path, String pattern)

Does the specified request path match the specified URL pattern? This method follows the same rules (in the same order) as those used for mapping requests to servlets.

Parameters
path:String

Context-relative request path to be checked (must start with '/')

pattern:String

URL pattern to be compared against

removeAuthRoleback to summary
public void removeAuthRole(String authRole)

Remove the specified role from the set of roles permitted to access the resources protected by this security constraint.

Parameters
authRole:String

Role name to be removed

removeCollectionback to summary
public void removeCollection(SecurityCollection collection)

Remove the specified web resource collection from those protected by this security constraint.

Parameters
collection:SecurityCollection

Web resource collection to be removed

setAuthConstraintback to summary
public void setAuthConstraint(boolean authConstraint)

Set the authorization constraint present flag for this security constraint.

Parameters
authConstraint:boolean

The new value

setCharsetback to summary
public void setCharset(Charset charset)

Overrides org.apache.tomcat.util.descriptor.web.XmlEncodingBase.setCharset.

Annotations
@Override
setDisplayNameback to summary
public void setDisplayName(String displayName)

Set the display name of this security constraint.

Parameters
displayName:String

The new value

setUserConstraintback to summary
public void setUserConstraint(String userConstraint)

Set the user data constraint for this security constraint.

Parameters
userConstraint:String

The new user data constraint

toStringback to summary
public String toString()

Overrides java.lang.Object.toString.

Return a String representation of this security constraint.

Returns:String

Doc from java.lang.Object.toString.

a string representation of the object

Annotations
@Override
treatAllAuthenticatedUsersAsApplicationRoleback to summary
public void treatAllAuthenticatedUsersAsApplicationRole()

Called in the unlikely event that an application defines a role named "**".