Top Description Inners Fields Constructors Methods
org.eclipse.jetty.security

public abstract Class SecurityHandler

extends Wrapper
implements Configuration
Class Inheritance
All Implemented Interfaces
org.eclipse.jetty.security.Authenticator.Configuration
Known Direct Subclasses
org.eclipse.jetty.security.SecurityHandler.PathMapped
Imports
java.security.Principal, java.util.ArrayList, .Collections, .Comparator, .HashMap, .HashSet, .List, .Map, .ServiceLoader, .Set, org.eclipse.jetty.http.HttpField, .HttpFields, .HttpHeader, .HttpHeaderValue, .HttpStatus, .HttpURI, org.eclipse.jetty.http.pathmap.MappedResource, .PathMappings, .PathSpec, .PathSpecGroup, org.eclipse.jetty.security.Authenticator.Configuration, .Constraint.Authorization, .Constraint.Transport, org.eclipse.jetty.security.authentication.LoginAuthenticator, org.eclipse.jetty.server.Context, .Handler, .HttpConfiguration, .Request, .Response, org.eclipse.jetty.server.handler.ContextHandler, org.eclipse.jetty.util.Callback, .TypeUtil, .URIUtil, org.eclipse.jetty.util.component.DumpableCollection, org.slf4j.Logger, .LoggerFactory

Abstract SecurityHandler.

Select and apply an Authenticator to a request.

The Authenticator may either be directly set on the handler or it will be created during start() with a call to either the default or set AuthenticatorFactory.

SecurityHandler has a set of parameters that are used by the Authentication.Configuration. At startup, any context init parameters that start with "org.eclipse.jetty.security." that do not have values in the SecurityHandler init parameters, are copied.

Nested and Inner Type Summary

Modifier and TypeClass and Description
public class
public static class
SecurityHandler.PathMapped

A concrete implementation of SecurityHandler that uses a PathMappings to match request to a list of Constraints, which are applied in the order of least significant to most significant.

Field Summary

Modifier and TypeField and Description
private static final List<Authenticator.Factory>
private String
private Authenticator
private Authenticator.Factory
private AuthenticationState.Deferred
private IdentityService
private LoginService
private final Map<String, String>
private String
private boolean
private int
private static final Logger
public static String

Constructor Summary

AccessConstructor and Description
protected
protected

Method Summary

Modifier and TypeMethod and Description
protected void
doStart()

Overrides org.eclipse.jetty.server.Handler.Abstract.doStart.

Starts the managed lifecycle beans in the order they were added.
protected void
doStop()

Overrides org.eclipse.jetty.server.Handler.Abstract.doStop.

Stops the managed lifecycle beans in the reverse order they were added.
protected IdentityService
protected LoginService

Returns:

An appropriate LoginService or null
findLoginService
()

Find an appropriate LoginService from the list returned by org.eclipse.jetty.util.component.Container#getBeans(Class) called on the result of getServer().

public String
public Authenticator
public Authenticator.Factory

Returns:

the authenticatorFactory
getAuthenticatorFactory
()

protected abstract Constraint
getConstraint(String pathInContext, Request request)

public static SecurityHandler
public IdentityService

Returns:

the identityService
getIdentityService
()

Implements org.eclipse.jetty.security.Authenticator.Configuration.getIdentityService.

Get the identityService.
public List<Authenticator.Factory>

Returns:

the list of discovered authenticatorFactories
getKnownAuthenticatorFactories
()

protected Set<String>
public LoginService

Returns:

the loginService
getLoginService
()

Implements org.eclipse.jetty.security.Authenticator.Configuration.getLoginService.

Get the loginService.
public String
getParameter(String
parameter name
key
)

Implements org.eclipse.jetty.security.Authenticator.Configuration.getParameter.

Get a SecurityHandler init parameter
public Set<String>
public String
public int
public boolean
handle(Request
the HTTP request to handle
request
,
Response
the HTTP response to handle
response
,
Callback
the callback to complete when the handling is complete
callback
)

Overrides org.eclipse.jetty.server.Handler.Wrapper.handle.

Implements org.eclipse.jetty.server.Request.Handler.handle.

Invoked to handle the passed HTTP request and response.

protected boolean
isAuthorized(Constraint constraint, AuthenticationState authenticationState)

public boolean
protected void
redirectToSecure(Request request, Response response, Callback callback)

public void
setAuthenticationType(String
the name of the Authenticator to use
authenticationType
)

public void
setAuthenticator(Authenticator
the authenticator
authenticator
)

Set the authenticator.

public void
setAuthenticatorFactory(Authenticator.Factory
the authenticatorFactory to set
authenticatorFactory
)

public void
setIdentityService(IdentityService
the identityService to set
identityService
)

Set the identityService.

public void
setLoginService(LoginService
the loginService to set
loginService
)

Set the loginService.

public String

Returns:

previous value
setParameter
(String
the key
key
,
String
the init value
value
)

Set an authentication parameter for retrieval via Configuration#getParameter(String)

public void
setRealmName(String
the realmName to set
realmName
)

public void
setSessionMaxInactiveIntervalOnAuthentication(int
An interval in seconds; or 0 to not set the interval on authentication; or a negative number to make the session never timeout after authentication.
seconds
)

Set the interval in seconds, which if non-zero, will be set with org.eclipse.jetty.server.Session#setMaxInactiveInterval(int) when a session is newly authenticated.

public void
setSessionRenewedOnAuthentication(boolean
true to renew the authentication on session
renew
)

Set renew the session on Authentication.

Inherited from org.eclipse.jetty.server.Handler.Wrapper:
getHandlergetInvocationTypesetHandler

Field Detail

__knownAuthenticatorFactoriesback to summary
private static final List<Authenticator.Factory> __knownAuthenticatorFactories
_authenticationTypeback to summary
private String _authenticationType
_authenticatorback to summary
private Authenticator _authenticator
_authenticatorFactoryback to summary
private Authenticator.Factory _authenticatorFactory
_deferredback to summary
private AuthenticationState.Deferred _deferred
_identityServiceback to summary
private IdentityService _identityService
_loginServiceback to summary
private LoginService _loginService
_parametersback to summary
private final Map<String, String> _parameters
_realmNameback to summary
private String _realmName
_renewSessionOnAuthenticationback to summary
private boolean _renewSessionOnAuthentication
_sessionMaxInactiveIntervalOnAuthenticationback to summary
private int _sessionMaxInactiveIntervalOnAuthentication
LOGback to summary
private static final Logger LOG

Hides org.eclipse.jetty.server.Handler.Abstract.LOG.

SESSION_AUTHENTICATED_ATTRIBUTEback to summary
public static String SESSION_AUTHENTICATED_ATTRIBUTE

Constructor Detail

SecurityHandlerback to summary
protected SecurityHandler()
SecurityHandlerback to summary
protected SecurityHandler(Handler handler)

Method Detail

doStartback to summary
protected void doStart() throws Exception

Overrides org.eclipse.jetty.server.Handler.Abstract.doStart.

Doc from org.eclipse.jetty.util.component.ContainerLifeCycle.doStart.

Starts the managed lifecycle beans in the order they were added.

Annotations
@Override
Exceptions
Exception:

Doc from org.eclipse.jetty.util.component.AbstractLifeCycle.doStart.

If there was a problem starting. Will cause a transition to FAILED state

doStopback to summary
protected void doStop() throws Exception

Overrides org.eclipse.jetty.server.Handler.Abstract.doStop.

Doc from org.eclipse.jetty.util.component.ContainerLifeCycle.doStop.

Stops the managed lifecycle beans in the reverse order they were added.

Annotations
@Override
Exceptions
Exception:

Doc from org.eclipse.jetty.util.component.AbstractLifeCycle.doStop.

If there was a problem stopping. Will cause a transition to FAILED state

findIdentityServiceback to summary
protected IdentityService findIdentityService()
findLoginServiceback to summary
protected LoginService findLoginService()

Find an appropriate LoginService from the list returned by org.eclipse.jetty.util.component.Container#getBeans(Class) called on the result of getServer(). A service is selected by:

  • if setRealmName(String) has been called, the first service with a matching name is used
  • if the list is size 1, that service is used
  • otherwise no service is selected.
Returns:LoginService

An appropriate LoginService or null

getAuthenticationTypeback to summary
public String getAuthenticationType()

Implements org.eclipse.jetty.security.Authenticator.Configuration.getAuthenticationType.

Returns:String

the name of the Authenticator

Annotations
@Override
getAuthenticatorback to summary
public Authenticator getAuthenticator()
getAuthenticatorFactoryback to summary
public Authenticator.Factory getAuthenticatorFactory()
Returns:Authenticator.Factory

the authenticatorFactory

getConstraintback to summary
protected abstract Constraint getConstraint(String pathInContext, Request request)
getCurrentSecurityHandlerback to summary
public static SecurityHandler getCurrentSecurityHandler()
getIdentityServiceback to summary
public IdentityService getIdentityService()

Implements org.eclipse.jetty.security.Authenticator.Configuration.getIdentityService.

Get the identityService.

Returns:IdentityService

the identityService

Annotations
@Override
getKnownAuthenticatorFactoriesback to summary
public List<Authenticator.Factory> getKnownAuthenticatorFactories()
Returns:List<Authenticator.Factory>

the list of discovered authenticatorFactories

getKnownRolesback to summary
protected Set<String> getKnownRoles()
getLoginServiceback to summary
public LoginService getLoginService()

Implements org.eclipse.jetty.security.Authenticator.Configuration.getLoginService.

Get the loginService.

Returns:LoginService

the loginService

Annotations
@Override
getParameterback to summary
public String getParameter(String key)

Implements org.eclipse.jetty.security.Authenticator.Configuration.getParameter.

Doc from org.eclipse.jetty.security.Authenticator.Configuration.getParameter.

Get a SecurityHandler init parameter

Parameters
key:String

parameter name

Returns:String

Parameter value or null

Annotations
@Override
getParameterNamesback to summary
public Set<String> getParameterNames()

Implements org.eclipse.jetty.security.Authenticator.Configuration.getParameterNames.

Doc from org.eclipse.jetty.security.Authenticator.Configuration.getParameterNames.

Get a SecurityHandler init parameter names

Returns:Set<String>

Set of parameter names

Annotations
@Override
getRealmNameback to summary
public String getRealmName()

Implements org.eclipse.jetty.security.Authenticator.Configuration.getRealmName.

Returns:String

the realmName

Annotations
@Override
getSessionMaxInactiveIntervalOnAuthenticationback to summary
public int getSessionMaxInactiveIntervalOnAuthentication()

Implements org.eclipse.jetty.security.Authenticator.Configuration.getSessionMaxInactiveIntervalOnAuthentication.

Doc from org.eclipse.jetty.security.Authenticator.Configuration.getSessionMaxInactiveIntervalOnAuthentication.

Get the interval in seconds, which if non-zero, will be set with Session#setMaxInactiveInterval(int) when a session is newly authenticated

Returns:int

An interval in seconds; or 0 to not set the interval on authentication; or a negative number to make the session never timeout after authentication.

Annotations
@Override
handleback to summary
public boolean handle(Request request, Response response, Callback callback) throws Exception

Overrides org.eclipse.jetty.server.Handler.Wrapper.handle.

Implements org.eclipse.jetty.server.Request.Handler.handle.

Doc from org.eclipse.jetty.server.Request.Handler.handle.

Invoked to handle the passed HTTP request and response.

The request is accepted by returning true, then handling must be concluded by completing the passed callback. The handling may be asynchronous, i.e. this method may return true and complete the given callback later, possibly from a different thread. If this method returns false, then the callback must not be invoked and any mutation on the response reversed.

Exceptions thrown by this method may be subsequently handled by an error Request.Handler, if present, otherwise a default HTTP 500 error is generated and the callback completed while writing the error response.

The simplest implementation is:

public boolean handle(Request request, Response response, Callback callback)
{
    callback.succeeded();
    return true;
}

A HelloWorld implementation is:

public boolean handle(Request request, Response response, Callback callback)
{
    response.write(true, ByteBuffer.wrap("Hello World\n".getBytes(StandardCharsets.UTF_8)), callback);
    return true;
}
Parameters
request:Request

the HTTP request to handle

response:Response

the HTTP response to handle

callback:Callback

the callback to complete when the handling is complete

Returns:boolean

True if and only if the request will be handled, a response generated and the callback eventually called. This may occur within the scope of the call to this method, or asynchronously some time later. If false is returned, then this method must not generate a response, nor complete the callback.

Annotations
@Override
Exceptions
Exception:
if there is a failure during the handling. Catchers cannot assume that the callback will be called and thus should attempt to complete the request as if a false had been returned.
isAuthorizedback to summary
protected boolean isAuthorized(Constraint constraint, AuthenticationState authenticationState)
isSessionRenewedOnAuthenticationback to summary
public boolean isSessionRenewedOnAuthentication()

Implements org.eclipse.jetty.security.Authenticator.Configuration.isSessionRenewedOnAuthentication.

Doc from org.eclipse.jetty.security.Authenticator.Configuration.isSessionRenewedOnAuthentication.

Should session ID be renewed on authentication.

Returns:boolean

true if the session ID should be renewed on authentication

Annotations
@Override
redirectToSecureback to summary
protected void redirectToSecure(Request request, Response response, Callback callback)
setAuthenticationTypeback to summary
public void setAuthenticationType(String authenticationType)
Parameters
authenticationType:String

the name of the Authenticator to use

Exceptions
IllegalStateException:
if the SecurityHandler is running
setAuthenticatorback to summary
public void setAuthenticator(Authenticator authenticator)

Set the authenticator.

Parameters
authenticator:Authenticator

the authenticator

Exceptions
IllegalStateException:
if the SecurityHandler is running
setAuthenticatorFactoryback to summary
public void setAuthenticatorFactory(Authenticator.Factory authenticatorFactory)
Parameters
authenticatorFactory:Authenticator.Factory

the authenticatorFactory to set

Exceptions
IllegalStateException:
if the SecurityHandler is running
setIdentityServiceback to summary
public void setIdentityService(IdentityService identityService)

Set the identityService.

Parameters
identityService:IdentityService

the identityService to set

setLoginServiceback to summary
public void setLoginService(LoginService loginService)

Set the loginService. If a LoginService is not set, or is set to null, then during doStart() the findLoginService() method is used to locate one.

Parameters
loginService:LoginService

the loginService to set

setParameterback to summary
public String setParameter(String key, String value)

Set an authentication parameter for retrieval via Configuration#getParameter(String)

Parameters
key:String

the key

value:String

the init value

Returns:String

previous value

Exceptions
IllegalStateException:
if the SecurityHandler is started
setRealmNameback to summary
public void setRealmName(String realmName)
Parameters
realmName:String

the realmName to set

Exceptions
IllegalStateException:
if the SecurityHandler is running
setSessionMaxInactiveIntervalOnAuthenticationback to summary
public void setSessionMaxInactiveIntervalOnAuthentication(int seconds)

Set the interval in seconds, which if non-zero, will be set with org.eclipse.jetty.server.Session#setMaxInactiveInterval(int) when a session is newly authenticated.

Parameters
seconds:int

An interval in seconds; or 0 to not set the interval on authentication; or a negative number to make the session never timeout after authentication.

See Also
Configuration#getSessionMaxInactiveIntervalOnAuthentication()
setSessionRenewedOnAuthenticationback to summary
public void setSessionRenewedOnAuthentication(boolean renew)

Set renew the session on Authentication.

If set to true, then on authentication, the session associated with a request is invalidated and replaced with a new session.

Parameters
renew:boolean

true to renew the authentication on session

See Also
Configuration#isSessionRenewedOnAuthentication()
org.eclipse.jetty.security back to summary

public Class SecurityHandler.NotChecked

extends Object
implements Principal
Class Inheritance
All Implemented Interfaces
java.security.Principal

Constructor Summary

AccessConstructor and Description
public

Method Summary

Modifier and TypeMethod and Description
public String
getName()

Implements java.security.Principal.getName.

Returns the name of this Principal.
public SecurityHandler
public String
toString()

Overrides java.lang.Object.toString.

Implements java.security.Principal.toString.

Returns a string representation of this Principal.
Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAllwaitwaitwait

Constructor Detail

NotCheckedback to summary
public NotChecked()

Method Detail

getNameback to summary
public String getName()

Implements java.security.Principal.getName.

Doc from java.security.Principal.getName.

Returns the name of this Principal.

Returns:String

the name of this Principal.

Annotations
@Override
getSecurityHandlerback to summary
public SecurityHandler getSecurityHandler()
toStringback to summary
public String toString()

Overrides java.lang.Object.toString.

Implements java.security.Principal.toString.

Doc from java.security.Principal.toString.

Returns a string representation of this Principal.

Returns:String

a string representation of this Principal.

Annotations
@Override
org.eclipse.jetty.security back to summary

public Class SecurityHandler.PathMapped

extends SecurityHandler
implements Comparator<PathSpec>
Class Inheritance
All Implemented Interfaces
java.util.Comparator

A concrete implementation of SecurityHandler that uses a PathMappings to match request to a list of Constraints, which are applied in the order of least significant to most significant.

An example of using this class is:

    SecurityHandler.PathMapped handler = new SecurityHandler.PathMapped();
    handler.put("/*", Constraint.combine(Constraint.FORBIDDEN, Constraint.SECURE_TRANSPORT);
    handler.put("", Constraint.ALLOWED);
    handler.put("/login", Constraint.ALLOWED);
    handler.put("*.png", Constraint.ANY_TRANSPORT);
    handler.put("/admin/*", Constraint.from("admin", "operator"));
    handler.put("/admin/super/*", Constraint.from("operator"));
    handler.put("/user/*", Constraint.ANY_USER);
    handler.put("*.xml", Constraint.FORBIDDEN);

When getConstraint(String, Request) is called, any matching constraints are sorted into least to most significant with compare(PathSpec, PathSpec), resulting in the order in which Constraint#combine(Constraint, Constraint) will be applied. For example:

Field Summary

Modifier and TypeField and Description
private final Set<String>
private final PathMappings<Constraint>
Inherited from org.eclipse.jetty.security.SecurityHandler:
SESSION_AUTHENTICATED_ATTRIBUTE

Constructor Summary

AccessConstructor and Description
public
public

Method Summary

Modifier and TypeMethod and Description
public int

Returns:

-1, 0 or 1
compare
(PathSpec
the first PathSpec to be compared.
ps1
,
PathSpec
the second PathSpec to be compared.
ps2
)

Implements java.util.Comparator.compare.

Comparator method to sort paths from least specific to most specific.
pack-priv int
compare(MappedResource<Constraint>
the first object to be compared.
c1
,
MappedResource<Constraint>
the second object to be compared.
c2
)

Implements java.util.Comparator.compare.

Compares its two arguments for order.
public Constraint
get(PathSpec pathSpec)

protected Constraint
protected Set<String>
protected int

Returns:

An integer representing relative precedence between PathSpecGroups.
pathSpecGroupPrecedence
(PathSpecGroup
The group to rank.
group
)

Get the relative precedence of a PathSpecGroup used by compare(MappedResource, MappedResource) to sort Constraints.

public Constraint
put(String pathSpec, Constraint constraint)

public Constraint
put(PathSpec pathSpec, Constraint constraint)

public Constraint
remove(PathSpec pathSpec)

Inherited from org.eclipse.jetty.security.SecurityHandler:
doStartdoStopfindIdentityServicefindLoginServicegetAuthenticationTypegetAuthenticatorgetAuthenticatorFactorygetCurrentSecurityHandlergetIdentityServicegetKnownAuthenticatorFactoriesgetLoginServicegetParametergetParameterNamesgetRealmNamegetSessionMaxInactiveIntervalOnAuthenticationhandleisAuthorizedisSessionRenewedOnAuthenticationredirectToSecuresetAuthenticationTypesetAuthenticatorsetAuthenticatorFactorysetIdentityServicesetLoginServicesetParametersetRealmNamesetSessionMaxInactiveIntervalOnAuthenticationsetSessionRenewedOnAuthentication

Field Detail

_knownRolesback to summary
private final Set<String> _knownRoles
_mappingsback to summary
private final PathMappings<Constraint> _mappings

Constructor Detail

PathMappedback to summary
public PathMapped()
PathMappedback to summary
public PathMapped(Handler handler)

Method Detail

compareback to summary
public int compare(PathSpec ps1, PathSpec ps2)

Implements java.util.Comparator.compare.

Comparator method to sort paths from least specific to most specific. Using the pathSpecGroupPrecedence(PathSpecGroup) to rank different groups and PathSpec#getSpecLength() to rank within a group. This method may be overridden to provide different precedence between constraints.

Parameters
ps1:PathSpec

the first PathSpec to be compared.

ps2:PathSpec

the second PathSpec to be compared.

Returns:int

-1, 0 or 1

Annotations
@Override
compareback to summary
pack-priv int compare(MappedResource<Constraint> c1, MappedResource<Constraint> c2)

Implements java.util.Comparator.compare.

Doc from java.util.Comparator.compare.

Compares its two arguments for order. Returns a negative integer, zero, or a positive integer as the first argument is less than, equal to, or greater than the second.

The implementor must ensure that signum(compare(x, y)) == -signum(compare(y, x)) for all x and y. (This implies that compare(x, y) must throw an exception if and only if compare(y, x) throws an exception.)

The implementor must also ensure that the relation is transitive: ((compare(x, y)>0) && (compare(y, z)>0)) implies compare(x, z)>0.

Finally, the implementor must ensure that compare(x, y)==0 implies that signum(compare(x, z))==signum(compare(y, z)) for all z.

Parameters
c1:MappedResource<Constraint>

the first object to be compared.

c2:MappedResource<Constraint>

the second object to be compared.

Returns:int

a negative integer, zero, or a positive integer as the first argument is less than, equal to, or greater than the second.

getback to summary
public Constraint get(PathSpec pathSpec)
getConstraintback to summary
protected Constraint getConstraint(String pathInContext, Request request)

Implements abstract org.eclipse.jetty.security.SecurityHandler.getConstraint.

Annotations
@Override
getKnownRolesback to summary
protected Set<String> getKnownRoles()

Overrides org.eclipse.jetty.security.SecurityHandler.getKnownRoles.

Annotations
@Override
pathSpecGroupPrecedenceback to summary
protected int pathSpecGroupPrecedence(PathSpecGroup group)

Get the relative precedence of a PathSpecGroup used by compare(MappedResource, MappedResource) to sort Constraints. The precedence from most significant to least is:

Parameters
group:PathSpecGroup

The group to rank.

Returns:int

An integer representing relative precedence between PathSpecGroups.

putback to summary
public Constraint put(String pathSpec, Constraint constraint)
putback to summary
public Constraint put(PathSpec pathSpec, Constraint constraint)
removeback to summary
public Constraint remove(PathSpec pathSpec)