Top Description Fields Constructors Methods
org.eclipse.jetty.security.authentication

public Class FormAuthenticator

extends LoginAuthenticator
Class Inheritance
Imports
java.util.concurrent.CompletableFuture, .ExecutionException, java.util.function.Function, org.eclipse.jetty.http.HttpHeader, .HttpMethod, .HttpStatus, .HttpURI, org.eclipse.jetty.security.AuthenticationState, .AuthenticationState.Succeeded, .Authenticator, .Constraint, .ServerAuthException, .UserIdentity, org.eclipse.jetty.server.FormFields, .Request, .Response, .Session, org.eclipse.jetty.util.Callback, .Fields, .URIUtil, org.slf4j.Logger, .LoggerFactory
FORM Authenticator.

This authenticator implements form authentication will use dispatchers to the login page if the __FORM_DISPATCH init parameter is set to true. Otherwise it will redirect.

The form authenticator redirects unauthenticated requests to a log page which should use a form to gather username/password from the user and send them to the /j_security_check URI within the context. FormAuthentication uses SessionAuthentication to wrap Authentication results so that they are associated with the session.

Field Summary

Modifier and TypeField and Description
public static final String
__FORM_DISPATCH

public static final String
__FORM_ERROR_PAGE

public static final String
__FORM_LOGIN_PAGE

public static final String
__J_METHOD

public static final String
__J_PASSWORD

public static final String
__J_POST

public static final String
__J_SECURITY_CHECK

public static final String
__J_URI

public static final String
__J_USERNAME

private boolean
_alwaysSaveUri

private boolean
_dispatch

private String
_formErrorPage

private String
_formErrorPath

private String
_formLoginPage

private String
_formLoginPath

private static final Logger
LOG

Hides org.eclipse.jetty.security.authentication.LoginAuthenticator.LOG.

Inherited from org.eclipse.jetty.security.authentication.LoginAuthenticator:
_identityService_loginService

Constructor Summary

AccessConstructor and Description
public
FormAuthenticator()

public
FormAuthenticator(String login, String error, boolean dispatch)

Method Summary

Modifier and TypeMethod and Description
private AuthenticationState
dispatch(String path, Request request, Response response, Callback callback)

protected String
encodeURL(String url, Request request)

public boolean
getAlwaysSaveUri()

public String
getAuthenticationType()

Implements org.eclipse.jetty.security.Authenticator.getAuthenticationType.

public Constraint.Authorization
getConstraintAuthentication(String
The pathInContext to potentially constrain.
pathInContext, Constraint.Authorization
The existing authentication constraint for the pathInContext determined independently of Authenticator
existing, Function<Boolean, Session>
Function to get or create a Session.
getSession)

Overrides default org.eclipse.jetty.security.Authenticator.getConstraintAuthentication.

Get an Constraint.Authorization applicable to the path for this authenticator.

protected Fields
getParameters(Request request)

public boolean
isJSecurityCheck(String uri)

public boolean
isLoginOrErrorPage(String pathInContext)

public UserIdentity
login(String
the username of the client to be authenticated
username, Object
the user's credential
password, Request
the inbound request that needs authentication
request, Response response)

Overrides org.eclipse.jetty.security.authentication.LoginAuthenticator.login.

If the UserIdentity returned from LoginService#login(String, Object, Request, Function) is not null, it is assumed that the user is fully authenticated and we need to change the session id to prevent session fixation vulnerability.

public void
logout(Request request, Response response)

Overrides org.eclipse.jetty.security.authentication.LoginAuthenticator.logout.

public Request
prepareRequest(Request
the request to prepare for handling
request, AuthenticationState
The authentication for the request
authenticationState)

Overrides default org.eclipse.jetty.security.Authenticator.prepareRequest.

Called after validateRequest(Request, Response, Callback) and before calling org.eclipse.jetty.server.Handler#handle(Request, Response, Callback) of the nested handler.

private AuthenticationState
sendChallenge(Request request, Response response, Callback callback)

private AuthenticationState
sendError(Request request, Response response, Callback callback)

public void
setAlwaysSaveUri(boolean
true to always save the uri
alwaysSave)

If true, uris that cause a redirect to a login page will always be remembered.

public void
setConfiguration(Authenticator.Configuration
the configuration
configuration)

Overrides org.eclipse.jetty.security.authentication.LoginAuthenticator.setConfiguration.

Implements org.eclipse.jetty.security.Authenticator.setConfiguration.

Configure the Authenticator

private void
setErrorPage(String path)

private void
setLoginPage(String path)

public AuthenticationState
validateRequest(Request
The request
request, Response
The response
response, Callback
the callback to use for writing a response
callback)

Implements org.eclipse.jetty.security.Authenticator.validateRequest.

Validate a request

Inherited from org.eclipse.jetty.security.authentication.LoginAuthenticator:
getLoginServiceupdateSession

Field Detail

__FORM_DISPATCHback to summary
public static final String __FORM_DISPATCH
__FORM_ERROR_PAGEback to summary
public static final String __FORM_ERROR_PAGE
__FORM_LOGIN_PAGEback to summary
public static final String __FORM_LOGIN_PAGE
__J_METHODback to summary
public static final String __J_METHOD
__J_PASSWORDback to summary
public static final String __J_PASSWORD
__J_POSTback to summary
public static final String __J_POST
__J_SECURITY_CHECKback to summary
public static final String __J_SECURITY_CHECK
__J_URIback to summary
public static final String __J_URI
__J_USERNAMEback to summary
public static final String __J_USERNAME
_alwaysSaveUriback to summary
private boolean _alwaysSaveUri
_dispatchback to summary
private boolean _dispatch
_formErrorPageback to summary
private String _formErrorPage
_formErrorPathback to summary
private String _formErrorPath
_formLoginPageback to summary
private String _formLoginPage
_formLoginPathback to summary
private String _formLoginPath
LOGback to summary
private static final Logger LOG

Hides org.eclipse.jetty.security.authentication.LoginAuthenticator.LOG.

Constructor Detail

FormAuthenticatorback to summary
public FormAuthenticator()
FormAuthenticatorback to summary
public FormAuthenticator(String login, String error, boolean dispatch)

Method Detail

dispatchback to summary
private AuthenticationState dispatch(String path, Request request, Response response, Callback callback)
encodeURLback to summary
protected String encodeURL(String url, Request request)
getAlwaysSaveUriback to summary
public boolean getAlwaysSaveUri()
getAuthenticationTypeback to summary
public String getAuthenticationType()

Implements org.eclipse.jetty.security.Authenticator.getAuthenticationType.

Returns:String

Doc from org.eclipse.jetty.security.Authenticator.getAuthenticationType.

The name of the authentication type

Annotations
@Override
getConstraintAuthenticationback to summary
public Constraint.Authorization getConstraintAuthentication(String pathInContext, Constraint.Authorization existing, Function<Boolean, Session> getSession)

Overrides default org.eclipse.jetty.security.Authenticator.getConstraintAuthentication.

Doc from org.eclipse.jetty.security.Authenticator.getConstraintAuthentication.

Get an Constraint.Authorization applicable to the path for this authenticator. This is typically used to vary protection on special URIs known to a specific Authenticator (e.g. /j_security_check for the org.eclipse.jetty.security.authentication.FormAuthenticator.

Parameters
pathInContext:String

The pathInContext to potentially constrain.

existing:Constraint.Authorization

The existing authentication constraint for the pathInContext determined independently of Authenticator

getSession:Function<Boolean, Session>

Function to get or create a Session.

Returns:Constraint.Authorization

The Constraint.Authorization to apply.

Annotations
@Override
getParametersback to summary
protected Fields getParameters(Request request)
isJSecurityCheckback to summary
public boolean isJSecurityCheck(String uri)
isLoginOrErrorPageback to summary
public boolean isLoginOrErrorPage(String pathInContext)
loginback to summary
public UserIdentity login(String username, Object password, Request request, Response response)

Overrides org.eclipse.jetty.security.authentication.LoginAuthenticator.login.

Doc from org.eclipse.jetty.security.authentication.LoginAuthenticator.login.

If the UserIdentity returned from LoginService#login(String, Object, Request, Function) is not null, it is assumed that the user is fully authenticated and we need to change the session id to prevent session fixation vulnerability. If the UserIdentity is not necessarily fully authenticated, then subclasses must override this method and determine when the UserIdentity IS fully authenticated and renew the session id.

Parameters
username:String

the username of the client to be authenticated

password:Object

the user's credential

request:Request

the inbound request that needs authentication

Annotations
@Override
logoutback to summary
public void logout(Request request, Response response)

Overrides org.eclipse.jetty.security.authentication.LoginAuthenticator.logout.

Annotations
@Override
prepareRequestback to summary
public Request prepareRequest(Request request, AuthenticationState authenticationState)

Overrides default org.eclipse.jetty.security.Authenticator.prepareRequest.

Doc from org.eclipse.jetty.security.Authenticator.prepareRequest.

Called after validateRequest(Request, Response, Callback) and before calling org.eclipse.jetty.server.Handler#handle(Request, Response, Callback) of the nested handler. This may be used by an Authenticator to restore method or content from a previous request that was challenged.

Parameters
request:Request

the request to prepare for handling

authenticationState:AuthenticationState

The authentication for the request

Annotations
@Override
sendChallengeback to summary
private AuthenticationState sendChallenge(Request request, Response response, Callback callback)
sendErrorback to summary
private AuthenticationState sendError(Request request, Response response, Callback callback)
setAlwaysSaveUriback to summary
public void setAlwaysSaveUri(boolean alwaysSave)

If true, uris that cause a redirect to a login page will always be remembered. If false, only the first uri that leads to a login page redirect is remembered. See https://bugs.eclipse.org/bugs/show_bug.cgi?id=379909

Parameters
alwaysSave:boolean

true to always save the uri

setConfigurationback to summary
public void setConfiguration(Authenticator.Configuration configuration)

Overrides org.eclipse.jetty.security.authentication.LoginAuthenticator.setConfiguration.

Implements org.eclipse.jetty.security.Authenticator.setConfiguration.

Doc from org.eclipse.jetty.security.Authenticator.setConfiguration.

Configure the Authenticator

Parameters
configuration:Authenticator.Configuration

the configuration

Annotations
@Override
setErrorPageback to summary
private void setErrorPage(String path)
setLoginPageback to summary
private void setLoginPage(String path)
validateRequestback to summary
public AuthenticationState validateRequest(Request request, Response response, Callback callback) throws ServerAuthException

Implements org.eclipse.jetty.security.Authenticator.validateRequest.

Doc from org.eclipse.jetty.security.Authenticator.validateRequest.

Validate a request

Parameters
request:Request

The request

response:Response

The response

callback:Callback

the callback to use for writing a response

Returns:AuthenticationState

An Authentication. If Authentication is successful, this will be a Succeeded. If a response has been sent by the Authenticator (which can be done for both successful and unsuccessful authentications), then the result will implement AuthenticationState.ResponseSent.

Annotations
@Override
Exceptions
ServerAuthException:
if unable to validate request