public class SingleSignOn extends ValveBase implements Lifecycle, SessionListener
Host
).Realm
that contains the shared user and role
information must be configured on the same Container (or a higher
one), and not overridden at the web application level.org.apache.catalina.authenticator
package.Modifier and Type | Field and Description |
---|---|
protected Map<String,SingleSignOnEntry> |
cache
The cache of SingleSignOnEntry instances for authenticated Principals,
keyed by the cookie value that is used to select them.
|
protected String |
cookieDomain
Optional SSO cookie domain.
|
protected boolean |
cookieHttpOnly
Optional SSO HTTP only.
|
protected static String |
info
Descriptive information about this Valve implementation.
|
protected LifecycleSupport |
lifecycle
The lifecycle event support for this component.
|
protected boolean |
requireReauthentication
Indicates whether this valve should require a downstream Authenticator to
reauthenticate each request, or if it itself can bind a UserPrincipal
and AuthType object to the request.
|
protected Map<Session,String> |
reverse
The cache of single sign on identifiers, keyed by the Session that is
associated with them.
|
protected boolean |
started
Component started flag.
|
container, controller, domain, mserver, next, oname
AFTER_START_EVENT, AFTER_STOP_EVENT, BEFORE_START_EVENT, BEFORE_STOP_EVENT, DESTROY_EVENT, INIT_EVENT, PERIODIC_EVENT, START_EVENT, STOP_EVENT
Constructor and Description |
---|
SingleSignOn() |
Modifier and Type | Method and Description |
---|---|
void |
addLifecycleListener(LifecycleListener listener)
Add a lifecycle event listener to this component.
|
void |
associate(String ssoId,
Session session)
Associate the specified single sign on identifier with the
specified Session.
|
void |
deregister(String ssoId)
Deregister the specified single sign on identifier, and invalidate
any associated sessions.
|
protected void |
deregister(String ssoId,
Session session)
Deregister the specified session.
|
LifecycleListener[] |
findLifecycleListeners()
Get the lifecycle listeners associated with this lifecycle.
|
String |
getCookieDomain()
Returns the optional cookie domain.
|
String |
getInfo()
Return descriptive information about this Valve implementation.
|
boolean |
getRequireReauthentication()
Gets whether each request needs to be reauthenticated (by an
Authenticator downstream in the pipeline) to the security
Realm , or if this Valve can itself bind security info
to the request based on the presence of a valid SSO entry without
rechecking with the Realm
|
void |
invoke(Request request,
Response response)
Perform single-sign-on support processing for this request.
|
boolean |
isCookieHttpOnly() |
protected SingleSignOnEntry |
lookup(String ssoId)
Look up and return the cached SingleSignOn entry associated with this
sso id value, if there is one; otherwise return
null . |
boolean |
reauthenticate(String ssoId,
Realm realm,
Request request)
Attempts reauthentication to the given
Realm using
the credentials associated with the single sign-on session
identified by argument ssoId . |
void |
register(String ssoId,
Principal principal,
String authType,
String username,
String password)
Register the specified Principal as being associated with the specified
value for the single sign on identifier.
|
void |
removeLifecycleListener(LifecycleListener listener)
Remove a lifecycle event listener from this component.
|
protected void |
removeSession(String ssoId,
Session session)
Remove a single Session from a SingleSignOn.
|
void |
sessionEvent(SessionEvent event)
Acknowledge the occurrence of the specified event.
|
void |
setCookieDomain(String cookieDomain)
Sets the domain to be used for sso cookies.
|
void |
setCookieHttpOnly(boolean cookieHttpOnly) |
void |
setRequireReauthentication(boolean required)
Sets whether each request needs to be reauthenticated (by an
Authenticator downstream in the pipeline) to the security
Realm , or if this Valve can itself bind security info
to the request, based on the presence of a valid SSO entry, without
rechecking with the Realm
|
void |
start()
Prepare for the beginning of active use of the public methods of this
component.
|
void |
stop()
Gracefully terminate the active use of the public methods of this
component.
|
String |
toString()
Return a String rendering of this object.
|
void |
update(String ssoId,
Principal principal,
String authType,
String username,
String password)
Updates any
SingleSignOnEntry found under key
ssoId with the given authentication data. |
backgroundProcess, createObjectName, event, getContainer, getContainerName, getController, getDomain, getNext, getObjectName, getParentName, postDeregister, postRegister, preDeregister, preRegister, setContainer, setController, setNext, setObjectName
protected Map<String,SingleSignOnEntry> cache
protected static String info
protected LifecycleSupport lifecycle
protected boolean requireReauthentication
protected Map<Session,String> reverse
protected boolean started
protected String cookieDomain
protected boolean cookieHttpOnly
public boolean isCookieHttpOnly()
public void setCookieHttpOnly(boolean cookieHttpOnly)
public String getCookieDomain()
public void setCookieDomain(String cookieDomain)
cookieDomain
- cookie domain namepublic boolean getRequireReauthentication()
Realm
, or if this Valve can itself bind security info
to the request based on the presence of a valid SSO entry without
rechecking with the Realm
- Returns:
true
if it is required that a downstream
Authenticator reauthenticate each request before calls to
HttpServletRequest.setUserPrincipal()
and HttpServletRequest.setAuthType()
are made;
false
if the Valve
can itself make
those calls relying on the presence of a valid SingleSignOn
entry associated with the request.
- See Also:
setRequireReauthentication(boolean)
-
setRequireReauthentication
public void setRequireReauthentication(boolean required)
Sets whether each request needs to be reauthenticated (by an
Authenticator downstream in the pipeline) to the security
Realm
, or if this Valve can itself bind security info
to the request, based on the presence of a valid SSO entry, without
rechecking with the Realm
If this property is false
(the default), this
Valve
will bind a UserPrincipal and AuthType to the request
if a valid SSO entry is associated with the request. It will not notify
the security Realm
of the incoming request.
This property should be set to true
if the overall server
configuration requires that the Realm
reauthenticate each
request thread. An example of such a configuration would be one where
the Realm
implementation provides security for both a
web tier and an associated EJB tier, and needs to set security
credentials on each request thread in order to support EJB access.
If this property is set to true
, this Valve will set flags
on the request notifying the downstream Authenticator that the request
is associated with an SSO session. The Authenticator will then call its
reauthenticateFromSSO
method to attempt to reauthenticate the request to the
Realm
, using any credentials that were cached with this
Valve.
The default value of this property is false
, in order
to maintain backward compatibility with previous versions of Tomcat.
- Parameters:
required
- true
if it is required that a downstream
Authenticator reauthenticate each request before calls
to HttpServletRequest.setUserPrincipal()
and HttpServletRequest.setAuthType()
are
made; false
if the Valve
can
itself make those calls relying on the presence of a
valid SingleSignOn entry associated with the request.
- See Also:
AuthenticatorBase.reauthenticateFromSSO(java.lang.String, org.apache.catalina.connector.Request)
-
addLifecycleListener
public void addLifecycleListener(LifecycleListener listener)
Add a lifecycle event listener to this component.
- Specified by:
addLifecycleListener
in interface Lifecycle
- Parameters:
listener
- The listener to add
-
findLifecycleListeners
public LifecycleListener[] findLifecycleListeners()
Get the lifecycle listeners associated with this lifecycle. If this
Lifecycle has no listeners registered, a zero-length array is returned.
- Specified by:
findLifecycleListeners
in interface Lifecycle
-
removeLifecycleListener
public void removeLifecycleListener(LifecycleListener listener)
Remove a lifecycle event listener from this component.
- Specified by:
removeLifecycleListener
in interface Lifecycle
- Parameters:
listener
- The listener to remove
-
start
public void start()
throws LifecycleException
Prepare for the beginning of active use of the public methods of this
component. This method should be called after configure()
,
and before any of the public methods of the component are utilized.
- Specified by:
start
in interface Lifecycle
- Throws:
LifecycleException
- if this component detects a fatal error
that prevents this component from being used
-
stop
public void stop()
throws LifecycleException
Gracefully terminate the active use of the public methods of this
component. This method should be the last one called on a given
instance of this component.
- Specified by:
stop
in interface Lifecycle
- Throws:
LifecycleException
- if this component detects a fatal error
that needs to be reported
-
sessionEvent
public void sessionEvent(SessionEvent event)
Acknowledge the occurrence of the specified event.
- Specified by:
sessionEvent
in interface SessionListener
- Parameters:
event
- SessionEvent that has occurred
-
getInfo
public String getInfo()
Return descriptive information about this Valve implementation.
-
invoke
public void invoke(Request request,
Response response)
throws IOException,
javax.servlet.ServletException
Perform single-sign-on support processing for this request.
- Specified by:
invoke
in interface Valve
- Specified by:
invoke
in class ValveBase
- Parameters:
request
- The servlet request we are processing
response
- The servlet response we are creating
- Throws:
IOException
- if an input/output error occurs
javax.servlet.ServletException
- if a servlet error occurs
-
toString
public String toString()
Return a String rendering of this object.
-
associate
public void associate(String ssoId,
Session session)
Associate the specified single sign on identifier with the
specified Session.
- Parameters:
ssoId
- Single sign on identifier
session
- Session to be associated
-
deregister
protected void deregister(String ssoId,
Session session)
Deregister the specified session. If it is the last session,
then also get rid of the single sign on identifier
- Parameters:
ssoId
- Single sign on identifier
session
- Session to be deregistered
-
deregister
public void deregister(String ssoId)
Deregister the specified single sign on identifier, and invalidate
any associated sessions.
- Parameters:
ssoId
- Single sign on identifier to deregister
-
reauthenticate
public boolean reauthenticate(String ssoId,
Realm realm,
Request request)
Attempts reauthentication to the given Realm
using
the credentials associated with the single sign-on session
identified by argument ssoId
.
If reauthentication is successful, the Principal
and
authorization type associated with the SSO session will be bound
to the given Request
object via calls to
Request.setAuthType()
and
Request.setUserPrincipal()
- Parameters:
ssoId
- identifier of SingleSignOn session with which the
caller is associated
realm
- Realm implementation against which the caller is to
be authenticated
request
- the request that needs to be authenticated
- Returns:
true
if reauthentication was successful,
false
otherwise.
-
register
public void register(String ssoId,
Principal principal,
String authType,
String username,
String password)
Register the specified Principal as being associated with the specified
value for the single sign on identifier.
- Parameters:
ssoId
- Single sign on identifier to register
principal
- Associated user principal that is identified
authType
- Authentication type used to authenticate this
user principal
username
- Username used to authenticate this user
password
- Password used to authenticate this user
-
update
public void update(String ssoId,
Principal principal,
String authType,
String username,
String password)
Updates any SingleSignOnEntry
found under key
ssoId
with the given authentication data.
The purpose of this method is to allow an SSO entry that was
established without a username/password combination (i.e. established
following DIGEST or CLIENT_CERT authentication) to be updated with
a username and password if one becomes available through a subsequent
BASIC or FORM authentication. The SSO entry will then be usable for
reauthentication.
NOTE: Only updates the SSO entry if a call to
SingleSignOnEntry.getCanReauthenticate()
returns
false
; otherwise, it is assumed that the SSO entry already
has sufficient information to allow reauthentication and that no update
is needed.
- Parameters:
ssoId
- identifier of Single sign to be updated
principal
- the Principal
returned by the latest
call to Realm.authenticate
.
authType
- the type of authenticator used (BASIC, CLIENT_CERT,
DIGEST or FORM)
username
- the username (if any) used for the authentication
password
- the password (if any) used for the authentication
-
lookup
protected SingleSignOnEntry lookup(String ssoId)
Look up and return the cached SingleSignOn entry associated with this
sso id value, if there is one; otherwise return null
.
- Parameters:
ssoId
- Single sign on identifier to look up
Copyright © 2017 JBoss by Red Hat. All rights reserved.