Package com.wavemaker.runtime.security.filter

Class WMTokenBasedPreAuthenticatedProcessingFilter

java.lang.Object
org.springframework.web.filter.GenericFilterBean
com.wavemaker.runtime.security.filter.WMTokenBasedPreAuthenticatedProcessingFilter
All Implemented Interfaces:
jakarta.servlet.Filter, org.springframework.beans.factory.Aware, org.springframework.beans.factory.BeanNameAware, org.springframework.beans.factory.DisposableBean, org.springframework.beans.factory.InitializingBean, org.springframework.context.ApplicationEventPublisherAware, org.springframework.context.EnvironmentAware, org.springframework.core.env.EnvironmentCapable, org.springframework.web.context.ServletContextAware
public class WMTokenBasedPreAuthenticatedProcessingFilter extends org.springframework.web.filter.GenericFilterBean implements org.springframework.context.ApplicationEventPublisherAware
WMAppTokenBasedPreAuthenticatedProcessingFilter for processing filters that handle pre-authenticated authentication requests, where it is assumed that the principal has already been authenticated by an external system.

The purpose is then only to extract the necessary information on the principal from the incoming request query param, rather than to authenticate them. External authentication systems may provide this information via request data such as token which the pre-authentication system can extract. It is assumed that the external system is responsible for the accuracy of the data and preventing the submission of forged values.

This filter will extract principal from the request only if url contains a "token" param. If token exist then it will extract principal from the given token and build authentication object.

eg, http://host/projectName/services/pages/page?name="abc"invalid input: '&token'="YWRtaW46MTQ1NjEyMDMxMTY5ODpjOWUxZTRiYmFiYWQ0MTdhOGNiMWYyNTI1NmY2MTJlMg"

Since:
8/2/16

  • Field Summary

    Fields inherited from class org.springframework.web.filter.GenericFilterBean

    logger

  • Constructor Summary

    Constructors
    Constructor
    Description
    WMTokenBasedPreAuthenticatedProcessingFilter()
     
    WMTokenBasedPreAuthenticatedProcessingFilter(org.springframework.security.authentication.AuthenticationManager authenticationManager, WMTokenBasedAuthenticationService wmTokenBasedAuthenticationService)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    afterPropertiesSet()
    Check whether all required properties have been set.
    void
    doFilter(jakarta.servlet.ServletRequest request, jakarta.servlet.ServletResponse response, jakarta.servlet.FilterChain chain)
     
    protected String
    getTokenFromReq(jakarta.servlet.http.HttpServletRequest request)
     
    void
    setApplicationEventPublisher(org.springframework.context.ApplicationEventPublisher applicationEventPublisher)
     
    void
    setAuthenticationManager(org.springframework.security.authentication.AuthenticationManager authenticationManager)
     
    void
    setAuthenticationSuccessHandler(org.springframework.security.web.authentication.AuthenticationSuccessHandler authenticationSuccessHandler)
     
    void
    setContinueFilterChainOnUnsuccessfulAuthentication(boolean continueFilterChainOnUnsuccessfulAuthentication)
    Deprecated.
    void
    setWmTokenBasedAuthenticationService(WMTokenBasedAuthenticationService wmTokenBasedAuthenticationService)
     
    protected void
    successfulAuthentication(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.Authentication authResult)
    Puts the Authentication instance returned by the authentication manager into the secure context.
    protected void
    unsuccessfulAuthentication(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.AuthenticationException failed)
    Ensures the authentication object in the secure context is set to null when authentication fails.

    Methods inherited from class org.springframework.web.filter.GenericFilterBean

    addRequiredProperty, createEnvironment, destroy, getEnvironment, getFilterConfig, getFilterName, getServletContext, init, initBeanWrapper, initFilterBean, setBeanName, setEnvironment, setServletContext

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • WMTokenBasedPreAuthenticatedProcessingFilter

      public WMTokenBasedPreAuthenticatedProcessingFilter()

    • WMTokenBasedPreAuthenticatedProcessingFilter

      public WMTokenBasedPreAuthenticatedProcessingFilter(org.springframework.security.authentication.AuthenticationManager authenticationManager, WMTokenBasedAuthenticationService wmTokenBasedAuthenticationService)

  • Method Details

    • afterPropertiesSet

      public void afterPropertiesSet()
      Check whether all required properties have been set.
      Specified by:
      afterPropertiesSet in interface org.springframework.beans.factory.InitializingBean
      Overrides:
      afterPropertiesSet in class org.springframework.web.filter.GenericFilterBean

    • doFilter

      public void doFilter(jakarta.servlet.ServletRequest request, jakarta.servlet.ServletResponse response, jakarta.servlet.FilterChain chain) throws IOException, jakarta.servlet.ServletException
      Specified by:
      doFilter in interface jakarta.servlet.Filter
      Throws:
      IOException
      jakarta.servlet.ServletException

    • getTokenFromReq

      protected String getTokenFromReq(jakarta.servlet.http.HttpServletRequest request)

    • successfulAuthentication

      protected void successfulAuthentication(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.Authentication authResult)
      Puts the Authentication instance returned by the authentication manager into the secure context.

    • unsuccessfulAuthentication

      protected void unsuccessfulAuthentication(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.AuthenticationException failed)
      Ensures the authentication object in the secure context is set to null when authentication fails.

      Caches the failure exception as a request attribute

    • setApplicationEventPublisher

      public void setApplicationEventPublisher(org.springframework.context.ApplicationEventPublisher applicationEventPublisher)
      Specified by:
      setApplicationEventPublisher in interface org.springframework.context.ApplicationEventPublisherAware

    • setAuthenticationManager

      public void setAuthenticationManager(org.springframework.security.authentication.AuthenticationManager authenticationManager)
      Parameters:
      authenticationManager - The AuthenticationManager to use

    • setContinueFilterChainOnUnsuccessfulAuthentication

      @Deprecated public void setContinueFilterChainOnUnsuccessfulAuthentication(boolean continueFilterChainOnUnsuccessfulAuthentication)
      Deprecated.
      If set to true, any AuthenticationException raised by the AuthenticationManager will be swallowed, and the request will be allowed to proceed, potentially using alternative authentication mechanisms. If false (the default), authentication failure will result in an immediate exception.
      Parameters:
      continueFilterChainOnUnsuccessfulAuthentication - set to true to allow the request to proceed after a failed authentication.

    • setWmTokenBasedAuthenticationService

      public void setWmTokenBasedAuthenticationService(WMTokenBasedAuthenticationService wmTokenBasedAuthenticationService)

    • setAuthenticationSuccessHandler

      public void setAuthenticationSuccessHandler(org.springframework.security.web.authentication.AuthenticationSuccessHandler authenticationSuccessHandler)