authenticationprocessingfilterentrypoint.java

acegi构造安全的java系统

/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.acegisecurity.ui.webapp;

import org.acegisecurity.AuthenticationException;

import org.acegisecurity.ui.AuthenticationEntryPoint;

import org.acegisecurity.util.PortMapper;
import org.acegisecurity.util.PortMapperImpl;
import org.acegisecurity.util.PortResolver;
import org.acegisecurity.util.PortResolverImpl;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

import org.springframework.beans.factory.InitializingBean;

import org.springframework.util.Assert;

import java.io.IOException;

import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
 * <p>
 * Used by the <code>SecurityEnforcementFilter</code> to commence
 * authentication via the {@link AuthenticationProcessingFilter}. This object
 * holds the location of the login form, relative to the web app context path,
 * and is used to commence a redirect to that form.
 * </p>
 * <p>
 * By setting the <em>forceHttps</em> property to true, you may configure the
 * class to force the protocol used for the login form to be <code>HTTPS</code>,
 * even if the original intercepted request for a resource used the
 * <code>HTTP</code> protocol. When this happens, after a successful login
 * (via HTTPS), the original resource will still be accessed as HTTP, via the
 * original request URL. For the forced HTTPS feature to work, the {@link
 * PortMapper} is consulted to determine the HTTP:HTTPS pairs.
 * </p>
 * 
 * @author Ben Alex
 * @author colin sampaleanu
 * @author Omri Spector
 * @version $Id: AuthenticationProcessingFilterEntryPoint.java 1873 2007-05-25
 * 03:21:17Z benalex $
 */
public class AuthenticationProcessingFilterEntryPoint implements AuthenticationEntryPoint, InitializingBean {
	// ~ Static fields/initializers
	// =====================================================================================

	private static final Log logger = LogFactory.getLog(AuthenticationProcessingFilterEntryPoint.class);

	// ~ Instance fields
	// ================================================================================================

	private PortMapper portMapper = new PortMapperImpl();

	private PortResolver portResolver = new PortResolverImpl();

	private String loginFormUrl;

	private boolean forceHttps = false;

	private boolean serverSideRedirect = false;

	// ~ Methods
	// ========================================================================================================

	public void afterPropertiesSet() throws Exception {
		Assert.hasLength(loginFormUrl, "loginFormUrl must be specified");
		Assert.notNull(portMapper, "portMapper must be specified");
		Assert.notNull(portResolver, "portResolver must be specified");
	}

	/**
	 * Allows subclasses to modify the login form URL that should be applicable
	 * for a given request.
	 * 
	 * @param request the request
	 * @param response the response
	 * @param exception the exception
	 * @return the URL (cannot be null or empty; defaults to
	 * {@link #getLoginFormUrl()})
	 */
	protected String determineUrlToUseForThisRequest(HttpServletRequest request, HttpServletResponse response,
			AuthenticationException exception) {
		return getLoginFormUrl();
	}

	public void commence(ServletRequest request, ServletResponse response, AuthenticationException authException)
			throws IOException, ServletException {
		HttpServletRequest req = (HttpServletRequest) request;
		HttpServletResponse resp = (HttpServletResponse) response;
		String scheme = request.getScheme();
		String serverName = request.getServerName();
		int serverPort = portResolver.getServerPort(request);
		String contextPath = req.getContextPath();

		boolean inHttp = "http".equals(scheme.toLowerCase());
		boolean inHttps = "https".equals(scheme.toLowerCase());

		boolean includePort = true;

		String redirectUrl = null;
		boolean doForceHttps = false;
		Integer httpsPort = null;

		if (inHttp && (serverPort == 80)) {
			includePort = false;
		}
		else if (inHttps && (serverPort == 443)) {
			includePort = false;
		}

		if (forceHttps && inHttp) {
			httpsPort = (Integer) portMapper.lookupHttpsPort(new Integer(serverPort));

			if (httpsPort != null) {
				doForceHttps = true;
				if (httpsPort.intValue() == 443) {
					includePort = false;
				}
				else {
					includePort = true;
				}
			}

		}

		String loginForm = determineUrlToUseForThisRequest(req, resp, authException);

		if (serverSideRedirect) {

			if (doForceHttps) {

				// before doing server side redirect, we need to do client
				// redirect to https.

				String servletPath = req.getServletPath();
				String pathInfo = req.getPathInfo();
				String query = req.getQueryString();

				redirectUrl = "https://" + serverName + ((includePort) ? (":" + httpsPort) : "") + contextPath
						+ servletPath + (pathInfo == null ? "" : pathInfo) + (query == null ? "" : "?" + query);

			}
			else {

				if (logger.isDebugEnabled()) {
					logger.debug("Server side forward to: " + loginForm);
				}

				RequestDispatcher dispatcher = req.getRequestDispatcher(loginForm);

				dispatcher.forward(request, response);

				return;

			}

		}
		else {

			if (doForceHttps) {

				redirectUrl = "https://" + serverName + ((includePort) ? (":" + httpsPort) : "") + contextPath
						+ loginForm;

			}
			else {

				redirectUrl = scheme + "://" + serverName + ((includePort) ? (":" + serverPort) : "") + contextPath
						+ loginForm;

			}
		}

		if (logger.isDebugEnabled()) {
			logger.debug("Redirecting to: " + redirectUrl);
		}

		((HttpServletResponse) response).sendRedirect(((HttpServletResponse) response).encodeRedirectURL(redirectUrl));
	}

	public boolean getForceHttps() {
		return forceHttps;
	}

	public String getLoginFormUrl() {
		return loginFormUrl;
	}

	public PortMapper getPortMapper() {
		return portMapper;
	}

	public PortResolver getPortResolver() {
		return portResolver;
	}

	public boolean isServerSideRedirect() {
		return serverSideRedirect;
	}

	/**
	 * Set to true to force login form access to be via https. If this value is
	 * ture (the default is false), and the incoming request for the protected
	 * resource which triggered the interceptor was not already
	 * <code>https</code>, then
	 * 
	 * @param forceHttps
	 */
	public void setForceHttps(boolean forceHttps) {
		this.forceHttps = forceHttps;
	}

	/**
	 * The URL where the <code>AuthenticationProcessingFilter</code> login
	 * page can be found. Should be relative to the web-app context path, and
	 * include a leading <code>/</code>
	 * 
	 * @param loginFormUrl
	 */
	public void setLoginFormUrl(String loginFormUrl) {
		this.loginFormUrl = loginFormUrl;
	}

	public void setPortMapper(PortMapper portMapper) {
		this.portMapper = portMapper;
	}

	public void setPortResolver(PortResolver portResolver) {
		this.portResolver = portResolver;
	}

	/**
	 * Tells if we are to do a server side include of the
	 * <code>loginFormUrl</code> instead of a 302 redirect.
	 * 
	 * @param serverSideRedirect
	 */
	public void setServerSideRedirect(boolean serverSideRedirect) {
		this.serverSideRedirect = serverSideRedirect;
	}

}