Package net.ltgt.oidc.servlet

Class AbstractAuthorizationFilter

java.lang.Object

jakarta.servlet.GenericFilter

jakarta.servlet.http.HttpFilter

net.ltgt.oidc.servlet.AbstractAuthorizationFilter

All Implemented Interfaces:

Filter, FilterConfig, Serializable

Direct Known Subclasses:

HasRoleFilter, IsAuthenticatedFilter

public abstract class AbstractAuthorizationFilter
extends HttpFilter

Base class for filters that redirect to the OpenID Provider when the user is not authorized.

Requests that are authorized (and pass down the filter chain) are additionally marked with the IS_PRIVATE_REQUEST_ATTRIBUTE_NAME attribute.

Subclasses should be installed after the UserFilter.

See Also:

• OpenID Connect Core 1.0
• UserFilter
• Serialized Form

Field Summary

Fields

Modifier and Type	Field	Description
static final String	IS_PRIVATE_REQUEST_ATTRIBUTE_NAME

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	AbstractAuthorizationFilter()
protected	AbstractAuthorizationFilter(AuthenticationRedirector authenticationRedirector)	Constructs a filter with the given authentication redirector.

Method Summary

Modifier and Type	Method	Description
protected void	configureAuthenticationRequest(HttpServletRequest req, AuthenticationRequest.Builder builder)	Configures the authentication request when redirecting to the OpenID Provider.
protected void	doFilter(HttpServletRequest req, HttpServletResponse res, FilterChain chain)
protected void	doRedirectToAuthenticationEndpoint(HttpServletRequest req, HttpServletResponse res)	This method is called whenever the user is not authorized and the request is a safe navigation request.
protected void	doSendUnauthorized(HttpServletRequest req, HttpServletResponse res)	This method is called whenever the user is not authenticated and the request is not a safe navigation request.
void	init()
protected abstract boolean	isAuthorized(HttpServletRequest req)	Returns whether the user is authorized.
protected boolean	isCallbackServlet(HttpServletRequest req)	Returns whether the request targets a callback servlet, that should be exempted from authorization check.
protected void	redirectToAuthenticationEndpoint(HttpServletRequest req, HttpServletResponse res)	This method is called whenever the user is not authorized and the request is a safe navigation request.
protected void	sendForbidden(HttpServletRequest req, HttpServletResponse res)	This method is called whenever the user is authenticated but not authorized.
protected void	sendUnauthorized(HttpServletRequest req, HttpServletResponse res)	This method is called whenever the user is not authorized and the request is not a safe navigation request.

Methods inherited from class jakarta.servlet.http.HttpFilter

doFilter

Methods inherited from class jakarta.servlet.GenericFilter

getFilterConfig, getFilterName, getInitParameter, getInitParameterNames, getServletContext, init

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface jakarta.servlet.Filter

destroy

Field Details

IS_PRIVATE_REQUEST_ATTRIBUTE_NAME

public static final String IS_PRIVATE_REQUEST_ATTRIBUTE_NAME

Constructor Details

AbstractAuthorizationFilter

protected AbstractAuthorizationFilter()

AbstractAuthorizationFilter

protected AbstractAuthorizationFilter(AuthenticationRedirector authenticationRedirector)

Constructs a filter with the given authentication redirector.

When this constructor is used, the servlet context attribute won't be read.

Method Details

init

@OverridingMethodsMustInvokeSuper
public void init()
          throws ServletException

Overrides:

init in class GenericFilter

Throws:

ServletException

doFilter

@ForOverride
protected void doFilter(HttpServletRequest req,
 HttpServletResponse res,
 FilterChain chain)
                 throws IOException,
ServletException

Overrides:

doFilter in class HttpFilter

Throws:

IOException

ServletException

isAuthorized

protected abstract boolean isAuthorized(HttpServletRequest req)

Returns whether the user is authorized.

Implementations should only use the requests getUserPrincipal() and/or isUserInRole().

isCallbackServlet

@ForOverride
protected boolean isCallbackServlet(HttpServletRequest req)

Returns whether the request targets a callback servlet, that should be exempted from authorization check.

redirectToAuthenticationEndpoint

@ForOverride
protected void redirectToAuthenticationEndpoint(HttpServletRequest req,
 HttpServletResponse res)
                                         throws IOException,
ServletException

This method is called whenever the user is not authorized and the request is a safe navigation request.

This implementation calls sendForbidden(jakarta.servlet.http.HttpServletRequest, jakarta.servlet.http.HttpServletResponse) whenever the user is authenticated, and defers to doRedirectToAuthenticationEndpoint(jakarta.servlet.http.HttpServletRequest, jakarta.servlet.http.HttpServletResponse) otherwise.

Throws:

IOException

ServletException

doRedirectToAuthenticationEndpoint

@ForOverride
protected void doRedirectToAuthenticationEndpoint(HttpServletRequest req,
 HttpServletResponse res)
                                           throws IOException,
ServletException

This method is called whenever the user is not authorized and the request is a safe navigation request.

The default implementation simply calls the globally configured AuthenticationRedirector, and allows configuring the authentication request.

Throws:

IOException

ServletException

See Also:

• configureAuthenticationRequest(jakarta.servlet.http.HttpServletRequest, com.nimbusds.openid.connect.sdk.AuthenticationRequest.Builder)
• sendUnauthorized(jakarta.servlet.http.HttpServletRequest, jakarta.servlet.http.HttpServletResponse)

configureAuthenticationRequest

@ForOverride
protected void configureAuthenticationRequest(HttpServletRequest req,
 AuthenticationRequest.Builder builder)

Configures the authentication request when redirecting to the OpenID Provider.

This method is called by the AuthenticationRedirector called by redirectToAuthenticationEndpoint(jakarta.servlet.http.HttpServletRequest, jakarta.servlet.http.HttpServletResponse).

See Also:

• redirectToAuthenticationEndpoint(jakarta.servlet.http.HttpServletRequest, jakarta.servlet.http.HttpServletResponse)

sendUnauthorized

@ForOverride
protected void sendUnauthorized(HttpServletRequest req,
 HttpServletResponse res)
                         throws IOException,
ServletException

This method is called whenever the user is not authorized and the request is not a safe navigation request.

This implementation calls sendForbidden(jakarta.servlet.http.HttpServletRequest, jakarta.servlet.http.HttpServletResponse) whenever the user is authenticated, and defers to doSendUnauthorized(jakarta.servlet.http.HttpServletRequest, jakarta.servlet.http.HttpServletResponse) otherwise.

Throws:

IOException

ServletException

See Also:

• redirectToAuthenticationEndpoint(jakarta.servlet.http.HttpServletRequest, jakarta.servlet.http.HttpServletResponse)

doSendUnauthorized

@ForOverride
protected void doSendUnauthorized(HttpServletRequest req,
 HttpServletResponse res)
                           throws IOException,
ServletException

This method is called whenever the user is not authenticated and the request is not a safe navigation request.

The default implementation simply calls res.sendError(SC_UNAUTHORIZED). This is not strictly HTTP-compliant as it's missing the WWW-Authenticate response header, but is a good way to signal the error to JavaScript clients making an AJAX request.

Throws:

IOException

ServletException

See Also:

• sendUnauthorized(jakarta.servlet.http.HttpServletRequest, jakarta.servlet.http.HttpServletResponse)
• redirectToAuthenticationEndpoint(jakarta.servlet.http.HttpServletRequest, jakarta.servlet.http.HttpServletResponse)

sendForbidden

@ForOverride
protected void sendForbidden(HttpServletRequest req,
 HttpServletResponse res)
                      throws IOException,
ServletException

This method is called whenever the user is authenticated but not authorized.

The default implementation simply calls res.sendError(SC_FORBIDDEN).

Throws:

IOException

ServletException