public abstract class AbstractAuthenticator extends java.lang.Object implements Authenticator
| Modifier and Type | Class and Description |
|---|---|
private class |
AbstractAuthenticator.ThreadLocalUser |
| Modifier and Type | Field and Description |
|---|---|
private AbstractAuthenticator.ThreadLocalUser |
currentUser
The currentUser ThreadLocal variable is used to make the currentUser available to any call in any part of an
application.
|
private Logger |
logger |
protected static java.lang.String |
USER
Key for user in session
|
| Constructor and Description |
|---|
AbstractAuthenticator() |
| Modifier and Type | Method and Description |
|---|---|
void |
clearCurrent()
Clears the current User.
|
boolean |
exists(java.lang.String accountName)
Determine if the account exists.
|
User |
getCurrentUser()
Returns the currently logged in User.
|
protected DefaultUser |
getUserFromRememberToken()
Returns the user if a matching remember token is found, or null if the token
is missing, token is corrupt, token is expired, account name does not match
and existing account, or hashed password does not match user's hashed password.
|
protected User |
getUserFromSession()
Gets the user from session.
|
User |
login()
Calls login with the *current* request and response.
|
User |
login(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response)
This method should be called for every HTTP request, to login the current user either from the session of HTTP
request.
|
private User |
loginWithUsernameAndPassword(javax.servlet.http.HttpServletRequest request)
Utility method to extract credentials and verify them.
|
void |
logout()
Logs out the current user.
|
void |
setCurrentUser(User user)
Sets the currently logged in User.
|
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, waitchangePassword, createUser, generateStrongPassword, generateStrongPassword, getUser, getUser, getUserNames, hashPassword, removeUser, verifyAccountNameStrength, verifyPassword, verifyPasswordStrengthprotected static final java.lang.String USER
private final Logger logger
private final AbstractAuthenticator.ThreadLocalUser currentUser
As a possible extension, one could create a delegation framework by adding another ThreadLocal to hold the delegating user identity.
public void clearCurrent()
clearCurrent in interface Authenticatorpublic boolean exists(java.lang.String accountName)
exists in interface AuthenticatoraccountName - the account namepublic User getCurrentUser()
getCurrentUser in interface Authenticatorprotected User getUserFromSession()
protected DefaultUser getUserFromRememberToken()
private User loginWithUsernameAndPassword(javax.servlet.http.HttpServletRequest request) throws AuthenticationException
request - The current HTTP requestAuthenticationException - if the submitted credentials are invalid.public User login() throws AuthenticationException
login in interface AuthenticatorUser if login is successful.AuthenticationExceptionHTTPUtilities.setCurrentHTTP(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)public User login(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) throws AuthenticationException
login in interface Authenticatorrequest - the current HTTP requestresponse - the HTTP responseAuthenticationException - if the credentials are not verified, or if the account is disabled, locked, expired, or timed outpublic void logout()
logout in interface Authenticatorpublic void setCurrentUser(User user)
setCurrentUser in interface Authenticatoruser - the user to set as the current user