|
@@ -42,18 +42,20 @@ import java.text.SimpleDateFormat;
|
|
|
import java.util.*;
|
|
|
|
|
|
/**
|
|
|
- * The {@link AuthenticationFilter} enables protecting web application resources with different (pluggable)
|
|
|
+ * <p>The {@link AuthenticationFilter} enables protecting web application
|
|
|
+ * resources with different (pluggable)
|
|
|
* authentication mechanisms and signer secret providers.
|
|
|
- * <p/>
|
|
|
+ * </p>
|
|
|
+ * <p>
|
|
|
* Out of the box it provides 2 authentication mechanisms: Pseudo and Kerberos SPNEGO.
|
|
|
- * <p/>
|
|
|
+ * </p>
|
|
|
* Additional authentication mechanisms are supported via the {@link AuthenticationHandler} interface.
|
|
|
- * <p/>
|
|
|
+ * <p>
|
|
|
* This filter delegates to the configured authentication handler for authentication and once it obtains an
|
|
|
* {@link AuthenticationToken} from it, sets a signed HTTP cookie with the token. For client requests
|
|
|
* that provide the signed HTTP cookie, it verifies the validity of the cookie, extracts the user information
|
|
|
* and lets the request proceed to the target resource.
|
|
|
- * <p/>
|
|
|
+ * </p>
|
|
|
* The supported configuration properties are:
|
|
|
* <ul>
|
|
|
* <li>config.prefix: indicates the prefix to be used by all other configuration properties, the default value
|
|
@@ -71,18 +73,19 @@ import java.util.*;
|
|
|
* <li>[#PREFIX#.]cookie.domain: domain to use for the HTTP cookie that stores the authentication token.</li>
|
|
|
* <li>[#PREFIX#.]cookie.path: path to use for the HTTP cookie that stores the authentication token.</li>
|
|
|
* </ul>
|
|
|
- * <p/>
|
|
|
+ * <p>
|
|
|
* The rest of the configuration properties are specific to the {@link AuthenticationHandler} implementation and the
|
|
|
* {@link AuthenticationFilter} will take all the properties that start with the prefix #PREFIX#, it will remove
|
|
|
* the prefix from it and it will pass them to the the authentication handler for initialization. Properties that do
|
|
|
* not start with the prefix will not be passed to the authentication handler initialization.
|
|
|
- * <p/>
|
|
|
+ * </p>
|
|
|
+ * <p>
|
|
|
* Out of the box it provides 3 signer secret provider implementations:
|
|
|
* "string", "random", and "zookeeper"
|
|
|
- * <p/>
|
|
|
+ * </p>
|
|
|
* Additional signer secret providers are supported via the
|
|
|
* {@link SignerSecretProvider} class.
|
|
|
- * <p/>
|
|
|
+ * <p>
|
|
|
* For the HTTP cookies mentioned above, the SignerSecretProvider is used to
|
|
|
* determine the secret to use for signing the cookies. Different
|
|
|
* implementations can have different behaviors. The "string" implementation
|
|
@@ -92,7 +95,7 @@ import java.util.*;
|
|
|
* [#PREFIX#.]token.validity mentioned above. The "zookeeper" implementation
|
|
|
* is like the "random" one, except that it synchronizes the random secret
|
|
|
* and rollovers between multiple servers; it's meant for HA services.
|
|
|
- * <p/>
|
|
|
+ * </p>
|
|
|
* The relevant configuration properties are:
|
|
|
* <ul>
|
|
|
* <li>signer.secret.provider: indicates the name of the SignerSecretProvider
|
|
@@ -106,10 +109,10 @@ import java.util.*;
|
|
|
* implementations are specified, this value is used as the rollover
|
|
|
* interval.</li>
|
|
|
* </ul>
|
|
|
- * <p/>
|
|
|
+ * <p>
|
|
|
* The "zookeeper" implementation has additional configuration properties that
|
|
|
* must be specified; see {@link ZKSignerSecretProvider} for details.
|
|
|
- * <p/>
|
|
|
+ * </p>
|
|
|
* For subclasses of AuthenticationFilter that want additional control over the
|
|
|
* SignerSecretProvider, they can use the following attribute set in the
|
|
|
* ServletContext:
|
|
@@ -188,10 +191,9 @@ public class AuthenticationFilter implements Filter {
|
|
|
private String cookiePath;
|
|
|
|
|
|
/**
|
|
|
- * Initializes the authentication filter and signer secret provider.
|
|
|
- * <p/>
|
|
|
- * It instantiates and initializes the specified {@link AuthenticationHandler}.
|
|
|
- * <p/>
|
|
|
+ * <p>Initializes the authentication filter and signer secret provider.</p>
|
|
|
+ * It instantiates and initializes the specified {@link
|
|
|
+ * AuthenticationHandler}.
|
|
|
*
|
|
|
* @param filterConfig filter configuration.
|
|
|
*
|
|
@@ -362,7 +364,7 @@ public class AuthenticationFilter implements Filter {
|
|
|
|
|
|
/**
|
|
|
* Destroys the filter.
|
|
|
- * <p/>
|
|
|
+ * <p>
|
|
|
* It invokes the {@link AuthenticationHandler#destroy()} method to release any resources it may hold.
|
|
|
*/
|
|
|
@Override
|
|
@@ -380,7 +382,7 @@ public class AuthenticationFilter implements Filter {
|
|
|
* Returns the filtered configuration (only properties starting with the specified prefix). The property keys
|
|
|
* are also trimmed from the prefix. The returned {@link Properties} object is used to initialized the
|
|
|
* {@link AuthenticationHandler}.
|
|
|
- * <p/>
|
|
|
+ * <p>
|
|
|
* This method can be overriden by subclasses to obtain the configuration from other configuration source than
|
|
|
* the web.xml file.
|
|
|
*
|
|
@@ -406,7 +408,7 @@ public class AuthenticationFilter implements Filter {
|
|
|
|
|
|
/**
|
|
|
* Returns the full URL of the request including the query string.
|
|
|
- * <p/>
|
|
|
+ * <p>
|
|
|
* Used as a convenience method for logging purposes.
|
|
|
*
|
|
|
* @param request the request object.
|
|
@@ -423,11 +425,11 @@ public class AuthenticationFilter implements Filter {
|
|
|
|
|
|
/**
|
|
|
* Returns the {@link AuthenticationToken} for the request.
|
|
|
- * <p/>
|
|
|
+ * <p>
|
|
|
* It looks at the received HTTP cookies and extracts the value of the {@link AuthenticatedURL#AUTH_COOKIE}
|
|
|
* if present. It verifies the signature and if correct it creates the {@link AuthenticationToken} and returns
|
|
|
* it.
|
|
|
- * <p/>
|
|
|
+ * <p>
|
|
|
* If this method returns <code>null</code> the filter will invoke the configured {@link AuthenticationHandler}
|
|
|
* to perform user authentication.
|
|
|
*
|
|
@@ -577,7 +579,7 @@ public class AuthenticationFilter implements Filter {
|
|
|
*
|
|
|
* @param token authentication token for the cookie.
|
|
|
* @param expires UNIX timestamp that indicates the expire date of the
|
|
|
- * cookie. It has no effect if its value < 0.
|
|
|
+ * cookie. It has no effect if its value < 0.
|
|
|
*
|
|
|
* XXX the following code duplicate some logic in Jetty / Servlet API,
|
|
|
* because of the fact that Hadoop is stuck at servlet 2.5 and jetty 6
|