org.springframework.security.cas.web
Class CasAuthenticationFilter

java.lang.Object
  extended by org.springframework.web.filter.GenericFilterBean
      extended by org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter
          extended by org.springframework.security.cas.web.CasAuthenticationFilter
All Implemented Interfaces:
Filter, BeanNameAware, DisposableBean, InitializingBean, ApplicationEventPublisherAware, MessageSourceAware, ServletContextAware

public class CasAuthenticationFilter
extends AbstractAuthenticationProcessingFilter

Processes a CAS service ticket.

A service ticket consists of an opaque ticket string. It arrives at this filter by the user's browser successfully authenticating using CAS, and then receiving a HTTP redirect to a service. The opaque ticket string is presented in the ticket request parameter. This filter monitors the service URL so it can receive the service ticket and process it. The CAS server knows which service URL to use via the ServiceProperties.getService() method.

Processing the service ticket involves creating a UsernamePasswordAuthenticationToken which uses CAS_STATEFUL_IDENTIFIER for the principal and the opaque ticket string as the credentials.

The configured AuthenticationManager is expected to provide a provider that can recognise UsernamePasswordAuthenticationTokens containing this special principal name, and process them accordingly by validation with the CAS server.

By configuring a shared ProxyGrantingTicketStorage between the TicketValidator and the CasAuthenticationFilter one can have the CasAuthenticationFilter handle the proxying requirements for CAS. In addition, the URI endpoint for the proxying would also need to be configured (i.e. the part after protocol, hostname, and port).

By default this filter processes the URL /j_spring_cas_security_check.

Version:
$Id: CasAuthenticationFilter.java 3928 2009-10-07 14:43:55Z ltaylor $
Author:
Ben Alex

Field Summary
static String CAS_STATEFUL_IDENTIFIER
          Used to identify a CAS request for a stateful user agent, such as a web browser.
static String CAS_STATELESS_IDENTIFIER
          Used to identify a CAS request for a stateless user agent, such as a remoting protocol client (e.g.
 
Fields inherited from class org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter
authenticationDetailsSource, eventPublisher, messages, SPRING_SECURITY_LAST_EXCEPTION_KEY
 
Fields inherited from class org.springframework.web.filter.GenericFilterBean
logger
 
Constructor Summary
CasAuthenticationFilter()
           
 
Method Summary
 Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
          Performs actual authentication.
protected  boolean requiresAuthentication(HttpServletRequest request, HttpServletResponse response)
          Overridden to provide proxying capabilities.
 void setProxyGrantingTicketStorage(org.jasig.cas.client.proxy.ProxyGrantingTicketStorage proxyGrantingTicketStorage)
           
 void setProxyReceptorUrl(String proxyReceptorUrl)
           
 void setServiceProperties(ServiceProperties serviceProperties)
           
 
Methods inherited from class org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter
afterPropertiesSet, doFilter, getAllowSessionCreation, getAuthenticationDetailsSource, getAuthenticationManager, getFilterProcessesUrl, getRememberMeServices, setAllowSessionCreation, setApplicationEventPublisher, setAuthenticationDetailsSource, setAuthenticationFailureHandler, setAuthenticationManager, setAuthenticationSuccessHandler, setContinueChainBeforeSuccessfulAuthentication, setFilterProcessesUrl, setMessageSource, setRememberMeServices, setSessionAuthenticationStrategy, successfulAuthentication, unsuccessfulAuthentication
 
Methods inherited from class org.springframework.web.filter.GenericFilterBean
addRequiredProperty, destroy, getFilterConfig, getFilterName, getServletContext, init, initBeanWrapper, initFilterBean, setBeanName, setServletContext
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Field Detail

CAS_STATEFUL_IDENTIFIER

public static final String CAS_STATEFUL_IDENTIFIER
Used to identify a CAS request for a stateful user agent, such as a web browser.

See Also:
Constant Field Values

CAS_STATELESS_IDENTIFIER

public static final String CAS_STATELESS_IDENTIFIER
Used to identify a CAS request for a stateless user agent, such as a remoting protocol client (e.g. Hessian, Burlap, SOAP etc). Results in a more aggressive caching strategy being used, as the absence of a HttpSession will result in a new authentication attempt on every request.

See Also:
Constant Field Values
Constructor Detail

CasAuthenticationFilter

public CasAuthenticationFilter()
Method Detail

attemptAuthentication

public Authentication attemptAuthentication(HttpServletRequest request,
                                            HttpServletResponse response)
                                     throws AuthenticationException
Description copied from class: AbstractAuthenticationProcessingFilter
Performs actual authentication.

The implementation should do one of the following:

  1. Return a populated authentication token for the authenticated user, indicating successful authentication
  2. Return null, indicating that the authentication process is still in progress. Before returning, the implementation should perform any additional work required to complete the process.
  3. Throw an AuthenticationException if the authentication process fails

Specified by:
attemptAuthentication in class AbstractAuthenticationProcessingFilter
Parameters:
request - from which to extract parameters and perform the authentication
response - the response, which may be needed if the implementation has to do a redirect as part of a multi-stage authentication process (such as OpenID).
Returns:
the authenticated user token, or null if authentication is incomplete.
Throws:
AuthenticationException - if authentication fails.

requiresAuthentication

protected boolean requiresAuthentication(HttpServletRequest request,
                                         HttpServletResponse response)
Overridden to provide proxying capabilities.

Overrides:
requiresAuthentication in class AbstractAuthenticationProcessingFilter
Returns:
true if the filter should attempt authentication, false otherwise.

setProxyReceptorUrl

public final void setProxyReceptorUrl(String proxyReceptorUrl)

setProxyGrantingTicketStorage

public final void setProxyGrantingTicketStorage(org.jasig.cas.client.proxy.ProxyGrantingTicketStorage proxyGrantingTicketStorage)

setServiceProperties

public final void setServiceProperties(ServiceProperties serviceProperties)


Copyright © 2004-2009 SpringSource, Inc. All Rights Reserved.