org.springframework.security.web.authentication
Class AnonymousAuthenticationFilter

java.lang.Object
  org.springframework.web.filter.GenericFilterBean
      org.springframework.security.web.authentication.AnonymousAuthenticationFilter

All Implemented Interfaces:

javax.servlet.Filter, BeanNameAware, DisposableBean, InitializingBean, ServletContextAware

public class AnonymousAuthenticationFilter
extends GenericFilterBean
implements InitializingBean

Detects if there is no Authentication object in the SecurityContextHolder, and populates it with one if needed.

Field Summary

Fields inherited from class org.springframework.web.filter.GenericFilterBean

logger

Constructor Summary

AnonymousAuthenticationFilter()
Deprecated. Use constructor injection version

AnonymousAuthenticationFilter(String key)
Creates a filter with a principal named "anonymousUser" and the single authority "ROLE_ANONYMOUS".

AnonymousAuthenticationFilter(String key, Object principal, List<GrantedAuthority> authorities)

Method Summary

void	afterPropertiesSet()
protected boolean	applyAnonymousForThisRequest(javax.servlet.http.HttpServletRequest request) Deprecated. no obvious use case and can easily be achieved by other means
protected Authentication	createAuthentication(javax.servlet.http.HttpServletRequest request)
void	doFilter(javax.servlet.ServletRequest req, javax.servlet.ServletResponse res, javax.servlet.FilterChain chain)
List<GrantedAuthority>	getAuthorities()
Object	getPrincipal()
void	setAuthenticationDetailsSource(AuthenticationDetailsSource<javax.servlet.http.HttpServletRequest,?> authenticationDetailsSource)
void	setKey(String key) Deprecated. use constructor injection instead
void	setUserAttribute(UserAttribute userAttributeDefinition) Deprecated. use constructor injection instead

Methods inherited from class org.springframework.web.filter.GenericFilterBean

addRequiredProperty, destroy, getFilterConfig, getFilterName, getServletContext, init, initBeanWrapper, initFilterBean, setBeanName, setServletContext

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AnonymousAuthenticationFilter

@Deprecated
public AnonymousAuthenticationFilter()

Deprecated. Use constructor injection version

AnonymousAuthenticationFilter

public AnonymousAuthenticationFilter(String key)

Creates a filter with a principal named "anonymousUser" and the single authority "ROLE_ANONYMOUS".

Parameters:

key - the key to identify tokens created by this filter

AnonymousAuthenticationFilter

public AnonymousAuthenticationFilter(String key,
                                     Object principal,
                                     List<GrantedAuthority> authorities)

Parameters:

key - key the key to identify tokens created by this filter

principal - the principal which will be used to represent anonymous users

authorities - the authority list for anonymous users

Method Detail

afterPropertiesSet

public void afterPropertiesSet()

Specified by:

afterPropertiesSet in interface InitializingBean

Overrides:

afterPropertiesSet in class GenericFilterBean

doFilter

public void doFilter(javax.servlet.ServletRequest req,
                     javax.servlet.ServletResponse res,
                     javax.servlet.FilterChain chain)
              throws IOException,
                     javax.servlet.ServletException

Specified by:

doFilter in interface javax.servlet.Filter

Throws:

IOException

javax.servlet.ServletException

applyAnonymousForThisRequest

@Deprecated
protected boolean applyAnonymousForThisRequest(javax.servlet.http.HttpServletRequest request)

Deprecated. no obvious use case and can easily be achieved by other means

Enables subclasses to determine whether or not an anonymous authentication token should be setup for this request. This is useful if anonymous authentication should be allowed only for specific IP subnet ranges etc.

Parameters:

request - to assist the method determine request details

Returns:

true if the anonymous token should be setup for this request (provided that the request doesn't already have some other Authentication inside it), or false if no anonymous token should be setup for this request

createAuthentication

protected Authentication createAuthentication(javax.servlet.http.HttpServletRequest request)

setAuthenticationDetailsSource

public void setAuthenticationDetailsSource(AuthenticationDetailsSource<javax.servlet.http.HttpServletRequest,?> authenticationDetailsSource)

getPrincipal

public Object getPrincipal()

getAuthorities

public List<GrantedAuthority> getAuthorities()

setKey

@Deprecated
public void setKey(String key)

Deprecated. use constructor injection instead

setUserAttribute

@Deprecated
public void setUserAttribute(UserAttribute userAttributeDefinition)

Deprecated. use constructor injection instead