org.springframework.security.web.servletapi

Class SecurityContextHolderAwareRequestWrapper

java.lang.Object

HttpServletRequestWrapper

org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestWrapper

public class SecurityContextHolderAwareRequestWrapper
extends HttpServletRequestWrapper

A Spring Security-aware HttpServletRequestWrapper, which uses the SecurityContext-defined Authentication object to implement the servlet API security methods:

• getUserPrincipal()
• isUserInRole(String)
• HttpServletRequestWrapper#getRemoteUser().

See Also:

SecurityContextHolderAwareRequestFilter

Constructor Summary

Constructors

Constructor and Description
SecurityContextHolderAwareRequestWrapper(HttpServletRequest request, AuthenticationTrustResolver trustResolver, java.lang.String rolePrefix) Creates a new instance
SecurityContextHolderAwareRequestWrapper(HttpServletRequest request, java.lang.String rolePrefix) Creates a new instance with AuthenticationTrustResolverImpl.

Method Summary

Modifier and Type	Method and Description
java.lang.String	getRemoteUser() Returns the principal's name, as obtained from the SecurityContextHolder.
java.security.Principal	getUserPrincipal() Returns the Authentication (which is a subclass of Principal), or null if unavailable.
boolean	isUserInRole(java.lang.String role) Simple searches for an exactly matching GrantedAuthority.getAuthority().
java.lang.String	toString()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

SecurityContextHolderAwareRequestWrapper

public SecurityContextHolderAwareRequestWrapper(HttpServletRequest request,
                                                java.lang.String rolePrefix)

Creates a new instance with AuthenticationTrustResolverImpl.

Parameters:

request -

rolePrefix -

SecurityContextHolderAwareRequestWrapper

public SecurityContextHolderAwareRequestWrapper(HttpServletRequest request,
                                                AuthenticationTrustResolver trustResolver,
                                                java.lang.String rolePrefix)

Creates a new instance

Parameters:

request - the original HttpServletRequest

trustResolver - the AuthenticationTrustResolver to use. Cannot be null.

rolePrefix - The prefix to be added to isUserInRole(String) or null if no prefix.

Method Detail

getRemoteUser

public java.lang.String getRemoteUser()

Returns the principal's name, as obtained from the SecurityContextHolder. Properly handles both String-based and UserDetails-based principals.

Returns:

the username or null if unavailable

getUserPrincipal

public java.security.Principal getUserPrincipal()

Returns the Authentication (which is a subclass of Principal), or null if unavailable.

Returns:

the Authentication, or null

isUserInRole

public boolean isUserInRole(java.lang.String role)

Simple searches for an exactly matching GrantedAuthority.getAuthority().

Will always return false if the SecurityContextHolder contains an Authentication with null principal and/or GrantedAuthority[] objects.

Parameters:

role - the GrantedAuthorityString representation to check for

Returns:

true if an exact (case sensitive) matching granted authority is located, false otherwise

toString

public java.lang.String toString()