org.fcrepo.auth.common

Class ServletContainerAuthenticationProvider

java.lang.Object

org.fcrepo.auth.common.ServletContainerAuthenticationProvider

All Implemented Interfaces:

org.modeshape.jcr.security.AuthenticationProvider

public class ServletContainerAuthenticationProvider
extends Object
implements org.modeshape.jcr.security.AuthenticationProvider

Authenticates ModeShape logins where JAX-RS credentials are supplied. Capable of authenticating whether or not container has performed user authentication. This is a singleton with an injected policy enforcement point. The singleton pattern allows ModeShape to obtain this instance via classname configuration.

Author:

Gregory Jansen

Field Summary

Fields

Modifier and Type	Field and Description
static Principal	EVERYONE The security principal for every request.
static String	EVERYONE_NAME
static String	FEDORA_ADMIN_ROLE User role for Fedora's admin users
static String	FEDORA_USER_ROLE User role for Fedora's ordinary users

Method Summary

Methods

Modifier and Type	Method and Description
org.modeshape.jcr.ExecutionContext	authenticate(javax.jcr.Credentials credentials, String repositoryName, String workspaceName, org.modeshape.jcr.ExecutionContext repositoryContext, Map<String,Object> sessionAttributes) Authenticate the user that is using the supplied credentials.
FedoraAuthorizationDelegate	getFad()
static org.modeshape.jcr.security.AuthenticationProvider	getInstance() Provides the singleton bean to ModeShape via reflection based on class name.
Set<PrincipalProvider>	getPrincipalProviders()
void	setFad(FedoraAuthorizationDelegate fad)
void	setPrincipalProviders(Set<PrincipalProvider> principalProviders)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

EVERYONE_NAME

public static final String EVERYONE_NAME

See Also:

Constant Field Values

EVERYONE

public static final Principal EVERYONE

The security principal for every request.

FEDORA_ADMIN_ROLE

public static final String FEDORA_ADMIN_ROLE

User role for Fedora's admin users

See Also:

Constant Field Values

FEDORA_USER_ROLE

public static final String FEDORA_USER_ROLE

User role for Fedora's ordinary users

See Also:

Constant Field Values

Method Detail

getInstance

public static org.modeshape.jcr.security.AuthenticationProvider getInstance()

Provides the singleton bean to ModeShape via reflection based on class name.

Returns:

a AuthenticationProvider

getPrincipalProviders

public Set<PrincipalProvider> getPrincipalProviders()

Returns:

the principalProviders

setPrincipalProviders

public void setPrincipalProviders(Set<PrincipalProvider> principalProviders)

Parameters:

principalProviders - the principalProviders to set

authenticate

public org.modeshape.jcr.ExecutionContext authenticate(javax.jcr.Credentials credentials,
                                              String repositoryName,
                                              String workspaceName,
                                              org.modeshape.jcr.ExecutionContext repositoryContext,
                                              Map<String,Object> sessionAttributes)

Authenticate the user that is using the supplied credentials.

If the credentials given establish that the authenticated user has the fedoraAdmin role, construct an ExecutionContext with FedoraAdminSecurityContext as the SecurityContext. Otherwise, construct an ExecutionContext with FedoraUserSecurityContext as the SecurityContext.

If the authenticated user does not have the fedoraAdmin role, session attributes will be assigned in the sessionAttributes map:

• FEDORA_SERVLET_REQUEST will be assigned the ServletRequest instance associated with credentials if the authenticated user has the fedoraUser role.
• FEDORA_USER_PRINCIPAL will be assigned the authenticated user's principal if the authenticated user has the fedoraUser role, and the EVERYONE principal otherwise.
• FEDORA_ALL_PRINCIPALS will be assigned the union of all principals obtained from configured PrincipalProvider instances plus the authenticated user's principal if the authenticated user has the fedoraUser role; FEDORA_ALL_PRINCIPALS will be assigned the singleton set containing the EVERYONE principal otherwise.

Specified by:

authenticate in interface org.modeshape.jcr.security.AuthenticationProvider

getFad

public FedoraAuthorizationDelegate getFad()

Returns:

the authorization delegate

setFad

public void setFad(FedoraAuthorizationDelegate fad)

Parameters:

fad - the authorization delegate to set