jodd.joy.auth

Class AuthorizationInterceptor

java.lang.Object

jodd.joy.auth.AuthorizationInterceptor

All Implemented Interfaces:

jodd.madvoc.ActionWrapper, jodd.madvoc.interceptor.ActionInterceptor

public abstract class AuthorizationInterceptor
extends java.lang.Object
implements jodd.madvoc.interceptor.ActionInterceptor

Authorization checking interceptor. Usually invoked after AuthenticationInterceptor.

Authorization pertains to the question "What may you do?". In JEE applications, this is achieved by making secured resources accessible ("requestable" in web applications) to particular "roles". Principals (i.e. users) who are associated with one or more of these roles will have access to those resources.

Constructor Summary

Constructors

Constructor and Description
AuthorizationInterceptor()

Method Summary

Modifier and Type	Method and Description
protected abstract boolean	authorize(jodd.madvoc.ActionRequest request, java.lang.Object userSession) Performs authorization of a request.
java.lang.Object	intercept(jodd.madvoc.ActionRequest actionRequest)
protected java.lang.Object	resultAccessDenied() Prepares result for access denied page.
protected java.lang.Object	resultLogin(java.lang.String targetUrl) Prepares result for login page, when access to target URL is forbidden.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface jodd.madvoc.interceptor.ActionInterceptor

apply

Methods inherited from interface jodd.madvoc.ActionWrapper

init

Constructor Detail

AuthorizationInterceptor

public AuthorizationInterceptor()

Method Detail

intercept

public java.lang.Object intercept(jodd.madvoc.ActionRequest actionRequest)
                           throws java.lang.Exception

Specified by:

intercept in interface jodd.madvoc.interceptor.ActionInterceptor

Throws:

java.lang.Exception

resultAccessDenied

protected java.lang.Object resultAccessDenied()

Prepares result for access denied page.

resultLogin

protected java.lang.Object resultLogin(java.lang.String targetUrl)

Prepares result for login page, when access to target URL is forbidden. To prevent using request parameter, consider CHAIN result type. Target URL may be null.

authorize

protected abstract boolean authorize(jodd.madvoc.ActionRequest request,
                                     java.lang.Object userSession)

Performs authorization of a request. User may or may not be authenticated.

For user that is not authenticated, userSession is null. Authenticated users will have their user session set.