public class FormAuthenticationFilter extends AuthenticatingFilter
loginUrl you configure.
This filter constructs a UsernamePasswordToken with the values found in
username, password,
and rememberMe request parameters. It then calls
Subject.login(usernamePasswordToken),
effectively automatically performing a login attempt. Note that the login attempt will only occur when the
isLoginSubmission(request,response)
is true, which by default occurs when the request is for the loginUrl and
is a POST request.
If the login attempt fails, the resulting AuthenticationException fully qualified class name will
be set as a request attribute under the failureKeyAttribute key. This
FQCN can be used as an i18n key or lookup mechanism to explain to the user why their login attempt failed
(e.g. no account, incorrect password, etc).
If you would prefer to handle the authentication validation and login in your own code, consider using the
PassThruAuthenticationFilter instead, which allows requests to the
AccessControlFilter.loginUrl to pass through to your application's code directly.
PassThruAuthenticationFilter| Modifier and Type | Field and Description |
|---|---|
static String |
DEFAULT_ERROR_KEY_ATTRIBUTE_NAME |
static String |
DEFAULT_PASSWORD_PARAM |
static String |
DEFAULT_REMEMBER_ME_PARAM |
static String |
DEFAULT_USERNAME_PARAM |
GET_METHOD, LOGIN_URL, pathMatcher, POST_METHOD, REDIRECT_TO_SAVED_URL, SUCCESS_URL, TAPESTRY_VERSION, UNAUTHORIZED_URL| Constructor and Description |
|---|
FormAuthenticationFilter(LoginContextService loginContextService) |
| Modifier and Type | Method and Description |
|---|---|
protected org.apache.shiro.authc.AuthenticationToken |
createToken(javax.servlet.ServletRequest request,
javax.servlet.ServletResponse response) |
String |
getFailureKeyAttribute() |
protected String |
getPassword(javax.servlet.ServletRequest request) |
String |
getPasswordParam() |
String |
getRememberMeParam() |
protected String |
getUsername(javax.servlet.ServletRequest request) |
String |
getUsernameParam() |
protected boolean |
isLoginSubmission(javax.servlet.ServletRequest request,
javax.servlet.ServletResponse response)
This default implementation merely returns
true if the request is an HTTP POST,
false otherwise. |
protected boolean |
isRememberMe(javax.servlet.ServletRequest request)
Returns
true if "rememberMe" should be enabled for the login attempt associated with the
current request, false otherwise. |
protected boolean |
onAccessDenied(javax.servlet.ServletRequest request,
javax.servlet.ServletResponse response)
Processes requests where the subject was denied access as determined by the
isAccessAllowed
method. |
protected boolean |
onLoginFailure(org.apache.shiro.authc.AuthenticationToken token,
org.apache.shiro.authc.AuthenticationException e,
javax.servlet.ServletRequest request,
javax.servlet.ServletResponse response) |
protected boolean |
onLoginSuccess(org.apache.shiro.authc.AuthenticationToken token,
org.apache.shiro.subject.Subject subject,
javax.servlet.ServletRequest request,
javax.servlet.ServletResponse response) |
protected void |
setFailureAttribute(javax.servlet.ServletRequest request,
org.apache.shiro.authc.AuthenticationException ae) |
void |
setFailureKeyAttribute(String failureKeyAttribute) |
void |
setLoginUrl(String loginUrl)
Sets the login URL used to authenticate a user.
|
void |
setPasswordParam(String passwordParam)
Sets the request parameter name to look for when acquiring the password.
|
void |
setRememberMeParam(String rememberMeParam)
Sets the request parameter name to look for when acquiring the rememberMe boolean value.
|
void |
setUsernameParam(String usernameParam)
Sets the request parameter name to look for when acquiring the username.
|
createToken, createToken, executeLogin, getHostisAccessAllowed, issueSuccessRedirectaddConfig, getLoginContextService, getLoginUrl, getSubject, getSuccessUrl, getUnauthorizedUrl, isLoginRequest, isRedirectToSavedUrl, onAccessDenied, onPreHandle, preHandle, redirectToLogin, saveRequest, saveRequestAndRedirectToLogin, setConfig, setRedirectToSavedUrl, setSuccessUrl, setUnauthorizedUrlafterCompletion, cleanup, doFilterInternal, executeChain, postHandledoFilter, getAlreadyFilteredAttributeName, isEnabled, isEnabled, setEnabled, shouldNotFiltergetName, setName, toStringBuilderdestroy, getFilterConfig, getInitParam, init, onFilterConfigSet, setFilterConfigpublic static final String DEFAULT_ERROR_KEY_ATTRIBUTE_NAME
public static final String DEFAULT_USERNAME_PARAM
public static final String DEFAULT_PASSWORD_PARAM
public static final String DEFAULT_REMEMBER_ME_PARAM
public FormAuthenticationFilter(LoginContextService loginContextService)
public void setLoginUrl(String loginUrl)
AccessControlFilterDEFAULT_LOGIN_URL is assumed.setLoginUrl in class AccessControlFilterloginUrl - the login URL used to authenticate a user, used when redirecting users if authentication is required.public String getUsernameParam()
public void setUsernameParam(String usernameParam)
username.usernameParam - the name of the request param to check for acquiring the username.public String getPasswordParam()
public void setPasswordParam(String passwordParam)
password.passwordParam - the name of the request param to check for acquiring the password.public String getRememberMeParam()
public void setRememberMeParam(String rememberMeParam)
rememberMe.
RememberMe will be true if the parameter value equals any of those supported by
WebUtils.isTrue(request,value), false
otherwise.rememberMeParam - the name of the request param to check for acquiring the rememberMe boolean value.public String getFailureKeyAttribute()
public void setFailureKeyAttribute(String failureKeyAttribute)
protected boolean onAccessDenied(javax.servlet.ServletRequest request,
javax.servlet.ServletResponse response)
throws Exception
AccessControlFilterisAccessAllowed
method.onAccessDenied in class AccessControlFilterrequest - the incoming ServletRequestresponse - the outgoing ServletResponsetrue if the request should continue to be processed; false if the subclass will
handle/render the response directly.Exception - if there is an error processing the request.protected boolean isLoginSubmission(javax.servlet.ServletRequest request,
javax.servlet.ServletResponse response)
true if the request is an HTTP POST,
false otherwise. Can be overridden by subclasses for custom login submission detection behavior.request - the incoming ServletRequestresponse - the outgoing ServletResponse.true if the request is an HTTP POST, false otherwise.protected org.apache.shiro.authc.AuthenticationToken createToken(javax.servlet.ServletRequest request,
javax.servlet.ServletResponse response)
createToken in class AuthenticatingFilterprotected boolean isRememberMe(javax.servlet.ServletRequest request)
AuthenticatingFiltertrue if "rememberMe" should be enabled for the login attempt associated with the
current request, false otherwise.
This implementation always returns false and is provided as a template hook to subclasses that
support rememberMe logins and wish to determine rememberMe in a custom mannner
based on the current request.isRememberMe in class AuthenticatingFilterrequest - the incoming ServletRequesttrue if "rememberMe" should be enabled for the login attempt associated with the
current request, false otherwise.protected boolean onLoginSuccess(org.apache.shiro.authc.AuthenticationToken token,
org.apache.shiro.subject.Subject subject,
javax.servlet.ServletRequest request,
javax.servlet.ServletResponse response)
throws Exception
onLoginSuccess in class AuthenticatingFilterExceptionprotected boolean onLoginFailure(org.apache.shiro.authc.AuthenticationToken token,
org.apache.shiro.authc.AuthenticationException e,
javax.servlet.ServletRequest request,
javax.servlet.ServletResponse response)
onLoginFailure in class AuthenticatingFilterprotected void setFailureAttribute(javax.servlet.ServletRequest request,
org.apache.shiro.authc.AuthenticationException ae)
protected String getUsername(javax.servlet.ServletRequest request)
protected String getPassword(javax.servlet.ServletRequest request)
Copyright © 2004–2018. All rights reserved.