Package cloud.piranha.webapp.api

Interface SecurityManager

All Known Implementing Classes:

DefaultSecurityManager, JakartaSecurityManager

public interface SecurityManager

The SecurityManager API.

Author:

Manfred Riem ([email protected]), Arjan Tijms

Nested Class Summary

Nested Classes

Modifier and Type	Interface	Description
static class	SecurityManager.AuthenticateSource
static interface	SecurityManager.UsernamePasswordLoginHandler	Method that bypasses the authentication mechanism installed by the authentication manager and directly invokes an identity store.

Method Summary

Modifier and Type	Method	Description
boolean	authenticate(HttpServletRequest request, HttpServletResponse response)	Authenticate the request.
default boolean	authenticate(HttpServletRequest request, HttpServletResponse response, SecurityManager.AuthenticateSource source)	Authenticate the request.
void	declareRoles(String[] roles)	Declare roles.
default HttpServletRequest	getAuthenticatedRequest(HttpServletRequest request, HttpServletResponse response)	Gets the request object the security system wants to put in place.
default HttpServletResponse	getAuthenticatedResponse(HttpServletRequest request, HttpServletResponse response)	Gets the response object the security system wants to put in place.
boolean	getDenyUncoveredHttpMethods()	Get if we are denying uncovered HTTP methods.
WebApplication	getWebApplication()	Get the web application.
default boolean	isCallerAuthorizedForResource(HttpServletRequest request)	Check if the current caller (which can be the anonymous caller) is authorized to access the requested resource.
default boolean	isRequestedResourcePublic(HttpServletRequest request)	Check if the requested resource, represented by the request, is public or not.
default boolean	isRequestSecurityAsRequired(HttpServletRequest request, HttpServletResponse response)	Check if the current request adheres to the user data constraint, if any.
boolean	isUserInRole(HttpServletRequest request, String role)	Is the user in the specific role.
void	login(HttpServletRequest request, String username, String password)	Login.
void	logout(HttpServletRequest request, HttpServletResponse response)	Logout.
default void	postRequestProcess(HttpServletRequest request, HttpServletResponse response)	Gives the security system the opportunity to process the response after the request (after the target resource has been invoked).
void	setDenyUncoveredHttpMethods(boolean denyUncoveredHttpMethods)	Set if we are denying uncovered HTTP methods.
default void	setUsernamePasswordLoginHandler(SecurityManager.UsernamePasswordLoginHandler usernamePasswordLoginHandler)	Set the handler that may be used by the login method to contact an identity store.
void	setWebApplication(WebApplication webApplication)	Set the web application.

Method Detail

getDenyUncoveredHttpMethods

boolean getDenyUncoveredHttpMethods()

Get if we are denying uncovered HTTP methods.

Returns:

true if we are, false otherwise.

isRequestSecurityAsRequired

default boolean isRequestSecurityAsRequired(HttpServletRequest request,
                                            HttpServletResponse response)
                                     throws IOException,
                                            ServletException

Check if the current request adheres to the user data constraint, if any.

In practice this means checking if HTTPS is used when so required by the application.

Parameters:

request - the request.

response - the response.

Returns:

true if request adheres to constraints, false otherwise

Throws:

IOException - when an I/O error occurs.

ServletException - when a servlet error occurs.

isRequestedResourcePublic

default boolean isRequestedResourcePublic(HttpServletRequest request)

Check if the requested resource, represented by the request, is public or not.

Parameters:

request - the request.

Returns:

true if the requested resource can be accessed by public (unauthenticated) callers, otherwise false

isCallerAuthorizedForResource

default boolean isCallerAuthorizedForResource(HttpServletRequest request)

Check if the current caller (which can be the anonymous caller) is authorized to access the requested resource.

If the unauthenticated caller is authorized, then this means the resource is public (aka unconstrained, aka unchecked), and the outcome of this method MUST be consistent with isRequestedResourcePublic(HttpServletRequest).

Parameters:

request - the request.

Returns:

true if the current caller is allowed to access the requested resource, false otherwise

authenticate

boolean authenticate(HttpServletRequest request,
                     HttpServletResponse response)
              throws IOException,
                     ServletException

Authenticate the request.

Parameters:

request - the request.

response - the response.

Returns:

true if authenticated.

Throws:

IOException - when an I/O error occurs.

ServletException - when a servlet error occurs.

getAuthenticatedRequest

default HttpServletRequest getAuthenticatedRequest(HttpServletRequest request,
                                                   HttpServletResponse response)

Gets the request object the security system wants to put in place.

This method allows the security system (or authentication module being delegated to) a custom or, more likely, wrapped request.

Parameters:

request - the request.

response - the response.

Returns:

a request object that the runtime should put into service

getAuthenticatedResponse

default HttpServletResponse getAuthenticatedResponse(HttpServletRequest request,
                                                     HttpServletResponse response)

Gets the response object the security system wants to put in place.

This method allows the security system (or authentication module being delegated to) a custom or, more likely, wrapped response.

Parameters:

request - the request.

response - the response.

Returns:

a response object that the runtime should put into service

authenticate

default boolean authenticate(HttpServletRequest request,
                             HttpServletResponse response,
                             SecurityManager.AuthenticateSource source)
                      throws IOException,
                             ServletException

Authenticate the request.

Parameters:

request - the request.

response - the response.

source - the source or moment from where this authenticate method is called

Returns:

true if authenticated.

Throws:

IOException - when an I/O error occurs.

ServletException - when a servlet error occurs.

postRequestProcess

default void postRequestProcess(HttpServletRequest request,
                                HttpServletResponse response)
                         throws IOException,
                                ServletException

Gives the security system the opportunity to process the response after the request (after the target resource has been invoked).

Although this may be rare to used in practice, it allows for encryption of the response, inserting security tokens, signing the response, etc.

Parameters:

request - the request.

response - the response.

Throws:

IOException - when an I/O error occurs.

ServletException - when a servlet error occurs.

declareRoles

void declareRoles(String[] roles)

Declare roles.

Parameters:

roles - the roles.

getWebApplication

WebApplication getWebApplication()

Get the web application.

Returns:

the web application.

isUserInRole

boolean isUserInRole(HttpServletRequest request,
                     String role)

Is the user in the specific role.

Parameters:

request - the request.

role - the role.

Returns:

true if in the role, false otherwise.

login

void login(HttpServletRequest request,
           String username,
           String password)
    throws ServletException

Login.

Parameters:

request - the request.

username - the username.

password - the password.

Throws:

ServletException - when unable to login.

logout

void logout(HttpServletRequest request,
            HttpServletResponse response)
     throws ServletException

Logout.

Parameters:

request - the request.

response - the response.

Throws:

ServletException - when a servlet error occurs.

setDenyUncoveredHttpMethods

void setDenyUncoveredHttpMethods(boolean denyUncoveredHttpMethods)

Set if we are denying uncovered HTTP methods.

Parameters:

denyUncoveredHttpMethods - the boolean value.

setWebApplication

void setWebApplication(WebApplication webApplication)

Set the web application.

Parameters:

webApplication - the web application.

setUsernamePasswordLoginHandler

default void setUsernamePasswordLoginHandler(SecurityManager.UsernamePasswordLoginHandler usernamePasswordLoginHandler)

Set the handler that may be used by the login method to contact an identity store.

Parameters:

usernamePasswordLoginHandler - the handler