org.figure8.join.control
Class AccessControlFilter

java.lang.Object
  org.figure8.join.control.AccessControlFilter

All Implemented Interfaces:

javax.servlet.Filter

public class AccessControlFilter
extends java.lang.Object
implements javax.servlet.Filter

Servlet filter that checks is user associated with request we are processing is allowed to call the specified action or business operation with the action.

Version:

$Revision: 1.2 $

Author:

Laurent Broudoux

Constructor Summary

AccessControlFilter()
Creates a new AccessControlFilter instance.

Method Summary

void	destroy() Called by the container to indicate to a filter that is being taken out of service.
void	doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain) Apply the Access Control filter to rh request we are processing.
protected java.lang.String	extractPath(javax.servlet.http.HttpServletRequest request) Identify and return the path component (from the request URI) that we will use to select an ActionConstraintConfig.
protected java.util.Collection	getRequiredRoles(javax.servlet.http.HttpServletRequest request, ActionConstraintConfig constraint) Extract a collection of required roles from the ActionContraintConfig.
void	init(javax.servlet.FilterConfig filterConfig) Called by the web container to indicate to a filter that is being placed into service.
protected org.apache.commons.digester.Digester	initDigester() Create and return a new Digester instance that has been initialized to process Join security control configuration files and configure a corresponding AccessControlConfig object (which must be pushed on to the evaluation stack before parsing begins).

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AccessControlFilter

public AccessControlFilter()

Creates a new AccessControlFilter instance.

Method Detail

init

public void init(javax.servlet.FilterConfig filterConfig)
          throws javax.servlet.ServletException

Called by the web container to indicate to a filter that is being placed into service. This method stores filterConfig into inner attribute and creates an AccessControlConfig object by "digestering" the join-access-control.xml configuration file.

Specified by:

init in interface javax.servlet.Filter

Parameters:

filterConfig - The configuration of this filter

Throws:

javax.servlet.ServletException - if app servlet context is not correctly initialized

doFilter

public void doFilter(javax.servlet.ServletRequest request,
                     javax.servlet.ServletResponse response,
                     javax.servlet.FilterChain chain)
              throws java.io.IOException,
                     javax.servlet.ServletException

Apply the Access Control filter to rh request we are processing. This involves using the AccessControlConfig object created during initilization to check if there's constraints on the current requested action and business operation.
If user is allowed to call action or business operation, chain.doFilter() is called. Else, user response is redierect to the page stored under "authorization.fails.url" servlet context attribute.

Specified by:

doFilter in interface javax.servlet.Filter

Parameters:

request - The servlet request we are processing

response - The servlet response we are creating

chain - The filter chain we are processing

Throws:

java.io.IOException - if an input/output error occurs

javax.servlet.ServletException - if a servlet error occurs

destroy

public void destroy()

Called by the container to indicate to a filter that is being taken out of service. Just release handles on filterConfig and accessConfig.

Specified by:

destroy in interface javax.servlet.Filter

initDigester

protected org.apache.commons.digester.Digester initDigester()

Create and return a new Digester instance that has been initialized to process Join security control configuration files and configure a corresponding AccessControlConfig object (which must be pushed on to the evaluation stack before parsing begins).

extractPath

protected java.lang.String extractPath(javax.servlet.http.HttpServletRequest request)

Identify and return the path component (from the request URI) that we will use to select an ActionConstraintConfig. If no such path can be identified, create an error response and return null.

Parameters:

request - The servlet request we are processing

getRequiredRoles

protected java.util.Collection getRequiredRoles(javax.servlet.http.HttpServletRequest request,
                                                ActionConstraintConfig constraint)

Extract a collection of required roles from the ActionContraintConfig. Check if action constraint specifies constraints for the business operation requested.

Parameters:

request - The servlet request we are processing.

constraint - The security control constraints related to requested action.

Returns:

Collection of org.figure8.join.security.RoleConfig