Class X509AuthenticationFilter
java.lang.Object
org.apache.shiro.web.servlet.ServletContextSupport
org.apache.shiro.web.servlet.AbstractFilter
org.apache.shiro.web.servlet.NameableFilter
org.apache.shiro.web.servlet.OncePerRequestFilter
org.apache.shiro.web.servlet.AdviceFilter
org.apache.shiro.web.filter.PathMatchingFilter
org.apache.shiro.web.filter.AccessControlFilter
org.apache.shiro.web.filter.authc.AuthenticationFilter
org.apache.shiro.web.filter.authc.AuthenticatingFilter
fr.gouv.vitam.common.auth.web.filter.X509AuthenticationFilter
- All Implemented Interfaces:
javax.servlet.Filter,org.apache.shiro.util.Nameable,org.apache.shiro.web.filter.PathConfigProcessor
public class X509AuthenticationFilter
extends org.apache.shiro.web.filter.authc.AuthenticatingFilter
Based on work: Copyright Paul Merlin 2011 (Apache Licence v2.0)
This implementation enable authentication by header if no certificate found in the request attribute
and the useHeader parameter is true
The checked header is "X-SSL-CLIENT-CERT" and the value must be a valid public certificate as pem formatted string
To enable this filter, replace in shiro.ini the key x509 to be equal to the current filter as follow.
x509 = fr.gouv.vitam.common.auth.web.filter.X509AuthenticationFilter
To enable use if header check in shiro.ini add the following
x509.useHeader = true
Be careful, passing a header certificate is not fully secure (Possible injection during the routing).
We recommend the use of request attribute instead of header.
-
Field Summary
Fields inherited from class org.apache.shiro.web.filter.authc.AuthenticatingFilter
PERMISSIVEFields inherited from class org.apache.shiro.web.filter.authc.AuthenticationFilter
DEFAULT_SUCCESS_URLFields inherited from class org.apache.shiro.web.filter.AccessControlFilter
DEFAULT_LOGIN_URL, GET_METHOD, POST_METHODFields inherited from class org.apache.shiro.web.filter.PathMatchingFilter
appliedPaths, pathMatcherFields inherited from class org.apache.shiro.web.servlet.OncePerRequestFilter
ALREADY_FILTERED_SUFFIXFields inherited from class org.apache.shiro.web.servlet.AbstractFilter
filterConfig -
Constructor Summary
Constructors -
Method Summary
Modifier and TypeMethodDescriptionprotected org.apache.shiro.authc.AuthenticationTokencreateToken(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response) protected booleanonAccessDenied(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response) protected booleanonLoginSuccess(org.apache.shiro.authc.AuthenticationToken token, org.apache.shiro.subject.Subject subject, javax.servlet.ServletRequest request, javax.servlet.ServletResponse response) voidsetUseHeader(boolean useHeader) Methods inherited from class org.apache.shiro.web.filter.authc.AuthenticatingFilter
cleanup, createToken, createToken, executeLogin, getHost, isAccessAllowed, isPermissive, isRememberMe, onLoginFailureMethods inherited from class org.apache.shiro.web.filter.authc.AuthenticationFilter
getSuccessUrl, issueSuccessRedirect, setSuccessUrlMethods inherited from class org.apache.shiro.web.filter.AccessControlFilter
getLoginUrl, getSubject, isLoginRequest, onAccessDenied, onPreHandle, redirectToLogin, saveRequest, saveRequestAndRedirectToLogin, setLoginUrlMethods inherited from class org.apache.shiro.web.filter.PathMatchingFilter
getPathWithinApplication, isEnabled, pathsMatch, pathsMatch, preHandle, processPathConfigMethods inherited from class org.apache.shiro.web.servlet.AdviceFilter
afterCompletion, doFilterInternal, executeChain, postHandleMethods inherited from class org.apache.shiro.web.servlet.OncePerRequestFilter
doFilter, getAlreadyFilteredAttributeName, isEnabled, isEnabled, isFilterOncePerRequest, setEnabled, setFilterOncePerRequest, shouldNotFilterMethods inherited from class org.apache.shiro.web.servlet.NameableFilter
getName, setName, toStringBuilderMethods inherited from class org.apache.shiro.web.servlet.AbstractFilter
destroy, getFilterConfig, getInitParam, init, onFilterConfigSet, setFilterConfigMethods inherited from class org.apache.shiro.web.servlet.ServletContextSupport
getContextAttribute, getContextInitParam, getServletContext, removeContextAttribute, setContextAttribute, setServletContext, toString
-
Constructor Details
-
X509AuthenticationFilter
public X509AuthenticationFilter()
-
-
Method Details
-
setUseHeader
public void setUseHeader(boolean useHeader) -
onAccessDenied
protected boolean onAccessDenied(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response) throws Exception - Specified by:
onAccessDeniedin classorg.apache.shiro.web.filter.AccessControlFilter- Throws:
Exception
-
onLoginSuccess
protected boolean onLoginSuccess(org.apache.shiro.authc.AuthenticationToken token, org.apache.shiro.subject.Subject subject, javax.servlet.ServletRequest request, javax.servlet.ServletResponse response) throws Exception - Overrides:
onLoginSuccessin classorg.apache.shiro.web.filter.authc.AuthenticatingFilter- Throws:
Exception
-
createToken
protected org.apache.shiro.authc.AuthenticationToken createToken(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response) - Specified by:
createTokenin classorg.apache.shiro.web.filter.authc.AuthenticatingFilter
-