- * Populates the SecurityContext with information obtained from
- * the HttpSession.
+ * Populates the SecurityContextHolder with information obtained
+ * from the HttpSession.
*
* The HttpSession will be queried to retrieve the
- * Authentication that should be stored against the
- * SecurityContext for the duration of the web request. At the
- * end of the web request, any updates made to the
- * SecurityContext will be persisted back to the
+ * SecurityContext that should be stored against the
+ * SecurityContextHolder for the duration of the web request. At
+ * the end of the web request, any updates made to the
+ * SecurityContextHolder will be persisted back to the
* HttpSession by this filter.
*
+ * If a valid SecurityContext cannot be obtained from the
+ * HttpSession for whatever reason, a fresh
+ * SecurityContext will be created and used instead. The created
+ * object will be of the instance defined by the {@link #setContext(Class)}
+ * method (which defaults to {@link
+ * net.sf.acegisecurity.context.SecurityContextImpl}.
+ *
* No HttpSession will be created by this filter if one does not
* already exist. If at the end of the web request the
* HttpSession does not exist, a HttpSession will
* only be created if the current contents of
- * SecurityContext are not null. This avoids
- * needless HttpSession creation, but automates the storage of
- * changes made to the SecurityContext.
+ * ContextHolder are not {@link
+ * java.lang.Object#equals(java.lang.Object)} to a new instance
+ * of {@link #setContext(Class)}. This avoids needless
+ * HttpSession creation, but automates the storage of changes
+ * made to the ContextHolder.
*
@@ -68,30 +79,35 @@ import javax.servlet.http.HttpSession;
* similar clients that will never present the same jsessionid
* etc), the {@link #setAllowSessionCreation(boolean)} should be set to
* false. Only do this if you really need to conserve server
- * memory and ensure all classes using the SecurityContext are
- * designed to have no persistence of the Authentication between
- * web requests.
+ * memory and ensure all classes using the ContextHolder are
+ * designed to have no persistence of the Context between web
+ * requests.
*
- * This filter MUST appear BEFORE any other Acegi Security related filters,
- * because this filter WILL REMOVE any Authentication it finds in
- * the SecurityContext.
+ * This filter MUST be executed BEFORE any authentication procesing mechanisms.
+ * Authentication processing mechanisms (eg BASIC, CAS processing filters etc)
+ * expect the ContextHolder to contain a valid
+ * SecureContext by the time they execute.
*
HttpSession if needed
* (sessions are always created sparingly, but setting this value to false
@@ -109,6 +125,24 @@ public class HttpSessionContextIntegrationFilter implements Filter {
return allowSessionCreation;
}
+ public void setContext(Class secureContext) {
+ this.context = secureContext;
+ }
+
+ public Class getContext() {
+ return context;
+ }
+
+ public void afterPropertiesSet() throws Exception {
+ if ((this.context == null)
+ || (!SecurityContext.class.isAssignableFrom(this.context))) {
+ throw new IllegalArgumentException(
+ "context must be defined and implement SecurityContext (typically use net.sf.acegisecurity.context.SecurityContextImpl)");
+ }
+
+ this.contextObject = generateNewContext();
+ }
+
/**
* Does nothing. We use IoC container lifecycle services instead.
*/
@@ -124,18 +158,6 @@ public class HttpSessionContextIntegrationFilter implements Filter {
request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
}
- // Nullify the ThreadLocal if it currently contains data (it shouldn't)
- if (SecurityContext.getAuthentication() != null) {
- if (logger.isWarnEnabled()) {
- logger.warn(
- "SecurityContext should have been null but contained: '"
- + SecurityContext.getAuthentication()
- + "'; setting to null now");
- }
-
- SecurityContext.setAuthentication(null);
- }
-
HttpSession httpSession = null;
boolean httpSessionExistedAtStartOfRequest = false;
@@ -146,47 +168,53 @@ public class HttpSessionContextIntegrationFilter implements Filter {
if (httpSession != null) {
httpSessionExistedAtStartOfRequest = true;
- Object authenticationObject = httpSession.getAttribute(ACEGI_SECURITY_AUTHENTICATION_CONTEXT_KEY);
+ Object contextObject = httpSession.getAttribute(ACEGI_SECURITY_CONTEXT_KEY);
- if (authenticationObject != null) {
- // HttpSession provided an Authentication object
- if (authenticationObject instanceof Authentication) {
+ if (contextObject != null) {
+ if (contextObject instanceof SecurityContext) {
if (logger.isDebugEnabled()) {
logger.debug(
- "Obtained from ACEGI_SECURITY_AUTHENTICATION_CONTEXT a valid Authentication and set to SecurityContext: '"
- + authenticationObject + "'");
+ "Obtained from ACEGI_SECURITY_CONTEXT a valid SecurityContext and set to SecurityContextHolder: '"
+ + contextObject + "'");
}
- SecurityContext.setAuthentication((Authentication) authenticationObject);
+ SecurityContextHolder.setContext((SecurityContext) contextObject);
} else {
if (logger.isWarnEnabled()) {
logger.warn(
- "ACEGI_SECURITY_AUTHENTICATION_CONTEXT did not contain an Authentication but contained: '"
- + authenticationObject
- + "'; are you improperly modifying the HttpSession directly (you should always use SecurityContext) or using the HttpSession attribute reserved for this class?");
+ "ACEGI_SECURITY_CONTEXT did not contain a SecurityContext but contained: '"
+ + contextObject
+ + "'; are you improperly modifying the HttpSession directly (you should always use SecurityContextHolder) or using the HttpSession attribute reserved for this class? - new SecurityContext instance associated with SecurityContextHolder");
}
+
+ SecurityContextHolder.setContext(generateNewContext());
}
} else {
if (logger.isDebugEnabled()) {
logger.debug(
- "HttpSession returned null object for ACEGI_SECURITY_AUTHENTICATION_CONTEXT");
+ "HttpSession returned null object for ACEGI_SECURITY_CONTEXT - new SecurityContext instance associated with SecurityContextHolder");
}
+
+ SecurityContextHolder.setContext(generateNewContext());
}
} else {
if (logger.isDebugEnabled()) {
- logger.debug("No HttpSession currently exists");
+ logger.debug(
+ "No HttpSession currently exists - new SecurityContext instance associated with SecurityContextHolder");
}
+
+ SecurityContextHolder.setContext(generateNewContext());
}
- // Make the HttpSession null, as we want to ensure we don't keep any
- // reference to the HttpSession laying around in memory (in case the
- // chain.doFilter() we're about to invoke decides to invalidate it).
+ // Make the HttpSession null, as we want to ensure we don't keep
+ // a reference to the HttpSession laying around in case the
+ // chain.doFilter() invalidates it.
httpSession = null;
// Proceed with chain
chain.doFilter(request, response);
- // Store Authentication back to HttpSession
+ // Store context back to HttpSession
try {
httpSession = ((HttpServletRequest) request).getSession(false);
} catch (IllegalStateException ignored) {}
@@ -194,21 +222,22 @@ public class HttpSessionContextIntegrationFilter implements Filter {
if ((httpSession == null) && httpSessionExistedAtStartOfRequest) {
if (logger.isDebugEnabled()) {
logger.debug(
- "HttpSession is now null, but was not null at start of request; session was invalidated during filter chain, so we will NOT create a new session now");
+ "HttpSession is now null, but was not null at start of request; session was invalidated, so do not create a new session");
}
}
- // Generate a HttpSession *only* if we have to
+ // Generate a HttpSession only if we need to
if ((httpSession == null) && !httpSessionExistedAtStartOfRequest) {
if (!allowSessionCreation) {
if (logger.isDebugEnabled()) {
logger.debug(
- "The HttpSessionContextIntegrationFilter is prohibited from creating a HttpSession by the allowSessionCreation property being false");
+ "The HttpSession is currently null, and the HttpSessionContextIntegrationFilter is prohibited from creating a HttpSession (because the allowSessionCreation property is false) - SecurityContext thus not stored for next request");
}
- } else if (SecurityContext.getAuthentication() != null) {
+ } else if (!contextObject.equals(
+ SecurityContextHolder.getContext())) {
if (logger.isDebugEnabled()) {
logger.debug(
- "HttpSession being created as SecurityContext contents are non-null");
+ "HttpSession being created as SecurityContextHolder contents are non-default");
}
try {
@@ -217,32 +246,44 @@ public class HttpSessionContextIntegrationFilter implements Filter {
} else {
if (logger.isDebugEnabled()) {
logger.debug(
- "SecurityContext contents and HttpSession are both null; not creating HttpSession");
+ "HttpSession is null, but SecurityContextHolder has not changed from default: ' "
+ + SecurityContextHolder.getContext()
+ + "'; not creating HttpSession or storing SecurityContextHolder contents");
}
}
}
- // If HttpSession exists or was just created, store current SecurityContext contents
+ // If HttpSession exists, store current SecurityContextHolder contents
if (httpSession != null) {
- httpSession.setAttribute(ACEGI_SECURITY_AUTHENTICATION_CONTEXT_KEY,
- SecurityContext.getAuthentication());
+ httpSession.setAttribute(ACEGI_SECURITY_CONTEXT_KEY,
+ SecurityContextHolder.getContext());
if (logger.isDebugEnabled()) {
logger.debug("SecurityContext stored to HttpSession: '"
- + SecurityContext.getAuthentication() + "'");
+ + SecurityContextHolder.getContext() + "'");
}
}
- // Remove SecurityContext contents, ready for next request
- SecurityContext.setAuthentication(null);
+ // Remove SecurityContextHolder contents
+ SecurityContextHolder.setContext(generateNewContext());
if (logger.isDebugEnabled()) {
logger.debug(
- "SecurityContext set to null as request processing completed");
+ "SecurityContextHolder set to new context, as request processing completed");
}
}
}
+ public SecurityContext generateNewContext() throws ServletException {
+ try {
+ return (SecurityContext) this.context.newInstance();
+ } catch (InstantiationException ie) {
+ throw new ServletException(ie);
+ } catch (IllegalAccessException iae) {
+ throw new ServletException(iae);
+ }
+ }
+
/**
* Does nothing. We use IoC container lifecycle services instead.
*
diff --git a/core/src/main/java/org/acegisecurity/context/SecurityContext.java b/core/src/main/java/org/acegisecurity/context/SecurityContext.java
index 65e7eff43a..5496d8c1d6 100644
--- a/core/src/main/java/org/acegisecurity/context/SecurityContext.java
+++ b/core/src/main/java/org/acegisecurity/context/SecurityContext.java
@@ -19,26 +19,35 @@ import net.sf.acegisecurity.Authentication;
/**
- * Associates a given {@link Authentication} with the current execution thread,
- * along with new threads the current execution thread may spawn.
+ * Interface defining the minimum security information associated with the
+ * current thread of execution.
+ *
+ * + * Stored in {@link net.sf.acegisecurity.context.SecurityContextHolder}. + *
* * @author Ben Alex * @version $Id$ - * - * @see java.lang.InheritableThreadLocal */ -public class SecurityContext { - //~ Static fields/initializers ============================================= - - private static InheritableThreadLocal authenticationHolder = new InheritableThreadLocal(); - +public interface SecurityContext { //~ Methods ================================================================ - public static void setAuthentication(Authentication authentication) { - authenticationHolder.set(authentication); - } + /** + * Changes the currently authenticated principal, or removes the + * authentication information. + * + * @param authentication the newAuthentication token, or
+ * null if no further authentication information
+ * should be stored
+ */
+ public void setAuthentication(Authentication authentication);
- public static Authentication getAuthentication() {
- return (Authentication) authenticationHolder.get();
- }
+ /**
+ * Obtains the currently authenticated principal, or an authentication
+ * request token.
+ *
+ * @return the Authentication or null if no
+ * authentication information is available
+ */
+ public Authentication getAuthentication();
}
diff --git a/core/src/main/java/org/acegisecurity/context/SecurityContextHolder.java b/core/src/main/java/org/acegisecurity/context/SecurityContextHolder.java
new file mode 100644
index 0000000000..0ab45808a3
--- /dev/null
+++ b/core/src/main/java/org/acegisecurity/context/SecurityContextHolder.java
@@ -0,0 +1,78 @@
+/* Copyright 2004, 2005 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.sf.acegisecurity.context;
+
+import org.springframework.util.Assert;
+
+
+/**
+ * Associates a given {@link SecurityContext} with the current execution
+ * thread, along with new threads the current execution thread may spawn.
+ *
+ *
+ * To guarantee the {@link #getContext()} never returns null, this
+ * class defaults to returning SecurityContextImpl if no
+ * SecurityContext has ever been associated with the current
+ * thread of execution. Despite this behaviour, in general another class will
+ * select the concrete SecurityContext implementation to use and
+ * expressly set an instance of that implementation against the
+ * SecurityContextHolder.
+ *
SecurityContext with the current thread of
+ * execution.
+ *
+ * @param context the new SecurityContext (may not be
+ * null)
+ */
+ public static void setContext(SecurityContext context) {
+ Assert.notNull(context,
+ "Only non-null SecurityContext instances are permitted");
+ contextHolder.set(context);
+ }
+
+ /**
+ * Obtains the SecurityContext associated with the current
+ * thread of execution. If no SecurityContext has been
+ * associated with the current thread of execution, a new instance of
+ * {@link SecurityContextImpl} is associated with the current thread and
+ * then returned.
+ *
+ * @return the current SecurityContext (guaranteed to never be
+ * null)
+ */
+ public static SecurityContext getContext() {
+ if (contextHolder.get() == null) {
+ contextHolder.set(new SecurityContextImpl());
+ }
+
+ return (SecurityContext) contextHolder.get();
+ }
+}
diff --git a/core/src/main/java/org/acegisecurity/context/SecurityContextImpl.java b/core/src/main/java/org/acegisecurity/context/SecurityContextImpl.java
new file mode 100644
index 0000000000..bf2887726d
--- /dev/null
+++ b/core/src/main/java/org/acegisecurity/context/SecurityContextImpl.java
@@ -0,0 +1,79 @@
+/* Copyright 2004, 2005 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.sf.acegisecurity.context;
+
+import net.sf.acegisecurity.Authentication;
+
+
+/**
+ * Base implementation of {@link SecurityContext}.
+ *
+ * + * Used by default by {@link + * net.sf.acegisecurity.context.SecurityContextHolder} and {@link + * net.sf.acegisecurity.context.HttpSessionContextIntegrationFilter}. + *
+ * + * @author Ben Alex + * @version $Id$ + */ +public class SecurityContextImpl implements SecurityContext { + //~ Instance fields ======================================================== + + private Authentication authentication; + + //~ Methods ================================================================ + + public void setAuthentication(Authentication authentication) { + this.authentication = authentication; + } + + public Authentication getAuthentication() { + return authentication; + } + + public boolean equals(Object obj) { + if (obj instanceof SecurityContextImpl) { + SecurityContextImpl test = (SecurityContextImpl) obj; + + if ((this.getAuthentication() == null) + && (test.getAuthentication() == null)) { + return true; + } + + if ((this.getAuthentication() != null) + && (test.getAuthentication() != null) + && this.getAuthentication().equals(test.getAuthentication())) { + return true; + } + } + + return false; + } + + public String toString() { + StringBuffer sb = new StringBuffer(); + sb.append(super.toString()); + + if (this.authentication == null) { + sb.append(": Null authentication"); + } else { + sb.append(": Authentication: " + this.authentication); + } + + return sb.toString(); + } +} diff --git a/core/src/main/java/org/acegisecurity/context/httpinvoker/AuthenticationSimpleHttpInvokerRequestExecutor.java b/core/src/main/java/org/acegisecurity/context/httpinvoker/AuthenticationSimpleHttpInvokerRequestExecutor.java index 5bd04f3377..4bb28250c3 100644 --- a/core/src/main/java/org/acegisecurity/context/httpinvoker/AuthenticationSimpleHttpInvokerRequestExecutor.java +++ b/core/src/main/java/org/acegisecurity/context/httpinvoker/AuthenticationSimpleHttpInvokerRequestExecutor.java @@ -17,7 +17,7 @@ package net.sf.acegisecurity.context.httpinvoker; import net.sf.acegisecurity.Authentication; import net.sf.acegisecurity.AuthenticationCredentialsNotFoundException; -import net.sf.acegisecurity.context.SecurityContext; +import net.sf.acegisecurity.context.SecurityContextHolder; import org.apache.commons.codec.binary.Base64; import org.apache.commons.logging.Log; @@ -86,7 +86,8 @@ public class AuthenticationSimpleHttpInvokerRequestExecutor throws IOException, AuthenticationCredentialsNotFoundException { super.prepareConnection(con, contentLength); - Authentication auth = SecurityContext.getAuthentication(); + Authentication auth = SecurityContextHolder.getContext() + .getAuthentication(); if ((auth != null) && (auth.getPrincipal() != null) && (auth.getCredentials() != null)) { diff --git a/core/src/main/java/org/acegisecurity/context/package.html b/core/src/main/java/org/acegisecurity/context/package.html index 8d37261f9a..3954b286d4 100644 --- a/core/src/main/java/org/acegisecurity/context/package.html +++ b/core/src/main/java/org/acegisecurity/context/package.html @@ -5,10 +5,6 @@ Provides a "request context". A request context is associated with the current execution thread. It holds objects that would otherwise need to be included in many method signatures, such as for authentication. - -The majority of this package has been deprecated. Please use the
-SecurityContext and HttpSessionContextIntegrationFilter
-classes only.