org.springframework.richclient.security.support
Class DefaultApplicationSecurityManager

Show UML class diagram

java.lang.Object
  org.springframework.richclient.security.support.DefaultApplicationSecurityManager

All Implemented Interfaces:

InitializingBean, ApplicationSecurityManager

public class DefaultApplicationSecurityManager
extends Object
implements ApplicationSecurityManager, InitializingBean

Default implementation of ApplicationSecurityManager. It provides basic processing for login and logout actions and the event lifecycle.

Instances of this class should be configured with an instance of AuthenticationManager to be used to handle authentication (login) requests. This would be done like this:

         <bean id="securityManager"
               class="org.springframework.richclient.security.support.DefaultApplicationSecurityManager">
            <property name="authenticationManager" ref="authenticationManager"/>
         </bean>
         
         <bean id="authenticationManager"
           class="org.springframework.security.providers.ProviderManager">
           <property name="providers">
               <list>
                   <ref bean="remoteAuthenticationProvider" />
               </list>
           </property>
       </bean>
       
       <bean id="remoteAuthenticationProvider"
           class="org.springframework.security.providers.rcp.RemoteAuthenticationProvider">
           <property name="remoteAuthenticationManager" ref="remoteAuthenticationManager" />
       </bean>
    
       <bean id="remoteAuthenticationManager"
           class="org.springframework.remoting.httpinvoker.HttpInvokerProxyFactoryBean">
           <property name="serviceUrl">
               <value>http://localhost:8080/myserver/rootContext/RemoteAuthenticationManager</value>
           </property>
           <property name="serviceInterface">
               <value>org.springframework.security.providers.rcp.RemoteAuthenticationManager</value>
           </property>
       </bean>
 

If this is not done, then an attempt will be made to "auto-configure" by locating an appropriate authentication manager in the application context. In order, a search will be made for a bean that implements one of these classes:

1. ProviderManager
2. AuthenticationProvider
3. AuthenticationManager

The first instance to be located will be used to handle authentication requests.

Author:

Larry Streepy

Constructor Summary

DefaultApplicationSecurityManager()
Default constructor.

DefaultApplicationSecurityManager(boolean autoConfigure)
Constructor invoked when we are created as the default implementation by ApplicationServices.

Method Summary

void	afterPropertiesSet() Ensure that we have an authentication manager to work with.
org.springframework.security.Authentication	doLogin(org.springframework.security.Authentication authentication) Process a login attempt and fire all related events.
org.springframework.security.Authentication	doLogout() Perform a logout.
org.springframework.security.Authentication	getAuthentication() Get the authentication token for the currently logged in user.
org.springframework.security.AuthenticationManager	getAuthenticationManager() Get the authentication manager in use.
boolean	isUserInRole(String role) Determine if the currently authenticated user has the role provided.
boolean	isUserLoggedIn() Return if a user is currently logged in, meaning that a previous call to doLogin resulted in a valid authentication request.
protected void	setAuthentication(org.springframework.security.Authentication authentication) Set the authenticaiton token.
void	setAuthenticationManager(org.springframework.security.AuthenticationManager authenticationManager) Set the authentication manager to use.
protected boolean	tryToWire(Class type) Try to locate and "wire in" a suitable authentication manager.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

DefaultApplicationSecurityManager

public DefaultApplicationSecurityManager()

Default constructor.

DefaultApplicationSecurityManager

public DefaultApplicationSecurityManager(boolean autoConfigure)

Constructor invoked when we are created as the default implementation by ApplicationServices. Since this bean won't be defined in the context under these circumstances, we need to perform some auto-configuration of our own.

Auto-configuration consists of trying to locate an AuthenticationManager (in one of several classes) in the application context. This auto-configuration is also attempted after the bean is constructed by the context if the authenticationManager property has not been set. See afterPropertiesSet().

Parameters:

autoConfigure - pass true to perform auto-configuration

Throws:

IllegalArgumentException - If the auto-configuration fails

See Also:

afterPropertiesSet()

Method Detail

setAuthenticationManager

public void setAuthenticationManager(org.springframework.security.AuthenticationManager authenticationManager)

Set the authentication manager to use.

Specified by:

setAuthenticationManager in interface ApplicationSecurityManager

Parameters:

authenticationManager - instance to use for authentication requests

getAuthenticationManager

public org.springframework.security.AuthenticationManager getAuthenticationManager()

Get the authentication manager in use.

Specified by:

getAuthenticationManager in interface ApplicationSecurityManager

Returns:

authenticationManager instance used for authentication requests

doLogin

public org.springframework.security.Authentication doLogin(org.springframework.security.Authentication authentication)

Process a login attempt and fire all related events. If the authentication fails, then a AuthenticationFailedEvent is published and the exception is rethrown. If the authentication succeeds, then an AuthenticationEvent is published, followed by a LoginEvent.

Specified by:

doLogin in interface ApplicationSecurityManager

Parameters:

authentication - token to use for the login attempt

Returns:

Authentication token resulting from a successful call to AuthenticationManager.authenticate(org.springframework.security.Authentication).

Throws:

org.springframework.security.SpringSecurityException - If the authentication attempt fails

See Also:

ApplicationSecurityManager.doLogin(org.springframework.security.Authentication)

isUserLoggedIn

public boolean isUserLoggedIn()

Return if a user is currently logged in, meaning that a previous call to doLogin resulted in a valid authentication request.

Specified by:

isUserLoggedIn in interface ApplicationSecurityManager

Returns:

true if a user is logged in

getAuthentication

public org.springframework.security.Authentication getAuthentication()

Get the authentication token for the currently logged in user.

Specified by:

getAuthentication in interface ApplicationSecurityManager

Returns:

authentication token, null if not logged in

setAuthentication

protected void setAuthentication(org.springframework.security.Authentication authentication)

Set the authenticaiton token.

Parameters:

authentication - token to install as current.

isUserInRole

public boolean isUserInRole(String role)

Determine if the currently authenticated user has the role provided. Note that role comparisons are case sensitive.

Specified by:

isUserInRole in interface ApplicationSecurityManager

Parameters:

role - to check

Returns:

true if the user has the role requested

doLogout

public org.springframework.security.Authentication doLogout()

Perform a logout. Set the current authentication token to null (in both the per-thread security context and the global context), then publish an AuthenticationEvent followed by a LogoutEvent.

Specified by:

doLogout in interface ApplicationSecurityManager

Returns:

Authentication token that was in place prior to the logout.

See Also:

ApplicationSecurityManager.doLogout()

afterPropertiesSet

public void afterPropertiesSet()

Ensure that we have an authentication manager to work with. If one has not been specifically wired in, then look for beans to "auto-wire" in. Look for a bean of one of the following types (in order): ProviderManager, AuthenticationProvider, and AuthenticationManager.

Specified by:

afterPropertiesSet in interface InitializingBean

See Also:

InitializingBean.afterPropertiesSet()

tryToWire

protected boolean tryToWire(Class type)

Try to locate and "wire in" a suitable authentication manager.

Parameters:

type - The type of bean to look for

Returns:

true if we found and wired a suitable bean