jp.terasoluna.fw.web.thin
Class AuthorizationControlFilter

java.lang.Object
  extended by jp.terasoluna.fw.web.thin.AbstractControlFilter<AuthorizationController>
      extended by jp.terasoluna.fw.web.thin.AuthorizationControlFilter
All Implemented Interfaces:
javax.servlet.Filter

public class AuthorizationControlFilter
extends AbstractControlFilter<AuthorizationController>

Performs access authority check.

This class calls any AuthorizationController instance which is specified in Bean definition file and transfers the access authority check of the specified path. The AuthorizationController instance performs the filter process of the request received from browser.

Access authority check function

Checks if there is access authority for the specified path. When there is access authority violation, UnauthorizedException is thrown.

How to use

To use this function, perform the following settings in deployment descriptor (web.xml) and Bean definition file. "Id" attribute which is defined in Bean definition file should be set as sampleAuthorizationController. In the "class" attribute of <bean> element, set the class that implementes the AuthorizationController interface.

Deployment descriptor(web.xml)

 <filter>
   <filter-name>
     authorizationControlFilter
   </filter-name>
   <filter-class>
     jp.terasoluna.fw.web.thin.AuthorizationControlFilter
   </filter-class>
   <init-param>
     <param-name>controller</param-name>
     <param-value>
       "sampleAuthorizationController"
     </param-value>
   </init-param>
 </filter>

 <filter-mapping>
   <filter-name>authorizationControlFilter</filter-name>
   <url-pattern>/*</url-pattern>
 </filter-mapping>
 
 <error-page>
   <exception-type>
     jp.terasoluna.fw.web.thin.UnauthorizedException
   </exception-type>
   <location>/unauthorizedError.jsp</location>
 </error-page>
 
Bean definition file

 <bean id="sampleAuthorizationController"
       class="jp.terasoluna...SampleAuthorizationController" />
 
At the time of setting the "id" attribute of <bean> element which is defined in Bean definition file, in the "authorizationController" which is the default value, <init-param> element can be omitted from the <filter> element in deployment descriptor (web.xml).

See Also:
AuthorizationController, BlockageControlFilter, BlockageController, ServerBlockageControlFilter, ServerBlockageController

Field Summary
private static java.lang.Class AUTHORIZATION_CONTROLLER_CLASS
          Controller class that transfers the access authority check process.
private static java.lang.String AUTHORIZATION_CONTROLLER_ERROR
          Error code indicating the failure in generating the authorization controller.
static java.lang.String AUTHORIZATION_THRU_KEY
          Key of "request" attribute which indicates that the request has passed through the filter.
protected static AuthorizationController controller
          AuthorizationController instance.
static java.lang.String DEFAULT_AUTHORIZATION_BEAN_ID
          Default id which is used in "Id" attribute of <bean> element to fetch the implementation class of controller from DI container.
private static org.apache.commons.logging.Log log
          Log class.
 
Fields inherited from class jp.terasoluna.fw.web.thin.AbstractControlFilter
config
 
Constructor Summary
AuthorizationControlFilter()
           
 
Method Summary
 void doFilter(javax.servlet.ServletRequest req, javax.servlet.ServletResponse res, javax.servlet.FilterChain chain)
          Performs access authority check.
static AuthorizationController getAuthorizationController()
          Returns AuthorizationController instance.
protected  java.lang.Class getControllerClass()
          Returns the interface which should be implemented by the class that performs access control.
 java.lang.String getDefaultControllerBeanId()
          Returns default id at the time of fetching the controller from DI container.
protected  java.lang.String getErrorCode()
          Returns error code that indicates the failure in generating the controller.
 void init(javax.servlet.FilterConfig config)
          This method is called by the container when the filter changes to Service start state. After creating an instance of the filter, container calls init method only once.
In order to request the Filter to execute the filter process, init method should finish normally. Container cannot change the Filter to service state when the init method is any of the following.
ServletException is thrown, It does not get recovered within the time defined by container, The implementation class of the controller does not exist or the settings are abnormal.
 
Methods inherited from class jp.terasoluna.fw.web.thin.AbstractControlFilter
destroy, getController, setConfig
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Field Detail

AUTHORIZATION_THRU_KEY

public static final java.lang.String AUTHORIZATION_THRU_KEY
Key of "request" attribute which indicates that the request has passed through the filter.

See Also:
Constant Field Values

DEFAULT_AUTHORIZATION_BEAN_ID

public static final java.lang.String DEFAULT_AUTHORIZATION_BEAN_ID
Default id which is used in the "id" attribute of <bean> element to fetch the implementation class of controller from DI container.

See Also:
Constant Field Values

AUTHORIZATION_CONTROLLER_ERROR

private static final java.lang.String AUTHORIZATION_CONTROLLER_ERROR
Error code that indicates the failure in generating the authentication controller.

See Also:
Constant Field Values

AUTHORIZATION_CONTROLLER_CLASS

private static final java.lang.Class AUTHORIZATION_CONTROLLER_CLASS
Controller class that transfers the access authority check process.


log

private static org.apache.commons.logging.Log log
Log class.


controller

protected static AuthorizationController controller
AuthorizationController instance.

Constructor Detail

AuthorizationControlFilter

public AuthorizationControlFilter()
Method Detail

getAuthorizationController

public static AuthorizationController getAuthorizationController()
Returns AuthorizationController instance.

Returns:
AuthorizationController instance which is set in this filter

init

public void init(javax.servlet.FilterConfig config)
          throws javax.servlet.ServletException
This method is called by the container when the filter changes to Service start state. After creating an instance of the filter, container calls init method only once.
In order to request the Filter to execute the filter process, init method should finish normally. Container cannot change the Filter to service state when the init method is any of the following.

Specified by:
init in interface javax.servlet.Filter
Overrides:
init in class AbstractControlFilter<AuthorizationController>
Parameters:
config - FilterConfig instance.
Throws:
javax.servlet.ServletException - Exception which is thrown at the time of abnormal initialization.
See Also:
Filter.init(javax.servlet.FilterConfig), AbstractControlFilter

doFilter

public void doFilter(javax.servlet.ServletRequest req,
                     javax.servlet.ServletResponse res,
                     javax.servlet.FilterChain chain)
              throws java.io.IOException,
                     javax.servlet.ServletException
Perform access authority check.

Specified by:
doFilter in interface javax.servlet.Filter
Specified by:
doFilter in class AbstractControlFilter<AuthorizationController>
Parameters:
req - HTTP request
res - HTTP response
chain - Filter chain
Throws:
java.io.IOException - I/O error
javax.servlet.ServletException - Servlet exception
See Also:
Filter.doFilter(javax.servlet.ServletRequest, javax.servlet.ServletResponse, javax.servlet.FilterChain)

getControllerClass

protected java.lang.Class getControllerClass()
Returns the interface which should be implemented by the class that performs access control.

Specified by:
getControllerClass in class AbstractControlFilter<AuthorizationController>
Returns:
Class of controller which is used in this filter.

getErrorCode

protected java.lang.String getErrorCode()
Returns the error code that indicates the failure in generating the controller.

Specified by:
getErrorCode in class AbstractControlFilter<AuthorizationController>
Returns:
Error code

getDefaultControllerBeanId

public java.lang.String getDefaultControllerBeanId()
Returns default id at the time of fetching controller from DI container.

Specified by:
getDefaultControllerBeanId in class AbstractControlFilter<AuthorizationController>
Returns:
Default id attribute value