Overview | Package | Class | Use | Tree | Deprecated | Index | Help
|  | BEA Systems, Inc.
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: INNER | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD

WebLogic Server 8.1 API Reference

## weblogic.servlet.security
Class ServletAuthentication

    java.lang.Object
      |
      +--weblogic.servlet.security.ServletAuthentication

public final class ServletAuthentication
extends java.lang.Object

ServletAuthentication allows both form-based authentication and programmatic authentication in servlets. It performs the authentication call through the Realm and sets the user information for the session. The weak() methods are used for password authentication and the strong() methods are used for certificate-based authentication. The strong() methods are only available through two-way SSL connections, based on the client certificate chain.

Author:
  Copyright © 2004 BEA Systems, Inc. All Rights Reserved.

Field Summary
`static int` | `AUTHENTICATED` Return value of a successful authentication
`static int` | `FAILED_AUTHENTICATION` Return value of an unsuccessful authentication
`static int` | `NEEDS_CREDENTIALS` Deprecated.

Constructor Summary
`ServletAuthentication(java.lang.String usernameField, java.lang.String passwordField)` Constructs a ServletAuthentication object which will look for specific form fields inside the HttpRequest for the username and password.

Method Summary
`static int` | `assertIdentity(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, java.lang.String realmName)` Strong authentication using the client-side certificate chain as the credential for authentication.
`static int` | `authenticate(javax.security.auth.callback.CallbackHandler handler, javax.servlet.http.HttpServletRequest request)` Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION.
`static int` | `authObject(java.lang.String username, java.lang.Object credential, javax.servlet.http.HttpServletRequest request)` Deprecated.
`static int` | `authObject(java.lang.String username, java.lang.Object credential, javax.servlet.http.HttpSession session, javax.servlet.http.HttpServletRequest request)` Deprecated.
`static void` | `done(javax.servlet.http.HttpServletRequest request)` Deprecated.
`static void` | `generateNewSessionID(javax.servlet.http.HttpServletRequest request)` This moves all current session information into a completely different session ID and re-associate this session with this new ID.
`static javax.servlet.http.Cookie` | `getSessionCookie(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)` This would allow you to get a handle on the session cookie itself.
`static java.lang.String` | `getTargetURLForFormAuthentication(javax.servlet.http.HttpSession session)` This method returns the target URL stored in the first step of Form based authentication.
`static boolean` | `invalidateAll(javax.servlet.http.HttpServletRequest req)` Invalidate all the sessions for the current user only (current cookie) and since the cookie is no longer required, kill the cookie too.
`static void` | `killCookie(javax.servlet.http.HttpServletRequest req)` Kills the current cookie
`static int` | `login(javax.security.auth.callback.CallbackHandler handler, javax.servlet.http.HttpServletRequest request)` Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION.
`static int` | `login(java.lang.String username, java.lang.String password, javax.servlet.http.HttpServletRequest request)` Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION after using the username and password to authenticate the user and setting that user information into the session.
`static boolean` | `logout(javax.servlet.http.HttpServletRequest req)` This "logs out" the user in the session by removing the pertinent data from the sessions the user has logged into and also from the webserver, without losing other session data.
`static void` | `runAs(javax.security.auth.Subject subject, javax.servlet.http.HttpServletRequest request)` With a given subject, this method sets the current thread identity and current session identity.
`static int` | `strong(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)` Strong authentication using the client-side certificate chain as the credential for authentication against the "weblogic" (default) realm.
`static int` | `strong(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, java.lang.String realmName)` Strong authentication using the client-side certificate chain as the credential for authentication.
`int` | `weak(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)` Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION after pulling the username and password from the request, authenticating the user and setting it into the session.
`static int` | `weak(java.lang.String username, java.lang.String password, javax.servlet.http.HttpServletRequest request)` Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION after using the username and password to authenticate the user and setting that user information into the session.
`static int` | `weak(java.lang.String username, java.lang.String password, javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)` Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION after using the username and password to authenticate the user and setting that user information into the session.
`static int` | `weak(java.lang.String username, java.lang.String password, javax.servlet.http.HttpSession session)` Deprecated.

Methods inherited from class java.lang.Object
`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

Field Detail

### AUTHENTICATED

    public static final int AUTHENTICATED

  Return value of a successful authentication

### FAILED_AUTHENTICATION

    public static final int FAILED_AUTHENTICATION

  Return value of an unsuccessful authentication

### NEEDS_CREDENTIALS

    public static final int NEEDS_CREDENTIALS

  Deprecated.
  Return value of an unsuccessful authentication due to no credentials.

Constructor Detail

### ServletAuthentication

    public ServletAuthentication(java.lang.String usernameField,
                                 java.lang.String passwordField)

  Constructs a ServletAuthentication object which will look for specific form fields inside the HttpRequest for the username and password.

Method Detail

### done

    public static void done(javax.servlet.http.HttpServletRequest request)

  Deprecated.
  This "logs out" the user in the session by removing the pertinent data from the sessions the user has logged into and also from the webserver, without losing other session data.

  Parameters:
    `request` - HttpServletRequest which contains the session

### logout

    public static boolean logout(javax.servlet.http.HttpServletRequest req)

  This "logs out" the user in the session by removing the pertinent data from the sessions the user has logged into and also from the webserver, without losing other session data.

  Parameters:
    `request` - HttpServletRequest

### invalidateAll

    public static boolean invalidateAll(javax.servlet.http.HttpServletRequest req)

  Invalidate all the sessions for the current user only (current cookie) and since the cookie is no longer required, kill the cookie too.

  Parameters:
    `request` - HttpServletRequest

### killCookie

    public static void killCookie(javax.servlet.http.HttpServletRequest req)

  Kills the current cookie

  Parameters:
    `request` - HttpServletRequest which contains the session

### strong

    public static int strong(javax.servlet.http.HttpServletRequest request,
                             javax.servlet.http.HttpServletResponse response)
                      throws javax.servlet.ServletException,
                             java.io.IOException

  Strong authentication using the client-side certificate chain as the credential for authentication against the "weblogic" (default) realm.

  Parameters:
    `request` - HttpServletRequest
    `response` - HttpServletResponse
  Returns:
    int authentication value
  Throws:
    javax.servlet.ServletException -
    java.io.IOException -

### strong

    public static int strong(javax.servlet.http.HttpServletRequest request,
                             javax.servlet.http.HttpServletResponse response,
                             java.lang.String realmName)
                      throws javax.servlet.ServletException,
                             java.io.IOException

  Strong authentication using the client-side certificate chain as the credential for authentication.

  Parameters:
    `request` - HttpServletRequest
    `response` - HttpServletResponse
    `realmName` - String name of the realm to authenticate against
  Returns:
    int authentication value
  Throws:
    javax.servlet.ServletException -
    java.io.IOException -

### assertIdentity

    public static int assertIdentity(javax.servlet.http.HttpServletRequest request,
                                     javax.servlet.http.HttpServletResponse response,
                                     java.lang.String realmName)
                              throws javax.servlet.ServletException,
                                     java.io.IOException,
                                     javax.security.auth.login.LoginException

  Strong authentication using the client-side certificate chain as the credential for authentication. This method is similar to "strong" except that it propogates the LoginException back to the caller.

  Parameters:
    `request` - HttpServletRequest
    `response` - HttpServletResponse
    `realmName` - String name of the realm to authenticate against
  Returns:
    int authentication value
  Throws:
    javax.servlet.ServletException -
    java.io.IOException -

### weak

    public int weak(javax.servlet.http.HttpServletRequest request,
                    javax.servlet.http.HttpServletResponse response)
             throws javax.servlet.ServletException,
                    java.io.IOException

  Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION after pulling the username and password from the request, authenticating the user and setting it into the session.

  This weak() method, unlike the others, is not static. It requires that the ServletAuthentication object be instantiated with the field names for the username and password inside the form.

  Parameters:
    `request` - HttpServletRequest
    `response` - HttpServletResponse
  Returns:
    int authentication value
  Throws:
    javax.servlet.ServletException -
    java.io.IOException -

### weak

    public static int weak(java.lang.String username,
                           java.lang.String password,
                           javax.servlet.http.HttpServletRequest request,
                           javax.servlet.http.HttpServletResponse response)

  Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION after using the username and password to authenticate the user and setting that user information into the session.

  Parameters:
    `username` - String
    `password` - String
    `request` - HttpServletRequest
    `response` - HttpServletResponse
  Returns:
    int authentication value

### weak

    public static int weak(java.lang.String username,
                           java.lang.String password,
                           javax.servlet.http.HttpServletRequest request)

  Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION after using the username and password to authenticate the user and setting that user information into the session.

  Parameters:
    `username` - String
    `password` - String
    `request` - HttpServletRequest
  Returns:
    int authentication value

### login

    public static int login(java.lang.String username,
                            java.lang.String password,
                            javax.servlet.http.HttpServletRequest request)
                     throws javax.security.auth.login.LoginException

  Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION after using the username and password to authenticate the user and setting that user information into the session. This method is similar to "weak", except that the LoginException is propogated to caller.

  Parameters:
    `username` - String
    `password` - String
    `request` - HttpServletRequest
  Returns:
    int authentication value
  Throws:
    javax.security.auth.login.LoginException -

### weak

    public static int weak(java.lang.String username,
                           java.lang.String password,
                           javax.servlet.http.HttpSession session)

  Deprecated.
  Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION after using the username and password to authenticate the user and setting that user information into the session. Note: This method has been deprecated. Use weak(username, password, request) instead.

  Parameters:
    `username` - String
    `password` - String
    `session` - HttpSession
  Returns:
    int authentication value

### authObject

    public static int authObject(java.lang.String username,
                                 java.lang.Object credential,
                                 javax.servlet.http.HttpServletRequest request)

  Deprecated.
  Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION after using the username and credential object to authenticate the user and setting that user information into the session. This method has been deprecated. Use authenticate(CallbackHandler, HttpServletRequest)

  Parameters:
    `username` - String
    `password` - String
    `request` - HttpServletRequest
  Returns:
    int authentication value

### authObject

    public static int authObject(java.lang.String username,
                                 java.lang.Object credential,
                                 javax.servlet.http.HttpSession session,
                                 javax.servlet.http.HttpServletRequest request)

  Deprecated.
  Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION after using the username and credential object to authenticate the user and setting that user information into the session. This method has been deprecated. Use authenticate(CallbackHandler, HttpServletRequest) instead.

  Parameters:
    `username` - String
    `password` - String
    `session` - HttpSession
  Returns:
    int authentication value

### authenticate

    public static int authenticate(javax.security.auth.callback.CallbackHandler handler,
                                   javax.servlet.http.HttpServletRequest request)

  Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION. This method is expected to be used when you have plugged in custom LoginModules. If the custom LoginModule is expecting the LoginException to be propogated back, then use the "login" method instead of "authenticate". The callback handler which you supply here should be able to handle the callbacks generated by your LoginModule. This method creates a session if session doesn't exists already.

  Parameters:
    `handler` - javax.security.auth.callback.CallbackHandler
    `request` - HttpServletRequest
  Returns:
    int authentication value

### login

    public static int login(javax.security.auth.callback.CallbackHandler handler,
                            javax.servlet.http.HttpServletRequest request)
                     throws javax.security.auth.login.LoginException

  Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION. This method is expected to be used when you have plugged in custom LoginModules. This is similar to "authenticate" method, except that this will throws LoginException back to caller, when it occurs. The callback handler which you supply here should be able to handle the callbacks generated by your LoginModule. This method creates a session if session doesn't exists already.

  Parameters:
    `handler` - javax.security.auth.callback.CallbackHandler
    `request` - HttpServletRequest
  Returns:
    int authentication value
  Throws:
    javax.security.auth.login.LoginException -

### generateNewSessionID

    public static void generateNewSessionID(javax.servlet.http.HttpServletRequest request)

  This moves all current session information into a completely different session ID and re-associate this session with this new ID. If a session cookie does not exist at this point, one will be created.

  Parameters:
    `request` - HttpServletRequest

### getSessionCookie

    public static javax.servlet.http.Cookie getSessionCookie(javax.servlet.http.HttpServletRequest request,
                                                             javax.servlet.http.HttpServletResponse response)

  This would allow you to get a handle on the session cookie itself. Returns null if there is no session or if session cookies have been turned off in the servlet engine.

  Parameters:
    `response` - HttpServletResponse
  Returns:
    Session Cookie if it exists, null otherwise

### runAs

    public static void runAs(javax.security.auth.Subject subject,
                             javax.servlet.http.HttpServletRequest request)

  With a given subject, this method sets the current thread identity and current session identity. This method will be used for logging in when you have a subject already.

  Parameters:
    `subject` - javax.security.auth.Subject
    `request` - HttpServletRequest

### getTargetURLForFormAuthentication

    public static java.lang.String getTargetURLForFormAuthentication(javax.servlet.http.HttpSession session)

  This method returns the target URL stored in the first step of Form based authentication. This allows users to handle the login process programmatically.

  Parameters:
    `session` - HttpSession
  Returns:
    Target URL for form based authentication

Overview | Package | Class | Use | Tree | Deprecated | Index | Help
| Documentation is available at http://e-docs.bea.com/wls/docs81
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: INNER | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD