shiro-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From lhazlew...@apache.org
Subject svn commit: r734355 - in /incubator/jsecurity/trunk: core/src/org/jsecurity/mgt/ web/src/org/jsecurity/web/
Date Wed, 14 Jan 2009 07:27:30 GMT
Author: lhazlewood
Date: Tue Jan 13 23:27:29 2009
New Revision: 734355

URL: http://svn.apache.org/viewvc?rev=734355&view=rev
Log:
JSEC-37 - architectural preparation to enable easy assumed identity support.  Need to vet
modifications before they can be verified as the final solution.

Added:
    incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/DefaultSubjectFactory.java
    incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/SessionSubjectBinder.java
    incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/SubjectBinder.java
    incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/SubjectFactory.java
    incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/ThreadContextSubjectBinder.java
    incubator/jsecurity/trunk/web/src/org/jsecurity/web/WebSubjectFactory.java
Modified:
    incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/DefaultSecurityManager.java
    incubator/jsecurity/trunk/web/src/org/jsecurity/web/DefaultWebSecurityManager.java

Modified: incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/DefaultSecurityManager.java
URL: http://svn.apache.org/viewvc/incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/DefaultSecurityManager.java?rev=734355&r1=734354&r2=734355&view=diff
==============================================================================
--- incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/DefaultSecurityManager.java (original)
+++ incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/DefaultSecurityManager.java Tue Jan
13 23:27:29 2009
@@ -26,10 +26,12 @@
 import org.jsecurity.realm.Realm;
 import org.jsecurity.session.InvalidSessionException;
 import org.jsecurity.session.Session;
-import org.jsecurity.subject.*;
+import org.jsecurity.subject.AbstractRememberMeManager;
+import org.jsecurity.subject.PrincipalCollection;
+import org.jsecurity.subject.RememberMeManager;
+import org.jsecurity.subject.Subject;
 import org.jsecurity.util.ThreadContext;
 
-import java.net.InetAddress;
 import java.util.Collection;
 
 /**
@@ -75,10 +77,16 @@
 
     protected RememberMeManager rememberMeManager;
 
+    protected SubjectFactory subjectFactory;
+
+    protected SubjectBinder subjectBinder;
+
     /**
      * Default no-arg constructor.
      */
     public DefaultSecurityManager() {
+        setSubjectBinder(new SessionSubjectBinder());
+        setSubjectFactory(new DefaultSubjectFactory(this));
     }
 
     /**
@@ -87,6 +95,7 @@
      * @param singleRealm the single realm used by this SecurityManager.
      */
     public DefaultSecurityManager(Realm singleRealm) {
+        this();
         setRealm(singleRealm);
     }
 
@@ -96,9 +105,26 @@
      * @param realms the realm instances backing this SecurityManager.
      */
     public DefaultSecurityManager(Collection<Realm> realms) {
+        this();
         setRealms(realms);
     }
 
+    public SubjectFactory getSubjectFactory() {
+        return subjectFactory;
+    }
+
+    public void setSubjectFactory(SubjectFactory subjectFactory) {
+        this.subjectFactory = subjectFactory;
+    }
+
+    public SubjectBinder getSubjectBinder() {
+        return subjectBinder;
+    }
+
+    public void setSubjectBinder(SubjectBinder subjectBinder) {
+        this.subjectBinder = subjectBinder;
+    }
+
     public RememberMeManager getRememberMeManager() {
         return rememberMeManager;
     }
@@ -158,34 +184,9 @@
         getRememberMeManagerForCipherAttributes().setDecryptionCipherKeyBase64(base64);
     }
 
-    private void assertPrincipals(AuthenticationInfo info) {
-        PrincipalCollection principals = info.getPrincipals();
-        if (principals == null || principals.isEmpty()) {
-            String msg = "Authentication info returned from Authenticator must have non null
and non empty principals.";
-            throw new IllegalArgumentException(msg);
-        }
-    }
-
     protected Subject createSubject() {
         PrincipalCollection principals = getRememberedIdentity();
-        return createSubject(principals);
-    }
-
-    protected Subject createSubject(PrincipalCollection subjectPrincipals) {
-        return createSubject(subjectPrincipals, null);
-    }
-
-    protected Subject createSubject(PrincipalCollection principals, Session existing) {
-        return createSubject(principals, existing, false);
-    }
-
-    protected Subject createSubject(PrincipalCollection principals, Session existing, boolean
authenticated) {
-        return createSubject(principals, existing, authenticated, null);
-    }
-
-    protected Subject createSubject(PrincipalCollection principals, Session existing,
-                                    boolean authenticated, InetAddress inetAddress) {
-        return new DelegatingSubject(principals, authenticated, inetAddress, existing, this);
+        return getSubjectFactory().createSubject(principals, null, false, null);
     }
 
     /**
@@ -197,25 +198,7 @@
      *         authenticated user.
      */
     protected Subject createSubject(AuthenticationToken token, AuthenticationInfo info) {
-        assertPrincipals(info);
-
-        //get any existing session that may exist - we don't want to lose it:
-        Subject subject = getSubject(false);
-        Session session = null;
-        if (subject != null) {
-            session = subject.getSession(false);
-        }
-
-        InetAddress authcSourceIP = null;
-        if (token instanceof InetAuthenticationToken) {
-            authcSourceIP = ((InetAuthenticationToken) token).getInetAddress();
-        }
-        if (authcSourceIP == null) {
-            //try the thread local:
-            authcSourceIP = ThreadContext.getInetAddress();
-        }
-
-        return createSubject(info.getPrincipals(), session, true, authcSourceIP);
+        return getSubjectFactory().createSubject(token, info, getSubject(false));
     }
 
     /**
@@ -228,10 +211,7 @@
      *                for later use.
      */
     protected void bind(Subject subject) {
-        if (log.isTraceEnabled()) {
-            log.trace("Binding Subject [" + subject + "] to a thread local...");
-        }
-        ThreadContext.bind(subject);
+        getSubjectBinder().bind(subject);
     }
 
     private void assertCreation(Subject subject) throws IllegalStateException {
@@ -358,16 +338,16 @@
         Subject subject = getSubject(false);
         if (subject != null) {
             try {
-                stopSession(subject);
-            } catch (Exception e) {
-                if (log.isDebugEnabled()) {
-                    String msg = "Unable to cleanly stop Session for Subject [" + subject.getPrincipal()
+ "] " +
-                            "Ignoring (logging out).";
-                    log.debug(msg, e);
-                }
-            }
-            try {
                 unbind(subject);
+                try {
+                    stopSession(subject);
+                } catch (Exception e) {
+                    if (log.isDebugEnabled()) {
+                        String msg = "Unable to cleanly stop Session for Subject [" + subject.getPrincipal()
+ "] " +
+                                "Ignoring (logging out).";
+                        log.debug(msg, e);
+                    }
+                }
             } catch (Exception e) {
                 if (log.isDebugEnabled()) {
                     String msg = "Unable to cleanly unbind Subject.  Ignoring (logging out).";
@@ -394,7 +374,7 @@
     }
 
     protected void unbind(Subject subject) {
-        ThreadContext.unbindSubject();
+        getSubjectBinder().unbind(subject);
     }
 
     protected PrincipalCollection getRememberedIdentity() {
@@ -414,7 +394,7 @@
     }
 
     protected Subject getSubject(boolean create) {
-        Subject subject = ThreadContext.getSubject();
+        Subject subject = getSubjectBinder().getSubject();
         if (subject == null && create) {
             subject = createSubject();
             bind(subject);

Added: incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/DefaultSubjectFactory.java
URL: http://svn.apache.org/viewvc/incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/DefaultSubjectFactory.java?rev=734355&view=auto
==============================================================================
--- incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/DefaultSubjectFactory.java (added)
+++ incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/DefaultSubjectFactory.java Tue Jan
13 23:27:29 2009
@@ -0,0 +1,98 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.jsecurity.mgt;
+
+import org.jsecurity.authc.AuthenticationInfo;
+import org.jsecurity.authc.AuthenticationToken;
+import org.jsecurity.authc.InetAuthenticationToken;
+import org.jsecurity.session.Session;
+import org.jsecurity.subject.DelegatingSubject;
+import org.jsecurity.subject.PrincipalCollection;
+import org.jsecurity.subject.Subject;
+import org.jsecurity.util.ThreadContext;
+
+import java.net.InetAddress;
+
+/**
+ * TODO - Class JavaDoc
+ *
+ * @author Les Hazlewood
+ * @since 1.0
+ */
+public class DefaultSubjectFactory implements SubjectFactory {
+
+    private SecurityManager securityManager;
+
+    public DefaultSubjectFactory() {
+    }
+
+    public DefaultSubjectFactory(SecurityManager securityManager) {
+        setSecurityManager(securityManager);
+    }
+
+    public SecurityManager getSecurityManager() {
+        return securityManager;
+    }
+
+    public void setSecurityManager(SecurityManager securityManager) {
+        this.securityManager = securityManager;
+    }
+
+    public Subject createSubject(PrincipalCollection principals, Session existing,
+                                 boolean authenticated, InetAddress inetAddress) {
+        return new DelegatingSubject(principals, authenticated, inetAddress, existing, getSecurityManager());
+    }
+
+    private void assertPrincipals(AuthenticationInfo info) {
+        PrincipalCollection principals = info.getPrincipals();
+        if (principals == null || principals.isEmpty()) {
+            String msg = "AuthenticationInfo must have non null and non empty principals.";
+            throw new IllegalArgumentException(msg);
+        }
+    }
+
+    /**
+     * Creates a <tt>Subject</tt> instance for the user represented by the given
method arguments.
+     *
+     * @param token the <tt>AuthenticationToken</tt> submitted for the successful
authentication.
+     * @param info  the <tt>AuthenticationInfo</tt> of a newly authenticated
user.
+     * @return the <tt>Subject</tt> instance that represents the user and session
data for the newly
+     *         authenticated user.
+     */
+    public Subject createSubject(AuthenticationToken token, AuthenticationInfo info, Subject
existing) {
+        assertPrincipals(info);
+
+        //get any existing session that may exist - we don't want to lose it:
+        Session session = null;
+        if (existing != null) {
+            session = existing.getSession(false);
+        }
+
+        InetAddress authcSourceIP = null;
+        if (token instanceof InetAuthenticationToken) {
+            authcSourceIP = ((InetAuthenticationToken) token).getInetAddress();
+        }
+        if (authcSourceIP == null) {
+            //try the thread local:
+            authcSourceIP = ThreadContext.getInetAddress();
+        }
+
+        return createSubject(info.getPrincipals(), session, true, authcSourceIP);
+    }
+}

Added: incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/SessionSubjectBinder.java
URL: http://svn.apache.org/viewvc/incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/SessionSubjectBinder.java?rev=734355&view=auto
==============================================================================
--- incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/SessionSubjectBinder.java (added)
+++ incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/SessionSubjectBinder.java Tue Jan
13 23:27:29 2009
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.jsecurity.mgt;
+
+import org.jsecurity.session.Session;
+import org.jsecurity.subject.PrincipalCollection;
+import org.jsecurity.subject.Subject;
+
+/**
+ * Binds the Subject to the accessible Session in addition to the ThreadContext.
+ *
+ * @author Les Hazlewood
+ * @since 1.0
+ */
+public class SessionSubjectBinder extends ThreadContextSubjectBinder {
+
+    /**
+     * The key that is used to store subject principals in the session.
+     */
+    public static final String PRINCIPALS_SESSION_KEY = SessionSubjectBinder.class.getName()
+ "_PRINCIPALS_SESSION_KEY";
+
+    /**
+     * The key that is used to store whether or not the user is authenticated in the session.
+     */
+    public static final String AUTHENTICATED_SESSION_KEY = SessionSubjectBinder.class.getName()
+ "_AUTHENTICATED_SESSION_KEY";
+
+    @Override
+    public void bind(Subject subject) {
+        bindToSession(subject);
+        super.bind(subject);
+    }
+
+    protected void bindToSession(Subject subject) {
+        PrincipalCollection principals = subject.getPrincipals();
+        if (principals != null && !principals.isEmpty()) {
+            Session session = subject.getSession();
+            session.setAttribute(PRINCIPALS_SESSION_KEY, principals);
+        } else {
+            Session session = subject.getSession(false);
+            if (session != null) {
+                session.removeAttribute(PRINCIPALS_SESSION_KEY);
+            }
+        }
+
+        if (subject.isAuthenticated()) {
+            Session session = subject.getSession();
+            session.setAttribute(AUTHENTICATED_SESSION_KEY, subject.isAuthenticated());
+        } else {
+            Session session = subject.getSession(false);
+            if (session != null) {
+                session.removeAttribute(AUTHENTICATED_SESSION_KEY);
+            }
+        }
+    }
+
+    @Override
+    public void unbind(Subject subject) {
+        Session session = subject.getSession(false);
+        if (session != null) {
+            session.removeAttribute(PRINCIPALS_SESSION_KEY);
+            session.removeAttribute(AUTHENTICATED_SESSION_KEY);
+        }
+        super.unbind(subject);
+    }
+}

Added: incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/SubjectBinder.java
URL: http://svn.apache.org/viewvc/incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/SubjectBinder.java?rev=734355&view=auto
==============================================================================
--- incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/SubjectBinder.java (added)
+++ incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/SubjectBinder.java Tue Jan 13 23:27:29
2009
@@ -0,0 +1,36 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.jsecurity.mgt;
+
+import org.jsecurity.subject.Subject;
+
+/**
+ * TODO - Class JavaDoc
+ *
+ * @author Les Hazlewood
+ * @since 1.0
+ */
+public interface SubjectBinder {
+
+    Subject getSubject();
+
+    void bind(Subject subject);
+
+    void unbind(Subject subject);
+}

Added: incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/SubjectFactory.java
URL: http://svn.apache.org/viewvc/incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/SubjectFactory.java?rev=734355&view=auto
==============================================================================
--- incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/SubjectFactory.java (added)
+++ incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/SubjectFactory.java Tue Jan 13 23:27:29
2009
@@ -0,0 +1,42 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.jsecurity.mgt;
+
+import org.jsecurity.authc.AuthenticationInfo;
+import org.jsecurity.authc.AuthenticationToken;
+import org.jsecurity.session.Session;
+import org.jsecurity.subject.PrincipalCollection;
+import org.jsecurity.subject.Subject;
+
+import java.net.InetAddress;
+
+/**
+ * TODO - Class JavaDoc
+ *
+ * @author Les Hazlewood
+ * @since 1.0
+ */
+public interface SubjectFactory {
+
+    Subject createSubject(AuthenticationToken token, AuthenticationInfo info, Subject existing);
+
+    Subject createSubject(PrincipalCollection principals, Session existing,
+                          boolean authenticated, InetAddress originatingHost);
+
+}

Added: incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/ThreadContextSubjectBinder.java
URL: http://svn.apache.org/viewvc/incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/ThreadContextSubjectBinder.java?rev=734355&view=auto
==============================================================================
--- incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/ThreadContextSubjectBinder.java (added)
+++ incubator/jsecurity/trunk/core/src/org/jsecurity/mgt/ThreadContextSubjectBinder.java Tue
Jan 13 23:27:29 2009
@@ -0,0 +1,50 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.jsecurity.mgt;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.jsecurity.subject.Subject;
+import org.jsecurity.util.ThreadContext;
+
+/**
+ * TODO - Class JavaDoc
+ *
+ * @author Les Hazlewood
+ * @since 1.0
+ */
+public class ThreadContextSubjectBinder implements SubjectBinder {
+
+    private static final Log log = LogFactory.getLog(ThreadContextSubjectBinder.class);
+
+    public Subject getSubject() {
+        return ThreadContext.getSubject();
+    }
+
+    public void bind(Subject subject) {
+        if (log.isTraceEnabled()) {
+            log.trace("Binding Subject [" + subject + "] to a thread local...");
+        }
+        ThreadContext.bind(subject);
+    }
+
+    public void unbind(Subject subject) {
+        ThreadContext.unbindSubject();
+    }
+}

Modified: incubator/jsecurity/trunk/web/src/org/jsecurity/web/DefaultWebSecurityManager.java
URL: http://svn.apache.org/viewvc/incubator/jsecurity/trunk/web/src/org/jsecurity/web/DefaultWebSecurityManager.java?rev=734355&r1=734354&r2=734355&view=diff
==============================================================================
--- incubator/jsecurity/trunk/web/src/org/jsecurity/web/DefaultWebSecurityManager.java (original)
+++ incubator/jsecurity/trunk/web/src/org/jsecurity/web/DefaultWebSecurityManager.java Tue
Jan 13 23:27:29 2009
@@ -22,18 +22,12 @@
 import org.apache.commons.logging.LogFactory;
 import org.jsecurity.mgt.DefaultSecurityManager;
 import org.jsecurity.realm.Realm;
-import org.jsecurity.session.Session;
 import org.jsecurity.session.mgt.SessionManager;
-import org.jsecurity.subject.PrincipalCollection;
-import org.jsecurity.subject.Subject;
 import org.jsecurity.util.LifecycleUtils;
 import org.jsecurity.web.session.DefaultWebSessionManager;
 import org.jsecurity.web.session.ServletContainerSessionManager;
 import org.jsecurity.web.session.WebSessionManager;
 
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import java.net.InetAddress;
 import java.util.Collection;
 
 /**
@@ -66,6 +60,7 @@
 
     public DefaultWebSecurityManager() {
         setRememberMeManager(new WebRememberMeManager());
+        setSubjectFactory(new WebSubjectFactory(this, (WebSessionManager) getSessionManager()));
     }
 
     public DefaultWebSecurityManager(Realm singleRealm) {
@@ -145,6 +140,7 @@
             LifecycleUtils.destroy(getSessionManager());
             SessionManager sm = createSessionManager();
             setSessionManager(sm);
+            setSubjectFactory(new WebSubjectFactory(this, (WebSessionManager) getSessionManager()));
         }
     }
 
@@ -165,99 +161,4 @@
             return new DefaultWebSessionManager();
         }
     }
-
-    protected PrincipalCollection getPrincipals(Session session) {
-        PrincipalCollection principals = null;
-        if (session != null) {
-            principals = (PrincipalCollection) session.getAttribute(PRINCIPALS_SESSION_KEY);
-        }
-        return principals;
-    }
-
-    protected PrincipalCollection getPrincipals(Session existing, ServletRequest servletRequest,
ServletResponse servletResponse) {
-        PrincipalCollection principals = getPrincipals(existing);
-        if (principals == null) {
-            //check remember me:
-            principals = getRememberedIdentity();
-            if (principals != null && existing != null) {
-                existing.setAttribute(PRINCIPALS_SESSION_KEY, principals);
-            }
-        }
-        return principals;
-    }
-
-    protected boolean isAuthenticated(Session session) {
-        Boolean value = null;
-        if (session != null) {
-            value = (Boolean) session.getAttribute(AUTHENTICATED_SESSION_KEY);
-        }
-        return value != null && value;
-    }
-
-    protected boolean isAuthenticated(Session existing, ServletRequest servletRequest, ServletResponse
servletResponse) {
-        return isAuthenticated(existing);
-    }
-
-    public Subject createSubject() {
-        ServletRequest request = WebUtils.getRequiredServletRequest();
-        ServletResponse response = WebUtils.getRequiredServletResponse();
-        return createSubject(request, response);
-    }
-
-    public Subject createSubject(ServletRequest request, ServletResponse response) {
-        Session session = ((WebSessionManager) getSessionManager()).getSession(request, response);
-        if (session == null) {
-            if (log.isTraceEnabled()) {
-                log.trace("No session found for the incoming request.  The Subject instance
created for " +
-                        "the incoming request will not have an associated Session.");
-            }
-        }
-        return createSubject(session, request, response);
-    }
-
-    public Subject createSubject(Session existing, ServletRequest request, ServletResponse
response) {
-        PrincipalCollection principals = getPrincipals(existing, request, response);
-        boolean authenticated = isAuthenticated(existing, request, response);
-        return createSubject(principals, authenticated, existing, request, response);
-    }
-
-    protected Subject createSubject(PrincipalCollection principals,
-                                    boolean authenticated,
-                                    Session existing,
-                                    ServletRequest request,
-                                    ServletResponse response) {
-        InetAddress inetAddress = WebUtils.getInetAddress(request);
-        return createSubject(principals, existing, authenticated, inetAddress);
-    }
-
-    protected void bind(Subject subject) {
-        super.bind(subject);
-        ServletRequest request = WebUtils.getRequiredServletRequest();
-        ServletResponse response = WebUtils.getRequiredServletResponse();
-        bind(subject, request, response);
-    }
-
-    protected void bind(Subject subject, ServletRequest request, ServletResponse response)
{
-
-        PrincipalCollection principals = subject.getPrincipals();
-        if (principals != null && !principals.isEmpty()) {
-            Session session = subject.getSession();
-            session.setAttribute(PRINCIPALS_SESSION_KEY, principals);
-        } else {
-            Session session = subject.getSession(false);
-            if (session != null) {
-                session.removeAttribute(PRINCIPALS_SESSION_KEY);
-            }
-        }
-
-        if (subject.isAuthenticated()) {
-            Session session = subject.getSession();
-            session.setAttribute(AUTHENTICATED_SESSION_KEY, subject.isAuthenticated());
-        } else {
-            Session session = subject.getSession(false);
-            if (session != null) {
-                session.removeAttribute(AUTHENTICATED_SESSION_KEY);
-            }
-        }
-    }
 }

Added: incubator/jsecurity/trunk/web/src/org/jsecurity/web/WebSubjectFactory.java
URL: http://svn.apache.org/viewvc/incubator/jsecurity/trunk/web/src/org/jsecurity/web/WebSubjectFactory.java?rev=734355&view=auto
==============================================================================
--- incubator/jsecurity/trunk/web/src/org/jsecurity/web/WebSubjectFactory.java (added)
+++ incubator/jsecurity/trunk/web/src/org/jsecurity/web/WebSubjectFactory.java Tue Jan 13
23:27:29 2009
@@ -0,0 +1,118 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.jsecurity.web;
+
+import org.jsecurity.mgt.DefaultSubjectFactory;
+import org.jsecurity.mgt.SecurityManager;
+import org.jsecurity.mgt.SessionSubjectBinder;
+import org.jsecurity.session.Session;
+import org.jsecurity.subject.PrincipalCollection;
+import org.jsecurity.subject.Subject;
+import org.jsecurity.web.session.WebSessionManager;
+
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import java.net.InetAddress;
+
+/**
+ * @author Les Hazlewood
+ * @since 1.0
+ */
+public class WebSubjectFactory extends DefaultSubjectFactory {
+
+    public static final String PRINCIPALS_SESSION_KEY = SessionSubjectBinder.PRINCIPALS_SESSION_KEY;
+    public static final String AUTHENTICATED_SESSION_KEY = SessionSubjectBinder.AUTHENTICATED_SESSION_KEY;
+
+    WebSessionManager webSessionManager;
+
+    public WebSubjectFactory() {
+    }
+
+    public WebSubjectFactory(SecurityManager securityManager) {
+        super(securityManager);
+    }
+
+    public WebSubjectFactory(SecurityManager securityManager, WebSessionManager webSessionManager)
{
+        super(securityManager);
+        setWebSessionManager(webSessionManager);
+    }
+
+    public WebSessionManager getWebSessionManager() {
+        return webSessionManager;
+    }
+
+    public void setWebSessionManager(WebSessionManager webSessionManager) {
+        this.webSessionManager = webSessionManager;
+    }
+
+    protected PrincipalCollection getPrincipals(Session existing) {
+        PrincipalCollection principals = null;
+        if (existing != null) {
+            principals = (PrincipalCollection) existing.getAttribute(PRINCIPALS_SESSION_KEY);
+        }
+//        if (principals == null) {
+//            //check remember me:
+//            principals = getRememberedIdentity();
+//            if (principals != null && existing != null) {
+//                existing.setAttribute(PRINCIPALS_SESSION_KEY, principals);
+//            }
+//        }
+        return principals;
+    }
+
+    protected boolean isAuthenticated(Session session) {
+        Boolean value = null;
+        if (session != null) {
+            value = (Boolean) session.getAttribute(AUTHENTICATED_SESSION_KEY);
+        }
+        return value != null && value;
+    }
+
+    protected Session getWebSession() {
+        ServletRequest request = WebUtils.getRequiredServletRequest();
+        ServletResponse response = WebUtils.getRequiredServletResponse();
+        return getWebSessionManager().getSession(request, response);
+    }
+
+    @Override
+    public Subject createSubject(PrincipalCollection principals, Session existing, boolean
authenticated, InetAddress inetAddress) {
+        Session session = existing;
+        if (session == null) {
+            session = getWebSession();
+        }
+
+        PrincipalCollection pc = principals;
+        if (pc == null) {
+            pc = getPrincipals(session);
+        }
+
+        boolean authc = authenticated;
+        if (!authc) {
+            //check session to be sure:
+            authc = isAuthenticated(session);
+        }
+
+        InetAddress inet = inetAddress;
+        if (inet == null) {
+            inet = WebUtils.getInetAddress(WebUtils.getRequiredServletRequest());
+        }
+
+        return super.createSubject(pc, session, authc, inet);
+    }
+}



Mime
View raw message