Package org.camunda.bpm.engine.rest.security.auth

Class ProcessEngineAuthenticationFilter

java.lang.Object

org.camunda.bpm.engine.rest.security.auth.ProcessEngineAuthenticationFilter

All Implemented Interfaces:

javax.servlet.Filter

public class ProcessEngineAuthenticationFilter
extends java.lang.Object
implements javax.servlet.Filter

Servlet filter to plug in authentication.

Valid init-params:

Parameter	Required	Expected value
"authentication-provider"	yes	An implementation of AuthenticationProvider
"rest-url-pattern-prefix"	no	The expected servlet path. Should only be set, if the underlying JAX-RS application is not deployed as a servlet (e.g. Resteasy allows deployments as a servlet filter). Value has to match what would be the HttpServletRequest.getServletPath() if it was deployed as a servlet.

Author:

Thorben Lindhauer

Field Summary

Fields

Modifier and Type	Field	Description
static java.lang.String	AUTHENTICATION_PROVIDER_PARAM
protected AuthenticationProvider	authenticationProvider
protected static java.lang.String	DEFAULT_ENGINE_NAME
protected static java.util.regex.Pattern	ENGINE_REQUEST_URL_PATTERN
static java.lang.String	SERVLET_PATH_PREFIX
protected java.lang.String	servletPathPrefix
protected static java.util.regex.Pattern[]	WHITE_LISTED_URL_PATTERNS

Constructor Summary

Constructors

Constructor	Description
ProcessEngineAuthenticationFilter()

Method Summary

Modifier and Type	Method	Description
protected void	clearAuthentication(ProcessEngine engine)
void	destroy()
void	doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain)
protected java.lang.String	extractEngineName(java.lang.String requestUrl)	May not return null
protected ProcessEngine	getAddressedEngine(java.lang.String engineName)
protected java.util.List<java.lang.String>	getGroupsOfUser(ProcessEngine engine, java.lang.String userId)
protected java.util.List<java.lang.String>	getTenantsOfUser(ProcessEngine engine, java.lang.String userId)
void	init(javax.servlet.FilterConfig filterConfig)
protected boolean	requiresEngineAuthentication(java.lang.String requestUrl)
protected void	setAuthenticatedUser(ProcessEngine engine, java.lang.String userId, java.util.List<java.lang.String> groupIds, java.util.List<java.lang.String> tenantIds)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

WHITE_LISTED_URL_PATTERNS

protected static final java.util.regex.Pattern[] WHITE_LISTED_URL_PATTERNS

ENGINE_REQUEST_URL_PATTERN

protected static final java.util.regex.Pattern ENGINE_REQUEST_URL_PATTERN

DEFAULT_ENGINE_NAME

protected static final java.lang.String DEFAULT_ENGINE_NAME

See Also:

Constant Field Values

AUTHENTICATION_PROVIDER_PARAM

public static final java.lang.String AUTHENTICATION_PROVIDER_PARAM

See Also:

Constant Field Values

SERVLET_PATH_PREFIX

public static final java.lang.String SERVLET_PATH_PREFIX

See Also:

Constant Field Values

authenticationProvider

protected AuthenticationProvider authenticationProvider

servletPathPrefix

protected java.lang.String servletPathPrefix

Constructor Detail

ProcessEngineAuthenticationFilter

public ProcessEngineAuthenticationFilter()

Method Detail

init

public void init(javax.servlet.FilterConfig filterConfig)
          throws javax.servlet.ServletException

Specified by:

init in interface javax.servlet.Filter

Throws:

javax.servlet.ServletException

doFilter

public void doFilter(javax.servlet.ServletRequest request,
                     javax.servlet.ServletResponse response,
                     javax.servlet.FilterChain chain)
              throws java.io.IOException,
                     javax.servlet.ServletException

Specified by:

doFilter in interface javax.servlet.Filter

Throws:

java.io.IOException

javax.servlet.ServletException

destroy

public void destroy()

Specified by:

destroy in interface javax.servlet.Filter

setAuthenticatedUser

protected void setAuthenticatedUser(ProcessEngine engine,
                                    java.lang.String userId,
                                    java.util.List<java.lang.String> groupIds,
                                    java.util.List<java.lang.String> tenantIds)

getGroupsOfUser

protected java.util.List<java.lang.String> getGroupsOfUser(ProcessEngine engine,
                                                           java.lang.String userId)

getTenantsOfUser

protected java.util.List<java.lang.String> getTenantsOfUser(ProcessEngine engine,
                                                            java.lang.String userId)

clearAuthentication

protected void clearAuthentication(ProcessEngine engine)

requiresEngineAuthentication

protected boolean requiresEngineAuthentication(java.lang.String requestUrl)

extractEngineName

protected java.lang.String extractEngineName(java.lang.String requestUrl)

May not return null

getAddressedEngine

protected ProcessEngine getAddressedEngine(java.lang.String engineName)