org.acegisecurity.ui
Class ExceptionTranslationFilter

java.lang.Object
  org.acegisecurity.ui.ExceptionTranslationFilter

All Implemented Interfaces:

javax.servlet.Filter, org.springframework.beans.factory.InitializingBean

public class ExceptionTranslationFilter
extends Object
implements javax.servlet.Filter, org.springframework.beans.factory.InitializingBean

Handles any AccessDeniedException and AuthenticationException thrown within the filter chain.

This filter is necessary because it provides the bridge between Java exceptions and HTTP responses. It is solely concerned with maintaining the user interface. This filter does not do any actual security enforcement.

If an AuthenticationException is detected, the filter will launch the authenticationEntryPoint. This allows common handling of authentication failures originating from any subclass of AbstractSecurityInterceptor.

If an AccessDeniedException is detected, the filter will determine whether or not the user is an anonymous user. If they are an anonymous user, the authenticationEntryPoint will be launched. If they are not an anonymous user, the filter will delegate to the AccessDeniedHandler. By default the filter will use AccessDeniedHandlerImpl.

To use this filter, it is necessary to specify the following properties:

• authenticationEntryPoint indicates the handler that should commence the authentication process if an AuthenticationException is detected. Note that this may also switch the current protocol from http to https for an SSL login.
• portResolver is used to determine the "real" port that a request was received on.

Do not use this class directly. Instead configure web.xml to use the FilterToBeanProxy.

Version:

$Id: ExceptionTranslationFilter.java 2134 2007-09-19 16:41:06Z luke_t $

Author:

Ben Alex, colin sampaleanu

Constructor Summary

ExceptionTranslationFilter()

Method Summary

void	afterPropertiesSet()
void	destroy()
void	doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain)
AuthenticationEntryPoint	getAuthenticationEntryPoint()
AuthenticationTrustResolver	getAuthenticationTrustResolver()
PortResolver	getPortResolver()
void	init(javax.servlet.FilterConfig filterConfig)
boolean	isCreateSessionAllowed() If true, indicates that SecurityEnforcementFilter is permitted to store the target URL and exception information in the HttpSession (the default).
protected void	sendStartAuthentication(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain, AuthenticationException reason)
void	setAccessDeniedHandler(AccessDeniedHandler accessDeniedHandler)
void	setAuthenticationEntryPoint(AuthenticationEntryPoint authenticationEntryPoint)
void	setAuthenticationTrustResolver(AuthenticationTrustResolver authenticationTrustResolver)
void	setCreateSessionAllowed(boolean createSessionAllowed)
void	setPortResolver(PortResolver portResolver)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

ExceptionTranslationFilter

public ExceptionTranslationFilter()

Method Detail

afterPropertiesSet

public void afterPropertiesSet()
                        throws Exception

Specified by:

afterPropertiesSet in interface org.springframework.beans.factory.InitializingBean

Throws:

Exception

doFilter

public void doFilter(javax.servlet.ServletRequest request,
                     javax.servlet.ServletResponse response,
                     javax.servlet.FilterChain chain)
              throws IOException,
                     javax.servlet.ServletException

Specified by:

doFilter in interface javax.servlet.Filter

Throws:

IOException

javax.servlet.ServletException

getAuthenticationEntryPoint

public AuthenticationEntryPoint getAuthenticationEntryPoint()

getAuthenticationTrustResolver

public AuthenticationTrustResolver getAuthenticationTrustResolver()

getPortResolver

public PortResolver getPortResolver()

isCreateSessionAllowed

public boolean isCreateSessionAllowed()

If true, indicates that SecurityEnforcementFilter is permitted to store the target URL and exception information in the HttpSession (the default). In situations where you do not wish to unnecessarily create HttpSessions - because the user agent will know the failed URL, such as with BASIC or Digest authentication - you may wish to set this property to false. Remember to also set the HttpSessionContextIntegrationFilter.allowSessionCreation to false if you set this property to false.

Returns:

true if the HttpSession will be used to store information about the failed request, false if the HttpSession will not be used

sendStartAuthentication

protected void sendStartAuthentication(javax.servlet.ServletRequest request,
                                       javax.servlet.ServletResponse response,
                                       javax.servlet.FilterChain chain,
                                       AuthenticationException reason)
                                throws javax.servlet.ServletException,
                                       IOException

Throws:

javax.servlet.ServletException

IOException

setAccessDeniedHandler

public void setAccessDeniedHandler(AccessDeniedHandler accessDeniedHandler)

setAuthenticationEntryPoint

public void setAuthenticationEntryPoint(AuthenticationEntryPoint authenticationEntryPoint)

setAuthenticationTrustResolver

public void setAuthenticationTrustResolver(AuthenticationTrustResolver authenticationTrustResolver)

setCreateSessionAllowed

public void setCreateSessionAllowed(boolean createSessionAllowed)

setPortResolver

public void setPortResolver(PortResolver portResolver)

init

public void init(javax.servlet.FilterConfig filterConfig)
          throws javax.servlet.ServletException

Specified by:

init in interface javax.servlet.Filter

Throws:

javax.servlet.ServletException

destroy

public void destroy()

Specified by:

destroy in interface javax.servlet.Filter