Package org.eclipse.jetty.annotations

Class ServletSecurityAnnotationHandler

java.lang.Object

org.eclipse.jetty.annotations.AnnotationIntrospector.AbstractIntrospectableAnnotationHandler

org.eclipse.jetty.annotations.ServletSecurityAnnotationHandler

All Implemented Interfaces:

AnnotationIntrospector.IntrospectableAnnotationHandler

public class ServletSecurityAnnotationHandler
extends AnnotationIntrospector.AbstractIntrospectableAnnotationHandler

ServletSecurityAnnotationHandler Inspect a class to see if it has an @ServletSecurity annotation on it, setting up the <security-constraint>s. A servlet can be defined in:

• web.xml
• web-fragment.xml
• @WebServlet annotation discovered
• ServletContext.createServlet

The ServletSecurity annotation for a servlet should only be processed iff metadata-complete == false.

Constructor Summary

Constructors

Constructor	Description
ServletSecurityAnnotationHandler(org.eclipse.jetty.webapp.WebAppContext wac)

Method Summary

Modifier and Type	Method	Description
protected boolean	constraintsExist(java.util.List<org.eclipse.jetty.servlet.ServletMapping> servletMappings, java.util.List<org.eclipse.jetty.security.ConstraintMapping> constraintMappings)	Check if there are already <security-constraint> elements defined that match the url-patterns for the servlet.
void	doHandle(java.lang.Class clazz)
protected java.util.List<org.eclipse.jetty.servlet.ServletMapping>	getServletMappings(java.lang.String className)	Get the ServletMappings for the servlet's class.
protected org.eclipse.jetty.util.security.Constraint	makeConstraint(java.lang.Class servlet, java.lang.String[] rolesAllowed, ServletSecurity.EmptyRoleSemantic permitOrDeny, ServletSecurity.TransportGuarantee transport)	Make a jetty Constraint object, which represents the <auth-constraint> and <user-data-constraint> elements, based on the security annotation.

Methods inherited from class org.eclipse.jetty.annotations.AnnotationIntrospector.AbstractIntrospectableAnnotationHandler

handle

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

ServletSecurityAnnotationHandler

public ServletSecurityAnnotationHandler(org.eclipse.jetty.webapp.WebAppContext wac)

Method Detail

doHandle

public void doHandle(java.lang.Class clazz)

Specified by:

doHandle in class AnnotationIntrospector.AbstractIntrospectableAnnotationHandler

See Also:

AnnotationIntrospector.IntrospectableAnnotationHandler.handle(java.lang.Class)

makeConstraint

protected org.eclipse.jetty.util.security.Constraint makeConstraint(java.lang.Class servlet,
                                                                    java.lang.String[] rolesAllowed,
                                                                    ServletSecurity.EmptyRoleSemantic permitOrDeny,
                                                                    ServletSecurity.TransportGuarantee transport)

Make a jetty Constraint object, which represents the <auth-constraint> and <user-data-constraint> elements, based on the security annotation.

Parameters:

servlet - the servlet

rolesAllowed - the roles allowed

permitOrDeny - the role / permission semantic

transport - the transport guarantee

Returns:

the constraint

getServletMappings

protected java.util.List<org.eclipse.jetty.servlet.ServletMapping> getServletMappings(java.lang.String className)

Get the ServletMappings for the servlet's class.

Parameters:

className - the class name

Returns:

the servlet mappings for the class

constraintsExist

protected boolean constraintsExist(java.util.List<org.eclipse.jetty.servlet.ServletMapping> servletMappings,
                                   java.util.List<org.eclipse.jetty.security.ConstraintMapping> constraintMappings)

Check if there are already <security-constraint> elements defined that match the url-patterns for the servlet.

Parameters:

servletMappings - the servlet mappings

constraintMappings - the constraint mappings

Returns:

true if constraint exists