org.jasig.cas.web.support

Class InspektrThrottledSubmissionByIpAddressAndUsernameHandlerInterceptorAdapter

java.lang.Object

org.springframework.web.servlet.handler.HandlerInterceptorAdapter

org.jasig.cas.web.support.AbstractThrottledSubmissionHandlerInterceptorAdapter

org.jasig.cas.web.support.InspektrThrottledSubmissionByIpAddressAndUsernameHandlerInterceptorAdapter

All Implemented Interfaces:

org.springframework.beans.factory.InitializingBean, org.springframework.web.servlet.AsyncHandlerInterceptor, org.springframework.web.servlet.HandlerInterceptor

public class InspektrThrottledSubmissionByIpAddressAndUsernameHandlerInterceptorAdapter
extends AbstractThrottledSubmissionHandlerInterceptorAdapter

Works in conjunction with the Inspektr Library to block attempts to dictionary attack users.

Defines a new Inspektr Action "THROTTLED_LOGIN_ATTEMPT" which keeps track of failed login attempts that don't result in AUTHENTICATION_FAILED methods

This relies on the default Inspektr table layout and username construction. The username construction can be overriden in a subclass.

Since:

3.3.5

Author:

Scott Battaglia

Field Summary

Fields inherited from class org.jasig.cas.web.support.AbstractThrottledSubmissionHandlerInterceptorAdapter

logger

Constructor Summary

Constructors

Constructor and Description
InspektrThrottledSubmissionByIpAddressAndUsernameHandlerInterceptorAdapter(org.jasig.inspektr.audit.AuditTrailManager auditTrailManager, DataSource dataSource) Instantiates a new inspektr throttled submission by ip address and username handler interceptor adapter.

Method Summary

Methods

Modifier and Type	Method and Description
protected String	constructUsername(javax.servlet.http.HttpServletRequest request, String usernameParameter) Construct username from the request.
protected boolean	exceedsThreshold(javax.servlet.http.HttpServletRequest request) Determine whether threshold has been exceeded.
protected void	recordSubmissionFailure(javax.servlet.http.HttpServletRequest request) Record submission failure.
protected void	recordThrottle(javax.servlet.http.HttpServletRequest request) Record throttling event.
void	setApplicationCode(String applicationCode)
void	setAuthenticationFailureCode(String authenticationFailureCode)

Methods inherited from class org.jasig.cas.web.support.AbstractThrottledSubmissionHandlerInterceptorAdapter

afterPropertiesSet, getFailureRangeInSeconds, getFailureThreshold, getThresholdRate, getUsernameParameter, postHandle, preHandle, setFailureRangeInSeconds, setFailureThreshold, setUsernameParameter, toString

Methods inherited from class org.springframework.web.servlet.handler.HandlerInterceptorAdapter

afterCompletion, afterConcurrentHandlingStarted

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

InspektrThrottledSubmissionByIpAddressAndUsernameHandlerInterceptorAdapter

public InspektrThrottledSubmissionByIpAddressAndUsernameHandlerInterceptorAdapter(org.jasig.inspektr.audit.AuditTrailManager auditTrailManager,
                                                                          DataSource dataSource)

Instantiates a new inspektr throttled submission by ip address and username handler interceptor adapter.

Parameters:

auditTrailManager - the audit trail manager

dataSource - the data source

Method Detail

exceedsThreshold

protected boolean exceedsThreshold(javax.servlet.http.HttpServletRequest request)

Description copied from class: AbstractThrottledSubmissionHandlerInterceptorAdapter

Determine whether threshold has been exceeded.

Specified by:

exceedsThreshold in class AbstractThrottledSubmissionHandlerInterceptorAdapter

Parameters:

request - the request

Returns:

true, if successful

recordSubmissionFailure

protected void recordSubmissionFailure(javax.servlet.http.HttpServletRequest request)

Description copied from class: AbstractThrottledSubmissionHandlerInterceptorAdapter

Record submission failure.

Specified by:

recordSubmissionFailure in class AbstractThrottledSubmissionHandlerInterceptorAdapter

Parameters:

request - the request

recordThrottle

protected void recordThrottle(javax.servlet.http.HttpServletRequest request)

Description copied from class: AbstractThrottledSubmissionHandlerInterceptorAdapter

Record throttling event.

Overrides:

recordThrottle in class AbstractThrottledSubmissionHandlerInterceptorAdapter

Parameters:

request - the request

setApplicationCode

public final void setApplicationCode(String applicationCode)

setAuthenticationFailureCode

public final void setAuthenticationFailureCode(String authenticationFailureCode)

constructUsername

protected String constructUsername(javax.servlet.http.HttpServletRequest request,
                       String usernameParameter)

Construct username from the request.

Parameters:

request - the request

usernameParameter - the username parameter

Returns:

the string