org.springframework.security.oauth2.provider.endpoint

Class TokenEndpointAuthenticationFilter

java.lang.Object

org.springframework.security.oauth2.provider.endpoint.TokenEndpointAuthenticationFilter

All Implemented Interfaces:

javax.servlet.Filter

public class TokenEndpointAuthenticationFilter
extends Object
implements javax.servlet.Filter

An optional authentication filter for the TokenEndpoint. It sits downstream of another filter (usually BasicAuthenticationFilter) for the client, and creates an OAuth2Authentication for the Spring SecurityContext if the request also contains user credentials, e.g. as typically would be the case in a password grant. This filter is only required if the TokenEndpoint (or one of it's dependencies) needs to know about the authenticated user. In a vanilla password grant this isn't normally necessary because the token granter will also authenticate the user.

If this filter is used the Spring Security context will contain an OAuth2Authentication encapsulating (as the authorization request) the form parameters coming into the filter and the client id from the already authenticated client authentication, and the authenticated user token extracted from the request and validated using the authentication manager.

Author:

Dave Syer

Constructor Summary

Constructors

Constructor and Description
TokenEndpointAuthenticationFilter(org.springframework.security.authentication.AuthenticationManager authenticationManager, OAuth2RequestFactory oAuth2RequestFactory)

Method Summary

Methods

Modifier and Type	Method and Description
void	destroy()
void	doFilter(javax.servlet.ServletRequest req, javax.servlet.ServletResponse res, javax.servlet.FilterChain chain)
protected org.springframework.security.core.Authentication	extractCredentials(javax.servlet.http.HttpServletRequest request) If the incoming request contains user credentials in headers or parameters then extract them here into an Authentication token that can be validated later.
void	init(javax.servlet.FilterConfig filterConfig)
protected void	onSuccessfulAuthentication(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, org.springframework.security.core.Authentication authResult)
protected void	onUnsuccessfulAuthentication(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, org.springframework.security.core.AuthenticationException failed)
void	setAuthenticationDetailsSource(org.springframework.security.authentication.AuthenticationDetailsSource<javax.servlet.http.HttpServletRequest,?> authenticationDetailsSource) A source of authentication details for requests that result in authentication.
void	setAuthenticationEntryPoint(org.springframework.security.web.AuthenticationEntryPoint authenticationEntryPoint) An authentication entry point that can handle unsuccessful authentication.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

TokenEndpointAuthenticationFilter

public TokenEndpointAuthenticationFilter(org.springframework.security.authentication.AuthenticationManager authenticationManager,
                                 OAuth2RequestFactory oAuth2RequestFactory)

Parameters:

authenticationManager - an AuthenticationManager for the incoming request

Method Detail

setAuthenticationEntryPoint

public void setAuthenticationEntryPoint(org.springframework.security.web.AuthenticationEntryPoint authenticationEntryPoint)

An authentication entry point that can handle unsuccessful authentication. Defaults to an OAuth2AuthenticationEntryPoint.

Parameters:

authenticationEntryPoint - the authenticationEntryPoint to set

setAuthenticationDetailsSource

public void setAuthenticationDetailsSource(org.springframework.security.authentication.AuthenticationDetailsSource<javax.servlet.http.HttpServletRequest,?> authenticationDetailsSource)

A source of authentication details for requests that result in authentication.

Parameters:

authenticationDetailsSource - the authenticationDetailsSource to set

doFilter

public void doFilter(javax.servlet.ServletRequest req,
            javax.servlet.ServletResponse res,
            javax.servlet.FilterChain chain)
              throws IOException,
                     javax.servlet.ServletException

Specified by:

doFilter in interface javax.servlet.Filter

Throws:

IOException

javax.servlet.ServletException

onSuccessfulAuthentication

protected void onSuccessfulAuthentication(javax.servlet.http.HttpServletRequest request,
                              javax.servlet.http.HttpServletResponse response,
                              org.springframework.security.core.Authentication authResult)
                                   throws IOException

Throws:

IOException

onUnsuccessfulAuthentication

protected void onUnsuccessfulAuthentication(javax.servlet.http.HttpServletRequest request,
                                javax.servlet.http.HttpServletResponse response,
                                org.springframework.security.core.AuthenticationException failed)
                                     throws IOException

Throws:

IOException

extractCredentials

protected org.springframework.security.core.Authentication extractCredentials(javax.servlet.http.HttpServletRequest request)

If the incoming request contains user credentials in headers or parameters then extract them here into an Authentication token that can be validated later. This implementation only recognises password grant requests and extracts the username and password.

Parameters:

request - the incoming request, possibly with user credentials

Returns:

an authentication for validation (or null if there is no further authentication)

init

public void init(javax.servlet.FilterConfig filterConfig)
          throws javax.servlet.ServletException

Specified by:

init in interface javax.servlet.Filter

Throws:

javax.servlet.ServletException

destroy

public void destroy()

Specified by:

destroy in interface javax.servlet.Filter