software.sandc.springframework.security.jwt.authority

Class JWTAuthority

java.lang.Object

software.sandc.springframework.security.jwt.consumer.JWTConsumer

software.sandc.springframework.security.jwt.authority.JWTAuthority

All Implemented Interfaces:

org.springframework.beans.factory.InitializingBean

public class JWTAuthority
extends JWTConsumer
implements org.springframework.beans.factory.InitializingBean

Field Summary

Fields

Modifier and Type	Field and Description
protected AuthorityKeyProvider	authorityKeyProvider
protected org.springframework.security.crypto.password.PasswordEncoder	passwordEncoder
protected boolean	refreshSessionOnAuthentication
protected boolean	refreshSessionOnRenewal
protected int	sessionInvalidationDelayInMinutes
protected SessionProvider	sessionProvider
protected int	tokenLifetimeInSeconds
protected org.springframework.security.core.userdetails.UserDetailsChecker	userDetailsChecker
protected org.springframework.security.core.userdetails.UserDetailsService	userDetailsService

Fields inherited from class software.sandc.springframework.security.jwt.consumer.JWTConsumer

authoritiesParameterName, jwtAuthorityConnector, jwtRequestResponseHandler, sessionIdParameterName, signingKeyResolver, SPRING_SECURITY_JWT_AUTHORITIES_PARAMETER_NAME, SPRING_SECURITY_JWT_SESSION_ID_PARAMETER_NAME, SPRING_SECURITY_JWT_XSRF_PARAMETER_NAME, TEN_YEARS_IN_SECONDS, xsrfParameterName

Constructor Summary

Constructors

Constructor and Description
JWTAuthority(org.springframework.security.core.userdetails.UserDetailsService userDetailsService)

Method Summary

Modifier and Type	Method and Description
void	afterPropertiesSet()
JWTContext	authenticateJWTRequest(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)
JWTContext	authenticateLoginRequest(Credentials credentials, javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)
protected String	convertToString(Collection<? extends org.springframework.security.core.GrantedAuthority> authorities)
JWTContext	create(String principal, Parameters parameters) Creates JWTContext for given principal.
JWTContext	createAndAttach(String principal, javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, Parameters parameters)
JWTContext	createAndAttachInvalidToken(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) This method can be used to overwrite existing valid token on the client side.
protected String	generateXSRFToken()
AuthorityKeyProvider	getAuthorityKeyProvider()
protected List<String>	getAuthorityListAsString(Collection<? extends org.springframework.security.core.GrantedAuthority> authorities)
org.springframework.security.crypto.password.PasswordEncoder	getPasswordEncoder()
int	getSessionInvalidationDelayInMinutes()
SessionProvider	getSessionProvider()
int	getTokenLifetimeInSeconds()
protected org.springframework.security.core.userdetails.UserDetails	getUserDetails(String principal)
org.springframework.security.core.userdetails.UserDetailsChecker	getUserDetailsChecker()
org.springframework.security.core.userdetails.UserDetailsService	getUserDetailsService()
protected void	handleJWTContext(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, JWTContext jwtContext)
boolean	isTokenRenewalEnabled()
protected boolean	isXSRFProtectionDisabled(Parameters parameters)
protected void	refreshSession(JWTContext jwtContext)
JWTContext	renew(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)
JWTContext	renew(TokenContainer tokenContainer, Parameters parameters)
void	setAuthorityKeyProvider(AuthorityKeyProvider authorityKeyProvider)
void	setPasswordEncoder(org.springframework.security.crypto.password.PasswordEncoder passwordEncoder) Set custom password encoder.
void	setRefreshSessionOnAuthentication(boolean refreshSessionOnAuthentication) Refresh related session on each JWT authentication step.
void	setRefreshSessionOnRenewal(boolean refreshSessionOnRenewal) Refresh related session on each JWT renewal.
void	setSessionInvalidationDelayInMinutes(int sessionInvalidationDelayInMinutes) Set session invalidation delay in minutes.
void	setSessionProvider(SessionProvider sessionProvider)
void	setTokenLifetimeInSeconds(int tokenLifetimeInSeconds) Set token lifetime in seconds.
void	setUserDetailsChecker(org.springframework.security.core.userdetails.UserDetailsChecker userDetailsChecker) Set UserDetailsChecker which will be used to validate the loaded UserDetails object.
void	setUserDetailsService(org.springframework.security.core.userdetails.UserDetailsService userDetailsService)

Methods inherited from class software.sandc.springframework.security.jwt.consumer.JWTConsumer

createJWTContext, extractPrincipal, extractSessionId, getAuthorities, getJWTModeFromParameters, getJwtRequestResponseHandler, setAuthoritiesParameterName, setJWTAuthorityConnector, setJwtRequestResponseHandler, setSessionIdParameterName, setSigningKeyResolver, setXsrfParameterName, validate, validateXSRF

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

userDetailsService

protected org.springframework.security.core.userdetails.UserDetailsService userDetailsService

sessionProvider

protected SessionProvider sessionProvider

userDetailsChecker

protected org.springframework.security.core.userdetails.UserDetailsChecker userDetailsChecker

tokenLifetimeInSeconds

protected int tokenLifetimeInSeconds

sessionInvalidationDelayInMinutes

protected int sessionInvalidationDelayInMinutes

passwordEncoder

protected org.springframework.security.crypto.password.PasswordEncoder passwordEncoder

authorityKeyProvider

protected AuthorityKeyProvider authorityKeyProvider

refreshSessionOnAuthentication

protected boolean refreshSessionOnAuthentication

refreshSessionOnRenewal

protected boolean refreshSessionOnRenewal

Constructor Detail

JWTAuthority

public JWTAuthority(org.springframework.security.core.userdetails.UserDetailsService userDetailsService)

Method Detail

authenticateJWTRequest

public JWTContext authenticateJWTRequest(javax.servlet.http.HttpServletRequest request,
                                         javax.servlet.http.HttpServletResponse response)

Overrides:

authenticateJWTRequest in class JWTConsumer

authenticateLoginRequest

public JWTContext authenticateLoginRequest(Credentials credentials,
                                           javax.servlet.http.HttpServletRequest request,
                                           javax.servlet.http.HttpServletResponse response)

createAndAttach

public JWTContext createAndAttach(String principal,
                                  javax.servlet.http.HttpServletRequest request,
                                  javax.servlet.http.HttpServletResponse response,
                                  Parameters parameters)

createAndAttachInvalidToken

public JWTContext createAndAttachInvalidToken(javax.servlet.http.HttpServletRequest request,
                                              javax.servlet.http.HttpServletResponse response)

This method can be used to overwrite existing valid token on the client side. Please be aware that, there is no guarantee to overwrite existing token in app mode on the client side.

Parameters:

request - HttpServletRequest object

response - HttpServletResponse object

Returns:

An invalid JWTContext object.

create

public JWTContext create(String principal,
                         Parameters parameters)
                  throws UserNotFoundException

Creates JWTContext for given principal. A JWTContext contains all relevant tokens (like JWT or XSRF Tokens) and JWTAuthentication object, which is relevant for Spring-Security.

Parameters:

principal - Unique user identifier. This can be the user name or user id according to underlying implementation.

Returns:

Fully fledged JWTContext object.

Throws:

UserNotFoundException - if the user identified with given principal cannot be found.

renew

public JWTContext renew(javax.servlet.http.HttpServletRequest request,
                        javax.servlet.http.HttpServletResponse response)

renew

public JWTContext renew(TokenContainer tokenContainer,
                        Parameters parameters)

afterPropertiesSet

public void afterPropertiesSet()
                        throws Exception

Specified by:

afterPropertiesSet in interface org.springframework.beans.factory.InitializingBean

Overrides:

afterPropertiesSet in class JWTConsumer

Throws:

Exception

isTokenRenewalEnabled

public boolean isTokenRenewalEnabled()

getUserDetailsService

public org.springframework.security.core.userdetails.UserDetailsService getUserDetailsService()

setUserDetailsService

public void setUserDetailsService(org.springframework.security.core.userdetails.UserDetailsService userDetailsService)

setSessionProvider

public void setSessionProvider(SessionProvider sessionProvider)

setAuthorityKeyProvider

public void setAuthorityKeyProvider(AuthorityKeyProvider authorityKeyProvider)

setUserDetailsChecker

public void setUserDetailsChecker(org.springframework.security.core.userdetails.UserDetailsChecker userDetailsChecker)

Set UserDetailsChecker which will be used to validate the loaded UserDetails object.

Parameters:

userDetailsChecker - An instance of user details checker implementation.

setTokenLifetimeInSeconds

public void setTokenLifetimeInSeconds(int tokenLifetimeInSeconds)

Set token lifetime in seconds.

Parameters:

tokenLifetimeInSeconds - Token lifetime in seconds.

setSessionInvalidationDelayInMinutes

public void setSessionInvalidationDelayInMinutes(int sessionInvalidationDelayInMinutes)

Set session invalidation delay in minutes.

Parameters:

sessionInvalidationDelayInMinutes - Session invalidation delay in minutes.

setPasswordEncoder

public void setPasswordEncoder(org.springframework.security.crypto.password.PasswordEncoder passwordEncoder)

Set custom password encoder.

Parameters:

passwordEncoder - Password encoder

getSessionProvider

public SessionProvider getSessionProvider()

getUserDetailsChecker

public org.springframework.security.core.userdetails.UserDetailsChecker getUserDetailsChecker()

getTokenLifetimeInSeconds

public int getTokenLifetimeInSeconds()

getSessionInvalidationDelayInMinutes

public int getSessionInvalidationDelayInMinutes()

getPasswordEncoder

public org.springframework.security.crypto.password.PasswordEncoder getPasswordEncoder()

getAuthorityKeyProvider

public AuthorityKeyProvider getAuthorityKeyProvider()

setRefreshSessionOnAuthentication

public void setRefreshSessionOnAuthentication(boolean refreshSessionOnAuthentication)

Refresh related session on each JWT authentication step. If you enable this, you can track user activity (by saving last touch date and other user related data) more precisely but this may cause increased database overhead.

Default value is false

Parameters:

refreshSessionOnAuthentication -

setRefreshSessionOnRenewal

public void setRefreshSessionOnRenewal(boolean refreshSessionOnRenewal)

Refresh related session on each JWT renewal. If you disable this, you cannot track user activity (by saving last touch date and other user related data) via user sessions.

Default value is true

Parameters:

refreshSessionOnRenewal -

generateXSRFToken

protected String generateXSRFToken()

convertToString

protected String convertToString(Collection<? extends org.springframework.security.core.GrantedAuthority> authorities)

getUserDetails

protected org.springframework.security.core.userdetails.UserDetails getUserDetails(String principal)

getAuthorityListAsString

protected List<String> getAuthorityListAsString(Collection<? extends org.springframework.security.core.GrantedAuthority> authorities)

refreshSession

protected void refreshSession(JWTContext jwtContext)

handleJWTContext

protected void handleJWTContext(javax.servlet.http.HttpServletRequest request,
                                javax.servlet.http.HttpServletResponse response,
                                JWTContext jwtContext)

Overrides:

handleJWTContext in class JWTConsumer

isXSRFProtectionDisabled

protected boolean isXSRFProtectionDisabled(Parameters parameters)