Package org.apache.jackrabbit.oak.spi.security.authentication

Class AbstractLoginModule

java.lang.Object
org.apache.jackrabbit.oak.spi.security.authentication.AbstractLoginModule
All Implemented Interfaces:
LoginModule
Direct Known Subclasses:
ExternalLoginModule, LoginModuleImpl, TokenLoginModule
@ProviderType public abstract class AbstractLoginModule extends Object implements LoginModule
Abstract implementation of the LoginModule interface that can act as base class for login modules that aim to authenticate subjects against information stored in the content repository.

LoginModule Methods

This base class provides a simple implementation for the following methods of the LoginModule interface:

  • Initialize: Initialization of this abstract module sets the following protected instance fields:
    • subject: The subject to be authenticated,
    • callbackHandler: The callback handler passed to the login module,
    • shareState: The map used to share state information with other login modules,
    • options: The configuration options of this login module as specified in the Configuration.
  • Logout: If the authenticated subject is not empty this logout implementation attempts to clear both principals and public credentials and returns true.
  • Abort: Clears the state of this login module by setting all private instance variables created in phase 1 or 2 to null. Subclasses are in charge of releasing their own state information by either overriding clearState().

Utility Methods

The following methods are provided in addition:

  • Field Details

    • SHARED_KEY_CREDENTIALS

      public static final String SHARED_KEY_CREDENTIALS
      Key of the sharedState entry referring to validated Credentials that is shared between multiple login modules.
      See Also:

    • SHARED_KEY_LOGIN_NAME

      public static final String SHARED_KEY_LOGIN_NAME
      Key of the sharedState entry referring to a valid login ID that is shared between multiple login modules.
      See Also:

    • SHARED_KEY_ATTRIBUTES

      public static final String SHARED_KEY_ATTRIBUTES
      Key of the sharedState entry referring to public attributes that are shared between multiple login modules.
      See Also:

    • SHARED_KEY_PRE_AUTH_LOGIN

      public static final String SHARED_KEY_PRE_AUTH_LOGIN
      Key of the sharedState entry referring to pre authenticated login information that is shared between multiple login modules.

    • subject

      protected Subject subject

    • callbackHandler

      protected CallbackHandler callbackHandler

    • sharedState

      protected Map sharedState

    • options

      protected ConfigurationParameters options

  • Constructor Details

    • AbstractLoginModule

      public AbstractLoginModule()

  • Method Details

    • initialize

      public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String,?> sharedState, Map<String,?> options)
      Specified by:
      initialize in interface LoginModule

    • logout

      public boolean logout() throws LoginException
      Besteffort default implementation of LoginModule.logout(), which removes all principals and all public credentials of type Credentials and AuthInfo from the subject. It will return false, if either principal set or credentials set is empty. Note, that this implementation is not able to only remove those principals/credentials that have been added by this very login module instance. Therefore subclasses should overwrite this method to provide a fully compliant solution of logout(). They may however take advantage of logout(Set, Set) in order to simplify the implementation of a logout that is compatible with the LoginModule.logout() contract incorporating the additional recommendations highlighted at JAAS LoginModule Dev Guide
      Specified by:
      logout in interface LoginModule
      Returns:
      true if neither principals nor public credentials of type Credentials or AuthInfo stored in the Subject are empty; false otherwise
      Throws:
      LoginException - if the subject is readonly and destroying Destroyable credentials fails with DestroyFailedException.

    • abort

      public boolean abort() throws LoginException
      Specified by:
      abort in interface LoginModule
      Throws:
      LoginException

    • clearState

      protected void clearState()
      Clear state information that has been created during LoginModule.login().

    • closeSystemSession

      protected void closeSystemSession()
      Close the system session acquired upon getRoot() and reset the associated root field. This method should be used instead of clearState(), if LoginModule.login() and LoginModule.commit() were successfully completed but the system session is not needed for a successful logout()

    • logout

      protected boolean logout(@Nullable @Nullable Set<Object> credentials, @Nullable @Nullable Set<? extends Principal> principals) throws LoginException
      General logout-helper that will return false if both credentials and principals are null. Note, that this implementation will only throw LoginException if the subject is marked readonly and destroying Destroyable credentials fails.
      Parameters:
      credentials - The set of credentials extracted by this instance during login/commit to be removed from Subject.getPublicCredentials()
      principals - A set of principals extracted by this instance during login/commit to be removed from Subject.getPrincipals()
      Returns:
      true if either the credential set or the principal set is not null, false otherwise.
      Throws:
      LoginException - If the subject is readonly and an error occurs while destroying any of the given credentials.
      See Also:

    • getSupportedCredentials

      @NotNull protected abstract @NotNull Set<Class> getSupportedCredentials()
      Returns:
      A set of supported credential classes.

    • getCredentials

      @Nullable protected @Nullable Credentials getCredentials()
      Tries to retrieve valid (supported) Credentials:
      1. using a CredentialsCallback,
      2. looking for a SHARED_KEY_CREDENTIALS entry in the shared state (see also getSharedCredentials() and finally by
      3. searching for valid credentials in the subject.
      Returns:
      Valid (supported) credentials or null.

    • getSharedCredentials

      @Nullable protected @Nullable Credentials getSharedCredentials()
      Returns:
      The credentials passed to this login module with the shared state.
      See Also:

    • getSharedLoginName

      @Nullable protected @Nullable String getSharedLoginName()
      Returns:
      The login name passed to this login module with the shared state.
      See Also:

    • getSharedPreAuthLogin

      @Nullable protected @Nullable PreAuthenticatedLogin getSharedPreAuthLogin()
      Returns:
      The pre authenticated login or null
      See Also:

    • getSecurityProvider

      @Nullable protected @Nullable SecurityProvider getSecurityProvider()
      Tries to obtain the SecurityProvider object from the callback handler using a new SecurityProviderCallback and keeps the value as private field. If the callback handler isn't able to handle the SecurityProviderCallback this method returns null.
      Returns:
      The SecurityProvider associated with this LoginModule or null.

    • getWhiteboard

      @Nullable protected @Nullable Whiteboard getWhiteboard()
      Tries to obtain the Whiteboard object from the callback handler using a new WhiteboardCallback and keeps the value as private field. If the callback handler isn't able to handle the WhiteboardCallback this method returns null.
      Returns:
      The Whiteboard associated with this LoginModule or null.

    • getRoot

      @Nullable protected @Nullable Root getRoot()
      Tries to obtain a Root object from the callback handler using a new RepositoryCallback and keeps the value as private field. If the callback handler isn't able to handle the RepositoryCallback this method returns null.
      Returns:
      The Root associated with this LoginModule or null.

    • getUserManager

      @Nullable protected @Nullable UserManager getUserManager()
      Retrieves the UserManager that should be used to handle this authentication. If no user manager has been configure this method returns null.
      Returns:
      A instance of UserManager or null.

    • getPrincipalProvider

      @Nullable protected @Nullable PrincipalProvider getPrincipalProvider()
      Retrieves the PrincipalProvider that should be used to handle this authentication. If no principal provider has been configure this method returns null.
      Returns:
      A instance of PrincipalProvider or null.

    • getPrincipals

      @NotNull protected @NotNull Set<? extends Principal> getPrincipals(@NotNull @NotNull String userId)
      Retrieves all principals associated with the specified userId for the configured principal provider.
      Parameters:
      userId - The id of the user.
      Returns:
      The set of principals associated with the given userId.
      See Also:

    • getPrincipals

      @NotNull protected @NotNull Set<? extends Principal> getPrincipals(@NotNull @NotNull Principal userPrincipal)

    • setAuthInfo

      protected static void setAuthInfo(@NotNull @NotNull AuthInfo authInfo, @NotNull @NotNull Subject subject)

    • getLoginModuleMonitor

      @NotNull protected @NotNull LoginModuleMonitor getLoginModuleMonitor()

    • onError

      protected void onError()