SingleSignOn (Apache Tomcat 6.0.53 API Documentation)

Overview

Package

Class

Tree

Deprecated

Index

Help

Apache Tomcat 6.0.53

PREV CLASS NEXT CLASS

FRAMES NO FRAMES

SUMMARY: NESTED | FIELD | CONSTR | METHOD

DETAIL: FIELD | CONSTR | METHOD

org.apache.catalina.authenticator
Class SingleSignOn

java.lang.Object
  org.apache.catalina.valves.ValveBase
      org.apache.catalina.authenticator.SingleSignOn

All Implemented Interfaces:: javax.management.MBeanRegistration, Contained, Lifecycle, SessionListener, Valve

Direct Known Subclasses:: ClusterSingleSignOn

public class SingleSignOn
extends ValveBase
implements Lifecycle, SessionListener
extends ValveBase
implements Lifecycle, SessionListener

A Valve that supports a "single sign on" user experience, where the security identity of a user who successfully authenticates to one web application is propogated to other web applications in the same security domain. For successful use, the following requirements must be met:

This Valve must be configured on the Container that represents a virtual host (typically an implementation of Host).
The Realm that contains the shared user and role information must be configured on the same Container (or a higher one), and not overridden at the web application level.
The web applications themselves must use one of the standard Authenticators found in the org.apache.catalina.authenticator package.

Author:: Craig R. McClanahan

Field Summary
`protected java.util.Map<java.lang.String,SingleSignOnEntry>`	`cache` The cache of SingleSignOnEntry instances for authenticated Principals, keyed by the cookie value that is used to select them.
`protected static java.lang.String`	`info` Descriptive information about this Valve implementation.
`protected LifecycleSupport`	`lifecycle` The lifecycle event support for this component.
`protected java.util.Map<Session,java.lang.String>`	`reverse` The cache of single sign on identifiers, keyed by the Session that is associated with them.
`protected static StringManager`	`sm` The string manager for this package.
`protected boolean`	`started` Component started flag.

Fields inherited from class org.apache.catalina.valves.ValveBase
`container, containerLog, controller, domain, mserver, next, oname`

Fields inherited from interface org.apache.catalina.Lifecycle
`AFTER_START_EVENT, AFTER_STOP_EVENT, BEFORE_START_EVENT, BEFORE_STOP_EVENT, DESTROY_EVENT, INIT_EVENT, PERIODIC_EVENT, START_EVENT, STOP_EVENT`

Constructor Summary
`SingleSignOn()`

Method Summary
`void`	`addLifecycleListener(LifecycleListener listener)` Add a lifecycle event listener to this component.
`protected void`	`associate(java.lang.String ssoId, Session session)` Associate the specified single sign on identifier with the specified Session.
`protected void`	`deregister(java.lang.String ssoId)` Deregister the specified single sign on identifier, and invalidate any associated sessions.
`protected void`	`deregister(java.lang.String ssoId, Session session)` Deregister the specified session.
`LifecycleListener[]`	`findLifecycleListeners()` Get the lifecycle listeners associated with this lifecycle.
`java.lang.String`	`getCookieDomain()` Returns the optional cookie domain.
`java.lang.String`	`getInfo()` Return descriptive information about this Valve implementation.
`boolean`	`getRequireReauthentication()` Gets whether each request needs to be reauthenticated (by an Authenticator downstream in the pipeline) to the security `Realm`, or if this Valve can itself bind security info to the request based on the presence of a valid SSO entry without rechecking with the `Realm`
`void`	`invoke(Request request, Response response)` Perform single-sign-on support processing for this request.
`protected SingleSignOnEntry`	`lookup(java.lang.String ssoId)` Look up and return the cached SingleSignOn entry associated with this sso id value, if there is one; otherwise return `null`.
`protected boolean`	`reauthenticate(java.lang.String ssoId, Realm realm, Request request)` Attempts reauthentication to the given `Realm` using the credentials associated with the single sign-on session identified by argument `ssoId`.
`protected void`	`register(java.lang.String ssoId, java.security.Principal principal, java.lang.String authType, java.lang.String username, java.lang.String password)` Register the specified Principal as being associated with the specified value for the single sign on identifier.
`void`	`removeLifecycleListener(LifecycleListener listener)` Remove a lifecycle event listener from this component.
`protected void`	`removeSession(java.lang.String ssoId, Session session)` Remove a single Session from a SingleSignOn.
`void`	`sessionEvent(SessionEvent event)` Acknowledge the occurrence of the specified event.
`void`	`setCookieDomain(java.lang.String cookieDomain)` Sets the domain to be used for sso cookies.
`void`	`setRequireReauthentication(boolean required)` Sets whether each request needs to be reauthenticated (by an Authenticator downstream in the pipeline) to the security `Realm`, or if this Valve can itself bind security info to the request, based on the presence of a valid SSO entry, without rechecking with the `Realm`
`void`	`start()` Prepare for the beginning of active use of the public methods of this component.
`void`	`stop()` Gracefully terminate the active use of the public methods of this component.
`java.lang.String`	`toString()` Return a String rendering of this object.
`protected void`	`update(java.lang.String ssoId, java.security.Principal principal, java.lang.String authType, java.lang.String username, java.lang.String password)` Updates any `SingleSignOnEntry` found under key `ssoId` with the given authentication data.

Methods inherited from class org.apache.catalina.valves.ValveBase
`backgroundProcess, createObjectName, event, getContainer, getContainerName, getController, getDomain, getNext, getObjectName, getParentName, postDeregister, postRegister, preDeregister, preRegister, setContainer, setController, setNext, setObjectName`

Methods inherited from class java.lang.Object
`clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait`

Field Detail

cache

protected java.util.Map<java.lang.String,SingleSignOnEntry> cache

The cache of SingleSignOnEntry instances for authenticated Principals, keyed by the cookie value that is used to select them.

info

protected static java.lang.String info

Descriptive information about this Valve implementation.

lifecycle

protected LifecycleSupport lifecycle

The lifecycle event support for this component.

reverse

protected java.util.Map<Session,java.lang.String> reverse

The cache of single sign on identifiers, keyed by the Session that is associated with them.

sm

protected static final StringManager sm

The string manager for this package.

started

protected boolean started

Component started flag.

Constructor Detail

SingleSignOn

public SingleSignOn()

Method Detail

getCookieDomain

public java.lang.String getCookieDomain()

Returns the optional cookie domain. May return null.

Returns:: The cookie domain

setCookieDomain

public void setCookieDomain(java.lang.String cookieDomain)

Sets the domain to be used for sso cookies.

Parameters:: cookieDomain - cookie domain name

getRequireReauthentication

public boolean getRequireReauthentication()

Gets whether each request needs to be reauthenticated (by an Authenticator downstream in the pipeline) to the security Realm, or if this Valve can itself bind security info to the request based on the presence of a valid SSO entry without rechecking with the

Realm




Returns:
true if it is required that a downstream
          Authenticator reauthenticate each request before calls to
          HttpServletRequest.setUserPrincipal()
          and HttpServletRequest.setAuthType() are made;
          false if the Valve can itself make
          those calls relying on the presence of a valid SingleSignOn
          entry associated with the request.
See Also:
setRequireReauthentication(boolean)





setRequireReauthentication
public void setRequireReauthentication(boolean required)

Sets whether each request needs to be reauthenticated (by an
 Authenticator downstream in the pipeline) to the security
 Realm, or if this Valve can itself bind security info
 to the request, based on the presence of a valid SSO entry, without
 rechecking with the Realm
 If this property is false (the default), this
 Valve will bind a UserPrincipal and AuthType to the request
 if a valid SSO entry is associated with the request.  It will not notify
 the security Realm of the incoming request.
 
 This property should be set to true if the overall server
 configuration requires that the Realm reauthenticate each
 request thread.  An example of such a configuration would be one where
 the Realm implementation provides security for both a
 web tier and an associated EJB tier, and needs to set security
 credentials on each request thread in order to support EJB access.
 

 If this property is set to true, this Valve will set flags
 on the request notifying the downstream Authenticator that the request
 is associated with an SSO session.  The Authenticator will then call its
 reauthenticateFromSSO
 method to attempt to reauthenticate the request to the
 Realm, using any credentials that were cached with this
 Valve.
 

 The default value of this property is false, in order
 to maintain backward compatibility with previous versions of Tomcat.





Parameters:
required - true if it is required that a downstream
                  Authenticator reauthenticate each request before calls
                  to  HttpServletRequest.setUserPrincipal()
                  and HttpServletRequest.setAuthType() are
                  made; false if the Valve can
                  itself make those calls relying on the presence of a
                  valid SingleSignOn entry associated with the request.
See Also:
AuthenticatorBase.reauthenticateFromSSO(java.lang.String, org.apache.catalina.connector.Request)





addLifecycleListener
public void addLifecycleListener(LifecycleListener listener)

Add a lifecycle event listener to this component.


Specified by:
addLifecycleListener in interface Lifecycle


Parameters:
listener - The listener to add





findLifecycleListeners
public LifecycleListener[] findLifecycleListeners()

Get the lifecycle listeners associated with this lifecycle. If this 
 Lifecycle has no listeners registered, a zero-length array is returned.


Specified by:
findLifecycleListeners in interface Lifecycle








removeLifecycleListener
public void removeLifecycleListener(LifecycleListener listener)

Remove a lifecycle event listener from this component.


Specified by:
removeLifecycleListener in interface Lifecycle


Parameters:
listener - The listener to remove





start
public void start()
           throws LifecycleException

Prepare for the beginning of active use of the public methods of this
 component.  This method should be called after configure(),
 and before any of the public methods of the component are utilized.


Specified by:
start in interface Lifecycle



Throws:
LifecycleException - if this component detects a fatal error
  that prevents this component from being used





stop
public void stop()
          throws LifecycleException

Gracefully terminate the active use of the public methods of this
 component.  This method should be the last one called on a given
 instance of this component.


Specified by:
stop in interface Lifecycle



Throws:
LifecycleException - if this component detects a fatal error
  that needs to be reported





sessionEvent
public void sessionEvent(SessionEvent event)

Acknowledge the occurrence of the specified event.


Specified by:
sessionEvent in interface SessionListener


Parameters:
event - SessionEvent that has occurred





getInfo
public java.lang.String getInfo()

Return descriptive information about this Valve implementation.


Specified by:
getInfo in interface Valve
Overrides:
getInfo in class ValveBase








invoke
public void invoke(Request request,
                   Response response)
            throws java.io.IOException,
                   javax.servlet.ServletException

Perform single-sign-on support processing for this request.


Specified by:
invoke in interface Valve
Specified by:
invoke in class ValveBase


Parameters:
request - The servlet request we are processing
response - The servlet response we are creating
Throws:
java.io.IOException - if an input/output error occurs
javax.servlet.ServletException - if a servlet error occurs





toString
public java.lang.String toString()

Return a String rendering of this object.


Overrides:
toString in class ValveBase








associate
protected void associate(java.lang.String ssoId,
                         Session session)

Associate the specified single sign on identifier with the
 specified Session.





Parameters:
ssoId - Single sign on identifier
session - Session to be associated





deregister
protected void deregister(java.lang.String ssoId,
                          Session session)

Deregister the specified session.  If it is the last session,
 then also get rid of the single sign on identifier





Parameters:
ssoId - Single sign on identifier
session - Session to be deregistered





deregister
protected void deregister(java.lang.String ssoId)

Deregister the specified single sign on identifier, and invalidate
 any associated sessions.





Parameters:
ssoId - Single sign on identifier to deregister





reauthenticate
protected boolean reauthenticate(java.lang.String ssoId,
                                 Realm realm,
                                 Request request)

Attempts reauthentication to the given Realm using
 the credentials associated with the single sign-on session
 identified by argument ssoId.
 
 If reauthentication is successful, the Principal and
 authorization type associated with the SSO session will be bound
 to the given Request object via calls to 
 Request.setAuthType() and 
 Request.setUserPrincipal()
 





Parameters:
ssoId - identifier of SingleSignOn session with which the
                  caller is associated
realm - Realm implementation against which the caller is to
                  be authenticated
request - the request that needs to be authenticated
Returns:
true if reauthentication was successful,
          false otherwise.





register
protected void register(java.lang.String ssoId,
                        java.security.Principal principal,
                        java.lang.String authType,
                        java.lang.String username,
                        java.lang.String password)

Register the specified Principal as being associated with the specified
 value for the single sign on identifier.





Parameters:
ssoId - Single sign on identifier to register
principal - Associated user principal that is identified
authType - Authentication type used to authenticate this
  user principal
username - Username used to authenticate this user
password - Password used to authenticate this user





update
protected void update(java.lang.String ssoId,
                      java.security.Principal principal,
                      java.lang.String authType,
                      java.lang.String username,
                      java.lang.String password)

Updates any SingleSignOnEntry found under key
 ssoId with the given authentication data.
 
 The purpose of this method is to allow an SSO entry that was
 established without a username/password combination (i.e. established
 following DIGEST or CLIENT_CERT authentication) to be updated with
 a username and password if one becomes available through a subsequent
 BASIC or FORM authentication.  The SSO entry will then be usable for
 reauthentication.
 

 NOTE: Only updates the SSO entry if a call to
 SingleSignOnEntry.getCanReauthenticate() returns
 false; otherwise, it is assumed that the SSO entry already
 has sufficient information to allow reauthentication and that no update
 is needed.





Parameters:
ssoId - identifier of Single sign to be updated
principal - the Principal returned by the latest
                  call to Realm.authenticate.
authType - the type of authenticator used (BASIC, CLIENT_CERT,
                  DIGEST or FORM)
username - the username (if any) used for the authentication
password - the password (if any) used for the authentication





lookup
protected SingleSignOnEntry lookup(java.lang.String ssoId)

Look up and return the cached SingleSignOn entry associated with this
 sso id value, if there is one; otherwise return null.





Parameters:
ssoId - Single sign on identifier to look up





removeSession
protected void removeSession(java.lang.String ssoId,
                             Session session)

Remove a single Session from a SingleSignOn.  Called when
 a session is timed out and no longer active.





Parameters:
ssoId - Single sign on identifier from which to remove the session.
session - the session to be removed.














  
      Overview 
      Package 
    Class 
      Tree 
      Deprecated 
      Index 
      Help 
  



Apache Tomcat 6.0.53





 PREV CLASS 
 NEXT CLASS

  FRAMES   
 NO FRAMES   
 







  SUMMARY: NESTED | FIELD | CONSTR | METHOD

DETAIL: FIELD | CONSTR | METHOD






Copyright © 2000-2017 Apache Software Foundation. All Rights Reserved.

org.apache.catalina.authenticator Class SingleSignOn

cache

info

lifecycle

reverse

sm

started

SingleSignOn

getCookieDomain

setCookieDomain

getRequireReauthentication

setRequireReauthentication

addLifecycleListener

findLifecycleListeners

removeLifecycleListener

start

stop

sessionEvent

getInfo

invoke

toString

associate

deregister

deregister

reauthenticate

register

update

lookup

removeSession

org.apache.catalina.authenticator
Class SingleSignOn