1 /*
2 * ModeShape (http://www.modeshape.org)
3 * See the COPYRIGHT.txt file distributed with this work for information
4 * regarding copyright ownership. Some portions may be licensed
5 * to Red Hat, Inc. under one or more contributor license agreements.
6 * See the AUTHORS.txt file in the distribution for a full listing of
7 * individual contributors.
8 *
9 * ModeShape is free software. Unless otherwise indicated, all code in ModeShape
10 * is licensed to you under the terms of the GNU Lesser General Public License as
11 * published by the Free Software Foundation; either version 2.1 of
12 * the License, or (at your option) any later version.
13 *
14 * ModeShape is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public
20 * License along with this software; if not, write to the Free
21 * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
22 * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
23 */
24 package org.modeshape.web.jcr;
25
26 import javax.servlet.http.HttpServletRequest;
27 import net.jcip.annotations.ThreadSafe;
28 import org.modeshape.common.util.CheckArg;
29 import org.modeshape.graph.SecurityContext;
30
31 /**
32 * Servlet-based {@link SecurityContext security context} that assumes servlet-based authentication and provides authorization
33 * through the {@link HttpServletRequest#isUserInRole(String) servlet role-checking mechanism}.
34 * <p>
35 * This security context is really only valid for the life of the {@link HttpServletRequest servlet request} and should
36 * only be used to support longer-lasting session scopes with great care. *
37 * </p>
38 */
39 @ThreadSafe
40 public class ServletSecurityContext implements SecurityContext {
41
42 private final String userName;
43 private final HttpServletRequest request;
44
45 /**
46 * Create a {@link ServletSecurityContext} with the supplied {@link HttpServletRequest servlet information}.
47 *
48 * @param request the servlet request; may not be null
49 */
50 public ServletSecurityContext( HttpServletRequest request ) {
51 CheckArg.isNotNull(request, "request");
52 this.request = request;
53 this.userName = request.getUserPrincipal() != null ? request.getUserPrincipal().getName() : null;
54 }
55
56 /**
57 * {@inheritDoc SecurityContext#getUserName()}
58 *
59 * @see SecurityContext#getUserName()
60 */
61 public final String getUserName() {
62 return userName;
63 }
64
65 /**
66 * {@inheritDoc SecurityContext#hasRole(String)}
67 *
68 * @see SecurityContext#hasRole(String)
69 */
70 public final boolean hasRole( String roleName ) {
71 return request.isUserInRole(roleName);
72 }
73
74 /**
75 * {@inheritDoc SecurityContext#logout()}
76 *
77 * @see SecurityContext#logout()
78 */
79 public void logout() {
80 }
81
82 }