org.jboss.net.axis.server
Class JBossAuthenticationHandler

java.lang.Object
  org.jboss.axis.handlers.BasicHandler (src) 
      org.jboss.net.axis.server.JBossAuthenticationHandler

All Implemented Interfaces:

Handler (src)

public class JBossAuthenticationHandler

extends BasicHandler (src)

AuthenticationHandler that interacts with a given JBoss autentication manager via default simple principals and passchars from the HTTP Basic Authentication.

It is derived from org.jboss.axis.handlers.SimpleAuthenticationHandler. Note that this is somehow redundant to the WebContainer security, but we want to be able to install different authentication schemes for different web services behind a single entry-point.

Per default, unauthenticated calls will be routed by NOT asking the jboss auth manager for validation (most domains still would refuse NobodyPrincipal, no matter how configured) and building a "null" security association.

By specifiying the validateUnauthenticatedCalls=true option, the handler will however try to interface the securityManager with the NobodyPrincipal and an empty password and ask for a proper security association. This is important when dealing with MS Clients (thanks to John Landers for pointing this out) that won�t send any authentication data if not confronted with an HTTP error on the first try.

Since:

14.03.2002

isInitialised

protected boolean isInitialised

whether this handler has been initialized already

shouldValidateUnauthenticatedCalls

protected boolean shouldValidateUnauthenticatedCalls

whether this handler should let through unauthenticated calls

authMgr

protected SubjectSecurityManager (src)  authMgr

this is the authentication manager that is responsible for our security domain if that is null, this authenticationhandler will block any call, rather deactivate the handler, then, or run against a NullSecurityManager

JBossAuthenticationHandler

public JBossAuthenticationHandler()

default, all options are set afterwards

initialise

protected void initialise()
                   throws AxisFault (src) 

initialize this authenticationhandler lazy, after the options have been set.

Throws:

AxisFault (src)

getPrincipal

protected java.security.Principal getPrincipal(java.lang.String userName)

creates a new principal belonging to the given username, override to adapt to specific security domains.

validate

protected javax.security.auth.Subject validate(java.security.Principal userPrincipal,
                                               java.lang.String passwd)
                                        throws AxisFault (src) 

validates the given principal with the given password

Throws:

AxisFault (src)

associate

protected void associate(java.security.Principal userPrincipal,
                         java.lang.String passwd,
                         javax.security.auth.Subject subject)

associates the call context with the given info

invoke

public void invoke(MessageContext (src)  msgContext)
            throws AxisFault (src) 

Authenticate the user and password from the msgContext. Note that we do not disassociate the subject here, since that would have to be done by a separate handler in the response chain and we currently expect Jetty or the WebContainer to do that for us

Specified by:

invoke in interface Handler (src)

Specified by:

invoke in class BasicHandler (src)

Throws:

AxisFault (src)