Package weblogic.servlet.security

Class ServletAuthentication

java.lang.Object

weblogic.servlet.security.ServletAuthentication

public final class ServletAuthentication
extends java.lang.Object

ServletAuthentication allows both form-based authentication and programmatic authentication in servlets. It performs the authentication call through the Realm and sets the user information into the session. The weak() methods are for password authentication and the strong() methods are for certificate-based authentication. The latter is available only via two-way SSL connections, based on the client certificate chain. In order to avoid a type of attack called "session fixation," you should change the user's session ID at login. To do this, call the generateNewSessionID method after you call the login method.

Field Summary

Fields

Modifier and Type	Field	Description
static int	AUTHENTICATED	Returns the value of a successful authentication.
static int	FAILED_AUTHENTICATION	Returns the value of an unsuccessful authentication.
static int	NEEDS_CREDENTIALS	Returns the value of an unsuccessful authentication due to no credentials.

Method Summary

Modifier and Type	Method	Description
static int	assertIdentity(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, java.lang.String realmName)	Deprecated. 12.2.1.0
static int	assertIdentity(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, java.lang.String realmName, AppContext appContext)	Deprecated. 12.2.1.0
static int	authenticate(javax.security.auth.callback.CallbackHandler handler, jakarta.servlet.http.HttpServletRequest request)	Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION.
static int	authObject(java.lang.String username, java.lang.Object credential, jakarta.servlet.http.HttpServletRequest request)	Deprecated.
static int	authObject(java.lang.String username, java.lang.Object credential, jakarta.servlet.http.HttpSession session, jakarta.servlet.http.HttpServletRequest request)	Deprecated.
static void	done(jakarta.servlet.http.HttpServletRequest request)	"Logs out" the user in the session by removing the pertinent data from the sessions the user has logged into and also from the webserver, without losing other session data.
static void	generateNewSessionID(jakarta.servlet.http.HttpServletRequest request)	Moves all current session information into a completely different session ID and re-associates this session with this new ID.
static jakarta.servlet.http.Cookie	getSessionCookie(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)	Allows you to get a handle on the session cookie itself.
static java.lang.String	getTargetURIForFormAuthentication(jakarta.servlet.http.HttpSession session)	Returns the target URI stored in the first step of Form based authentication.
static java.lang.String	getTargetURLForFormAuthentication(jakarta.servlet.http.HttpSession session)	Returns the target URL stored in the first step of Form based authentication.
static boolean	invalidateAll(jakarta.servlet.http.HttpServletRequest req)	Invalidates all the sessions for the current user only (that is, the current cookie), and since the cookie is no longer required, kills the cookie too.
static void	killCookie(jakarta.servlet.http.HttpServletRequest req)	Kills the current cookie.
static int	login(java.lang.String username, java.lang.String password, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)	Deprecated. as of 12c - use HttpServletRequest.login(java.lang.String, java.lang.String)
static int	login(javax.security.auth.callback.CallbackHandler handler, jakarta.servlet.http.HttpServletRequest request)	Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION.
static boolean	logout(jakarta.servlet.http.HttpServletRequest req)	Deprecated. as of 12c - use HttpServletRequest.logout()
static boolean	logout(jakarta.servlet.http.HttpSession session)	Deprecated. as of 12c - use HttpServletRequest.logout()
static void	runAs(javax.security.auth.Subject subject, jakarta.servlet.http.HttpServletRequest request)	With a given subject, this method sets the current thread identity and current session identity.
static int	strong(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)	Strong authentication using the client-side certificate chain as the credential for authentication against the "weblogic" (default) realm.
static int	strong(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, java.lang.String realmName)	Deprecated. 12.2.1.0
int	weak(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)	Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION after pulling the username and password from the request, authenticating the user and setting it into the session.
static int	weak(java.lang.String username, java.lang.String password, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)	Deprecated. as of 12c - use HttpServletRequest.login(java.lang.String, java.lang.String)
static int	weak(java.lang.String username, java.lang.String password, jakarta.servlet.http.HttpSession session)	Deprecated.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

AUTHENTICATED

public static final int AUTHENTICATED

Returns the value of a successful authentication.

See Also:

Constant Field Values

FAILED_AUTHENTICATION

public static final int FAILED_AUTHENTICATION

Returns the value of an unsuccessful authentication.

See Also:

Constant Field Values

NEEDS_CREDENTIALS

public static final int NEEDS_CREDENTIALS

Returns the value of an unsuccessful authentication due to no credentials.

See Also:

Constant Field Values

Method Detail

done

public static void done(jakarta.servlet.http.HttpServletRequest request)

"Logs out" the user in the session by removing the pertinent data from the sessions the user has logged into and also from the webserver, without losing other session data. (This method is functionally equivalent to logout().)

Parameters:

request - HttpServletRequest which contains the session

logout

@Deprecated
public static boolean logout(jakarta.servlet.http.HttpServletRequest req)

Deprecated.

as of 12c - use HttpServletRequest.logout()

"Logs out" the user in the session by removing the pertinent data from the sessions the user has logged into and also from the webserver, without losing other session data.

Parameters:

req - HttpServletRequest

logout

@Deprecated
public static boolean logout(jakarta.servlet.http.HttpSession session)

Deprecated.

as of 12c - use HttpServletRequest.logout()

"Logs out" the user in the session by removing the pertinent data from the sessions the user has logged into and also from the webserver, without losing other session data.

Parameters:

session - HttpSession

invalidateAll

public static boolean invalidateAll(jakarta.servlet.http.HttpServletRequest req)

Invalidates all the sessions for the current user only (that is, the current cookie), and since the cookie is no longer required, kills the cookie too.

Parameters:

req - HttpServletRequest

killCookie

public static void killCookie(jakarta.servlet.http.HttpServletRequest req)

Kills the current cookie.

Parameters:

req - HttpServletRequest which contains the session

strong

public static int strong(jakarta.servlet.http.HttpServletRequest request,
                         jakarta.servlet.http.HttpServletResponse response)
                  throws jakarta.servlet.ServletException,
                         java.io.IOException

Strong authentication using the client-side certificate chain as the credential for authentication against the "weblogic" (default) realm.

Parameters:

request - HttpServletRequest

response - HttpServletResponse

Returns:

int authentication value

Throws:

jakarta.servlet.ServletException

java.io.IOException

strong

@Deprecated
public static int strong(jakarta.servlet.http.HttpServletRequest request,
                         jakarta.servlet.http.HttpServletResponse response,
                         java.lang.String realmName)
                  throws jakarta.servlet.ServletException,
                         java.io.IOException

Deprecated.

12.2.1.0

Strong authentication using the client-side certificate chain as the credential for authentication.

Parameters:

request - HttpServletRequest

response - HttpServletResponse

realmName - String name of the realm to authenticate against

Returns:

int authentication value

Throws:

jakarta.servlet.ServletException

java.io.IOException

assertIdentity

@Deprecated
public static int assertIdentity(jakarta.servlet.http.HttpServletRequest request,
                                 jakarta.servlet.http.HttpServletResponse response,
                                 java.lang.String realmName)
                          throws jakarta.servlet.ServletException,
                                 java.io.IOException,
                                 javax.security.auth.login.LoginException

Deprecated.

12.2.1.0

Strong authentication using the client-side certificate chain as the credential for authentication. This method is similar to "strong" except that it propogates the LoginException back to the caller.

Parameters:

request - HttpServletRequest

response - HttpServletResponse

realmName - String name of the realm to authenticate against

Returns:

int authentication value

Throws:

jakarta.servlet.ServletException

java.io.IOException

javax.security.auth.login.LoginException

assertIdentity

@Deprecated
public static int assertIdentity(jakarta.servlet.http.HttpServletRequest request,
                                 jakarta.servlet.http.HttpServletResponse response,
                                 java.lang.String realmName,
                                 AppContext appContext)
                          throws jakarta.servlet.ServletException,
                                 java.io.IOException,
                                 javax.security.auth.login.LoginException

Deprecated.

12.2.1.0

Strong authentication using the client-side certificate chain as the credential for authentication. This method is similar to "strong" except that it propogates the LoginException back to the caller. This method also takes in an AppContext so that callers can pass in additional context information that can be used by the security providers. The AppContext is passed onto the security providers as is. It is the responsibility of the caller to add request and response objects to the AppContext if required.

Parameters:

request - HttpServletRequest

response - HttpServletResponse

realmName - String name of the realm to authenticate against

appContext - AppContext to use when asserting identity

Returns:

int authentication value

Throws:

jakarta.servlet.ServletException

java.io.IOException

javax.security.auth.login.LoginException

weak

public int weak(jakarta.servlet.http.HttpServletRequest request,
                jakarta.servlet.http.HttpServletResponse response)
         throws jakarta.servlet.ServletException,
                java.io.IOException

Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION after pulling the username and password from the request, authenticating the user and setting it into the session.

This weak() method, unlike the others, is not static. It requires that the ServletAuthentication object be instantiated with the field names for the username and password inside the form.

Parameters:

request - HttpServletRequest

response - HttpServletResponse

Returns:

int authentication value

Throws:

jakarta.servlet.ServletException

java.io.IOException

weak

@Deprecated
public static int weak(java.lang.String username,
                       java.lang.String password,
                       jakarta.servlet.http.HttpServletRequest request,
                       jakarta.servlet.http.HttpServletResponse response)

Deprecated.

as of 12c - use HttpServletRequest.login(java.lang.String, java.lang.String)

Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION after using the username and password to authenticate the user and setting that user information into the session.

Parameters:

username - String

password - String

request - HttpServletRequest

response - HttpServletResponse

Returns:

int authentication value

login

@Deprecated
public static int login(java.lang.String username,
                        java.lang.String password,
                        jakarta.servlet.http.HttpServletRequest request,
                        jakarta.servlet.http.HttpServletResponse response)
                 throws javax.security.auth.login.LoginException

Deprecated.

as of 12c - use HttpServletRequest.login(java.lang.String, java.lang.String)

Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION after using the username and password to authenticate the user and setting that user information into the session. This method is similar to "weak", except that the LoginException is propogated to caller. To avoid a type of attack called "session fixation," you should change the user's session ID at login. To do this, call the generateNewSessionID method after you call the login method.

Parameters:

username - String

password - String

request - HttpServletRequest

response - HttpServletResponse

Returns:

int authentication value

Throws:

javax.security.auth.login.LoginException

weak

@Deprecated
public static int weak(java.lang.String username,
                       java.lang.String password,
                       jakarta.servlet.http.HttpSession session)

Deprecated.

Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION after using the username and password to authenticate the user and setting that user information into the session. Note: This method has been deprecated. Use weak(username, password, request) instead.

Parameters:

username - String

password - String

session - HttpSession

Returns:

int authentication value

authObject

@Deprecated
public static int authObject(java.lang.String username,
                             java.lang.Object credential,
                             jakarta.servlet.http.HttpServletRequest request)

Deprecated.

Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION after using the username and credential object to authenticate the user and setting that user information into the session. This method has been deprecated. Use authenticate(CallbackHandler, HttpServletRequest) instead.

Parameters:

username - String

credential - String

request - HttpServletRequest

Returns:

int authentication value

authObject

@Deprecated
public static int authObject(java.lang.String username,
                             java.lang.Object credential,
                             jakarta.servlet.http.HttpSession session,
                             jakarta.servlet.http.HttpServletRequest request)

Deprecated.

Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION after using the username and credential object to authenticate the user and setting that user information into the session. This method has been deprecated. Use authenticate(CallbackHandler, HttpServletRequest) instead.

Parameters:

username - String

credential - String

session - HttpSession

Returns:

int authentication value

authenticate

public static int authenticate(javax.security.auth.callback.CallbackHandler handler,
                               jakarta.servlet.http.HttpServletRequest request)

Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION. This method is expected to be used when you have plugged in custom LoginModules. If the custom LoginModule is expecting the LoginException to be propogated back, then use the "login" method instead of "authenticate". The callback handler that you supply here should be able to handle the callbacks generated by your LoginModule. This method creates a session if a session doesn't exist already. To avoid a type of attack called "session fixation," you should change the user's session ID at login. To do this, call the generateNewSessionID method after you call the login method.

Parameters:

handler - javax.security.auth.callback.CallbackHandler

request - HttpServletRequest

Returns:

int authentication value

login

public static int login(javax.security.auth.callback.CallbackHandler handler,
                        jakarta.servlet.http.HttpServletRequest request)
                 throws javax.security.auth.login.LoginException

Returns an int value for AUTHENTICATED or FAILED_AUTHENTICATION. This method is expected to be used when you have plugged in custom LoginModules. This is similar to the "authenticate" method, except that this throws a LoginException back to the caller when authentication fails. The callback handler that you supply here should be able to handle the callbacks generated by your LoginModule. This method creates a session if a session doesn't exist already.

Parameters:

handler - javax.security.auth.callback.CallbackHandler

request - HttpServletRequest

Returns:

int authentication value

Throws:

javax.security.auth.login.LoginException

generateNewSessionID

public static void generateNewSessionID(jakarta.servlet.http.HttpServletRequest request)

Moves all current session information into a completely different session ID and re-associates this session with this new ID. If a session cookie does not exist at this point, one is created.

Parameters:

request - HttpServletRequest

getSessionCookie

public static jakarta.servlet.http.Cookie getSessionCookie(jakarta.servlet.http.HttpServletRequest request,
                                                           jakarta.servlet.http.HttpServletResponse response)

Allows you to get a handle on the session cookie itself. Returns null if there is no session or if session cookies have been turned off in the servlet engine.

Parameters:

response - HttpServletResponse

Returns:

Session Cookie if it exists, null otherwise

runAs

public static void runAs(javax.security.auth.Subject subject,
                         jakarta.servlet.http.HttpServletRequest request)

With a given subject, this method sets the current thread identity and current session identity. This method is used for logging in when you already have a subject.

Parameters:

subject - javax.security.auth.Subject

request - HttpServletRequest

getTargetURLForFormAuthentication

public static java.lang.String getTargetURLForFormAuthentication(jakarta.servlet.http.HttpSession session)

Returns the target URL stored in the first step of Form based authentication. This allows users to handle the login process programmatically.

Parameters:

session - HttpSession

Returns:

Target URL for form based authentication

getTargetURIForFormAuthentication

public static java.lang.String getTargetURIForFormAuthentication(jakarta.servlet.http.HttpSession session)

Returns the target URI stored in the first step of Form based authentication. This allows users to handle the login process programmatically.

Parameters:

session - HttpSession

Returns:

Target URI for form based authentication