org.apache.catalina.authenticator

Class SingleSignOn

public class SingleSignOn extends ValveBase implements Lifecycle, SessionListener

A Valve that supports a "single sign on" user experience, where the security identity of a user who successfully authenticates to one web application is propogated to other web applications in the same security domain. For successful use, the following requirements must be met:

Version: $Revision: 536380 $ $Date: 2007-05-09 01:49:56 +0200 (Wed, 09 May 2007) $

Author: Craig R. McClanahan

Field Summary
protected Map<String,SingleSignOnEntry>cache
The cache of SingleSignOnEntry instances for authenticated Principals, keyed by the cookie value that is used to select them.
protected static Stringinfo
Descriptive information about this Valve implementation.
protected LifecycleSupportlifecycle
The lifecycle event support for this component.
protected Map<Session,String>reverse
The cache of single sign on identifiers, keyed by the Session that is associated with them.
protected static StringManagersm
The string manager for this package.
protected booleanstarted
Component started flag.
Method Summary
voidaddLifecycleListener(LifecycleListener listener)
Add a lifecycle event listener to this component.
protected voidassociate(String ssoId, Session session)
Associate the specified single sign on identifier with the specified Session.
protected voidderegister(String ssoId, Session session)
Deregister the specified session.
protected voidderegister(String ssoId)
Deregister the specified single sign on identifier, and invalidate any associated sessions.
LifecycleListener[]findLifecycleListeners()
Get the lifecycle listeners associated with this lifecycle.
StringgetCookieDomain()
Returns the optional cookie domain.
StringgetInfo()
Return descriptive information about this Valve implementation.
booleangetRequireReauthentication()
Gets whether each request needs to be reauthenticated (by an Authenticator downstream in the pipeline) to the security Realm, or if this Valve can itself bind security info to the request based on the presence of a valid SSO entry without rechecking with the Realm
voidinvoke(Request request, Response response)
Perform single-sign-on support processing for this request.
protected SingleSignOnEntrylookup(String ssoId)
Look up and return the cached SingleSignOn entry associated with this sso id value, if there is one; otherwise return null.
protected booleanreauthenticate(String ssoId, Realm realm, Request request)
Attempts reauthentication to the given Realm using the credentials associated with the single sign-on session identified by argument ssoId.
protected voidregister(String ssoId, Principal principal, String authType, String username, String password)
Register the specified Principal as being associated with the specified value for the single sign on identifier.
voidremoveLifecycleListener(LifecycleListener listener)
Remove a lifecycle event listener from this component.
protected voidremoveSession(String ssoId, Session session)
Remove a single Session from a SingleSignOn.
voidsessionEvent(SessionEvent event)
Acknowledge the occurrence of the specified event.
voidsetCookieDomain(String cookieDomain)
Sets the domain to be used for sso cookies.
voidsetRequireReauthentication(boolean required)
Sets whether each request needs to be reauthenticated (by an Authenticator downstream in the pipeline) to the security Realm, or if this Valve can itself bind security info to the request, based on the presence of a valid SSO entry, without rechecking with the Realm
voidstart()
Prepare for the beginning of active use of the public methods of this component.
voidstop()
Gracefully terminate the active use of the public methods of this component.
StringtoString()
Return a String rendering of this object.
protected voidupdate(String ssoId, Principal principal, String authType, String username, String password)
Updates any SingleSignOnEntry found under key ssoId with the given authentication data.

Field Detail

cache

protected Map<String,SingleSignOnEntry> cache
The cache of SingleSignOnEntry instances for authenticated Principals, keyed by the cookie value that is used to select them.

info

protected static String info
Descriptive information about this Valve implementation.

lifecycle

protected LifecycleSupport lifecycle
The lifecycle event support for this component.

reverse

protected Map<Session,String> reverse
The cache of single sign on identifiers, keyed by the Session that is associated with them.

sm

protected static final StringManager sm
The string manager for this package.

started

protected boolean started
Component started flag.

Method Detail

addLifecycleListener

public void addLifecycleListener(LifecycleListener listener)
Add a lifecycle event listener to this component.

Parameters: listener The listener to add

associate

protected void associate(String ssoId, Session session)
Associate the specified single sign on identifier with the specified Session.

Parameters: ssoId Single sign on identifier session Session to be associated

deregister

protected void deregister(String ssoId, Session session)
Deregister the specified session. If it is the last session, then also get rid of the single sign on identifier

Parameters: ssoId Single sign on identifier session Session to be deregistered

deregister

protected void deregister(String ssoId)
Deregister the specified single sign on identifier, and invalidate any associated sessions.

Parameters: ssoId Single sign on identifier to deregister

findLifecycleListeners

public LifecycleListener[] findLifecycleListeners()
Get the lifecycle listeners associated with this lifecycle. If this Lifecycle has no listeners registered, a zero-length array is returned.

getCookieDomain

public String getCookieDomain()
Returns the optional cookie domain. May return null.

Returns: The cookie domain

getInfo

public String getInfo()
Return descriptive information about this Valve implementation.

getRequireReauthentication

public boolean getRequireReauthentication()
Gets whether each request needs to be reauthenticated (by an Authenticator downstream in the pipeline) to the security Realm, or if this Valve can itself bind security info to the request based on the presence of a valid SSO entry without rechecking with the RealmReturns: true if it is required that a downstream Authenticator reauthenticate each request before calls to HttpServletRequest.setUserPrincipal() and HttpServletRequest.setAuthType() are made; false if the Valve can itself make those calls relying on the presence of a valid SingleSignOn entry associated with the request.

See Also: SingleSignOn

invoke

public void invoke(Request request, Response response)
Perform single-sign-on support processing for this request.

Parameters: request The servlet request we are processing response The servlet response we are creating

Throws: IOException if an input/output error occurs ServletException if a servlet error occurs

lookup

protected SingleSignOnEntry lookup(String ssoId)
Look up and return the cached SingleSignOn entry associated with this sso id value, if there is one; otherwise return null.

Parameters: ssoId Single sign on identifier to look up

reauthenticate

protected boolean reauthenticate(String ssoId, Realm realm, Request request)
Attempts reauthentication to the given Realm using the credentials associated with the single sign-on session identified by argument ssoId.

If reauthentication is successful, the Principal and authorization type associated with the SSO session will be bound to the given Request object via calls to Request.setAuthType() and Request.setUserPrincipal()

Parameters: ssoId identifier of SingleSignOn session with which the caller is associated realm Realm implementation against which the caller is to be authenticated request the request that needs to be authenticated

Returns: true if reauthentication was successful, false otherwise.

register

protected void register(String ssoId, Principal principal, String authType, String username, String password)
Register the specified Principal as being associated with the specified value for the single sign on identifier.

Parameters: ssoId Single sign on identifier to register principal Associated user principal that is identified authType Authentication type used to authenticate this user principal username Username used to authenticate this user password Password used to authenticate this user

removeLifecycleListener

public void removeLifecycleListener(LifecycleListener listener)
Remove a lifecycle event listener from this component.

Parameters: listener The listener to remove

removeSession

protected void removeSession(String ssoId, Session session)
Remove a single Session from a SingleSignOn. Called when a session is timed out and no longer active.

Parameters: ssoId Single sign on identifier from which to remove the session. session the session to be removed.

sessionEvent

public void sessionEvent(SessionEvent event)
Acknowledge the occurrence of the specified event.

Parameters: event SessionEvent that has occurred

setCookieDomain

public void setCookieDomain(String cookieDomain)
Sets the domain to be used for sso cookies.

Parameters: cookieDomain cookie domain name

setRequireReauthentication

public void setRequireReauthentication(boolean required)
Sets whether each request needs to be reauthenticated (by an Authenticator downstream in the pipeline) to the security Realm, or if this Valve can itself bind security info to the request, based on the presence of a valid SSO entry, without rechecking with the Realm If this property is false (the default), this Valve will bind a UserPrincipal and AuthType to the request if a valid SSO entry is associated with the request. It will not notify the security Realm of the incoming request.

This property should be set to true if the overall server configuration requires that the Realm reauthenticate each request thread. An example of such a configuration would be one where the Realm implementation provides security for both a web tier and an associated EJB tier, and needs to set security credentials on each request thread in order to support EJB access.

If this property is set to true, this Valve will set flags on the request notifying the downstream Authenticator that the request is associated with an SSO session. The Authenticator will then call its reauthenticateFromSSO method to attempt to reauthenticate the request to the Realm, using any credentials that were cached with this Valve.

The default value of this property is false, in order to maintain backward compatibility with previous versions of Tomcat.

Parameters: required true if it is required that a downstream Authenticator reauthenticate each request before calls to HttpServletRequest.setUserPrincipal() and HttpServletRequest.setAuthType() are made; false if the Valve can itself make those calls relying on the presence of a valid SingleSignOn entry associated with the request.

See Also: AuthenticatorBase

start

public void start()
Prepare for the beginning of active use of the public methods of this component. This method should be called after configure(), and before any of the public methods of the component are utilized.

Throws: LifecycleException if this component detects a fatal error that prevents this component from being used

stop

public void stop()
Gracefully terminate the active use of the public methods of this component. This method should be the last one called on a given instance of this component.

Throws: LifecycleException if this component detects a fatal error that needs to be reported

toString

public String toString()
Return a String rendering of this object.

update

protected void update(String ssoId, Principal principal, String authType, String username, String password)
Updates any SingleSignOnEntry found under key ssoId with the given authentication data.

The purpose of this method is to allow an SSO entry that was established without a username/password combination (i.e. established following DIGEST or CLIENT_CERT authentication) to be updated with a username and password if one becomes available through a subsequent BASIC or FORM authentication. The SSO entry will then be usable for reauthentication.

NOTE: Only updates the SSO entry if a call to SingleSignOnEntry.getCanReauthenticate() returns false; otherwise, it is assumed that the SSO entry already has sufficient information to allow reauthentication and that no update is needed.

Parameters: ssoId identifier of Single sign to be updated principal the Principal returned by the latest call to Realm.authenticate. authType the type of authenticator used (BASIC, CLIENT_CERT, DIGEST or FORM) username the username (if any) used for the authentication password the password (if any) used for the authentication

Copyright © 2000-2011 Apache Software Foundation. All Rights Reserved.