From 60f8095cf26ce9122e187a9d4398833846f36557 Mon Sep 17 00:00:00 2001 From: Ben Alex Date: Mon, 27 Jun 2005 03:05:26 +0000 Subject: [PATCH] Make Authenticated.isAuthenticated() behaviour switchable. See http://opensource.atlassian.com/projects/spring/browse/SEC-13. --- .../AbstractSecurityInterceptor.java | 49 +++++++++++++------ doc/xdocs/changes.xml | 2 +- 2 files changed, 36 insertions(+), 15 deletions(-) diff --git a/core/src/main/java/org/acegisecurity/intercept/AbstractSecurityInterceptor.java b/core/src/main/java/org/acegisecurity/intercept/AbstractSecurityInterceptor.java index 8587cfcc84..05cc7fe784 100644 --- a/core/src/main/java/org/acegisecurity/intercept/AbstractSecurityInterceptor.java +++ b/core/src/main/java/org/acegisecurity/intercept/AbstractSecurityInterceptor.java @@ -59,8 +59,8 @@ import java.util.Set; * *
    *
  1. - * Extract the {@link SecureContext} from the {@link ContextHolder}, handling - * any errors such as invalid or null objects. + * Extract the {@link SecureContext} from the {@link SecurityContextHolder}, + * handling any errors such as invalid or null objects. *
    2. *
  2. * Obtain the {@link Authentication} object from the extracted @@ -77,9 +77,12 @@ import java.util.Set; * *
      *
    1. - * Authenticate the request against the configured {@link - * AuthenticationManager}, replacing the Authentication object on - * the ContextHolder with the returned value. + * If either the {@link net.sf.acegisecurity.Authentication#isAuthenticated()} + * returns false, or the {@link #alwaysReauthenticate} is + * true, authenticate the request against the configured {@link + * AuthenticationManager}. When authenticated, replace the + * Authentication object on the + * SecurityContextHolder with the returned value. *
      2. *
    2. * Authorize the request against the configured {@link AccessDecisionManager}. @@ -101,8 +104,8 @@ import java.util.Set; *
      3. *
    3. * If the RunAsManager replaced the Authentication - * object, return the ContextHolder to the object that existed - * after the call to AuthenticationManager. + * object, return the SecurityContextHolder to the object that + * existed after the call to AuthenticationManager. *
      4. *
    4. * If an AfterInvocationManager is defined, invoke the invocation @@ -118,11 +121,6 @@ import java.util.Set; * *
        *
      1. - * If the ContextHolder contains a SecureContext, set - * the isAuthenticated flag on the Authentication - * object to false. - *
        2. - *
      2. * As described above, the concrete subclass will be returned an * InterceptorStatusToken which is subsequently re-presented to * the AbstractSecurityInterceptor after the secure object has @@ -157,6 +155,7 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean, private ApplicationContext context; private AuthenticationManager authenticationManager; private RunAsManager runAsManager = new NullRunAsManager(); + private boolean alwaysReauthenticate = false; private boolean validateConfigAttributes = true; //~ Methods ================================================================ @@ -170,6 +169,27 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean, return afterInvocationManager; } + /** + * Indicates whether the AbstractSecurityInterceptor should + * ignore the {@link Authentication#isAuthenticated()} property. Defaults + * to false, meaning by default the + * Authentication.isAuthenticated() property is trusted and + * re-authentication will not occur if the principal has already been + * authenticated. + * + * @param alwaysReauthenticate true to force + * AbstractSecurityInterceptor to disregard the value + * of Authentication.isAuthenticated() and always + * re-authenticate the request (defaults to false). + */ + public void setAlwaysReauthenticate(boolean alwaysReauthenticate) { + this.alwaysReauthenticate = alwaysReauthenticate; + } + + public boolean isAlwaysReauthenticate() { + return alwaysReauthenticate; + } + public void setApplicationContext(ApplicationContext applicationContext) throws BeansException { this.context = applicationContext; @@ -364,11 +384,12 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean, object, attr); } - // Attempt authentication if not already authenticated + // Attempt authentication if not already authenticated, or user always wants reauthentication Authentication authenticated; if (!SecurityContextHolder.getContext().getAuthentication() - .isAuthenticated()) { + .isAuthenticated() + || alwaysReauthenticate) { try { authenticated = this.authenticationManager.authenticate(SecurityContextHolder.getContext() .getAuthentication()); diff --git a/doc/xdocs/changes.xml b/doc/xdocs/changes.xml index 9f2e23f10d..1e26283155 100644 --- a/doc/xdocs/changes.xml +++ b/doc/xdocs/changes.xml @@ -37,7 +37,7 @@ AuthorityGranter.grant now returns a java.util.Set of role names, instead of a single role name JavaDoc improvements Correct synchronization issue with FilterToBeanProxy initialization - Refactor Authentication.isAuthenticated() handling to be more performance + Refactor Authentication.isAuthenticated() handling to be more performant Silently catch NotSerializableException in AbstractProcessingFilter if rootCause is not Serializable Remove getters and setters from JdbcDaoImpl so IoC container cannot modify MappingSqlQuerys Refactor DAO authentication failure events under a consistent abstract superclass