CAS-Client客户端研究(四)-HttpServletRequestWrapperFilter
2016-07-08 00:00
591 查看
最近研究CAS,先从客户开始来说明CAS的逻辑,可能会结合源代码。
必要说明:http://blog.csdn.net/yuwenruli/article/details/6602180
HttpServletRequestWrapperFilter其实作用很简单,就是在HttpServletRequest对象再包装一次,让其支持getUserPrincipal,getRemoteUser方法来取得登录的用户信息。
实现起来比较简单,这个里面使用到一个类CasHttpServletRequestWrapper,其继承HttpServletRequestWrapper,通过给定Assertion对象中取得AttributePrincipal对象来组装CasHttpServletRequestWrapper,看看源代码
我们再来看看CasHttpServletRequestWrapper的源代码
必要说明:http://blog.csdn.net/yuwenruli/article/details/6602180
HttpServletRequestWrapperFilter其实作用很简单,就是在HttpServletRequest对象再包装一次,让其支持getUserPrincipal,getRemoteUser方法来取得登录的用户信息。
实现起来比较简单,这个里面使用到一个类CasHttpServletRequestWrapper,其继承HttpServletRequestWrapper,通过给定Assertion对象中取得AttributePrincipal对象来组装CasHttpServletRequestWrapper,看看源代码
public void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse, final FilterChain filterChain) throws IOException, ServletException { //从Session或者request中取得AttributePrincipal,其实Assertion的一个principal属性 final AttributePrincipal principal = retrievePrincipalFromSessionOrRequest(servletRequest); //对request进行包装,并处理后面的过滤器,使其后面的过滤器或者servlet能够在request.getRemoteUser()或者request.getUserPrincipal()取得用户信息 filterChain.doFilter(new CasHttpServletRequestWrapper((HttpServletRequest) servletRequest, principal), servletResponse); } protected AttributePrincipal retrievePrincipalFromSessionOrRequest(final ServletRequest servletRequest) { final HttpServletRequest request = (HttpServletRequest) servletRequest; final HttpSession session = request.getSession(false); final Assertion assertion = (Assertion) (session == null ? request.getAttribute(AbstractCasFilter.CONST_CAS_ASSERTION) : session.getAttribute(AbstractCasFilter.CONST_CAS_ASSERTION)); return assertion == null ? null : assertion.getPrincipal(); }
我们再来看看CasHttpServletRequestWrapper的源代码
final class CasHttpServletRequestWrapper extends HttpServletRequestWrapper { private final AttributePrincipal principal; CasHttpServletRequestWrapper(final HttpServletRequest request, final AttributePrincipal principal) { super(request); this.principal = principal; } public Principal getUserPrincipal() { return this.principal; } public String getRemoteUser() { return principal != null ? this.principal.getName() : null; } public boolean isUserInRole(final String role) { if (CommonUtils.isBlank(role)) { log.debug("No valid role provided. Returning false."); return false; } if (this.principal == null) { log.debug("No Principal in Request. Returning false."); return false; } if (CommonUtils.isBlank(roleAttribute)) { log.debug("No Role Attribute Configured. Returning false."); return false; } final Object value = this.principal.getAttributes().get(roleAttribute); if (value instanceof Collection<?>) { for (final Object o : (Collection<?>) value) { if (rolesEqual(role, o)) { log.debug("User [" + getRemoteUser() + "] is in role [" + role + "]: " + true); return true; } } } final boolean isMember = rolesEqual(role, value); log.debug("User [" + getRemoteUser() + "] is in role [" + role + "]: " + isMember); return isMember; } /** * Determines whether the given role is equal to the candidate * role attribute taking into account case sensitivity. * * @param given Role under consideration. * @param candidate Role that the current user possesses. * * @return True if roles are equal, false otherwise. */ private boolean rolesEqual(final String given, final Object candidate) { return ignoreCase ? given.equalsIgnoreCase(candidate.toString()) : given.equals(candidate); } }
相关文章推荐
- IBM WAS ND 分布式网络环境的理解与集群的实现
- TCP/IP整理
- iOS第三方网络诊断库——LDNetDiagnoService
- Ping,traceroute和mtr
- 使用C#开发HTTP服务器系列之构建RESTful API
- httpclient在android studio中用不了
- http 协议 与tcp/ip协议、Socket的区别
- UVA 10480 Sabotage 网络流
- socket参数的设置
- 使用httpie分析资源,并绕过下载保护
- 使用ImageNet在faster-rcnn上训练自己的分类网络
- 计算机网络(7)-----TCP协议概述
- 第九天:排列活动顺序和估算活动资源,网络进度网络图,4种活动逻辑解析表,3种网络图绘制方法、确定依赖关系,提前量滞后量
- 第九天:排列活动顺序和估算活动资源,网络进度网络图,4种活动逻辑解析表,3种网络图绘制方法、确定依赖关系,提前量滞后量
- 计算机网络知识点(谢希仁版教材) (扫盲帖)
- CNN 卷积神经网络结构
- 图论(网络流,二分图最小点权覆盖):POJ 2125 Destroying The Graph
- java http 请求
- Servlet的Cookie与Seesion的介绍
- 在LoadRunner中设置HTTP请求time-out的时间