Author: buildbot
Date: Tue May 23 08:45:01 2017
New Revision: 1012754
Log:
Staging update by buildbot for sling
Modified:
websites/staging/sling/trunk/content/ (props changed)
websites/staging/sling/trunk/content/documentation/the-sling-engine/authentication/authentication-framework.html
Propchange: websites/staging/sling/trunk/content/
------------------------------------------------------------------------------
--- cms:source-revision (original)
+++ cms:source-revision Tue May 23 08:45:01 2017
@@ -1 +1 @@
-1795784
+1795883
Modified:
websites/staging/sling/trunk/content/documentation/the-sling-engine/authentication/authentication-framework.html
==============================================================================
---
websites/staging/sling/trunk/content/documentation/the-sling-engine/authentication/authentication-framework.html
(original)
+++
websites/staging/sling/trunk/content/documentation/the-sling-engine/authentication/authentication-framework.html
Tue May 23 08:45:01 2017
@@ -220,18 +220,20 @@ h2:hover > .headerlink, h3:hover > .head
<p>The values set on the <em>Authentication Requirements</em> configuration
property or the <code>sling.auth.requirements</code> service registration
property can be absolute paths or URLs like the <code>path</code> service
registration property of <code>AuthenticationHandler</code> services. This
allows the limitation of this setup to certain requests by scheme and/or
virtual host address. The requests path
(<code>HttpServletRequest.getServletPath()</code> +
<code>HttpServletRequest.getPathInfo()</code>) is afterwards matched against
the given paths. It matches if it starts with one of the given paths.</p>
<p><strong>Examples</strong></p>
<ul>
-<li>
-<p>The <code>LoginServlet</code> contained in the Sling Auth Core bundle
registers itself with the service registration property
<code>sling.auth.requirements = "-/system/sling/login"</code> to ensure the
servlet can be accessed without requiring authentication. The following request
urls would work then without authentication:</p>
-<ul>
+<li>The <code>LoginServlet</code> contained in the Sling Auth Core bundle
registers itself with the service registration property
<code>sling.auth.requirements = "-/system/sling/login"</code> to ensure the
servlet can be accessed without requiring authentication (checks for
<code>slash</code> or <code>dot</code> or <code>end of string</code>). The
following request urls would work then without authentication:<ul>
<li>/system/sling/login</li>
<li>/system/sling/login.html</li>
<li>/system/sling/login/somesuffix</li>
-<li>/system/sling/login-test (if this is not desired, you have to use a
restriction like this: <code>sling.auth.requirements =
"-/system/sling/login"</code>)</li>
</ul>
</li>
-<li>
-<p>An authentication handler may register itself with the service registration
property <code>sling.auth.requirements = "-/apps/sample/loginform"</code> to
ensure the login form can be rendered without requiring authentication.</p>
-</li>
+</ul>
+<p>While the following request will still require authentication </p>
+<div class="codehilite"><pre><span class="o">*</span> <span
class="o">/</span><span class="n">system</span><span class="o">/</span><span
class="n">sling</span><span class="o">/</span><span class="n">login</span><span
class="o">-</span><span class="n">test</span>
+</pre></div>
+
+
+<ul>
+<li>An authentication handler may register itself with the service
registration property <code>sling.auth.requirements =
"-/apps/sample/loginform"</code> to ensure the login form can be rendered
without requiring authentication.</li>
</ul>
<h2 id="authenticator-implementation">Authenticator implementation<a
class="headerlink" href="#authenticator-implementation" title="Permanent
link">¶</a></h2>
<p>The implementation of the <code>Authenticator</code> interface is similar
for both methods:</p>
@@ -271,7 +273,7 @@ h2:hover > .headerlink, h3:hover > .head
</ol>
<p>Unlike for the <code>login</code> method in the <code>logout</code> method
case all <code>AuthenticationHandler</code> services selected in the first step
are called. If none can be selected or none can actually handle the
<code>dropCredentials</code> request, the <code>logout</code> silently
returns.</p>
<div class="timestamp" style="margin-top: 30px; font-size: 80%;
text-align: right;">
- Rev. 1712288 by kwin on Tue, 3 Nov 2015 13:11:22 +0000
+ Rev. 1795883 by asanso on Tue, 23 May 2017 08:44:44 +0000
</div>
<div class="trademarkFooter">
Apache Sling, Sling, Apache, the Apache feather logo, and the Apache
Sling project
