|
Page Edited :
SLINGxSITE :
Authentication
Authentication has been edited by Felix Meschberger (Apr 26, 2009). Content:AuthenticationThis page is about how requests are authenticated in Sling. The process of authenticating client requests takes two steps: The first step extracts the credentials from the request and the second step tries to login to the JCR repository 1 . The former of these steps is extensible by providing AuthenticationHandler services, while the latter is coded into the SlingAuthenticator class. But before getting to much into the details, lets step back and look at the various actors in the authentication game. The SlingMaingServlet which is the main entry point into the Sling system for all request processing is registered with the OSGi HTTP Service. The servlet is registered together with a customized implementation of the OSGi HttpContext class. The HttpContext interface defines a handleSecurity method which is intended to authenticate the request. This method is implemented in Sling to use the SlingAuthenticator class which in turn uses AuthenticationHandler services to extract credentials from the request and login to the repository. This sounds all very nice, but how is this linked together ? Lets look at the processing steps from the point a request is sent to a Sling system to the moment the request is finally entering the SlingMainServlet.service method:
The important thing to note here is, that at the time the handleSecurity method is called, the SlingMainServlet is not yet in control of the request. So any functionality added by the SlingMainServlet, notably the SlingHttpServletRequest and SlingHttpServletResponse objects are not available to the implementation of the handleSecurity method. HttpContext.handleSecurityThe HttpContext.handleSecurity method is implemented by the SlingMainServlet because this servlet implements the HttpContext interface itself. The handleSecurity method simply calls SlingAuthenticator.authenticate method and returns the result of this call. If the call fails, an error is logged and false is returned to not handle the request. SlingAuthenticatorThe SlingAuthenticator class is an internal class of the org.apache.sling.engine bundle, which also has the SlingMainServlet. In fact the single instance of this class is managed by the SlingMainServlet. The SlingAuthenticator class has the following basic features:
The authenticate method gets credentials from the AuthenticationHandler and logs into the JCR repository using those credentials. If the login is successful, the SlingAuthenticator sets the following request attributes:
NOTE: Do NOT use the javax.jcr.Session request attribute in your Sling applications. This attribute must be considered an implementation specific to convey the JCR Session to the SlingMainServlet. In future versions of the Sling Engine bundle, this request attribute may not be present anymore. To get the JCR Session for the current request adapt the request's resource resolver to a JCR Session: Session session = request.getResourceResolver().adaptTo(Session.class);
Each path may be an absolute URL, an URL with just the host/port and path or just a plain absolute path:
When looking for an AuthenticationHandler the authentication handler is selected whose path is the longest match on the request URL. If the service is registered with Scheme and Host/Port, these must exactly match for the service to be eligible. AuthenticatorThe Authenticator interface has been introduced in Rev. 768396 to implement SLING-938 (Refine initiaition of the authentication process) org.apache.sling.engine.auth.Authenticator /** * The <code>Authenticator</code> interface defines the service interface of the * authenticator used by the Sling engine. This service provides a method to * find an {...@link AuthenticationHandler} and call its * {...@link AuthenticationHandler#requestAuthentication(HttpServletRequest, HttpServletResponse)} * method. * <p> * This interface is not intended to be implemented by applications but may be * used to initiate the authentication process form a request processing servlet * or script. * * @since 2.0.4 */ public interface Authenticator { /** * Finds an {...@link AuthenticationHandler} for the given request and call its * {...@link AuthenticationHandler#requestAuthentication(HttpServletRequest, HttpServletResponse)} * method to initiate an authentication process with the client. * <p> * This method must be called on an uncommitted response since the * implementation may want to reset the response to start the authentication * process with a clean response. If the response is already committed an * <code>IllegalStateException</code> is thrown. * <p> * After this method has finished, request processing should be terminated * and the response be considered committed and finished. * * @param request The object representing the client request. * @param response The object representing the response to the client. * @throws NoAuthenticationHandlerException If no authentication handler * claims responsibility to authenticate the request. * @throws IllegalStateException If the response has already been committed. */ public void login(HttpServletRequest request, HttpServletResponse response); } This interface is implemented by the SlingAuthenticator class which is also registered under this service interface. The SlingAuthenticator implementation in fact already has an implementation of this method, which finds an AuthenticationHandler for the request and calls its requestAuthentication method. The login method has three possible exit states:
|
Unsubscribe or edit your notifications preferences
