Package org.eclipse.jetty.security
Class ConstraintSecurityHandler
- java.lang.Object
-
- org.eclipse.jetty.util.component.AbstractLifeCycle
-
- org.eclipse.jetty.util.component.ContainerLifeCycle
-
- org.eclipse.jetty.server.handler.AbstractHandler
-
- org.eclipse.jetty.server.handler.AbstractHandlerContainer
-
- org.eclipse.jetty.server.handler.HandlerWrapper
-
- org.eclipse.jetty.security.SecurityHandler
-
- org.eclipse.jetty.security.ConstraintSecurityHandler
-
- All Implemented Interfaces:
Authenticator.AuthConfiguration
,ConstraintAware
,Handler
,HandlerContainer
,Container
,Destroyable
,Dumpable
,Dumpable.DumpableContainer
,LifeCycle
@Deprecated(since="2021-05-27") public class ConstraintSecurityHandler extends SecurityHandler implements ConstraintAware
Deprecated.The Eclipse Jetty and Apache Felix Http Jetty packages are no longer supported.ConstraintSecurityHandlerHandler to enforce SecurityConstraints. This implementation is servlet spec 3.1 compliant and pre-computes the constraint combinations for runtime efficiency.
-
-
Nested Class Summary
-
Nested classes/interfaces inherited from class org.eclipse.jetty.security.SecurityHandler
SecurityHandler.NotChecked
-
Nested classes/interfaces inherited from class org.eclipse.jetty.server.handler.AbstractHandler
AbstractHandler.ErrorDispatchHandler
-
Nested classes/interfaces inherited from class org.eclipse.jetty.util.component.AbstractLifeCycle
AbstractLifeCycle.AbstractLifeCycleListener
-
Nested classes/interfaces inherited from interface org.eclipse.jetty.util.component.Container
Container.InheritedListener, Container.Listener
-
Nested classes/interfaces inherited from interface org.eclipse.jetty.util.component.Dumpable
Dumpable.DumpableContainer
-
Nested classes/interfaces inherited from interface org.eclipse.jetty.util.component.LifeCycle
LifeCycle.Listener
-
-
Field Summary
-
Fields inherited from class org.eclipse.jetty.security.SecurityHandler
__NO_USER, __NOBODY
-
-
Constructor Summary
Constructors Constructor Description ConstraintSecurityHandler()
Deprecated.
-
Method Summary
All Methods Static Methods Instance Methods Concrete Methods Deprecated Methods Modifier and Type Method Description void
addConstraintMapping(ConstraintMapping mapping)
Deprecated.Add a Constraint Mapping.void
addRole(java.lang.String role)
Deprecated.Add a Role definition.boolean
checkPathsWithUncoveredHttpMethods()
Deprecated.Servlet spec 3.1 pg.static Constraint
createConstraint()
Deprecated.static Constraint
createConstraint(java.lang.String name, boolean authenticate, java.lang.String[] roles, int dataConstraint)
Deprecated.Create a security constraintstatic Constraint
createConstraint(java.lang.String name, java.lang.String[] rolesAllowed, ServletSecurity.EmptyRoleSemantic permitOrDeny, ServletSecurity.TransportGuarantee transport)
Deprecated.Create Constraintstatic Constraint
createConstraint(java.lang.String name, HttpConstraintElement element)
Deprecated.Create a Constraintstatic Constraint
createConstraint(Constraint constraint)
Deprecated.static java.util.List<ConstraintMapping>
createConstraintsWithMappingsForPath(java.lang.String name, java.lang.String pathSpec, ServletSecurityElement securityElement)
Deprecated.Generate Constraints and ContraintMappings for the given url pattern and ServletSecurityElementvoid
dump(java.lang.Appendable out, java.lang.String indent)
Deprecated.Dump this object (and children) into an Appendable using the provided indent after any new lines.java.util.List<ConstraintMapping>
getConstraintMappings()
Deprecated.static java.util.List<ConstraintMapping>
getConstraintMappingsForPath(java.lang.String pathSpec, java.util.List<ConstraintMapping> constraintMappings)
Deprecated.java.util.Set<java.lang.String>
getPathsWithUncoveredHttpMethods()
Deprecated.Servlet spec 3.1 pg.java.util.Set<java.lang.String>
getRoles()
Deprecated.boolean
isDenyUncoveredHttpMethods()
Deprecated.static java.util.List<ConstraintMapping>
removeConstraintMappingsForPath(java.lang.String pathSpec, java.util.List<ConstraintMapping> constraintMappings)
Deprecated.Take out of the constraint mappings those that match the given path.void
setConstraintMappings(java.util.List<ConstraintMapping> constraintMappings)
Deprecated.Process the constraints following the combining rules in Servlet 3.0 EA spec section 13.7.1 Note that much of the logic is in the RoleInfo class.void
setConstraintMappings(java.util.List<ConstraintMapping> constraintMappings, java.util.Set<java.lang.String> roles)
Deprecated.Process the constraints following the combining rules in Servlet 3.0 EA spec section 13.7.1 Note that much of the logic is in the RoleInfo class.void
setConstraintMappings(ConstraintMapping[] constraintMappings)
Deprecated.Process the constraints following the combining rules in Servlet 3.0 EA spec section 13.7.1 Note that much of the logic is in the RoleInfo class.void
setDenyUncoveredHttpMethods(boolean deny)
Deprecated.See Servlet Spec 31, sec 13.8.4, pg 145 When true, requests with http methods not explicitly covered either by inclusion or omissions in constraints, will have access denied.void
setRoles(java.util.Set<java.lang.String> roles)
Deprecated.Set the known roles.-
Methods inherited from class org.eclipse.jetty.security.SecurityHandler
getAuthenticator, getAuthenticatorFactory, getAuthMethod, getCurrentSecurityHandler, getIdentityService, getInitParameter, getInitParameterNames, getKnownAuthenticatorFactories, getLoginService, getRealmName, handle, isCheckWelcomeFiles, isSessionRenewedOnAuthentication, logout, setAuthenticator, setAuthenticatorFactory, setAuthMethod, setCheckWelcomeFiles, setIdentityService, setInitParameter, setLoginService, setRealmName, setSessionRenewedOnAuthentication
-
Methods inherited from class org.eclipse.jetty.server.handler.HandlerWrapper
destroy, getHandler, getHandlers, insertHandler, setHandler
-
Methods inherited from class org.eclipse.jetty.server.handler.AbstractHandlerContainer
findContainerOf, getChildHandlerByClass, getChildHandlers, getChildHandlersByClass, setServer
-
Methods inherited from class org.eclipse.jetty.server.handler.AbstractHandler
getServer
-
Methods inherited from class org.eclipse.jetty.util.component.ContainerLifeCycle
addBean, addBean, addEventListener, addManaged, contains, dump, dump, dump, dump, dumpObject, dumpStdErr, getBean, getBeans, getBeans, getContainedBeans, isAuto, isManaged, isUnmanaged, manage, removeBean, removeBeans, removeEventListener, setBeans, setStopTimeout, unmanage, updateBean, updateBean, updateBeans
-
Methods inherited from class org.eclipse.jetty.util.component.AbstractLifeCycle
addLifeCycleListener, getState, getState, getStopTimeout, isFailed, isRunning, isStarted, isStarting, isStopped, isStopping, removeLifeCycleListener, start, stop, toString
-
Methods inherited from class java.lang.Object
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait
-
Methods inherited from interface org.eclipse.jetty.util.component.Dumpable.DumpableContainer
isDumpable
-
Methods inherited from interface org.eclipse.jetty.util.component.LifeCycle
addLifeCycleListener, isFailed, isRunning, isStarted, isStarting, isStopped, isStopping, removeLifeCycleListener, start, stop
-
-
-
-
Method Detail
-
createConstraint
public static Constraint createConstraint()
Deprecated.
-
createConstraint
public static Constraint createConstraint(Constraint constraint)
Deprecated.
-
createConstraint
public static Constraint createConstraint(java.lang.String name, boolean authenticate, java.lang.String[] roles, int dataConstraint)
Deprecated.Create a security constraint- Parameters:
name
- the name of the constraintauthenticate
- true to authenticateroles
- list of rolesdataConstraint
- the data constraint- Returns:
- the constraint
-
createConstraint
public static Constraint createConstraint(java.lang.String name, HttpConstraintElement element)
Deprecated.Create a Constraint- Parameters:
name
- the nameelement
- the http constraint element- Returns:
- the created constraint
-
createConstraint
public static Constraint createConstraint(java.lang.String name, java.lang.String[] rolesAllowed, ServletSecurity.EmptyRoleSemantic permitOrDeny, ServletSecurity.TransportGuarantee transport)
Deprecated.Create Constraint- Parameters:
name
- the namerolesAllowed
- the list of allowed rolespermitOrDeny
- the permission semantictransport
- the transport guarantee- Returns:
- the created constraint
-
getConstraintMappingsForPath
public static java.util.List<ConstraintMapping> getConstraintMappingsForPath(java.lang.String pathSpec, java.util.List<ConstraintMapping> constraintMappings)
Deprecated.
-
removeConstraintMappingsForPath
public static java.util.List<ConstraintMapping> removeConstraintMappingsForPath(java.lang.String pathSpec, java.util.List<ConstraintMapping> constraintMappings)
Deprecated.Take out of the constraint mappings those that match the given path.- Parameters:
pathSpec
- the path specconstraintMappings
- a new list minus the matching constraints- Returns:
- the list of constraint mappings
-
createConstraintsWithMappingsForPath
public static java.util.List<ConstraintMapping> createConstraintsWithMappingsForPath(java.lang.String name, java.lang.String pathSpec, ServletSecurityElement securityElement)
Deprecated.Generate Constraints and ContraintMappings for the given url pattern and ServletSecurityElement- Parameters:
name
- the namepathSpec
- the path specsecurityElement
- the servlet security element- Returns:
- the list of constraint mappings
-
getConstraintMappings
public java.util.List<ConstraintMapping> getConstraintMappings()
Deprecated.- Specified by:
getConstraintMappings
in interfaceConstraintAware
-
getRoles
public java.util.Set<java.lang.String> getRoles()
Deprecated.- Specified by:
getRoles
in interfaceConstraintAware
-
setConstraintMappings
public void setConstraintMappings(java.util.List<ConstraintMapping> constraintMappings)
Deprecated.Process the constraints following the combining rules in Servlet 3.0 EA spec section 13.7.1 Note that much of the logic is in the RoleInfo class.- Parameters:
constraintMappings
- The constraintMappings to set, from which the set of known roles is determined.
-
setConstraintMappings
public void setConstraintMappings(ConstraintMapping[] constraintMappings)
Deprecated.Process the constraints following the combining rules in Servlet 3.0 EA spec section 13.7.1 Note that much of the logic is in the RoleInfo class.- Parameters:
constraintMappings
- The constraintMappings to set as array, from which the set of known roles is determined. Needed to retain API compatibility for 7.x
-
setConstraintMappings
public void setConstraintMappings(java.util.List<ConstraintMapping> constraintMappings, java.util.Set<java.lang.String> roles)
Deprecated.Process the constraints following the combining rules in Servlet 3.0 EA spec section 13.7.1 Note that much of the logic is in the RoleInfo class.- Specified by:
setConstraintMappings
in interfaceConstraintAware
- Parameters:
constraintMappings
- The constraintMappings to set.roles
- The known roles (or null to determine them from the mappings)
-
setRoles
public void setRoles(java.util.Set<java.lang.String> roles)
Deprecated.Set the known roles. This may be overridden by a subsequent call tosetConstraintMappings(ConstraintMapping[])
orsetConstraintMappings(List, Set)
.- Parameters:
roles
- The known roles (or null to determine them from the mappings)
-
addConstraintMapping
public void addConstraintMapping(ConstraintMapping mapping)
Deprecated.Description copied from interface:ConstraintAware
Add a Constraint Mapping. May be called for running webapplication as an annotated servlet is instantiated.- Specified by:
addConstraintMapping
in interfaceConstraintAware
- Parameters:
mapping
- the mapping- See Also:
ConstraintAware.addConstraintMapping(org.eclipse.jetty.security.ConstraintMapping)
-
addRole
public void addRole(java.lang.String role)
Deprecated.Description copied from interface:ConstraintAware
Add a Role definition. May be called on running webapplication as an annotated servlet is instantiated.- Specified by:
addRole
in interfaceConstraintAware
- Parameters:
role
- the role- See Also:
ConstraintAware.addRole(java.lang.String)
-
dump
public void dump(java.lang.Appendable out, java.lang.String indent) throws java.io.IOException
Deprecated.Description copied from interface:Dumpable
Dump this object (and children) into an Appendable using the provided indent after any new lines. The indent should not be applied to the first object dumped.- Specified by:
dump
in interfaceDumpable
- Overrides:
dump
in classContainerLifeCycle
- Parameters:
out
- The appendable to dump toindent
- The indent to apply after any new lines.- Throws:
java.io.IOException
- if unable to write to Appendable
-
setDenyUncoveredHttpMethods
public void setDenyUncoveredHttpMethods(boolean deny)
Deprecated.Description copied from interface:ConstraintAware
See Servlet Spec 31, sec 13.8.4, pg 145 When true, requests with http methods not explicitly covered either by inclusion or omissions in constraints, will have access denied.- Specified by:
setDenyUncoveredHttpMethods
in interfaceConstraintAware
- Parameters:
deny
- true for denied method access- See Also:
ConstraintAware.setDenyUncoveredHttpMethods(boolean)
-
isDenyUncoveredHttpMethods
public boolean isDenyUncoveredHttpMethods()
Deprecated.- Specified by:
isDenyUncoveredHttpMethods
in interfaceConstraintAware
-
checkPathsWithUncoveredHttpMethods
public boolean checkPathsWithUncoveredHttpMethods()
Deprecated.Servlet spec 3.1 pg. 147.- Specified by:
checkPathsWithUncoveredHttpMethods
in interfaceConstraintAware
- Returns:
- true if urls with uncovered http methods
-
getPathsWithUncoveredHttpMethods
public java.util.Set<java.lang.String> getPathsWithUncoveredHttpMethods()
Deprecated.Servlet spec 3.1 pg. 147. The container must check all the combined security constraint information and log any methods that are not protected and the urls at which they are not protected- Returns:
- list of paths for which there are uncovered methods
-
-