View Javadoc

1   /* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
2    *
3    * Licensed under the Apache License, Version 2.0 (the "License");
4    * you may not use this file except in compliance with the License.
5    * You may obtain a copy of the License at
6    *
7    *     http://www.apache.org/licenses/LICENSE-2.0
8    *
9    * Unless required by applicable law or agreed to in writing, software
10   * distributed under the License is distributed on an "AS IS" BASIS,
11   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12   * See the License for the specific language governing permissions and
13   * limitations under the License.
14   */
15  
16  package org.acegisecurity.providers.rememberme;
17  
18  import org.acegisecurity.AcegiMessageSource;
19  import org.acegisecurity.Authentication;
20  import org.acegisecurity.AuthenticationException;
21  import org.acegisecurity.BadCredentialsException;
22  
23  import org.acegisecurity.providers.AuthenticationProvider;
24  
25  import org.apache.commons.logging.Log;
26  import org.apache.commons.logging.LogFactory;
27  
28  import org.springframework.beans.factory.InitializingBean;
29  
30  import org.springframework.context.MessageSource;
31  import org.springframework.context.MessageSourceAware;
32  import org.springframework.context.support.MessageSourceAccessor;
33  
34  import org.springframework.util.Assert;
35  
36  
37  /**
38   * An {@link AuthenticationProvider} implementation that validates {@link
39   * org.acegisecurity.providers.rememberme.RememberMeAuthenticationToken}s.<p>To be successfully validated, the
40   * {@link org.acegisecurity.providers.rememberme.RememberMeAuthenticationToken#getKeyHash()} must match this class'
41   * {@link #getKey()}.</p>
42   */
43  public class RememberMeAuthenticationProvider implements AuthenticationProvider, InitializingBean, MessageSourceAware {
44      //~ Static fields/initializers =====================================================================================
45  
46      private static final Log logger = LogFactory.getLog(RememberMeAuthenticationProvider.class);
47  
48      //~ Instance fields ================================================================================================
49  
50      protected MessageSourceAccessor messages = AcegiMessageSource.getAccessor();
51      private String key;
52  
53      //~ Methods ========================================================================================================
54  
55  	public void afterPropertiesSet() throws Exception {
56          Assert.hasLength(key);
57          Assert.notNull(this.messages, "A message source must be set");
58      }
59  
60      public Authentication authenticate(Authentication authentication)
61          throws AuthenticationException {
62          if (!supports(authentication.getClass())) {
63              return null;
64          }
65  
66          if (this.key.hashCode() != ((RememberMeAuthenticationToken) authentication).getKeyHash()) {
67              throw new BadCredentialsException(messages.getMessage("RememberMeAuthenticationProvider.incorrectKey",
68                      "The presented RememberMeAuthenticationToken does not contain the expected key"));
69          }
70  
71          return authentication;
72      }
73  
74      public String getKey() {
75          return key;
76      }
77  
78      public void setKey(String key) {
79          this.key = key;
80      }
81  
82      public void setMessageSource(MessageSource messageSource) {
83          this.messages = new MessageSourceAccessor(messageSource);
84      }
85  
86      public boolean supports(Class authentication) {
87          return (RememberMeAuthenticationToken.class.isAssignableFrom(authentication));
88      }
89  }