Package com.spotfire.server.security

Interface AuthenticationContext

All Known Subinterfaces:
WebAuthenticationContext
public interface AuthenticationContext
The AuthenticationContext contains information about the client and the network connection used by a client that needs to be authenticated. This information can be used by a CustomAuthenticator or a CustomWebAuthenticator implementation during authentication, or by a PostAuthenticationFilter implementation to perform extra checks (such as validating the client's IP number against a list of allowed hosts) after the user has been authenticated.

When used from a PostAuthenticationFilter implementation these attributes may be available:

  • If the user has been authenticated using a X.509 certificate, then the certificate chain is available as a java.security.cert.X509Certificate[] attribute that can be retrieved by calling the getAttribute(java.lang.String) method with the name javax.servlet.request.X509Certificate.
  • If the user has been authenticated using form based authentication, then a possibly empty java.util.Map<String, java.util.List<String>> attribute is available and can be retrieved by calling the getAttribute(java.lang.String) method with the name com.spotfire.server.security.custom-parameters. This map contains all parameters with the prefix sf_custom_login_ posted by a custom login page. Note that the prefix is stripped from the parameter names before they're added to the map.
  • If the user has been authenticated using OpenID Connect, then the following attributes are available:
    • The access token as a String attribute that can be retrieved by calling the getAttribute(java.lang.String) method with the name com.spotfire.server.security.oidc.access-token.
    • The (unparsed) ID token as a String attribute that can be retrieved by calling the getAttribute(java.lang.String) method with the name com.spotfire.server.security.oidc.id-token.
Since:
3.0

  • Method Details

    • getRemoteAddr

      String getRemoteAddr()
      See ServletRequest.getRemoteAddr().
      Returns:
      remote address
      Since:
      3.0

    • getRemoteHost

      String getRemoteHost()
      See ServletRequest.getRemoteHost().
      Returns:
      remote host
      Since:
      3.0

    • getServerName

      String getServerName()
      See ServletRequest.getServerName().
      Returns:
      server name
      Since:
      3.0

    • getServerPort

      int getServerPort()
      See ServletRequest.getServerPort().
      Returns:
      server port
      Since:
      3.0

    • isSecure

      boolean isSecure()
      See ServletRequest.isSecure().
      Returns:
      is secure
      Since:
      3.0

    • getCookies

      @Deprecated Cookie[] getCookies()
      Deprecated.
      Use getHeader("Cookie") instead to access the raw HTTP cookie data
      This method is deprecated, as the Cookie class changes package name in Java EE 9 from javax.servlet.http.Cookie to jakarta.servlet.http.Cookie. The method invocation getHeader("Cookie") can be used instead in order to access the raw HTTP cookie data.
      Returns:
      cookies
      Since:
      3.0
      See Also:

    • getDateHeader

      long getDateHeader(String name)
      See HttpServletRequest.getDateHeader(java.lang.String).
      Parameters:
      name - date header name
      Returns:
      date header
      Since:
      3.0

    • getHeader

      String getHeader(String name)
      See HttpServletRequest.getHeader(java.lang.String).
      Parameters:
      name - header name
      Returns:
      header by name
      Since:
      3.0

    • getHeaderNames

      Enumeration<String> getHeaderNames()
      See HttpServletRequest.getHeaderNames().
      Returns:
      header names
      Since:
      3.0

    • getHeaders

      Enumeration<String> getHeaders(String name)
      See HttpServletRequest.getHeaders(java.lang.String).
      Parameters:
      name - header name
      Returns:
      headers by name
      Since:
      3.0

    • getIntHeader

      int getIntHeader(String name)
      See HttpServletRequest.getIntHeader(java.lang.String).
      Parameters:
      name - header name
      Returns:
      int value of the header
      Since:
      3.0

    • getAttribute

      Object getAttribute(String name)
      Returns the value of the named attribute as an Object, or null if no attribute of the given name exists.

      For requests made using HTTPS, the client certificates are available using both the old Java EE attribute name javax.servlet.request.X509Certificate and the new Java EE 9 attribute name jakarta.servlet.request.X509Certificate. The usage of the old Java EE attribute name is deprecated.

      Parameters:
      name - attribute name
      Returns:
      request attribute
      Since:
      3.2
      See Also:

    • getAttributeNames

      Enumeration<String> getAttributeNames()
      Returns an Enumeration containing the names of the attributes available to this request. This method returns an empty Enumeration if the request has no attributes available to it.

      For requests made using HTTPS, the client certificates are available using both the old Java EE attribute name javax.servlet.request.X509Certificate and the new Java EE 9 attribute name jakarta.servlet.request.X509Certificate. The usage of the old Java EE attribute name is deprecated.

      Returns:
      an Enumeration of strings containing the names of the request's attributes
      Since:
      3.2
      See Also:

    • getLocalAddr

      String getLocalAddr()
      Delegates to the underlying javax.servlet.http.HttpServletRequest.
      Returns:
      the local address
      Since:
      7.6
      See Also:

    • getLocalName

      String getLocalName()
      Delegates to the underlying javax.servlet.http.HttpServletRequest.
      Returns:
      the local name
      Since:
      7.6
      See Also:

    • getLocalPort

      int getLocalPort()
      Delegates to the underlying javax.servlet.http.HttpServletRequest.
      Returns:
      the local port
      Since:
      7.6
      See Also:

    • getLocale

      Locale getLocale()
      Delegates to the underlying javax.servlet.http.HttpServletRequest.
      Returns:
      the preferred locale
      Since:
      7.6
      See Also:

    • getLocales

      Enumeration<Locale> getLocales()
      Delegates to the underlying javax.servlet.http.HttpServletRequest.
      Returns:
      the preferred locales
      Since:
      7.6
      See Also:

    • getRemotePort

      int getRemotePort()
      Delegates to the underlying javax.servlet.http.HttpServletRequest.
      Returns:
      the remote port
      Since:
      7.6
      See Also:

    • getRequestedSessionId

      String getRequestedSessionId()
      Delegates to the underlying javax.servlet.http.HttpServletRequest.

      Note: the session ID should never be logged or exposed in any other way.

      Returns:
      the requested HTTP session ID
      Since:
      7.6
      See Also:

    • getSessionId

      String getSessionId()
      Returns the HTTP session ID.

      Note: the session ID should never be logged or exposed in any other way.

      Returns:
      the HTTP session ID
      Since:
      7.6
      See Also:

    • isRequestedSessionIdFromCookie

      boolean isRequestedSessionIdFromCookie()
      Returns the HTTP session ID.

      Note: the session ID should never be logged or exposed in any other way.

      Returns:
      true if the requested session ID came from a cookie, and false otherwise
      Since:
      7.6
      See Also:

    • isRequestedSessionIdFromURL

      boolean isRequestedSessionIdFromURL()
      Returns the HTTP session ID.

      Note: the session ID should never be logged or exposed in any other way.

      Returns:
      true if the requested session ID came from the URL, and false otherwise
      Since:
      7.6
      See Also:

    • isRequestedSessionIdValid

      boolean isRequestedSessionIdValid()
      Returns the HTTP session ID.

      Note: the session ID should never be logged or exposed in any other way.

      Returns:
      true if the requested session is valid, and false otherwise
      Since:
      7.6
      See Also:

    • getQueryString

      String getQueryString()
      Delegates to the underlying javax.servlet.http.HttpServletRequest.
      Returns:
      the query string or null
      Since:
      7.8
      See Also:

    • getRequestContext

      Map<String,Object> getRequestContext()
      Returns a mutable map, stored as a request attribute, that is only available from this interface.

      Typically used to pass context information (that is only applicable during the current request) from for example a CustomAuthenticator implementation to a PostAuthenticationFilter implementation.

      Returns:
      the request context
      Since:
      7.11

    • getUserDirectory

      UserDirectory getUserDirectory()
      Returns a reference to the User Directory class, that can be used for reading and writing users and groups.
      Returns:
      a reference to the User Directory class
      Since:
      10.1