Examples with Authentication org.eclipse.jetty.server.Authentication used on opensource projects

Example 31 with Authentication

use of org.eclipse.jetty.server.Authentication in project drill by apache.

the class TestDrillSpnegoAuthenticator method testAuthClientRequestForOtherPage.

/**
 * Test to verify response when request is sent for any other resource other than
 * {@link WebServerConstants#SPENGO_LOGIN_RESOURCE_PATH} from authenticated session. Expectation is server will
 * find the authenticated UserIdentity and will not perform the authentication again for new resource.
 */
@Test
public void testAuthClientRequestForOtherPage() throws Exception {
    final HttpServletRequest request = Mockito.mock(HttpServletRequest.class);
    final HttpServletResponse response = Mockito.mock(HttpServletResponse.class);
    final HttpSession session = Mockito.mock(HttpSession.class);
    final Authentication authentication = Mockito.mock(UserAuthentication.class);
    Mockito.when(request.getSession(true)).thenReturn(session);
    Mockito.when(request.getRequestURI()).thenReturn(WebServerConstants.WEBSERVER_ROOT_PATH);
    Mockito.when(session.getAttribute(SessionAuthentication.__J_AUTHENTICATED)).thenReturn(authentication);
    final UserAuthentication returnedAuthentication = (UserAuthentication) spnegoAuthenticator.validateRequest(request, response, false);
    assertEquals(authentication, returnedAuthentication);
    verify(response, never()).sendError(401);
    verify(response, never()).setHeader(HttpHeader.WWW_AUTHENTICATE.asString(), HttpHeader.NEGOTIATE.asString());
}

Example 32 with Authentication

use of org.eclipse.jetty.server.Authentication in project drill by apache.

the class DrillSpnegoAuthenticator method validateRequest.

/**
 * Updated logic as compared to default implementation in
 * {@link SpnegoAuthenticator#validateRequest(ServletRequest, ServletResponse, boolean)} to handle below cases:
 * 1) Perform SPNEGO authentication only when spnegoLogin resource is requested. This helps to avoid authentication
 *    for each and every resource which the JETTY provided authenticator does.
 * 2) Helps to redirect to the target URL after authentication is done successfully.
 * 3) Clear-Up in memory session information once LogOut is triggered such that any future request also triggers SPNEGO
 *    authentication.
 * @param request
 * @param response
 * @param mandatoryAuth
 * @return
 * @throws ServerAuthException
 */
@Override
public Authentication validateRequest(ServletRequest request, ServletResponse response, boolean mandatoryAuth) throws ServerAuthException {
    final HttpServletRequest req = (HttpServletRequest) request;
    final HttpSession session = req.getSession(true);
    final Authentication authentication = (Authentication) session.getAttribute(SessionAuthentication.__J_AUTHENTICATED);
    final String uri = req.getRequestURI();
    // If the Request URI is for /spnegoLogin then perform login
    final boolean mandatory = mandatoryAuth || uri.equals(WebServerConstants.SPENGO_LOGIN_RESOURCE_PATH);
    // invalidated
    if (authentication != null) {
        if (uri.equals(WebServerConstants.LOGOUT_RESOURCE_PATH)) {
            return null;
        }
        // Already logged in so just return the session attribute.
        return authentication;
    }
    // Try to authenticate an unauthenticated session.
    return authenticateSession(request, response, mandatory);
}