The simple wrapper for the HttpServletRequest seems to be working quite well. I'd love any feedback, and if so, for this to be included in the next release of Acegi. I think it's a great step forward to making it possible for Acegi to be a "drop-in" replacement.
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.SecureContext;
/**
* Wraps a normal <code>HttpServletRequest</code> with a
* {@link AuthenticationHttpServletRequest}.
* <p/>
* This helps with transparent migration from old container managed code
* that relied on calls such as <code>request.getUserPrincipal</code> to
* the Acegi framework.
*/
public class AuthenticationWrapperFilter implements Filter {
/**
* @see javax.servlet.Filter#init(javax.servlet.FilterConf ig)
*/
public void init(FilterConfig arg0) throws ServletException { }
/**
* @see javax.servlet.Filter#doFilter(javax.servlet.Servle tRequest, javax.servlet.ServletResponse, javax.servlet.FilterChain)
*/
public void doFilter(ServletRequest req, ServletResponse res,
FilterChain chain) throws IOException, ServletException {
SecureContext ctx = (SecureContext) ContextHolder.getContext();
ServletRequest oldReq = null;
if (isValidContext(ctx)) {
oldReq = req;
req = new AuthenticationHttpServletRequest((HttpServletReque st)req);
}
chain.doFilter(req, res);
if (isValidContext(ctx)) {
req = oldReq;
}
}
/**
* @param ctx the current context
* @return <code>true</code> if the context is not null and it has an
* <code>Authentication</code> object, or <code>false</code>
*/
private boolean isValidContext(SecureContext ctx) {
return ctx != null && ctx.getAuthentication() != null;
}
/**
* @see javax.servlet.Filter#destroy()
*/
public void destroy() { }
}
import java.security.Principal;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import net.sf.acegisecurity.Authentication;
import net.sf.acegisecurity.GrantedAuthority;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.SecureContext;
/**
* Wraps a normal <code>HttpServletRequest</code> to delegate Principal
* related methods to the <code>Authentication</code> object that lives
* in the <code>SecureContext</code> of the current Thread.
* <p/>
* This helps with transparent migration from old container managed code
* that relied on calls such as <code>request.getUserPrincipal</code> to
* the Acegi framework.
*/
public class AuthenticationHttpServletRequest extends HttpServletRequestWrapper {
private Authentication auth;
/**
* @param request the original request
*/
public AuthenticationHttpServletRequest(HttpServletReques t request) {
super(request);
SecureContext ctx = (SecureContext) ContextHolder.getContext();
auth = ctx.getAuthentication();
}
/**
* @see javax.servlet.http.HttpServletRequest#getRemoteUse r()
*/
public String getRemoteUser() {
return auth.getName();
}
/**
* @see javax.servlet.http.HttpServletRequest#getUserPrinc ipal()
*/
public Principal getUserPrincipal() {
return auth;
}
/**
* @see javax.servlet.http.HttpServletRequest#isUserInRole (java.lang.String)
*/
public boolean isUserInRole(String roleName) {
if (roleName == null) return false;
GrantedAuthority[] roles = auth.getAuthorities();
for (int i = 0; i < roles.length; i++) {
if (roleName.equals(roles[i].getAuthority())) {
return true;
}
}
return false;
}
}