flex.messaging.security
Class WeblogicLoginCommand

java.lang.Object
  flex.messaging.security.AppServerLoginCommand
      flex.messaging.security.WeblogicLoginCommand

All Implemented Interfaces:

LoginCommand

public class WeblogicLoginCommand
extends AppServerLoginCommand

Authenticates against WebLogic and if using an HttpServlet will store the authenticated user in the request. Authorization is done via WebLogic groups, not via the WebLogic roles mechanism.

Constructor Summary

WeblogicLoginCommand()

Method Summary

Principal	doAuthentication(String username, Object credentials) The gateway calls this method to perform programmatic, custom authentication.
boolean	doAuthorization(Principal principal, List roles) The gateway calls this method to perform programmatic authorization.
boolean	logout(Principal principal) Attempts to log a user out from their session.

Methods inherited from class flex.messaging.security.AppServerLoginCommand

start, stop

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

WeblogicLoginCommand

public WeblogicLoginCommand()

Method Detail

doAuthentication

public Principal doAuthentication(String username,
                                  Object credentials)

The gateway calls this method to perform programmatic, custom authentication.

The credentials are passed as a Map to allow for extra properties to be passed in the future. For now, only a "password" property is sent.

Parameters:

username - The principal being authenticated

credentials - A map, typically with string keys and values - holds, for example, a password

Returns:

principal for the authenticated user when authentication is successful; null otherwise

doAuthorization

public boolean doAuthorization(Principal principal,
                               List roles)

The gateway calls this method to perform programmatic authorization.

This implementation will simply iterate over the supplied roles and check that at least one of the roles returned true from a call to HttpServletRequest.isUserInRole(String role).

Specified by:

doAuthorization in interface LoginCommand

Overrides:

doAuthorization in class AppServerLoginCommand

Parameters:

principal - The principal being checked for authorization

roles - A List of role names to check, all members should be strings

Returns:

true if the principal belongs to at least one of the roles

logout

public boolean logout(Principal principal)

Attempts to log a user out from their session. NOTE: May not be possible on all application servers.

Parameters:

principal - The principal to logout.

Returns:

true when logout is successful