Package org.eclipse.jetty.annotations

Class ServletSecurityAnnotationHandler

java.lang.Object

org.eclipse.jetty.annotations.AnnotationIntrospector.AbstractIntrospectableAnnotationHandler

org.eclipse.jetty.annotations.ServletSecurityAnnotationHandler

All Implemented Interfaces:

AnnotationIntrospector.IntrospectableAnnotationHandler

public class ServletSecurityAnnotationHandler
extends AnnotationIntrospector.AbstractIntrospectableAnnotationHandler

ServletSecurityAnnotationHandler Inspect a class to see if it has an @ServletSecurity annotation on it, setting up the <security-constraint>s. A servlet can be defined in:

• web.xml
• web-fragment.xml
• @WebServlet annotation discovered
• ServletContext.createServlet

The ServletSecurity annotation for a servlet should only be processed iff metadata-complete == false.

Constructor Summary

Constructors

Constructor	Description
ServletSecurityAnnotationHandler(WebAppContext wac)

Method Summary

Modifier and Type	Method	Description
protected boolean	constraintsExist(java.util.List<ServletMapping> servletMappings, java.util.List<ConstraintMapping> constraintMappings)	Check if there are already <security-constraint> elements defined that match the url-patterns for the servlet.
void	doHandle(java.lang.Class clazz)
protected java.util.List<ServletMapping>	getServletMappings(java.lang.String className)	Get the ServletMappings for the servlet's class.
protected Constraint	makeConstraint(java.lang.Class servlet, java.lang.String[] rolesAllowed, javax.servlet.annotation.ServletSecurity.EmptyRoleSemantic permitOrDeny, javax.servlet.annotation.ServletSecurity.TransportGuarantee transport)	Make a jetty Constraint object, which represents the <auth-constraint> and <user-data-constraint> elements, based on the security annotation.

Methods inherited from class org.eclipse.jetty.annotations.AnnotationIntrospector.AbstractIntrospectableAnnotationHandler

handle

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

ServletSecurityAnnotationHandler

public ServletSecurityAnnotationHandler(WebAppContext wac)

Method Detail

doHandle

public void doHandle(java.lang.Class clazz)

Specified by:

doHandle in class AnnotationIntrospector.AbstractIntrospectableAnnotationHandler

See Also:

AnnotationIntrospector.IntrospectableAnnotationHandler.handle(java.lang.Class)

makeConstraint

protected Constraint makeConstraint(java.lang.Class servlet,
                                    java.lang.String[] rolesAllowed,
                                    javax.servlet.annotation.ServletSecurity.EmptyRoleSemantic permitOrDeny,
                                    javax.servlet.annotation.ServletSecurity.TransportGuarantee transport)

Make a jetty Constraint object, which represents the <auth-constraint> and <user-data-constraint> elements, based on the security annotation.

Parameters:

servlet - the servlet

rolesAllowed - the roles allowed

permitOrDeny - the role / permission semantic

transport - the transport guarantee

Returns:

the constraint

getServletMappings

protected java.util.List<ServletMapping> getServletMappings(java.lang.String className)

Get the ServletMappings for the servlet's class.

Parameters:

className - the class name

Returns:

the servlet mappings for the class

constraintsExist

protected boolean constraintsExist(java.util.List<ServletMapping> servletMappings,
                                   java.util.List<ConstraintMapping> constraintMappings)

Check if there are already <security-constraint> elements defined that match the url-patterns for the servlet.

Parameters:

servletMappings - the servlet mappings

constraintMappings - the constraint mappings

Returns:

true if constraint exists