@Override
    public void doFilter(ServletRequest request,
                         ServletResponse response,
                         FilterChain chain) throws IOException,
            ServletException {
        HttpServletRequest req = (HttpServletRequest) request;
        HttpServletResponse res = (HttpServletResponse) response;

        // This is a hack to skip challenge authentication of API-A methods via the
        // REST API if API-A AuthN is off (as indicated by the "authnAPIA"
        // filter init-param).
        // If API-A AuthN is off, for all GET requests via the REST API,
        // except those which are known to be part of API-M, don't challenge for authentication
        // (but do pick up any preemptive credentials that are supplied)
        // FIXME: As other servlets that require authn also go through this filter,
        // there's probably a neater way to ensure we are only catching API-A methods
        // currently we are explicitly testing for other management URLs/paths
        // (probably should test fullPath for {appcontext}/objects (REST API) and then
        // test path for API-A methods, maybe regex to make it explicit)
        boolean doChallenge = true;
        if (!authnAPIA) {
            if (req.getMethod().equals("GET") || req.getMethod().equals("HEAD")) {
                String requestPath = req.getPathInfo();
                if (requestPath == null) requestPath = ""; // null is returned eg for /fedora/objects? - API-A, so we still want to do the below...
                String fullPath = req.getRequestURI();
                // API-M methods
                // potentially extra String evals, but aiming for clarity
                boolean isExport = requestPath.endsWith("/export");
                boolean isObjectXML = requestPath.endsWith("/objectXML");
                boolean isGetDatastream =
                        requestPath.contains("/datastreams/")
                                && !requestPath.endsWith("/content");
                isGetDatastream = isGetDatastream || (requestPath.endsWith("/datastreams")
                                && Boolean.valueOf(request.getParameter("profiles")));
                boolean isGetRelationships =
                        requestPath.endsWith("/relationships");
                boolean isValidate = requestPath.endsWith("/validate");
                // management get methods (LITE API, control)
                boolean isManagement =
                        fullPath.endsWith("/management/control")
                                || fullPath.endsWith("/management/getNextPID");
                // user servlet
                boolean isUserServlet = fullPath.endsWith("/user");
                // challenge if API-M or one of the above other services (otherwise we assume it is API-A)
                doChallenge =
                        isExport || isObjectXML || isGetDatastream
                                || isGetRelationships || isValidate
                                || isManagement || isUserServlet;
            }
        }

        if (logger.isDebugEnabled()) {
            logger.debug("incoming filter: {}", this.getClass().getName());
            logger.debug("session-id: {}", req.getSession().getId());
        }

        Subject subject = authenticate(req);

        if (subject == null) {
            if (doChallenge) {
                loginForm(res);
                return;
            } else {
                // no auth required, and none supplied, do rest of chain
                chain.doFilter(request, response);
                return;
            }
        }

        // obtain the user principal from the subject and add to servlet.
        Principal userPrincipal = getUserPrincipal(subject);

        // obtain the user roles from the subject and add to servlet.
        Set<String> userRoles = getUserRoles(subject);

        // wrap the request in one that has the ability to store role
        // and principal information and store this information.
        AuthHttpServletRequestWrapper authRequest =
                new AuthHttpServletRequestWrapper(req);
        authRequest.setUserPrincipal(userPrincipal);
        authRequest.setUserRoles(userRoles);

        // add the roles that were obtained to the Subject.
        addRolesToSubject(subject, userRoles);

        // populate FEDORA_AUX_SUBJECT_ATTRIBUTES with fedoraRole
        // and any additional Subject attributes
        populateFedoraAttributes(subject, userRoles, authRequest);

        chain.doFilter(authRequest, response);

        if (logger.isDebugEnabled()) {
            logger.debug("outgoing filter: " + this.getClass().getName());
        }
    }
@ Override public void doFilter ( ServletRequest request , ServletResponse response , FilterChain chain ) throws IOException , ServletException { HttpServletRequest req = ( HttpServletRequest ) request ; HttpServletResponse res = ( HttpServletResponse ) response ; boolean doChallenge = true ; if ( ! authnAPIA ) { if ( req . getMethod ( ) . equals ( "GET" ) || req . getMethod ( ) . equals ( "HEAD" ) ) { String requestPath = req . getPathInfo ( ) ; if ( requestPath == null ) requestPath = "" ; String fullPath = req . getRequestURI ( ) ; boolean isExport = requestPath . endsWith ( "/export" ) ; boolean isObjectXML = requestPath . endsWith ( "/objectXML" ) ; boolean isGetDatastream = requestPath . contains ( "/datastreams/" ) && ! requestPath . endsWith ( "/content" ) ; isGetDatastream = isGetDatastream || ( requestPath . endsWith ( "/datastreams" ) && Boolean . valueOf ( request . getParameter ( "profiles" ) ) ) ; boolean isGetRelationships = requestPath . endsWith ( "/relationships" ) ; boolean isValidate = requestPath . endsWith ( "/validate" ) ; boolean isManagement = fullPath . endsWith ( "/management/control" ) || fullPath . endsWith ( "/management/getNextPID" ) ; boolean isUserServlet = fullPath . endsWith ( "/user" ) ; doChallenge = isExport || isObjectXML || isGetDatastream || isGetRelationships || isValidate || isManagement || isUserServlet ; } } if ( logger . isDebugEnabled ( ) ) { logger . debug ( "incoming filter: {}" , this . getClass ( ) . getName ( ) ) ; logger . debug ( "session-id: {}" , req . getSession ( ) . getId ( ) ) ; } Subject subject = authenticate ( req ) ; if ( subject == null ) { if ( doChallenge ) { loginForm ( res ) ; return ; } else { chain . doFilter ( request , response ) ; return ; } } Principal userPrincipal = getUserPrincipal ( subject ) ; Set < String > userRoles = getUserRoles ( subject ) ; AuthHttpServletRequestWrapper authRequest = new AuthHttpServletRequestWrapper ( req ) ; authRequest . setUserPrincipal ( userPrincipal ) ; authRequest . setUserRoles ( userRoles ) ; addRolesToSubject ( subject , userRoles ) ; populateFedoraAttributes ( subject , userRoles , authRequest ) ; chain . doFilter ( authRequest , response ) ; if ( logger . isDebugEnabled ( ) ) { logger . debug ( "outgoing filter: " + this . getClass ( ) . getName ( ) ) ; } }
/*
(non-Javadoc)
@see javax.servlet.Filter#doFilter(javax.servlet.ServletRequest,
javax.servlet.ServletResponse, javax.servlet.FilterChain)