uk.ac.warwick.sso.client.oauth

Class OAuthFilter

java.lang.Object

uk.ac.warwick.sso.client.oauth.OAuthFilter

All Implemented Interfaces:

javax.servlet.Filter

public final class OAuthFilter
extends java.lang.Object
implements javax.servlet.Filter

A filter that can be added after SSOClientFilter in order to allow the application to accept requests with a valid OAuth token.

These tokens are created and authorised via websignon with your provider ID. If the user has provided an Authorization header in the HTTP request that corresponds to a valid OAuth token, and there is no authorised user already in the request, an User will be inserted into the request the key specified by SSOClientFilter.getUserKey() and will be accessible for the remainder of the request. This should allow the filter to be dropped in immediately after the SSOClientFilter and work immediately.

Users from this filter will return true for User.isOAuthUser().

OAuth details are as follows:

• Request token URL: https://websignon.warwick.ac.uk/oauth/requestToken?scope=[Your Provider ID]
• Authorisation URL: https://websignon.warwick.ac.uk/oauth/authorise
• Access token URL: https://websignon.warwick.ac.uk/oauth/requestToken

Constructor Summary

Constructors

Constructor and Description
OAuthFilter()

Method Summary

Modifier and Type	Method and Description
void	destroy()
void	doFilter(javax.servlet.ServletRequest arg0, javax.servlet.ServletResponse arg1, javax.servlet.FilterChain chain)
uk.ac.warwick.sso.client.SSOConfiguration	getConfig()
java.lang.String	getConfigSuffix()
uk.ac.warwick.sso.client.oauth.OAuthService	getOAuthService()
uk.ac.warwick.userlookup.UserLookupInterface	getUserLookup()
void	init(javax.servlet.FilterConfig ctx)
void	setConfig(uk.ac.warwick.sso.client.SSOConfiguration config)
void	setConfigSuffix(java.lang.String configSuffix) Set the configuration suffix for the sso-config.xml file.
void	setExpiredToken401(boolean expiredToken401) If set to true (the default), then any Authorization header in the request that does not resolve to a valid OAuth token will cause the application to generate a HTTP 401 Unauthorized, instructing the user to use OAuth.
void	setOAuthService(uk.ac.warwick.sso.client.oauth.OAuthService service)
void	setUserLookup(uk.ac.warwick.userlookup.UserLookupInterface userLookup)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

OAuthFilter

public OAuthFilter()

Method Detail

doFilter

public void doFilter(javax.servlet.ServletRequest arg0,
                     javax.servlet.ServletResponse arg1,
                     javax.servlet.FilterChain chain)
              throws java.io.IOException,
                     javax.servlet.ServletException

Specified by:

doFilter in interface javax.servlet.Filter

Throws:

java.io.IOException

javax.servlet.ServletException

init

public void init(javax.servlet.FilterConfig ctx)
          throws javax.servlet.ServletException

Specified by:

init in interface javax.servlet.Filter

Throws:

javax.servlet.ServletException

destroy

public void destroy()

Specified by:

destroy in interface javax.servlet.Filter

getConfig

public uk.ac.warwick.sso.client.SSOConfiguration getConfig()

setConfig

public void setConfig(uk.ac.warwick.sso.client.SSOConfiguration config)

getConfigSuffix

public java.lang.String getConfigSuffix()

setConfigSuffix

public void setConfigSuffix(java.lang.String configSuffix)

Set the configuration suffix for the sso-config.xml file. This should be the same value as set for SSOClientFilter

Parameters:

configSuffix - The configuration suffix string

getOAuthService

public uk.ac.warwick.sso.client.oauth.OAuthService getOAuthService()

setOAuthService

public void setOAuthService(uk.ac.warwick.sso.client.oauth.OAuthService service)

getUserLookup

public uk.ac.warwick.userlookup.UserLookupInterface getUserLookup()

setUserLookup

public void setUserLookup(uk.ac.warwick.userlookup.UserLookupInterface userLookup)

setExpiredToken401

public void setExpiredToken401(boolean expiredToken401)

If set to true (the default), then any Authorization header in the request that does not resolve to a valid OAuth token will cause the application to generate a HTTP 401 Unauthorized, instructing the user to use OAuth. This is highly recommended (and will not affect requests without this header)