public interface Session extends WikiEventListener
Represents a long-running wiki session, with an associated user Principal, user Subject, and authentication status. The sesion
is initialized with minimal, default-deny values: authentication is set to false, and the user principal is set to
null.
The Session allows callers to:
isAnonymous() and isAuthenticated()getLoginPrincipal(),
getUserPrincipal() and getPrincipals()addMessage(String), getMessages(String)
and clearMessages(String)To keep track of the Principals each user posseses, each Session stores a JAAS Subject. Various login processes add or remove Principals when users authenticate or log out.
Session extends the WikiEventListener interface and listens for group add/change/delete
events fired by event sources the Session is registered with: org.apache.wiki.auth.AuthenticationManager,
org.apache.wiki.auth.UserManager and org.apache.wiki.auth.authorize.GroupManager, so it can catch group events. Thus,
when a user is added to a org.apache.wiki.auth.authorize.Group, a corresponding org.apache.wiki.auth.GroupPrincipal is
injected into the Subject's Principal set. Likewise, when the user is removed from the Group or the Group is deleted, the
GroupPrincipal is removed from the Subject. The effect that this strategy produces is extremely beneficial: when someone adds a user
to a wiki group, that user immediately gains the privileges associated with that group; he or she does not need to
re-authenticate.
In addition to methods for examining individual Session objects, this class also contains a number of static
methods for managing Sessions for an entire wiki. These methods allow callers to find, query and remove Session objects, and
to obtain a list of the current wiki session users.
| Modifier and Type | Field and Description |
|---|---|
static java.lang.String |
ANONYMOUS
An anonymous user's session status.
|
static java.lang.String |
ASSERTED
An asserted user's session status.
|
static java.lang.String |
AUTHENTICATED
An authenticated user's session status.
|
| Modifier and Type | Method and Description |
|---|---|
void |
addMessage(java.lang.String message)
Adds a message to the generic list of messages associated with the session.
|
void |
addMessage(java.lang.String topic,
java.lang.String message)
Adds a message to the specific set of messages associated with the session.
|
void |
clearMessages()
Clears all messages associated with this session.
|
void |
clearMessages(java.lang.String topic)
Clears all messages associated with a session topic.
|
static java.lang.Object |
doPrivileged(Session session,
java.security.PrivilegedAction<?> action)
Wrapper for
Subject.doAsPrivileged(Subject, PrivilegedAction, java.security.AccessControlContext)
that executes an action with the privileges posssessed by a Session's Subject. |
java.util.Locale |
getLocale()
Returns a cached Locale object for this user.
|
java.security.Principal |
getLoginPrincipal()
Returns the Principal used to log in to an authenticated session.
|
java.lang.String[] |
getMessages()
Returns all generic messages associated with this session.
|
java.lang.String[] |
getMessages(java.lang.String topic)
Returns all messages associated with a session topic.
|
java.security.Principal[] |
getPrincipals()
Returns all user Principals associated with this session.
|
java.security.Principal[] |
getRoles()
Returns an array of Principal objects that represents the groups and roles that the user associated with a Session possesses.
|
java.lang.String |
getStatus()
Returns the status of the wiki session as a text string.
|
javax.security.auth.Subject |
getSubject()
Returns the
Subject associated to the session. |
java.security.Principal |
getUserPrincipal()
Returns the primary user Principal associated with this session.
|
boolean |
hasPrincipal(java.security.Principal principal)
Returns
true if the Session's Subject possess a supplied Principal. |
void |
invalidate()
Invalidates the Session and resets its Subject's Principals to the equivalent of a "guest session".
|
boolean |
isAnonymous()
Determines whether the current session is anonymous.
|
boolean |
isAsserted()
Returns
true if the user is considered asserted via a session cookie; that is, the Subject contains the Principal
Role.ASSERTED. |
boolean |
isAuthenticated()
Returns the authentication status of the user's session.
|
actionPerformedstatic final java.lang.String ANONYMOUS
static final java.lang.String ASSERTED
static final java.lang.String AUTHENTICATED
boolean isAsserted()
true if the user is considered asserted via a session cookie; that is, the Subject contains the Principal
Role.ASSERTED.true if the user is assertedboolean isAuthenticated()
true if the user is authenticatedboolean isAnonymous()
Determines whether the current session is anonymous. This will be true if any of these conditions are true:
org.apache.wiki.auth.authorize.Role#ANONYMOUSorg.apache.wiki.auth.WikiPrincipal#GUESTgetUserPrincipal() evaluates to an IP address.The criteria above are listed in the order in which they are evaluated.
java.security.Principal getLoginPrincipal()
Returns the Principal used to log in to an authenticated session. The login principal is determined by examining the
Subject's Principal set for PrincipalWrappers or WikiPrincipals with type designator LOGIN_NAME; the first one
found is the login principal. If one is not found, this method returns the first principal that isn't of type Role or
GroupPrincipal. If neither of these conditions hold, this method returns
org.apache.wiki.auth.WikiPrincipal#GUEST.
java.security.Principal getUserPrincipal()
Returns the primary user Principal associated with this session. The primary user principal is determined as follows:
WIKI_NAME or (alternatively) FULL_NAME is the primary Principal.org.apache.wiki.auth.WikiPrincipal#GUEST.java.util.Locale getLocale()
void addMessage(java.lang.String message)
clearMessages() method is called.message - the message to add; if null it is ignored.void addMessage(java.lang.String topic, java.lang.String message)
clearMessages() method is called.topic - the topic to associate the message to;message - the message to addvoid clearMessages()
void clearMessages(java.lang.String topic)
topic - the topic whose messages should be cleared.java.lang.String[] getMessages()
clearMessages().java.lang.String[] getMessages(java.lang.String topic)
clearMessages(String).topic - The topicjava.security.Principal[] getPrincipals()
org.apache.wiki.auth.AuthenticationManager#isUserPrincipal(Principal)java.security.Principal[] getRoles()
getName method. Note
that this method does not consult the external Authorizer or GroupManager; it relies on the Principals that have been
injected into the user's Subject at login time, or after group creation/modification/deletion.boolean hasPrincipal(java.security.Principal principal)
true if the Session's Subject possess a supplied Principal. This method eliminates the need to externally
request and inspect the JAAS subject.principal - the Principal to testvoid invalidate()
java.lang.String getStatus()
Returns the status of the wiki session as a text string. Valid values are:
javax.security.auth.Subject getSubject()
Subject associated to the session.Subject associated to the session.static java.lang.Object doPrivileged(Session session, java.security.PrivilegedAction<?> action) throws java.security.AccessControlException
Subject.doAsPrivileged(Subject, PrivilegedAction, java.security.AccessControlContext)
that executes an action with the privileges posssessed by a Session's Subject. The action executes with a null
AccessControlContext, which has the effect of running it "cleanly" without the AccessControlContexts of the caller.session - the wiki sessionaction - the privileged actionnulljava.security.AccessControlException - if the action is not permitted by the security policyCopyright (c) 2001-2022 The Apache Software Foundation. All rights reserved.