public class

DigestAuthenticationFilter

extends GenericFilterBean
implements MessageSourceAware
java.lang.Object
   ↳ org.springframework.web.filter.GenericFilterBean
     ↳ org.springframework.security.web.authentication.www.DigestAuthenticationFilter

Class Overview

Processes a HTTP request's Digest authorization headers, putting the result into the SecurityContextHolder.

For a detailed background on what this filter is designed to process, refer to RFC 2617 (which superseded RFC 2069, although this filter support clients that implement either RFC 2617 or RFC 2069).

This filter can be used to provide Digest authentication services to both remoting protocol clients (such as Hessian and SOAP) as well as standard user agents (such as Internet Explorer and FireFox).

This Digest implementation has been designed to avoid needing to store session state between invocations. All session management information is stored in the "nonce" that is sent to the client by the DigestAuthenticationEntryPoint.

If authentication is successful, the resulting Authentication object will be placed into the SecurityContextHolder.

If authentication fails, an AuthenticationEntryPoint implementation is called. This must always be DigestAuthenticationEntryPoint, which will prompt the user to authenticate again via Digest authentication.

Note there are limitations to Digest authentication, although it is a more comprehensive and secure solution than Basic authentication. Please see RFC 2617 section 4 for a full discussion on the advantages of Digest authentication over Basic authentication, including commentary on the limitations that it still imposes.

Summary

Fields
protected MessageSourceAccessor messages
[Expand]
Inherited Fields
From class org.springframework.web.filter.GenericFilterBean
Public Constructors
DigestAuthenticationFilter()
Public Methods
void afterPropertiesSet()
void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
UserCache getUserCache()
UserDetailsService getUserDetailsService()
void setAuthenticationDetailsSource(AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource)
void setAuthenticationEntryPoint(DigestAuthenticationEntryPoint authenticationEntryPoint)
void setCreateAuthenticatedToken(boolean createAuthenticatedToken)
If you set this property, the Authentication object, which is created after the successful digest authentication will be marked as authenticated and filled with the authorities loaded by the UserDetailsService.
void setMessageSource(MessageSource messageSource)
void setPasswordAlreadyEncoded(boolean passwordAlreadyEncoded)
void setUserCache(UserCache userCache)
void setUserDetailsService(UserDetailsService userDetailsService)
Protected Methods
final DigestAuthenticationEntryPoint getAuthenticationEntryPoint()
[Expand]
Inherited Methods
From class org.springframework.web.filter.GenericFilterBean
From class java.lang.Object
From interface javax.servlet.Filter
From interface org.springframework.beans.factory.BeanNameAware
From interface org.springframework.beans.factory.DisposableBean
From interface org.springframework.beans.factory.InitializingBean
From interface org.springframework.context.MessageSourceAware
From interface org.springframework.web.context.ServletContextAware

Fields

protected MessageSourceAccessor messages

Public Constructors

public DigestAuthenticationFilter ()

Public Methods

public void afterPropertiesSet ()

public void doFilter (ServletRequest req, ServletResponse res, FilterChain chain)

Throws
IOException
ServletException

public UserCache getUserCache ()

public UserDetailsService getUserDetailsService ()

public void setAuthenticationDetailsSource (AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource)

public void setAuthenticationEntryPoint (DigestAuthenticationEntryPoint authenticationEntryPoint)

public void setCreateAuthenticatedToken (boolean createAuthenticatedToken)

If you set this property, the Authentication object, which is created after the successful digest authentication will be marked as authenticated and filled with the authorities loaded by the UserDetailsService. It therefore will not be re-authenticated by your AuthenticationProvider. This means, that only the password of the user is checked, but not the flags like isEnabled() or isAccountNonExpired(). You will save some time by enabling this flag, as otherwise your UserDetailsService will be called twice. A more secure option would be to introduce a cache around your UserDetailsService, but if you don't use these flags, you can also safely enable this option.

Parameters
createAuthenticatedToken default is false

public void setMessageSource (MessageSource messageSource)

public void setPasswordAlreadyEncoded (boolean passwordAlreadyEncoded)

public void setUserCache (UserCache userCache)

public void setUserDetailsService (UserDetailsService userDetailsService)

Protected Methods

protected final DigestAuthenticationEntryPoint getAuthenticationEntryPoint ()