AuthenticationProvider
s are tried in order until one provides a non-null response. A non-null response indicates the provider had authority to decide on the authentication request and no further providers are tried. If an AuthenticationException
is thrown by a provider, it is retained until subsequent providers are tried. If a subsequent provider successfully authenticates the request, the earlier authentication exception is disregarded and the successful authentication will be used. If no subsequent provider provides a non-null response, or a new AuthenticationException
, the last AuthenticationException
received will be used. If no provider returns a non-null response, or indicates it can even process an Authentication
, the ProviderManager
will throw a ProviderNotFoundException
.
If a valid Authentication
is returned by an AuthenticationProvider
, the ProviderManager
will publish an {@link org.acegisecurity.event.authentication.AuthenticationSuccessEvent}. If an AuthenticationException
is detected, the final AuthenticationException
thrown will be used to publish an appropriate failure event. By default ProviderManager
maps common exceptions to events, but this can be fine-tuned by providing a new exceptionMappings
java.util.Properties
object. In the properties object, each of the keys represent the fully qualified classname of the exception, and each of the values represent the name of an event class which subclasses {@link org.acegisecurity.event.authentication.AbstractAuthenticationFailureEvent} and provides its constructor.
By default, Smack only knows how to process IQ packets with sub-packets that are in a few namespaces such as:
<?xml version="1.0"?> <smackProviders> <iqProvider> <elementName>query</elementName> <namespace>jabber:iq:time</namespace> <className>org.jivesoftware.smack.packet.Time</className> </iqProvider> </smackProviders>Each IQ provider is associated with an element name and a namespace. If multiple provider entries attempt to register to handle the same namespace, the first entry loaded from the classpath will take precedence. The IQ provider class can either implement the IQProvider interface, or extend the IQ class. In the former case, each IQProvider is responsible for parsing the raw XML stream to create an IQ instance. In the latter case, bean introspection is used to try to automatically set properties of the IQ instance using the values found in the IQ packet XML. For example, an XMPP time packet resembles the following:
<iq type='result' to='joe@example.com' from='mary@example.com' id='time_1'> <query xmlns='jabber:iq:time'> <utc>20020910T17:58:35</utc> <tz>MDT</tz> <display>Tue Sep 10 12:58:35 2002</display> </query> </iq>In order for this packet to be automatically mapped to the Time object listed in the providers file above, it must have the methods setUtc(String), setTz(String), and setDisplay(String). The introspection service will automatically try to convert the String value from the XML into a boolean, int, long, float, double, or Class depending on the type the IQ instance expects.
A pluggable system for packet extensions, child elements in a custom namespace for message and presence packets, also exists. Each extension provider is registered with a name space in the smack.providers file as in the following example:
<?xml version="1.0"?> <smackProviders> <extensionProvider> <elementName>x</elementName> <namespace>jabber:iq:event</namespace> <className>org.jivesoftware.smack.packet.MessageEvent</className> </extensionProvider> </smackProviders>If multiple provider entries attempt to register to handle the same element name and namespace, the first entry loaded from the classpath will take precedence. Whenever a packet extension is found in a packet, parsing will be passed to the correct provider. Each provider can either implement the PacketExtensionProvider interface or be a standard Java Bean. In the former case, each extension provider is responsible for parsing the raw XML stream to contruct an object. In the latter case, bean introspection is used to try to automatically set the properties of the class using the values in the packet extension sub-element. When an extension provider is not registered for an element name and namespace combination, Smack will store all top-level elements of the sub-packet in DefaultPacketExtension object and then attach it to the packet.
It is possible to provide a custom provider manager instead of the default implementation provided by Smack. If you want to provide your own provider manager then you need to do it before creating any {@link org.jivesoftware.smack.Connection} by sending the static{@link #setInstance(ProviderManager)} message. Trying to change the provider manager afteran Connection was created will result in an {@link IllegalStateException} error. @author Matt Tucker
AuthenticationProviders are usually tried in order until one provides a non-null response. A non-null response indicates the provider had authority to decide on the authentication request and no further providers are tried. If a subsequent provider successfully authenticates the request, the earlier authentication exception is disregarded and the successful authentication will be used. If no subsequent provider provides a non-null response, or a new AuthenticationException
, the last AuthenticationException
received will be used. If no provider returns a non-null response, or indicates it can even process an Authentication
, the ProviderManager
will throw a ProviderNotFoundException
. A parent {@code AuthenticationManager} can also be set, and this will also be tried if none of the configuredproviders can perform the authentication. This is intended to support namespace configuration options though and is not a feature that should normally be required.
The exception to this process is when a provider throws an {@link AccountStatusException}, in which case no further providers in the list will be queried. Post-authentication, the credentials will be cleared from the returned {@code Authentication} object, if itimplements the {@link CredentialsContainer} interface. This behaviour can be controlled by modifying the{@link #setEraseCredentialsAfterAuthentication(boolean) eraseCredentialsAfterAuthentication} property.
Authentication event publishing is delegated to the configured {@link AuthenticationEventPublisher} which defaultsto a null implementation which doesn't publish events, so if you are configuring the bean yourself you must inject a publisher bean if you want to receive events. The standard implementation is {@link DefaultAuthenticationEventPublisher}which maps common exceptions to events (in the case of authentication failure) and publishes an {@link org.springframework.security.authentication.event.AuthenticationSuccessEvent AuthenticationSuccessEvent} ifauthentication succeeds. If you are using the namespace then an instance of this bean will be used automatically by the <http> configuration, so you will receive events from the web part of your application automatically.
Note that the implementation also publishes authentication failure events when it obtains an authentication result (or an exception) from the "parent" {@code AuthenticationManager} if one has been set. So in this situation, theparent should not generally be configured to publish events or there will be duplicates. @author Ben Alex @author Luke Taylor @see DefaultAuthenticationEventPublisher
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|