org.apache.struts2.interceptor
Class RolesInterceptor

java.lang.Object
  extended by com.opensymphony.xwork2.interceptor.AbstractInterceptor
      extended by org.apache.struts2.interceptor.RolesInterceptor
All Implemented Interfaces:
Interceptor, Serializable

public class RolesInterceptor
extends AbstractInterceptor

This interceptor ensures that the action will only be executed if the user has the correct role.

Interceptor parameters:

When both allowedRoles and disallowedRoles are configured, then disallowedRoles takes precedence, applying the following logic: (if ((inRole(role1) || inRole(role2) || ... inRole(roleN)) && !inRole(roleA) && !inRole(roleB) && ... !inRole(roleZ)) { //permit ...

There are three extensions to the existing interceptor:
  <!-- START SNIPPET: example -->
  <!-- only allows the admin and member roles -->
  <action name="someAction" class="com.examples.SomeAction">
      <interceptor-ref name="completeStack"/>
      <interceptor-ref name="roles">
        <param name="allowedRoles">admin,member</param>
      </interceptor-ref>
      <result name="success">good_result.ftl</result>
  </action>
  <!-- END SNIPPET: example -->
 

See Also:
Serialized Form

Field Summary
protected  List<String> allowedRoles
           
protected  List<String> disallowedRoles
           
 
Constructor Summary
RolesInterceptor()
           
 
Method Summary
protected  boolean areRolesValid(List<String> roles)
          Extension point for sub-classes to test if configured roles are known valid roles.
protected  String handleRejection(ActionInvocation invocation, javax.servlet.http.HttpServletResponse response)
          Handles a rejection by sending a 403 HTTP error
 String intercept(ActionInvocation invocation)
           
protected  boolean isAllowed(javax.servlet.http.HttpServletRequest request, Object action)
          Determines if the request should be allowed for the action
 void setAllowedRoles(String roles)
           
 void setDisallowedRoles(String roles)
           
protected  List<String> stringToList(String val)
          Splits a string into a List
 
Methods inherited from class com.opensymphony.xwork2.interceptor.AbstractInterceptor
destroy, init
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Field Detail

allowedRoles

protected List<String> allowedRoles

disallowedRoles

protected List<String> disallowedRoles
Constructor Detail

RolesInterceptor

public RolesInterceptor()
Method Detail

setAllowedRoles

public void setAllowedRoles(String roles)

setDisallowedRoles

public void setDisallowedRoles(String roles)

intercept

public String intercept(ActionInvocation invocation)
                 throws Exception
Specified by:
intercept in interface Interceptor
Specified by:
intercept in class AbstractInterceptor
Throws:
Exception

stringToList

protected List<String> stringToList(String val)
Splits a string into a List


isAllowed

protected boolean isAllowed(javax.servlet.http.HttpServletRequest request,
                            Object action)
Determines if the request should be allowed for the action

Parameters:
request - The request
action - The action object
Returns:
True if allowed, false otherwise

handleRejection

protected String handleRejection(ActionInvocation invocation,
                                 javax.servlet.http.HttpServletResponse response)
                          throws Exception
Handles a rejection by sending a 403 HTTP error

Parameters:
invocation - The invocation
Returns:
The result code
Throws:
Exception

areRolesValid

protected boolean areRolesValid(List<String> roles)
Extension point for sub-classes to test if configured roles are known valid roles. Implementations are encouraged to implement this method to prevent misconfigured roles. If this method returns false, the RolesInterceptor will be disabled and block all requests.

Parameters:
roles - allowed and disallowed roles
Returns:
whether the roles are valid or not (always true for the default implementation)


Copyright © 2000-2015 Apache Software Foundation. All Rights Reserved.