org.vaadin.spring.security

Interface VaadinSecurity

All Superinterfaces:

VaadinSecurityContext

All Known Subinterfaces:

VaadinManagedSecurity, VaadinSharedSecurity

All Known Implementing Classes:

AbstractVaadinSecurity, DefaultVaadinManagedSecurity, DefaultVaadinSharedSecurity

public interface VaadinSecurity
extends VaadinSecurityContext

Interface that provides the Spring Security operations that are most commonly required in a Vaadin application.

Author:

Petter Holmström (petter@vaadin.com), Gert-Jan Timmer (gjr.timmer@gmail.com)

Method Summary

Modifier and Type	Method and Description
Authentication	getAuthentication() Gets the authentication token of the current user.
boolean	hasAccessToObject(Object securedObject, String... securityConfigurationAttributes) Checks if the current user is authorized based on the specified security configuration attributes.
boolean	hasAccessToSecuredMethod(Object securedObject, String methodName, Class<?>... methodParameterTypes) Uses the Secured annotation on the specified method to check if the current user has access to the secured object.
boolean	hasAccessToSecuredObject(Object securedObject) Convenience method that invokes hasAccessToObject(Object, String...), using the Secured annotation of the secured object to get the security configuration attributes.
boolean	hasAnyAuthority(String... authorities) Checks if the current user has at least one of the specified authorities.
boolean	hasAuthorities(String... authorities) Checks if the current user has all required authorities.
boolean	hasAuthority(String authority) Checks if the current user has the specified authority.
boolean	isAuthenticated() Returns true if the current user is authenticated and not anonymous.
boolean	isAuthenticatedAnonymously() Returns true if the current user is authenticated and anonymous.
boolean	isFullyAuthenticated() Returns true if the current user is authenticated and neither anonymous nor a Remember Me user.
boolean	isRememberMeAuthenticated() Returns true if the current user is authenticated by a Remember Me token.
Authentication	login(Authentication authentication) Tries to login using the specified authentication object.
Authentication	login(String username, String password) Convenience method that invokes login(org.springframework.security.core.Authentication) with a UsernamePasswordAuthenticationToken-object.
void	logout() Logs the user out.

Methods inherited from interface org.vaadin.spring.security.VaadinSecurityContext

getAccessDecisionManager, getApplicationContext, getAuthenticationManager, getRememberMeServices, hasAccessDecisionManager, hasAuthenticationManager

Method Detail

isAuthenticated

boolean isAuthenticated()

Returns true if the current user is authenticated and not anonymous.

isAuthenticatedAnonymously

boolean isAuthenticatedAnonymously()

Returns true if the current user is authenticated and anonymous.

isRememberMeAuthenticated

boolean isRememberMeAuthenticated()

Returns true if the current user is authenticated by a Remember Me token.

isFullyAuthenticated

boolean isFullyAuthenticated()

Returns true if the current user is authenticated and neither anonymous nor a Remember Me user.

login

Authentication login(Authentication authentication)
              throws AuthenticationException,
                     Exception

Tries to login using the specified authentication object. If authentication succeeds, this method will return without exceptions.

Parameters:

authentication - the authentication object to authenticate, must not be null.

Returns:

the authenticated Authentication token.

Throws:

AuthenticationException - if authentication fails.

Exception

login

Authentication login(String username,
                     String password)
              throws AuthenticationException,
                     Exception

Convenience method that invokes login(org.springframework.security.core.Authentication) with a UsernamePasswordAuthenticationToken-object.

Parameters:

username - the username to use, must not be null.

password - the password to use, must not be null.

Returns:

the authenticated Authentication token.

Throws:

AuthenticationException - if authentication fails.

Exception

logout

void logout()

Logs the user out.

hasAuthority

boolean hasAuthority(String authority)

Checks if the current user has the specified authority. This method works with static authorities (such as roles). If you need more dynamic authorization (such as ACLs or EL expressions), use hasAccessToObject(Object, String...).

Parameters:

authority - the authority to check, must not be null.

Returns:

true if the current SecurityContext contains an authenticated Authentication token that has a GrantedAuthority whose string representation matches the specified authority.

See Also:

Authentication.getAuthorities(), GrantedAuthority.getAuthority()

getAuthentication

Authentication getAuthentication()

Gets the authentication token of the current user.

Returns:

the Authentication token stored in the current SecurityContext, or null.

hasAccessToObject

boolean hasAccessToObject(Object securedObject,
                          String... securityConfigurationAttributes)

Checks if the current user is authorized based on the specified security configuration attributes. The attributes can be roles or Spring EL expressions (basically anything you can specify as values of the Secured annotation).

Parameters:

securedObject - the secured object.

securityConfigurationAttributes - the security configuration attributes.

Returns:

true if the current user is authorized, false if not.

hasAccessToSecuredObject

boolean hasAccessToSecuredObject(Object securedObject)

Convenience method that invokes hasAccessToObject(Object, String...), using the Secured annotation of the secured object to get the security configuration attributes.

Parameters:

securedObject - the secured object, must not be null and must have the Secured annotation.

Returns:

true if the current user is authorized, false if not.

hasAccessToSecuredMethod

boolean hasAccessToSecuredMethod(Object securedObject,
                                 String methodName,
                                 Class<?>... methodParameterTypes)

Uses the Secured annotation on the specified method to check if the current user has access to the secured object.

Parameters:

securedObject - the secured object, must not be null.

methodName - the name of the method holding the Secured annotation.

methodParameterTypes - the parameter types of the method holding the Secured annotation.

Returns:

true if the current user is authorized, false if not.

See Also:

hasAccessToSecuredObject(Object)

hasAuthorities

boolean hasAuthorities(String... authorities)

Checks if the current user has all required authorities.

Parameters:

authorities - the required authorities.

Returns:

true if the current user is authenticated and has all of the specified authorities.

See Also:

hasAuthority(String), hasAnyAuthority(String...)

hasAnyAuthority

boolean hasAnyAuthority(String... authorities)

Checks if the current user has at least one of the specified authorities.

Parameters:

authorities - the authorities.

Returns:

true if the current user is authenticated and has at least one of the specified authorities.

See Also:

hasAuthority(String), hasAuthorities(String...)