001/*
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements.  See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership.  The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License.  You may obtain a copy of the License at
009 *
010 *     http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing,
013 * software distributed under the License is distributed on an
014 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
015 * KIND, either express or implied.  See the License for the
016 * specific language governing permissions and limitations
017 * under the License.
018 */
019package org.apache.shiro.web.filter.authc;
020
021import org.apache.shiro.subject.Subject;
022
023import javax.servlet.ServletRequest;
024import javax.servlet.ServletResponse;
025
026/**
027 * An authentication filter that redirects the user to the login page when they are trying to access
028 * a protected resource.  However, if the user is trying to access the login page, the filter lets
029 * the request pass through to the application code.
030 * <p/>
031 * The difference between this filter and the {@link FormAuthenticationFilter FormAuthenticationFilter} is that
032 * on a login submission (by default an HTTP POST to the login URL), the <code>FormAuthenticationFilter</code> filter
033 * attempts to automatically authenticate the user by passing the <code>username</code> and <code>password</code>
034 * request parameter values to
035 * {@link org.apache.shiro.subject.Subject#login(org.apache.shiro.authc.AuthenticationToken) Subject.login(usernamePasswordToken)}
036 * directly.
037 * <p/>
038 * Conversely, this controller always passes all requests to the {@link #setLoginUrl loginUrl} through, both GETs and
039 * POSTs.  This is useful in cases where the developer wants to write their own login behavior, which should include a
040 * call to {@link Subject#login(org.apache.shiro.authc.AuthenticationToken) Subject.login(AuthenticationToken)}
041 * at some point.  For example,  if the developer has their own custom MVC login controller or validator,
042 * this <code>PassThruAuthenticationFilter</code> may be appropriate.
043 *
044 * @see FormAuthenticationFilter
045 * @since 0.9
046 */
047public class PassThruAuthenticationFilter extends AuthenticationFilter {
048
049    //TODO - complete JavaDoc
050
051    protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
052        if (isLoginRequest(request, response)) {
053            return true;
054        } else {
055            saveRequestAndRedirectToLogin(request, response);
056            return false;
057        }
058    }
059
060}