public class HudsonPrivateSecurityRealm extends AbstractPasswordBasedSecurityRealm implements ModelObject, AccessControlled
SecurityRealm
that performs authentication by looking up User
.
Implements AccessControlled
to satisfy view rendering, but in reality the access control
is done against the Jenkins
object.
Modifier and Type | Class and Description |
---|---|
static class |
HudsonPrivateSecurityRealm.DescriptorImpl |
static class |
HudsonPrivateSecurityRealm.Details
UserProperty that provides the UserDetails view of the User object. |
static class |
HudsonPrivateSecurityRealm.ManageUserLinks
Displays "manage users" link in the system config if
HudsonPrivateSecurityRealm
is in effect. |
static class |
HudsonPrivateSecurityRealm.SignupInfo |
SecurityRealm.SecurityComponents
ExtensionPoint.LegacyInstancesAreScopedToHudson
Modifier and Type | Field and Description |
---|---|
static org.acegisecurity.providers.encoding.PasswordEncoder |
PASSWORD_ENCODER
Combines
JBCRYPT_ENCODER and CLASSIC into one so that we can continue
to accept CLASSIC format but new encoding will always done via JBCRYPT_ENCODER . |
AUTHENTICATED_AUTHORITY, LIST, NO_AUTHENTICATION
Constructor and Description |
---|
HudsonPrivateSecurityRealm(boolean allowsSignup)
Deprecated.
|
HudsonPrivateSecurityRealm(boolean allowsSignup,
boolean enableCaptcha,
CaptchaSupport captchaSupport) |
Modifier and Type | Method and Description |
---|---|
boolean |
allowsSignup()
Returns true if this
SecurityRealm allows online sign-up. |
protected HudsonPrivateSecurityRealm.Details |
authenticate(String username,
String password)
Authenticate a login attempt.
|
void |
checkPermission(Permission permission)
Convenient short-cut for
getACL().checkPermission(permission) |
org.kohsuke.stapler.HttpResponse |
commenceSignup(FederatedLoginService.FederatedIdentity identity)
Show the sign up page with the data from the identity.
|
User |
createAccount(String userName,
String password)
Creates a new user account by registering a password to the user.
|
User |
createAccountByAdmin(org.kohsuke.stapler.StaplerRequest req,
org.kohsuke.stapler.StaplerResponse rsp,
String addUserView,
String successView)
Creates a user account.
|
User |
doCreateAccount(org.kohsuke.stapler.StaplerRequest req,
org.kohsuke.stapler.StaplerResponse rsp)
Creates an user account.
|
void |
doCreateAccountByAdmin(org.kohsuke.stapler.StaplerRequest req,
org.kohsuke.stapler.StaplerResponse rsp)
Creates a user account.
|
User |
doCreateAccountWithFederatedIdentity(org.kohsuke.stapler.StaplerRequest req,
org.kohsuke.stapler.StaplerResponse rsp)
Creates an account and associates that with the given identity.
|
void |
doCreateFirstAccount(org.kohsuke.stapler.StaplerRequest req,
org.kohsuke.stapler.StaplerResponse rsp)
Creates a first admin user account.
|
ACL |
getACL()
Obtains the ACL associated with this object.
|
boolean |
getAllowsSignup() |
List<User> |
getAllUsers()
All users who can login to the system.
|
String |
getDisplayName()
This is used primarily when the object is listed in the breadcrumb, in the user management screen.
|
User |
getUser(String id)
This is to map users under the security realm URL.
|
boolean |
hasPermission(Permission permission)
Convenient short-cut for
getACL().hasPermission(permission) |
boolean |
isEnableCaptcha()
Checks if captcha is enabled on user signup.
|
boolean |
isMailerPluginPresent() |
GroupDetails |
loadGroupByGroupname(String groupname)
This implementation doesn't support groups.
|
HudsonPrivateSecurityRealm.Details |
loadUserByUsername(String username)
Retrieves information about an user by its name.
|
createCliAuthenticator, createSecurityComponents
all, canLogOut, createFilter, doCaptcha, doLogout, findBean, getAuthenticationGatewayUrl, getCaptchaSupport, getCaptchaSupportDescriptors, getDescriptor, getFrom, getGroupIdStrategy, getLoginUrl, getPostLogOutUrl, getSecurityComponents, getUserIdStrategy, loadGroupByGroupname, setCaptchaSupport, validateCaptcha
public static final org.acegisecurity.providers.encoding.PasswordEncoder PASSWORD_ENCODER
JBCRYPT_ENCODER
and CLASSIC
into one so that we can continue
to accept CLASSIC
format but new encoding will always done via JBCRYPT_ENCODER
.@Deprecated public HudsonPrivateSecurityRealm(boolean allowsSignup)
@DataBoundConstructor public HudsonPrivateSecurityRealm(boolean allowsSignup, boolean enableCaptcha, CaptchaSupport captchaSupport)
public boolean allowsSignup()
SecurityRealm
SecurityRealm
allows online sign-up.
This creates a hyperlink that redirects users to CONTEXT_ROOT/signUp,
which will be served by the signup.jelly view of this class.
If the implementation needs to redirect the user to a different URL for signing up, use the following jelly script as signup.jelly
<xmp>
<st:redirect url="http://www.sun.com/" xmlns:st="jelly:stapler"/>
</xmp>
allowsSignup
in class SecurityRealm
@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class) public boolean getAllowsSignup()
public boolean isEnableCaptcha()
public GroupDetails loadGroupByGroupname(String groupname) throws org.acegisecurity.userdetails.UsernameNotFoundException, org.springframework.dao.DataAccessException
loadGroupByGroupname
in class AbstractPasswordBasedSecurityRealm
org.acegisecurity.userdetails.UsernameNotFoundException
org.springframework.dao.DataAccessException
public HudsonPrivateSecurityRealm.Details loadUserByUsername(String username) throws org.acegisecurity.userdetails.UsernameNotFoundException, org.springframework.dao.DataAccessException
AbstractPasswordBasedSecurityRealm
This method is used, for example, to validate if the given token is a valid user name when the user is configuring an ACL.
This is an optional method that improves the user experience. If your backend doesn't support
a query like this, just always throw UsernameNotFoundException
.
loadUserByUsername
in interface org.acegisecurity.userdetails.UserDetailsService
loadUserByUsername
in class AbstractPasswordBasedSecurityRealm
org.acegisecurity.userdetails.UsernameNotFoundException
org.springframework.dao.DataAccessException
protected HudsonPrivateSecurityRealm.Details authenticate(String username, String password) throws org.acegisecurity.AuthenticationException
AbstractPasswordBasedSecurityRealm
AbstractPasswordBasedSecurityRealm
.
If the user name and the password pair matches, retrieve the information about this user and
return it as a UserDetails
object. User
is a convenient
implementation to use, but if your backend offers additional data, you may want to use your own subtype
so that the rest of Hudson can use those additional information (such as e-mail address --- see
MailAddressResolver.)
Properties like UserDetails.getPassword()
make no sense, so just return an empty value from it.
The only information that you need to pay real attention is UserDetails.getAuthorities()
, which
is a list of roles/groups that the user is in. At minimum, this must contain SecurityRealm.AUTHENTICATED_AUTHORITY
(which indicates that this user is authenticated and not anonymous), but if your backend supports a notion
of groups, you should make sure that the authorities contain one entry per one group. This enables
users to control authorization based on groups.
If the user name and the password pair doesn't match, throw AuthenticationException
to reject the login
attempt.
authenticate
in class AbstractPasswordBasedSecurityRealm
org.acegisecurity.AuthenticationException
public org.kohsuke.stapler.HttpResponse commenceSignup(FederatedLoginService.FederatedIdentity identity)
commenceSignup
in class SecurityRealm
public User doCreateAccountWithFederatedIdentity(org.kohsuke.stapler.StaplerRequest req, org.kohsuke.stapler.StaplerResponse rsp) throws IOException, javax.servlet.ServletException
commenceSignup(hudson.security.FederatedLoginService.FederatedIdentity)
.IOException
javax.servlet.ServletException
public User doCreateAccount(org.kohsuke.stapler.StaplerRequest req, org.kohsuke.stapler.StaplerResponse rsp) throws IOException, javax.servlet.ServletException
IOException
javax.servlet.ServletException
public void doCreateAccountByAdmin(org.kohsuke.stapler.StaplerRequest req, org.kohsuke.stapler.StaplerResponse rsp) throws IOException, javax.servlet.ServletException
doCreateAccount(StaplerRequest, StaplerResponse)
in that
this is someone creating another user.IOException
javax.servlet.ServletException
@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class) public User createAccountByAdmin(org.kohsuke.stapler.StaplerRequest req, org.kohsuke.stapler.StaplerResponse rsp, String addUserView, String successView) throws IOException, javax.servlet.ServletException
Jenkins.ADMINISTER
IOException
javax.servlet.ServletException
public void doCreateFirstAccount(org.kohsuke.stapler.StaplerRequest req, org.kohsuke.stapler.StaplerResponse rsp) throws IOException, javax.servlet.ServletException
This can be run by anyone, but only to create the very first user account.
IOException
javax.servlet.ServletException
@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class) public boolean isMailerPluginPresent()
public User createAccount(String userName, String password) throws IOException
IOException
public String getDisplayName()
getDisplayName
in interface ModelObject
public ACL getACL()
AccessControlled
getACL
in interface AccessControlled
public void checkPermission(Permission permission)
AccessControlled
getACL().checkPermission(permission)
checkPermission
in interface AccessControlled
public boolean hasPermission(Permission permission)
AccessControlled
getACL().hasPermission(permission)
hasPermission
in interface AccessControlled
Copyright © 2004–2017. All rights reserved.