org.jenkinsci.plugins.cas

Class CasSecurityRealm

java.lang.Object

hudson.model.AbstractDescribableImpl<hudson.security.SecurityRealm>

hudson.security.SecurityRealm

org.jenkinsci.plugins.cas.CasSecurityRealm

All Implemented Interfaces:

hudson.ExtensionPoint, hudson.model.Describable<hudson.security.SecurityRealm>

public class CasSecurityRealm
extends hudson.security.SecurityRealm

CAS Single Sign-On security realm.

Author:

Fabien Crespel, J. David Beutel

See Also:

Apereo CAS project

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	CasSecurityRealm.DescriptorImpl

Nested classes/interfaces inherited from class hudson.security.SecurityRealm

hudson.security.SecurityRealm.SecurityComponents

Nested classes/interfaces inherited from interface hudson.ExtensionPoint

hudson.ExtensionPoint.LegacyInstancesAreScopedToHudson

Field Summary

Fields

Modifier and Type	Field and Description
CasProtocol	casProtocol
String	casServerUrl
static String	DEFAULT_COMMENCE_LOGIN_URL
static String	DEFAULT_FAILED_LOGIN_URL
static String	DEFAULT_FINISH_LOGIN_URL
Boolean	enableRestApi
Boolean	enableSingleSignOut
Boolean	forceRenewal

Fields inherited from class hudson.security.SecurityRealm

AUTHENTICATED_AUTHORITY, LIST, NO_AUTHENTICATION

Constructor Summary

Constructors

Constructor and Description
CasSecurityRealm(String casServerUrl, CasProtocol casProtocol, Boolean forceRenewal, Boolean enableSingleSignOut) Deprecated.
CasSecurityRealm(String casServerUrl, CasProtocol casProtocol, Boolean forceRenewal, Boolean enableSingleSignOut, Boolean enableRestApi)

Method Summary

Methods

Modifier and Type	Method and Description
javax.servlet.Filter	createFilter(javax.servlet.FilterConfig filterConfig) Build the filter that will validate the service ticket returned by CAS.
hudson.security.SecurityRealm.SecurityComponents	createSecurityComponents() Build a authentication manager which uses the CAS REST API for username and password based authentication against the REST API.
void	doCommenceLogin(org.kohsuke.stapler.StaplerRequest req, org.kohsuke.stapler.StaplerResponse rsp) The login process starts from here, using the CasAuthenticationEntryPoint defined in the CasSecurityRealm.groovy application context.
void	doFinishLogin(org.kohsuke.stapler.StaplerRequest req, org.kohsuke.stapler.StaplerResponse rsp) The login process finishes here, by mapping the Spring Security authentication back to Acegi and by firing the authenticated event.
void	doLogout(org.kohsuke.stapler.StaplerRequest req, org.kohsuke.stapler.StaplerResponse rsp) Handles the logout processing.
protected org.springframework.web.context.WebApplicationContext	getApplicationContext() Create the Spring application context that will hold CAS filters.
protected CasRestAuthenticator	getCasRestAuthenticator() Get or create the CAS REST client for API authentication.
static String	getFailedLoginUrl() Get the URL to redirect to in case of authentication failure.
static String	getFinishLoginUrl() Get the callback URL after CAS authentication.
static String	getJenkinsUrl() Get the root Jenkins URL configured in global settings.
static String	getJenkinsUrl(javax.servlet.http.HttpServletRequest req) Get the root Jenkins URL configured in global settings, or construct it from the current HTTP request.
String	getLoginUrl() Login begins with our doCommenceLogin(StaplerRequest, StaplerResponse) method.
protected String	getPostLogOutUrl(org.kohsuke.stapler.StaplerRequest req, org.acegisecurity.Authentication auth) Logout redirects to CAS before coming back to Jenkins.
static String	getServiceUrl(javax.servlet.http.HttpServletRequest req, org.springframework.security.cas.ServiceProperties serviceProperties) Get the full service URL for use with CAS.
protected boolean	isRestApiEnabled() Check if the CAS REST API is enabled.

Methods inherited from class hudson.security.SecurityRealm

all, allowsSignup, canLogOut, commenceSignup, createCliAuthenticator, doCaptcha, findBean, getAuthenticationGatewayUrl, getCaptchaSupport, getCaptchaSupportDescriptors, getDescriptor, getGroupIdStrategy, getSecurityComponents, getUserIdStrategy, loadGroupByGroupname, loadGroupByGroupname, loadUserByUsername, setCaptchaSupport, validateCaptcha

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

DEFAULT_COMMENCE_LOGIN_URL

public static final String DEFAULT_COMMENCE_LOGIN_URL

See Also:

Constant Field Values

DEFAULT_FINISH_LOGIN_URL

public static final String DEFAULT_FINISH_LOGIN_URL

See Also:

Constant Field Values

DEFAULT_FAILED_LOGIN_URL

public static final String DEFAULT_FAILED_LOGIN_URL

See Also:

Constant Field Values

casServerUrl

public final String casServerUrl

casProtocol

public final CasProtocol casProtocol

forceRenewal

public final Boolean forceRenewal

enableSingleSignOut

public final Boolean enableSingleSignOut

enableRestApi

public final Boolean enableRestApi

Constructor Detail

CasSecurityRealm

@Deprecated
public CasSecurityRealm(String casServerUrl,
                           CasProtocol casProtocol,
                           Boolean forceRenewal,
                           Boolean enableSingleSignOut)

Deprecated.

CasSecurityRealm

@DataBoundConstructor
public CasSecurityRealm(String casServerUrl,
                                     CasProtocol casProtocol,
                                     Boolean forceRenewal,
                                     Boolean enableSingleSignOut,
                                     Boolean enableRestApi)

Method Detail

getJenkinsUrl

public static String getJenkinsUrl()

Get the root Jenkins URL configured in global settings.

Returns:

Jenkins URL

getJenkinsUrl

public static String getJenkinsUrl(javax.servlet.http.HttpServletRequest req)

Get the root Jenkins URL configured in global settings, or construct it from the current HTTP request.

Parameters:

req - current HTTP request

Returns:

Jenkins URL

getFinishLoginUrl

public static String getFinishLoginUrl()

Get the callback URL after CAS authentication.

Returns:

finish login URL

getFailedLoginUrl

public static String getFailedLoginUrl()

Get the URL to redirect to in case of authentication failure.

Returns:

failed login URL

getServiceUrl

public static String getServiceUrl(javax.servlet.http.HttpServletRequest req,
                   org.springframework.security.cas.ServiceProperties serviceProperties)

Get the full service URL for use with CAS.

Parameters:

req - current HTTP request

serviceProperties - service properties

Returns:

full service URL

getApplicationContext

protected org.springframework.web.context.WebApplicationContext getApplicationContext()

Create the Spring application context that will hold CAS filters.

Returns:

Spring application context

getCasRestAuthenticator

protected CasRestAuthenticator getCasRestAuthenticator()

Get or create the CAS REST client for API authentication.

Returns:

CAS REST authenticator

isRestApiEnabled

protected boolean isRestApiEnabled()

Check if the CAS REST API is enabled.

Returns:

true if enabled

getLoginUrl

public String getLoginUrl()

Login begins with our doCommenceLogin(StaplerRequest, StaplerResponse) method.

Overrides:

getLoginUrl in class hudson.security.SecurityRealm

Returns:

Jenkins commenceLogin URL

getPostLogOutUrl

protected String getPostLogOutUrl(org.kohsuke.stapler.StaplerRequest req,
                      org.acegisecurity.Authentication auth)

Logout redirects to CAS before coming back to Jenkins.

Overrides:

getPostLogOutUrl in class hudson.security.SecurityRealm

Returns:

CAS logout URL

createSecurityComponents

public hudson.security.SecurityRealm.SecurityComponents createSecurityComponents()

Build a authentication manager which uses the CAS REST API for username and password based authentication against the REST API. Browser authentication is handled by the CAS filter chain.

Specified by:

createSecurityComponents in class hudson.security.SecurityRealm

Returns:

SecurityComponents holder for the authentication manager

createFilter

public javax.servlet.Filter createFilter(javax.servlet.FilterConfig filterConfig)

Build the filter that will validate the service ticket returned by CAS. This filter, defined in the CasSecurityRealm.groovy application context, will wrap the original filter chain from Jenkins to preserve support for API token authentication (among other features).

Overrides:

createFilter in class hudson.security.SecurityRealm

Returns:

CAS filter

doLogout

public void doLogout(org.kohsuke.stapler.StaplerRequest req,
            org.kohsuke.stapler.StaplerResponse rsp)
              throws IOException,
                     javax.servlet.ServletException

Handles the logout processing.

Overrides:

doLogout in class hudson.security.SecurityRealm

Parameters:

req - request

rsp - response

Throws:

IOException

javax.servlet.ServletException

doCommenceLogin

public void doCommenceLogin(org.kohsuke.stapler.StaplerRequest req,
                   org.kohsuke.stapler.StaplerResponse rsp)
                     throws IOException,
                            javax.servlet.ServletException

The login process starts from here, using the CasAuthenticationEntryPoint defined in the CasSecurityRealm.groovy application context.

Parameters:

req - request

rsp - response

Throws:

IOException

javax.servlet.ServletException

doFinishLogin

public void doFinishLogin(org.kohsuke.stapler.StaplerRequest req,
                 org.kohsuke.stapler.StaplerResponse rsp)

The login process finishes here, by mapping the Spring Security authentication back to Acegi and by firing the authenticated event.

Parameters:

req - request

rsp - response