Warning |
---|
|
Work in progress / Draft / Comments welcome but nonethelesss page not finished... |
Let me lead with the fact that I don't understand Spring Web MVC well enough.
...
We need to be able to support determining at runtime per request what kind of Credentials we have received and will be passing into the CentralAuthenticationService.
Discussion
Haven't I seen this before?
Yes, this is this page all over again.
Panel |
---|
title | LoginController inheritence |
---|
|
For reference, the following is the class hierarchy for LoginController. Highlighted methods are those involved in the discussion below. Tip |
---|
icon | false |
---|
title | LoginController |
---|
|
extends Note |
---|
|
icon | false |
---|
title | SimpleFormController |
---|
|
extends
Note |
---|
icon | false |
---|
title | AbstractFormController |
|
- protected abstract ModelAndView processFormSubmissionshowForm(
final HttpServletRequest request, final HttpServletResponse response, final BindException errors) throws Exception {} - protected ModelAndView processFormSubmission(final HttpServletRequest request, final HttpServletResponse response, final Object object, final BindException errors) throws Exception {}
|
extends
Note |
---|
icon | false |
---|
title | SimpleFormController |
---|
|
|
extends
Note |
---|
icon | false |
---|
title | AbstractFormController |
---|
|
- protected abstract ModelAndView processFormSubmission(
HttpServletRequest request, HttpServletResponse response, Object command, BindException errors) throws Exception; - protected final Object getCommand(HttpServletRequest request) throws Exception;
- protected Object formBackingObject(HttpServletRequest request) throws Exception {};
|
extends
Note |
---|
icon | false |
---|
title | BaseCommandController |
---|
|
- protected Object getCommand(HttpServletRequest request) {}
- protected final Object createCommand() throws InstantiationException, IllegalAccessException;
- protected final ServletRequestDataBinder bindAndValidate(HttpServletRequest request, Object command) throws Exception {}
|
extends
Note |
---|
icon | false |
---|
title | AbstractController |
---|
|
- public final ModelAndView handleRequest(HttpServletRequest request, HttpServletResponse response) throws Exception {}
- protected abstract ModelAndView handleRequestInternal(HttpServletRequest request, HttpServletResponse response) throws Exception;
|
extends
Note |
---|
icon | false |
---|
title | WebContentGenerator |
---|
|
|
extends
Note |
---|
icon | false |
---|
title | WebApplicationObjectSupport |
---|
|
|
extends
Note |
---|
icon | false |
---|
title | ApplicationObjectSupport |
---|
|
|
...
In this page I'd like to look carefully at where that command object is coming from and what binding is being done.
Panel |
---|
bgColor | #FFFFCE |
---|
borderStyle | solid |
---|
title | Where is the object coming from? |
---|
borderStyle | solid |
---|
|
We need to look carefully at the "object" argument. The object here is a Command. LoginController extends SimpleFormController which extends AbstractFormController which extends BaseCommandController which extends AbstractController which extends WebContentGenerator which extends WebApplicationObjectSupport which extends ApplicationObjectSupport. In Spring Web MVC FormControllers, the forms play the role of "commands" in the more general CommandController model. So, in AbstractController there is a final method handleRequest(): Code Block |
---|
title | AbstractController handleRequest() |
---|
|
public final ModelAndView handleRequest(HttpServletRequest request, HttpServletResponse response)
throws Exception {
// delegate to WebContentGenerator for checking and preparing
checkAndPrepare(request, response, this instanceof LastModified);
// execute in synchronized block if required
if (this.synchronizeOnSession) {
HttpSession session = request.getSession(false);
if (session != null) {
synchronized (session) {
return handleRequestInternal(request, response);
}
}
}
return handleRequestInternal(request, response);
}
|
As we can see here, it delegates to the method handleRequestInternal(), which is declared to be abstract: Code Block |
---|
title | AbstractController handleRequestInternal() |
---|
|
/**
* Template method. Subclasses must implement this.
* The contract is the same as for handleRequest.
* @see #handleRequest
*/
protected abstract ModelAndView handleRequestInternal(HttpServletRequest request, HttpServletResponse response)
throws Exception;
|
AbstractCommandController implements this abstract method: Code Block |
---|
title | AbstractCommandController handleRequestInternal() implementation |
---|
|
/**
* Handles two cases: form submissions and showing a new form.
* Delegates the decision between the two to isFormSubmission,
* always treating requests without existing form session attribute
* as new form when using session form mode.
*/
protected final ModelAndView handleRequestInternal(HttpServletRequest request, HttpServletResponse response)
throws Exception {
if (isFormSubmission(request)) {
if (isSessionForm() && request.getSession().getAttribute(getFormSessionAttributeName()) == null) {
// cannot submit a session form if no form object is in the session
return handleInvalidSubmit(request, response);
}
// process submit
Object command = getCommand(request);
ServletRequestDataBinder binder = bindAndValidate(request, command);
return processFormSubmission(request, response, command, binder.getErrors());
} else {
return showNewForm(request, response);
}
}
|
And in turn delegates to processFormSubmission(). Note that it first binds the request to the command and validates the request. Warning |
---|
| The bindAndValidate() method is implemented in BaseCommandController as: Code Block |
---|
title | BaseCommandController bindAndValidate() |
---|
|
/**
* Bind the parameters of the given request to the given command object.
* @param request current HTTP request
* @param command the command to bind onto
* @return the ServletRequestDataBinder instance for additional custom validation
* @throws Exception in case of invalid state or arguments
*/
protected final ServletRequestDataBinder bindAndValidate(HttpServletRequest request, Object command)
throws Exception {
ServletRequestDataBinder binder = createBinder(request, command);
binder.bind(request);
onBind(request, command, binder.getErrors());
if (this.validators != null && isValidateOnBinding() && !suppressValidation(request)) {
for (int i = 0; i < this.validators.length; i++) {
ValidationUtils.invokeValidator(this.validators[i], command, binder.getErrors());
}
}
onBindAndValidate(request, command, binder.getErrors());
return binder;
}
|
That createBinder method it invokes looks like this: Code Block |
---|
title | BaseCommandController createBinder() |
---|
|
protected ServletRequestDataBinder createBinder(HttpServletRequest request, Object command)
throws Exception {
ServletRequestDataBinder binder = new ServletRequestDataBinder(command, getCommandName());
if (this.messageCodesResolver != null) {
binder.setMessageCodesResolver(this.messageCodesResolver);
}
initBinder(request, binder);
return binder;
}
|
The upshot of the matter is that setter methods for JavaBean properties the names of which correspond to the names of parameters on the HttpServletRequest are invoked with the values of those HttpServletRequest parameters as arguments. |
whereas processFormSubmission() is an abstract method of AbstractFormController: Code Block |
---|
title | processFormSubmission is abstract method of AbstractFormController |
---|
|
protected abstract ModelAndView processFormSubmission(
HttpServletRequest request, HttpServletResponse response, Object command, BindException errors)
throws Exception;
|
LoginController defaults this Command class: Code Block |
---|
title | LoginController afterPropertiesSet() excerpt |
---|
|
public void afterPropertiesSet() throws Exception {
if (this.getCommandClass() == null) {
this.setCommandName("credentials");
this.setCommandClass(UsernamePasswordCredentials.class);
|
In BaseCommandController, we have: Code Block |
---|
title | BaseCommandController getCommand() |
---|
|
/**
* Retrieve a command object for the given request.
* <p>Default implementation calls createCommand. Subclasses can override this.
* @param request current HTTP request
* @return object command to bind onto
* @see #createCommand
*/
protected Object getCommand(HttpServletRequest request) throws Exception {
return createCommand();
}
|
And the createCommand() method to which it delegates: Code Block |
---|
title | BaseCommandController createCommand() |
---|
|
/**
* Create a new command instance for the command class of this controller.
* @return the new command instance
* @throws InstantiationException if the command class could not be instantiated
* @throws IllegalAccessException if the class or its constructor is not accessible
*/
protected final Object createCommand() throws InstantiationException, IllegalAccessException {
if (this.commandClass == null) {
throw new IllegalStateException("Cannot create command without commandClass being set - " +
"either set commandClass or override formBackingObject");
}
if (logger.isDebugEnabled()) {
logger.debug("Creating new command of class [" + this.commandClass.getName() + "]");
}
return this.commandClass.newInstance();
}
|
In summaryTo sum up, the "command" argument of type Object to the processFormSubmission() method of LoginController is an instance of the Class that was set using the setCommandClass() method by configuring the commandClass JavaBean property of LoginController or by allowing it to default as implemented in LoginController's afterPropertiesSet(). |
...
Code Block |
---|
title | Current CredentialsBinder interface |
---|
|
/**
* Interface for a class that can bind items stored in the request to a particular
* credentials implementation. This allows for binding beyond the basic
* JavaBean/Request parameter binding that is handled by Spring automatically.
*/
public interface CredentialsBinder {
/**
* Method to allow manually binding attributes from the request object to properties of
* the credentials. Useful when there is no mapping of attribute to property for the
* usual Spring binding to handle.
*
* @param request The HttpServletRequest from which we wish to bind credentials to
* @param credentials The credentials we will be doing custom binding to.
*/
void bind(HttpServletRequest request, Credentials credentials);
/**
*
* Method to determine if a CredentialsBinder supports a specific class or not.
*
* @param clazz The class to determine is supported or not
* @return true if this class is supported by the CredentialsBinder, false otherwise.
*/
boolean supports(Class clazz);
}
|
...
This doesn't appear to get us where we need to be, though. We need to be able to support switching among several different types of Credentials.
Note |
---|
title | Why several different types of credentials in one LoginController instance? |
---|
|
A draft of this document prompted the question "Why does an instance of a LoginController need to support more than one type of Credentials?" Any given CAS deployment might want to support more than one type of credentials. Say, username/password and also desktop Kerberos. So we'd have two radically different kinds of Credentials. One way to handle this would be to have multiple instances of the LoginController, one for each type of credentials we might handle. But how did we know which LoginController to go to? We probably shouldn't switch on the URL, since after all any given CAS client is going to redirect to the single institutional CAS login URL regardless of end user preference about what kind of credential she wants to present. Another way (I propose) is to give our LoginController a plugin, a RequestToCredentials. This object is responsible for examining the HttpServletRequest and returning the Credentials it represents. It is these credentials that get passed from LoginController into the CentralAuthenticationService for processing. One plausible implementation of this interface will be the implementation that delegates to a List of other implementations, returning true to supports() if any of its children support the presented HttpServletRequest and returning the Credentials returned by the first of its children to support the request. |
We might have mapped AuthenticationHandlers for Password credentials and for Kerberos credentials, say. The current LoginController implementation requires us to name the class an instance of which will be our Credentials once for the entire instance of LoginController. Per each request we can only configure the Credentials instance that has already been created for us.
...
Now, we might like to over-ride the BaseCommandController's implmentation implementation of getCommand():
Code Block |
---|
title | BaseCommandController's implementation of getCommand() |
---|
|
protected Object getCommand(HttpServletRequest request) throws Exception {
return createCommand();
}
|
...