public class RulesAwareRequestAuthorizationFilter extends AbstractRequestAuthorizationFilter
Any issuer that is not in the list will be rejected.
For example, we might have some requirement that the issuer Mallory should only be able to use the subject "Mallory", whereas the issuer Alice might be able to use the subject "Alice" or "Bob". We might write something like this:
rules = ImmutableMap.of(
"Mallory", jwt -> "Mallory".equals(jwt.getClaims().getSubject().orElse("Mallory")),
"Alice", jwt -> ImmutableSet.of("Alice", "Bob").contains(jwt.getClaims().getSubject().orElse("Alice"))
);
This would prevent Mallory from using Alice or Bob as the subject when we don't expect them to. (This particular
example is actually covered better by the IssuerAndSubjectAwareRequestAuthorizationFilter, which extends this
class.)
| Constructor and Description |
|---|
RulesAwareRequestAuthorizationFilter(Map<String,Predicate<Jwt>> issuersAndChecks) |
| Modifier and Type | Method and Description |
|---|---|
protected boolean |
isAuthorized(javax.servlet.http.HttpServletRequest request,
Jwt jwt)
Decides if the token is authorized for the request.
|
destroy, doFilter, init, onAuthorizationFailure, onAuthorizationSuccess, onTokenNotFoundprotected boolean isAuthorized(javax.servlet.http.HttpServletRequest request,
Jwt jwt)
AbstractRequestAuthorizationFilterisAuthorized in class AbstractRequestAuthorizationFilterrequest - HTTP request receivedjwt - Authentic and valid JWT token extracted from the requestCopyright © 2017 Atlassian. All rights reserved.