001    /*
002     * Licensed to the Apache Software Foundation (ASF) under one
003     * or more contributor license agreements.  See the NOTICE file
004     * distributed with this work for additional information
005     * regarding copyright ownership.  The ASF licenses this file
006     * to you under the Apache License, Version 2.0 (the
007     * "License"); you may not use this file except in compliance
008     * with the License.  You may obtain a copy of the License at
009     *
010     *     http://www.apache.org/licenses/LICENSE-2.0
011     *
012     * Unless required by applicable law or agreed to in writing,
013     * software distributed under the License is distributed on an
014     * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
015     * KIND, either express or implied.  See the License for the
016     * specific language governing permissions and limitations
017     * under the License.
018     */
019    package org.apache.shiro.web.filter.authc;
020    
021    import javax.servlet.ServletRequest;
022    import javax.servlet.ServletResponse;
023    
024    /**
025     * An authentication filter that redirects the user to the login page when they are trying to access
026     * a protected resource.  However, if the user is trying to access the login page, the filter lets
027     * the request pass through to the application code.
028     * <p/>
029     * The difference between this filter and the {@link FormAuthenticationFilter FormAuthenticationFilter} is that
030     * on a login submission (by default an HTTP POST to the login URL), the <code>FormAuthenticationFilter</code> filter
031     * attempts to automatically authenticate the user by passing the <code>username</code> and <code>password</code>
032     * request parameter values to
033     * {@link org.apache.shiro.subject.Subject#login(org.apache.shiro.authc.AuthenticationToken) Subject.login(usernamePasswordToken)}
034     * directly.
035     * <p/>
036     * Conversely, this controller always passes all requests to the {@link #setLoginUrl loginUrl} through, both GETs and
037     * POSTs.  This is useful in cases where the developer wants to write their own login behavior, which should include a
038     * call to {@link org.apache.shiro.subject.Subject#login(org.apache.shiro.authc.AuthenticationToken) Subject.login(AuthenticationToken)}
039     * at some point.  For example,  if the developer has their own custom MVC login controller or validator,
040     * this <code>PassThruAuthenticationFilter</code> may be appropriate.
041     *
042     * @see FormAuthenticationFilter
043     * @since 0.9
044     */
045    public class PassThruAuthenticationFilter extends AuthenticationFilter {
046    
047        //TODO - complete JavaDoc
048    
049        protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
050            if (isLoginRequest(request, response)) {
051                return true;
052            } else {
053                saveRequestAndRedirectToLogin(request, response);
054                return false;
055            }
056        }
057    
058    }