public class RolesInterceptor extends AbstractInterceptor
This interceptor ensures that the action will only be executed if the user has the correct role.
Interceptor parameters:
When both allowedRoles and disallowedRoles are configured, then disallowedRoles takes precedence, applying the following logic: (if ((inRole(role1) || inRole(role2) || ... inRole(roleN)) && !inRole(roleA) && !inRole(roleB) && ... !inRole(roleZ)) { //permit ...
There are three extensions to the existing interceptor:
<!-- START SNIPPET: example -->
<!-- only allows the admin and member roles -->
<action name="someAction" class="com.examples.SomeAction">
<interceptor-ref name="completeStack"/>
<interceptor-ref name="roles">
<param name="allowedRoles">admin,member</param>
</interceptor-ref>
<result name="success">good_result.ftl</result>
</action>
<!-- END SNIPPET: example -->
| Modifier and Type | Field and Description |
|---|---|
protected List<String> |
allowedRoles |
protected List<String> |
disallowedRoles |
| Constructor and Description |
|---|
RolesInterceptor() |
| Modifier and Type | Method and Description |
|---|---|
protected boolean |
areRolesValid(List<String> roles)
Extension point for sub-classes to test if configured roles are known valid roles.
|
protected String |
handleRejection(ActionInvocation invocation,
javax.servlet.http.HttpServletResponse response)
Handles a rejection by sending a 403 HTTP error
|
String |
intercept(ActionInvocation invocation)
Override to handle interception
|
protected boolean |
isAllowed(javax.servlet.http.HttpServletRequest request,
Object action)
Determines if the request should be allowed for the action
|
void |
setAllowedRoles(String roles) |
void |
setDisallowedRoles(String roles) |
protected List<String> |
stringToList(String val)
Splits a string into a List
|
destroy, initpublic void setAllowedRoles(String roles)
public void setDisallowedRoles(String roles)
public String intercept(ActionInvocation invocation) throws Exception
AbstractInterceptorintercept in interface Interceptorintercept in class AbstractInterceptorinvocation - the action invocationActionInvocation.invoke(), or from the interceptor itself.Exception - any system-level error, as defined in Action.execute().protected List<String> stringToList(String val)
val - the string to splitprotected boolean isAllowed(javax.servlet.http.HttpServletRequest request,
Object action)
request - The requestaction - The action objectprotected String handleRejection(ActionInvocation invocation, javax.servlet.http.HttpServletResponse response) throws Exception
invocation - The invocationresponse - the servlet response objectException - in case of any errorprotected boolean areRolesValid(List<String> roles)
roles - allowed and disallowed rolesCopyright © 2000–2017 Apache Software Foundation. All rights reserved.