Package org.springframework.security.web.authentication.preauth

# Class RequestAttributeAuthenticationFilter

java.lang.Object
org.springframework.web.filter.GenericFilterBean
org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter
org.springframework.security.web.authentication.preauth.RequestAttributeAuthenticationFilter

All Implemented Interfaces:
  `jakarta.servlet.Filter`, `org.springframework.beans.factory.Aware`, `org.springframework.beans.factory.BeanNameAware`, `org.springframework.beans.factory.DisposableBean`, `org.springframework.beans.factory.InitializingBean`, `org.springframework.context.ApplicationEventPublisherAware`, `org.springframework.context.EnvironmentAware`, `org.springframework.core.env.EnvironmentCapable`, `org.springframework.web.context.ServletContextAware`

public class RequestAttributeAuthenticationFilter extends AbstractPreAuthenticatedProcessingFilter
A simple pre-authenticated filter which obtains the username from request attributes, for use with SSO systems such as Stanford WebAuth or Shibboleth.

As with most pre-authenticated scenarios, it is essential that the external authentication system is set up correctly as this filter does no authentication whatsoever.

The property `principalEnvironmentVariable` is the name of the request attribute that contains the username. It defaults to "REMOTE_USER" for compatibility with WebAuth and Shibboleth.

If the environment variable is missing from the request, `getPreAuthenticatedPrincipal` will throw an exception. You can override this behaviour by setting the `exceptionIfVariableMissing` property.

Since:
  4.2

## Field Summary

### Fields inherited from class org.springframework.web.filter.GenericFilterBean

`logger`

## Constructor Summary

Constructors
Constructor
Description
`RequestAttributeAuthenticationFilter()`

## Method Summary

Modifier and Type
Method
Description
`protected Object`
`getPreAuthenticatedCredentials(jakarta.servlet.http.HttpServletRequest request)`
Credentials aren't usually applicable, but if a `credentialsEnvironmentVariable` is set, this will be read and used as the credentials value.
`protected Object`
`getPreAuthenticatedPrincipal(jakarta.servlet.http.HttpServletRequest request)`
Read and returns the variable named by `principalEnvironmentVariable` from the request.
`void`
`setCredentialsEnvironmentVariable(String credentialsEnvironmentVariable)`
`void`
`setExceptionIfVariableMissing(boolean exceptionIfVariableMissing)`
Defines whether an exception should be raised if the principal variable is missing.
`void`
`setPrincipalEnvironmentVariable(String principalEnvironmentVariable)`

### Methods inherited from class org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter

`afterPropertiesSet, doFilter, getAuthenticationDetailsSource, principalChanged, setApplicationEventPublisher, setAuthenticationDetailsSource, setAuthenticationFailureHandler, setAuthenticationManager, setAuthenticationSuccessHandler, setCheckForPrincipalChanges, setContinueFilterChainOnUnsuccessfulAuthentication, setInvalidateSessionOnPrincipalChange, setRequiresAuthenticationRequestMatcher, setSecurityContextHolderStrategy, setSecurityContextRepository, successfulAuthentication, unsuccessfulAuthentication`

### Methods inherited from class org.springframework.web.filter.GenericFilterBean

`addRequiredProperty, createEnvironment, destroy, getEnvironment, getFilterConfig, getFilterName, getServletContext, init, initBeanWrapper, initFilterBean, setBeanName, setEnvironment, setServletContext`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Constructor Details

### RequestAttributeAuthenticationFilter

public RequestAttributeAuthenticationFilter()

## Method Details

### getPreAuthenticatedPrincipal

protected Object getPreAuthenticatedPrincipal(jakarta.servlet.http.HttpServletRequest request)
Read and returns the variable named by `principalEnvironmentVariable` from the request.

Specified by:
  `getPreAuthenticatedPrincipal` in class `AbstractPreAuthenticatedProcessingFilter`
Throws:
  `PreAuthenticatedCredentialsNotFoundException` - if the environment variable is missing and `exceptionIfVariableMissing` is set to `true`.

### getPreAuthenticatedCredentials

protected Object getPreAuthenticatedCredentials(jakarta.servlet.http.HttpServletRequest request)
Credentials aren't usually applicable, but if a `credentialsEnvironmentVariable` is set, this will be read and used as the credentials value. Otherwise a dummy value will be used.

Specified by:
  `getPreAuthenticatedCredentials` in class `AbstractPreAuthenticatedProcessingFilter`

### setPrincipalEnvironmentVariable

public void setPrincipalEnvironmentVariable(String principalEnvironmentVariable)

### setCredentialsEnvironmentVariable

public void setCredentialsEnvironmentVariable(String credentialsEnvironmentVariable)

### setExceptionIfVariableMissing

public void setExceptionIfVariableMissing(boolean exceptionIfVariableMissing)
Defines whether an exception should be raised if the principal variable is missing. Defaults to `true`.

Parameters:
  `exceptionIfVariableMissing` - set to `false` to override the default behaviour and allow the request to proceed if no variable is found.