Package com.isomorphic.auth

Class LoginTokens

java.lang.Object
com.isomorphic.auth.LoginTokens
public final class LoginTokens extends Object
One-time login tokens, with which the server logs in the headless browser it uses to render a report as a given user (scheduled report delivery).

The server opens the report page with a token in the query string (PARAM). SmartClient's AuthenticationFilter honours it. An application with its own authentication honours it by calling redeem(HttpServletRequest) early in its login handling and, when that returns a user name, logging that user in its usual way for the rest of the browser's session. All checks are made by redeem(): a token is accepted once, within two minutes, on the page it was issued for, from this machine (authentication.loginTokens.allowedAddresses), and only while login tokens are enabled (authentication.loginTokens.enabled, by default when report delivery is). Tokens are issued only by the server itself.

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    PARAM
    Query parameter that carries a token: isc_loginToken.

  • Method Summary

    Modifier and Type
    Method
    Description
    static String
    redeem(jakarta.servlet.http.HttpServletRequest request)
    The user a request's login token logs in, or null: the request carries no token, tokens are disabled, or the token is unknown, used, expired, for another page, or presented from an address that is not allowed.

  • Field Details

  • Method Details

    • redeem

      public static String redeem(jakarta.servlet.http.HttpServletRequest request)
      The user a request's login token logs in, or null: the request carries no token, tokens are disabled, or the token is unknown, used, expired, for another page, or presented from an address that is not allowed. A token is used up by its first presentation, whatever the outcome. Answers the same for repeated calls on one request (for example when a URL rewrite passes it through a filter twice). Reads the token from the query string only, never from a request body.

      Call it early in an application's own login handling; when it returns a user name, log that user in as the application does after a successful password check.

      Parameters:
      request - the incoming request
      Returns:
      the user name to log in, or null