001 /*
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements. See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership. The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License. You may obtain a copy of the License at
009 *
010 * http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing,
013 * software distributed under the License is distributed on an
014 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
015 * KIND, either express or implied. See the License for the
016 * specific language governing permissions and limitations
017 * under the License.
018 */
019 package org.apache.shiro.authz.aop;
020
021 import java.lang.annotation.Annotation;
022
023 import org.apache.shiro.authz.AuthorizationException;
024 import org.apache.shiro.authz.UnauthenticatedException;
025 import org.apache.shiro.authz.annotation.RequiresGuest;
026
027
028 /**
029 * Checks to see if a @{@link org.apache.shiro.authz.annotation.RequiresGuest RequiresGuest} annotation
030 * is declared, and if so, ensures the calling <code>Subject</code> does <em>not</em>
031 * have an {@link org.apache.shiro.subject.Subject#getPrincipal() identity} before invoking the method.
032 * <p>
033 * This annotation essentially ensures that <code>subject.{@link org.apache.shiro.subject.Subject#getPrincipal() getPrincipal()} == null</code>.
034 *
035 * @author Les Hazlewood
036 * @since 0.9.0
037 */
038 public class GuestAnnotationHandler extends AuthorizingAnnotationHandler {
039
040 /**
041 * Default no-argument constructor that ensures this interceptor looks for
042 *
043 * {@link org.apache.shiro.authz.annotation.RequiresGuest RequiresGuest} annotations in a method
044 * declaration.
045 */
046 public GuestAnnotationHandler() {
047 super(RequiresGuest.class);
048 }
049
050 /**
051 * Ensures that the calling <code>Subject</code> is NOT a <em>user</em>, that is, they do not
052 * have an {@link org.apache.shiro.subject.Subject#getPrincipal() identity} before continuing. If they are
053 * a user ({@link org.apache.shiro.subject.Subject#getPrincipal() Subject.getPrincipal()} != null), an
054 * <code>AuthorizingException</code> will be thrown indicating that execution is not allowed to continue.
055 *
056 * @param a the annotation to check for one or more roles
057 * @throws org.apache.shiro.authz.AuthorizationException
058 * if the calling <code>Subject</code> is not a "guest".
059 */
060 public void assertAuthorized(Annotation a) throws AuthorizationException {
061 if (a instanceof RequiresGuest && getSubject().getPrincipal() != null) {
062 throw new UnauthenticatedException("Attempting to perform a guest-only operation. The current Subject is " +
063 "not a guest (they have been authenticated or remembered from a previous login). Access " +
064 "denied.");
065 }
066 }
067 }