Apereo-Learning-Analytics-Initiative / OpenLRW

public class JwtTokenAuthenticationProcessingFilter extends AbstractAuthenticationProcessingFilter {

    private final AuthenticationFailureHandler failureHandler;

    private final TokenExtractor tokenExtractor;

    @Autowired

    public JwtTokenAuthenticationProcessingFilter(AuthenticationFailureHandler failureHandler, 

            TokenExtractor tokenExtractor, RequestMatcher matcher) {

        super(matcher);

        this.failureHandler = failureHandler;

        this.tokenExtractor = tokenExtractor;

    }

    @Override

    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)

            throws AuthenticationException, IOException, ServletException {

        String tokenPayload = request.getHeader(WebSecurityConfig.JWT_TOKEN_HEADER_PARAM);

        RawAccessJwtToken token = new RawAccessJwtToken(tokenExtractor.extract(tokenPayload));

        return getAuthenticationManager().authenticate(new JwtAuthenticationToken(token));

    }

    @Override

    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain,

            Authentication authResult) throws IOException, ServletException {

        SecurityContext context = SecurityContextHolder.createEmptyContext();

        context.setAuthentication(authResult);

        SecurityContextHolder.setContext(context);

        chain.doFilter(request, response);

    }

    @Override

    protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response,

            AuthenticationException failed) throws IOException, ServletException {

        SecurityContextHolder.clearContext();

        failureHandler.onAuthenticationFailure(request, response, failed);