Wagon will use during login operation.
@author Michal Maczka
@version $Id: AuthenticationInfo.java 682051 2008-08-02 21:29:38Z hboutemy $
AuthenticationInfo represents a Subject's (aka user's) stored account information relevant to the authentication/log-in process only. It is important to understand the differnce between this interface and the {@link AuthenticationToken AuthenticationToken} interface. AuthenticationInfo implementationsrepresent already-verified and stored account data, whereas an AuthenticationToken represents data submitted for any given login attempt (which may or may not successfully match the verified and stored account AuthenticationInfo). Because the act of authentication (log-in) is orthoganal to authorization (access control), this interface is intended to represent only the account data needed by Shiro during an authentication attempt. Shiro also has a parallel {@link org.apache.shiro.authz.AuthorizationInfo AuthorizationInfo} interface for use during theauthorization process that references access control data such as roles and permissions. But because many if not most {@link org.apache.shiro.realm.Realm Realm}s store both sets of data for a Subject, it might be convenient for a Realm implementation to utilize an implementation of the {@link Account Account}interface instead, which is a convenience interface that combines both AuthenticationInfo and AuthorizationInfo. Whether you choose to implement these two interfaces separately or implement the one Account interface for a given Realm is entirely based on your application's needs or your preferences. Pleae note: Since Shiro sometimes logs authentication operations, please ensure your AuthenticationInfo's toString() implementation does not print out account credentials (password, etc), as these might be viewable to someone reading your logs. This is good practice anyway, and account credentials should rarely (if ever) be printed out for any reason. If you're using Shiro's default implementations of this interface, they only ever print the account {@link #getPrincipals() principals}, so you do not need to do anything additional.
AuthenticationInfo conveys any authentication credentials and/or details extracted by the {@link AuthenticationHandler#extractCredentials(javax.servlet.http.HttpServletRequest,javax.servlet.http.HttpServletResponse)}method from the request. {@link AuthenticationHandler} implementations must return instances of thisclass which may be constructed through any of the provided public constructors.
Internally all values are stored in the map where some property names have special semantics and the data type of the properties are ensured by the {@link #put(String,Object)} method implementation.
AuthenticationInfo defines the data returned from the {@link AuthenticationHandler#authenticate(javax.servlet.http.HttpServletRequest,javax.servlet.http.HttpServletResponse)}method.
@deprecated see {@link AuthenticationHandler}
| |