Package com.sun.identity.jaxrpc

Class JAXRPCRequestFilter

java.lang.Object

com.sun.identity.jaxrpc.JAXRPCRequestFilter

All Implemented Interfaces:

jakarta.servlet.Filter

public class JAXRPCRequestFilter
extends Object
implements jakarta.servlet.Filter

Servlet filter for the /jaxrpc/* endpoints.

The stock JAX-RPC servlet does not expose the incoming HttpServletRequest to the service implementations. This filter captures the current request in a thread local so that individual JAXRPC methods can read the caller's SSO token from the request cookie when they need to authenticate the caller (e.g. the notification-URL registration methods, to prevent unauthenticated stored SSRF - GHSA-w858-46wv-v45w).

The filter itself never rejects a request (the per-method read/create/modify calls carry their token as an explicit argument and must keep working); authorization is enforced per-method via isServerOrAgentAuthorized().

Field Summary

Fields

Modifier and Type	Field	Description
static String	SKIP_AUTH_CHECK	When set to true, the caller check performed by isServerOrAgentAuthorized() is skipped.

Constructor Summary

Constructors

Constructor	Description
JAXRPCRequestFilter()

Method Summary

Modifier and Type	Method	Description
void	destroy()
void	doFilter(jakarta.servlet.ServletRequest request, jakarta.servlet.ServletResponse response, jakarta.servlet.FilterChain chain)
static jakarta.servlet.http.HttpServletRequest	getCurrentRequest()
void	init(jakarta.servlet.FilterConfig filterConfig)
static boolean	isServerOrAgentAuthorized()	Authorizes the current JAXRPC caller for notification-URL registration.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

SKIP_AUTH_CHECK

public static final String SKIP_AUTH_CHECK

When set to true, the caller check performed by isServerOrAgentAuthorized() is skipped. Runtime toggle - lets legacy clients that do not send an SSO cookie keep registering notification URLs without a rebuild.

See Also:

Constant Field Values

Constructor Detail

JAXRPCRequestFilter

public JAXRPCRequestFilter()

Method Detail

getCurrentRequest

public static jakarta.servlet.http.HttpServletRequest getCurrentRequest()

Returns:

the HttpServletRequest currently being processed on this thread by the /jaxrpc/* servlet, or null if there is none.

isServerOrAgentAuthorized

public static boolean isServerOrAgentAuthorized()

Authorizes the current JAXRPC caller for notification-URL registration.

The caller is authorized when it presents (via the request cookie) a valid SSO token that belongs to a server (an admin/application token) or an agent (an SessionType.APPLICATION session). Regular user tokens and anonymous callers are rejected. The check is skipped entirely when the SKIP_AUTH_CHECK system property is true.

Returns:

true if the caller is allowed to register/deregister notification URLs.

init

public void init(jakarta.servlet.FilterConfig filterConfig)
          throws jakarta.servlet.ServletException

Specified by:

init in interface jakarta.servlet.Filter

Throws:

jakarta.servlet.ServletException

doFilter

public void doFilter(jakarta.servlet.ServletRequest request,
                     jakarta.servlet.ServletResponse response,
                     jakarta.servlet.FilterChain chain)
              throws IOException,
                     jakarta.servlet.ServletException

Specified by:

doFilter in interface jakarta.servlet.Filter

Throws:

IOException

jakarta.servlet.ServletException

destroy

public void destroy()

Specified by:

destroy in interface jakarta.servlet.Filter