public class RolesInterceptor extends AbstractInterceptor
This interceptor ensures that the action will only be executed if the user has the correct role.
Interceptor parameters:
When both allowedRoles and disallowedRoles are configured, then disallowedRoles takes precedence, applying the following logic: (if ((inRole(role1) || inRole(role2) || ... inRole(roleN)) && !inRole(roleA) && !inRole(roleB) && ... !inRole(roleZ)) { //permit ...
There are three extensions to the existing interceptor:
  <!-- START SNIPPET: example -->
  <!-- only allows the admin and member roles -->
  <action name="someAction" class="com.examples.SomeAction">
      <interceptor-ref name="completeStack"/>
      <interceptor-ref name="roles">
        <param name="allowedRoles">admin,member</param>
      </interceptor-ref>
      <result name="success">good_result.ftl</result>
  </action>
  <!-- END SNIPPET: example -->
 ConditionalInterceptor.LegacyAdapter| Modifier and Type | Field and Description | 
|---|---|
| protected List<String> | allowedRoles | 
| protected List<String> | disallowedRoles | 
| Constructor and Description | 
|---|
| RolesInterceptor() | 
| Modifier and Type | Method and Description | 
|---|---|
| protected boolean | areRolesValid(List<String> roles)Extension point for sub-classes to test if configured roles are known valid roles. | 
| protected String | handleRejection(ActionInvocation invocation,
               javax.servlet.http.HttpServletResponse response)Handles a rejection by sending a 403 HTTP error | 
| String | intercept(ActionInvocation invocation)Override to handle interception | 
| protected boolean | isAllowed(javax.servlet.http.HttpServletRequest request,
         Object action)Determines if the request should be allowed for the action | 
| void | setAllowedRoles(String roles) | 
| void | setDisallowedRoles(String roles) | 
| protected List<String> | stringToList(String val)Splits a string into a List | 
intercept, shouldIntercept, shouldInterceptdestroy, init, setDisabledclone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, waitadaptadaptdestroy, initpublic void setAllowedRoles(String roles)
public void setDisallowedRoles(String roles)
public String intercept(ActionInvocation invocation) throws Exception
AbstractInterceptorintercept in class AbstractInterceptorExceptionprotected List<String> stringToList(String val)
val - the string to splitprotected boolean isAllowed(javax.servlet.http.HttpServletRequest request,
                            Object action)
request - The requestaction - The action objectprotected String handleRejection(ActionInvocation invocation, javax.servlet.http.HttpServletResponse response) throws Exception
invocation - The invocationresponse - the servlet response objectException - in case of any errorprotected boolean areRolesValid(List<String> roles)
roles - allowed and disallowed rolesCopyright © 2000–2025 Apache Software Foundation. All rights reserved.