org.picketlink.http.internal.authentication.schemes

Class TokenAuthenticationScheme

java.lang.Object

org.picketlink.http.internal.authentication.schemes.TokenAuthenticationScheme

All Implemented Interfaces:

HttpAuthenticationScheme<TokenAuthenticationConfiguration>

public class TokenAuthenticationScheme
extends Object
implements HttpAuthenticationScheme<TokenAuthenticationConfiguration>

A custom HttpAuthenticationScheme that knows how to extract a header from the request containing a token to authenticate/re-authenticate an user.

Tokens are issued by providing specific credentials for the primary authentication scheme. This scheme will be used to validate user's credentials (eg.: username/password over BASIC) and if successful, issue a token.

By default, the primary authentication scheme is BasicAuthenticationScheme. In order to change it, subclasses may override the getPrimaryAuthenticationScheme method.

Once a token is issued, it will be written to the HttpServletResponse using a JSON format. In order to change how tokens are returned to clients, subclasses may override the writeToken(String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse).

This scheme is used by the SecurityFilter, which is configured in the web application deployment descriptor (web.xml).

Author:

Pedro Igor

Field Summary

Fields

Modifier and Type	Field and Description
static String	AUTHENTICATION_SCHEME_NAME
static String	AUTHORIZATION_TOKEN_HEADER_NAME
static String	REQUIRES_AUTHENTICATION_HEADER_NAME

Constructor Summary

Constructors

Constructor and Description
TokenAuthenticationScheme()

Method Summary

Methods

Modifier and Type	Method and Description
void	challengeClient(HttpServletRequest request, HttpServletResponse response) We use a 401 http status code to sinalize to clients that authentication is required.
protected TokenCredential	createCredential(String extractedToken) Creates a TokenCredential using the token previously extracted from the request.
void	extractCredential(HttpServletRequest request, DefaultLoginCredentials creds) Extracts the credentials from the given HttpServletRequest and populates the DefaultLoginCredentials with them.
protected String	extractTokenFromRequest(HttpServletRequest request) Extracts the token from the HttpServletRequest.
protected DefaultLoginCredentials	getCredentials() Returns the current DefaultLoginCredentials associated with the request.
protected Identity	getIdentity() Returns the current Identity associated with the request.
protected HttpAuthenticationScheme	getPrimaryAuthenticationScheme() Returns the primary HttpAuthenticationScheme that will be used to validate user's credential before issuing a new token.
protected Token.Consumer	getTokenConsumer()
protected Token.Provider	getTokenProvider()
void	initialize(TokenAuthenticationConfiguration config) Called one time during initialization.
protected String	issueToken(HttpServletRequest request, HttpServletResponse response) Issues a token for a previously authenticated Account using the configured Token.Provider.
void	onPostAuthentication(HttpServletRequest request, HttpServletResponse response) Performs any post-authentication logic regarding of the authentication result.
protected void	writeToken(String issuedToken, HttpServletRequest request, HttpServletResponse response) Writes the issuedToken to the HttpServletResponse.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

AUTHORIZATION_TOKEN_HEADER_NAME

public static final String AUTHORIZATION_TOKEN_HEADER_NAME

See Also:

Constant Field Values

AUTHENTICATION_SCHEME_NAME

public static final String AUTHENTICATION_SCHEME_NAME

See Also:

Constant Field Values

REQUIRES_AUTHENTICATION_HEADER_NAME

public static final String REQUIRES_AUTHENTICATION_HEADER_NAME

See Also:

Constant Field Values

Constructor Detail

TokenAuthenticationScheme

public TokenAuthenticationScheme()

Method Detail

initialize

public void initialize(TokenAuthenticationConfiguration config)

Description copied from interface: HttpAuthenticationScheme

Called one time during initialization.

Specified by:

initialize in interface HttpAuthenticationScheme<TokenAuthenticationConfiguration>

Parameters:

config - The configuration.

extractCredential

public void extractCredential(HttpServletRequest request,
                     DefaultLoginCredentials creds)

Description copied from interface: HttpAuthenticationScheme

Extracts the credentials from the given HttpServletRequest and populates the DefaultLoginCredentials with them. If the request is not an authentication attempt (as defined by the implementation), then creds is not affected.

Specified by:

extractCredential in interface HttpAuthenticationScheme<TokenAuthenticationConfiguration>

Parameters:

request - The current request, to examine for authentication information.

creds - The credentials instance that will be populated with the credentials found in the request, if any.

challengeClient

public void challengeClient(HttpServletRequest request,
                   HttpServletResponse response)

We use a 401 http status code to sinalize to clients that authentication is required.

We only challenge clients if the authentication failed. In other words, if there is a token in the request bu it is invalid.

Specified by:

challengeClient in interface HttpAuthenticationScheme<TokenAuthenticationConfiguration>

Parameters:

request -

response -

Throws:

IOException

onPostAuthentication

public void onPostAuthentication(HttpServletRequest request,
                        HttpServletResponse response)

Description copied from interface: HttpAuthenticationScheme

Performs any post-authentication logic regarding of the authentication result.

Specified by:

onPostAuthentication in interface HttpAuthenticationScheme<TokenAuthenticationConfiguration>

Parameters:

request - The current request, which may be used to obtain a RequestDispatcher if needed.

response - The current response, which can be used to send an HTTP response, or a redirect.

getCredentials

protected DefaultLoginCredentials getCredentials()

Returns the current DefaultLoginCredentials associated with the request.

Returns:

getIdentity

protected Identity getIdentity()

Returns the current Identity associated with the request.

Returns:

getPrimaryAuthenticationScheme

protected HttpAuthenticationScheme getPrimaryAuthenticationScheme()

Returns the primary HttpAuthenticationScheme that will be used to validate user's credential before issuing a new token.

Default authentication scheme is BasicAuthenticationScheme.

Returns:

extractTokenFromRequest

protected String extractTokenFromRequest(HttpServletRequest request)

Extracts the token from the HttpServletRequest.

Subclasses can override this method to customize how tokens are extracted from the request.

Parameters:

request -

Returns:

A String representing the token extracted from the request.

createCredential

protected TokenCredential createCredential(String extractedToken)

Creates a TokenCredential using the token previously extracted from the request.

Subclasses can override this method to customize how the credential is created. Defaults to an instance of TokenCredential.

Parameters:

extractedToken - The token previously extracted from the request.

Returns:

issueToken

protected String issueToken(HttpServletRequest request,
                HttpServletResponse response)

Issues a token for a previously authenticated Account using the configured Token.Provider.

Parameters:

request -

response -

writeToken

protected void writeToken(String issuedToken,
              HttpServletRequest request,
              HttpServletResponse response)

Writes the issuedToken to the HttpServletResponse.

Parameters:

issuedToken -

request -

response -

getTokenProvider

protected Token.Provider getTokenProvider()

getTokenConsumer

protected Token.Consumer getTokenConsumer()