Interface AuthenticationProvider

public interface AuthenticationProvider
Verifies Credentials on the server side.

This is the pluggable half of Tentackle's authentication: an application server collects all providers along the classpath and asks them, in turn, to authenticate the credentials the client presented. Several providers may coexist, so single sign-on for humans and password logins for batch or service accounts can be served by the same server.

Providers are registered via the service SPI and need a public no-arg constructor: 

   @Service(AuthenticationProvider.class)
   public class MyOidcAuthenticationProvider implements AuthenticationProvider {

     @Override
     public boolean supports(Credentials credentials) {
       return credentials instanceof TokenCredentials;
     }

     @Override
     public Authentication authenticate(Credentials credentials) {
       // verify signature, issuer, audience and expiry, then:
       return new DefaultAuthentication(subject, credentials);
     }
   }
A provider that verified the credentials but does not know the application's user leaves the user id at zero and lets the UserResolver map the principal onto the application's user entity.

Providers are instantiated once per server and must be thread-safe.

Author:
harald
See Also:

  • Method Summary

    Modifier and Type
    Method
    Description
    Authentication
    authenticate(Credentials credentials)
    Authenticates the credentials.
    default String
    getName()
    Gets the name of this provider.
    Used for logging and to tell in an Authentication who authenticated it.
    default int
    getPriority()
    Gets the priority determining the position in the provider chain.
    Providers with a lower value are asked first.
    boolean
    supports(Credentials credentials)
    Returns whether this provider is responsible for the given credentials.

  • Method Details

    • supports

      boolean supports(Credentials credentials)
      Returns whether this provider is responsible for the given credentials.
      Parameters:
      credentials - the credentials presented by the client, never null
      Returns:
      true if authenticate(Credentials) should be invoked

    • authenticate

      Authentication authenticate(Credentials credentials)
      Authenticates the credentials.

      Returning null abstains and lets the next provider in the chain try. Throwing an AuthenticationException vetoes the login and stops the chain — use it when the credentials were meant for this provider but are invalid.

      Parameters:
      credentials - the credentials presented by the client, never null
      Returns:
      the proven identity, null to abstain
      Throws:
      LoginFailedException - if the login must be refused

    • getPriority

      default int getPriority()
      Gets the priority determining the position in the provider chain.
      Providers with a lower value are asked first. Providers of equal priority are ordered by class name, so the chain is always deterministic.
      Returns:
      the priority, 0 by default

    • getName

      default String getName()
      Gets the name of this provider.
      Used for logging and to tell in an Authentication who authenticated it.
      Returns:
      the name, never null