Class DigestAuthenticator
java.lang.Object
org.eclipse.jetty.security.authentication.LoginAuthenticator
org.eclipse.jetty.security.authentication.DigestAuthenticator
- All Implemented Interfaces:
Authenticator
The nonce max age in ms can be set with the
SecurityHandler.setParameter(String, String)
using the name "maxNonceAge". The nonce max count can be set with SecurityHandler.setParameter(String, String)
using the name "maxNonceCount". When the age or count is exceeded, the nonce is considered stale.-
Nested Class Summary
Nested classes/interfaces inherited from class org.eclipse.jetty.security.authentication.LoginAuthenticator
LoginAuthenticator.LoggedOutAuthentication, LoginAuthenticator.UserAuthenticationSent, LoginAuthenticator.UserAuthenticationSucceeded
Nested classes/interfaces inherited from interface org.eclipse.jetty.security.Authenticator
Authenticator.Configuration, Authenticator.Factory, Authenticator.NoOp
-
Field Summary
Fields inherited from class org.eclipse.jetty.security.authentication.LoginAuthenticator
_identityService, _loginService
Fields inherited from interface org.eclipse.jetty.security.Authenticator
BASIC_AUTH, CERT_AUTH, CERT_AUTH2, DIGEST_AUTH, FORM_AUTH, MULTI_AUTH, NEGOTIATE_AUTH, OPENID_AUTH, SIWE_AUTH, SPNEGO_AUTH
-
Constructor Summary
Constructors -
Method Summary
Modifier and TypeMethodDescriptionlong
int
If the UserIdentity returned fromLoginService.login(String, Object, Request, Function)
is not null, it is assumed that the user is fully authenticated and we need to change the session id to prevent session fixation vulnerability.void
setAlgorithm
(String algorithm) void
setConfiguration
(Authenticator.Configuration configuration) Configure the Authenticatorvoid
setMaxNonceAge
(long maxNonceAgeInMillis) void
setMaxNonceCount
(int maxNC) validateRequest
(Request req, Response res, Callback callback) Attempts to validate the authentication state of the given request.Methods inherited from class org.eclipse.jetty.security.authentication.LoginAuthenticator
getLoginService, logout, setLoginService, updateSession
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
Methods inherited from interface org.eclipse.jetty.security.Authenticator
getConstraintAuthentication, prepareRequest
-
Constructor Details
-
DigestAuthenticator
public DigestAuthenticator()
-
-
Method Details
-
setAlgorithm
-
getAlgorithm
-
setConfiguration
Description copied from interface:Authenticator
Configure the Authenticator- Specified by:
setConfiguration
in interfaceAuthenticator
- Overrides:
setConfiguration
in classLoginAuthenticator
- Parameters:
configuration
- the configuration
-
getMaxNonceCount
public int getMaxNonceCount() -
setMaxNonceCount
public void setMaxNonceCount(int maxNC) -
getMaxNonceAge
public long getMaxNonceAge() -
setMaxNonceAge
public void setMaxNonceAge(long maxNonceAgeInMillis) -
getAuthenticationType
- Returns:
- The name of the authentication type
-
validateRequest
public AuthenticationState validateRequest(Request req, Response res, Callback callback) throws ServerAuthException Description copied from interface:Authenticator
Attempts to validate the authentication state of the given request.If authentication is successful, an
AuthenticationState.Succeeded
is returned. If the authenticator has already committed a response (for either success or failure), the returned value will implementAuthenticationState.ResponseSent
, and the providedCallback
will be eventually be completed, otherwise the caller is responsible for completing theCallback
.A
null
return value indicates that no authentication state could be established, possibly because the response has already been committed.- Parameters:
req
- the request to validate.res
- the response associated with the request.callback
- the callback to use for writing a response.- Returns:
- an
AuthenticationState
, ornull
if authentication could not be resolved. - Throws:
ServerAuthException
- if unable to validate request.
-
login
Description copied from class:LoginAuthenticator
If the UserIdentity returned fromLoginService.login(String, Object, Request, Function)
is not null, it is assumed that the user is fully authenticated and we need to change the session id to prevent session fixation vulnerability. If the UserIdentity is not necessarily fully authenticated, then subclasses must override this method and determine when the UserIdentity IS fully authenticated and renew the session id.- Overrides:
login
in classLoginAuthenticator
- Parameters:
username
- the username of the client to be authenticatedcredentials
- the user's credentialrequest
- the inbound request that needs authentication
-
newNonce
-