Package org.eclipse.jetty.security.authentication

Class DigestAuthenticator

java.lang.Object

org.eclipse.jetty.security.authentication.LoginAuthenticator

org.eclipse.jetty.security.authentication.DigestAuthenticator

All Implemented Interfaces:

Authenticator

public class DigestAuthenticator
extends LoginAuthenticator

The nonce max age in ms can be set with the SecurityHandler.setParameter(String, String) using the name "maxNonceAge". The nonce max count can be set with SecurityHandler.setParameter(String, String) using the name "maxNonceCount". When the age or count is exceeded, the nonce is considered stale.

Nested Class Summary

Nested classes/interfaces inherited from class org.eclipse.jetty.security.authentication.LoginAuthenticator

LoginAuthenticator.LoggedOutAuthentication, LoginAuthenticator.UserAuthenticationSent, LoginAuthenticator.UserAuthenticationSucceeded

Nested classes/interfaces inherited from interface org.eclipse.jetty.security.Authenticator

Authenticator.Configuration, Authenticator.Factory, Authenticator.NoOp

Field Summary

Fields inherited from class org.eclipse.jetty.security.authentication.LoginAuthenticator

_identityService, _loginService

Fields inherited from interface org.eclipse.jetty.security.Authenticator

BASIC_AUTH, CERT_AUTH, CERT_AUTH2, DIGEST_AUTH, FORM_AUTH, NEGOTIATE_AUTH, OPENID_AUTH, SPNEGO_AUTH

Constructor Summary

Constructors

Constructor	Description
DigestAuthenticator()

Method Summary

Modifier and Type	Method	Description
String	getAuthenticationType()
long	getMaxNonceAge()
int	getMaxNonceCount()
UserIdentity	login(String username, Object credentials, Request request, Response response)	If the UserIdentity returned from LoginService.login(String, Object, Request, Function) is not null, it is assumed that the user is fully authenticated and we need to change the session id to prevent session fixation vulnerability.
String	newNonce(Request request)
void	setConfiguration(Authenticator.Configuration configuration)	Configure the Authenticator
void	setMaxNonceAge(long maxNonceAgeInMillis)
void	setMaxNonceCount(int maxNC)
AuthenticationState	validateRequest(Request req, Response res, Callback callback)	Validate a request

Methods inherited from class org.eclipse.jetty.security.authentication.LoginAuthenticator

getLoginService, logout, updateSession

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.eclipse.jetty.security.Authenticator

getConstraintAuthentication, prepareRequest

Constructor Details

DigestAuthenticator

public DigestAuthenticator()

Method Details

setConfiguration

public void setConfiguration(Authenticator.Configuration configuration)

Description copied from interface: Authenticator

Configure the Authenticator

Specified by:

setConfiguration in interface Authenticator

Overrides:

setConfiguration in class LoginAuthenticator

Parameters:

configuration - the configuration

getMaxNonceCount

public int getMaxNonceCount()

setMaxNonceCount

public void setMaxNonceCount(int maxNC)

getMaxNonceAge

public long getMaxNonceAge()

setMaxNonceAge

public void setMaxNonceAge(long maxNonceAgeInMillis)

getAuthenticationType

public String getAuthenticationType()

Returns:

The name of the authentication type

validateRequest

public AuthenticationState validateRequest(Request req,
 Response res,
 Callback callback)
                                    throws ServerAuthException

Description copied from interface: Authenticator

Validate a request

Parameters:

req - The request

res - The response

callback - the callback to use for writing a response

Returns:

An Authentication. If Authentication is successful, this will be a AuthenticationState.Succeeded. If a response has been sent by the Authenticator (which can be done for both successful and unsuccessful authentications), then the result will implement AuthenticationState.ResponseSent.

Throws:

ServerAuthException - if unable to validate request

login

public UserIdentity login(String username,
 Object credentials,
 Request request,
 Response response)

Description copied from class: LoginAuthenticator

If the UserIdentity returned from LoginService.login(String, Object, Request, Function) is not null, it is assumed that the user is fully authenticated and we need to change the session id to prevent session fixation vulnerability. If the UserIdentity is not necessarily fully authenticated, then subclasses must override this method and determine when the UserIdentity IS fully authenticated and renew the session id.

Overrides:

login in class LoginAuthenticator

Parameters:

username - the username of the client to be authenticated

credentials - the user's credential

request - the inbound request that needs authentication

newNonce

public String newNonce(Request request)