Package org.eclipse.jetty.security.authentication

Class DigestAuthenticator

java.lang.Object
org.eclipse.jetty.security.authentication.LoginAuthenticator
org.eclipse.jetty.security.authentication.DigestAuthenticator
All Implemented Interfaces:
Authenticator
public class DigestAuthenticator extends LoginAuthenticator
The nonce max age in ms can be set with the SecurityHandler.setInitParameter(String, String) using the name "maxNonceAge". The nonce max count can be set with SecurityHandler.setInitParameter(String, String) using the name "maxNonceCount". When the age or count is exceeded, the nonce is considered stale.

  • Field Details

    • LOG

      private static final Logger LOG

    • _random

      private final SecureRandom _random

    • _nonces

      private final Map<String,DigestAuthenticator.Nonce> _nonces

    • _secretKey

      private final SecretKey _secretKey

    • _maxNonceAgeMs

      private long _maxNonceAgeMs

    • _maxNonceCount

      private int _maxNonceCount

    • _algorithm

      private String _algorithm

    • _userHashing

      private boolean _userHashing

  • Constructor Details

    • DigestAuthenticator

      public DigestAuthenticator()

  • Method Details

    • setConfiguration

      public void setConfiguration(Authenticator.AuthConfiguration configuration)
      Description copied from interface: Authenticator
      Configure the Authenticator
      Specified by:
      setConfiguration in interface Authenticator
      Overrides:
      setConfiguration in class LoginAuthenticator
      Parameters:
      configuration - the configuration

    • getMaxNonceCount

      public int getMaxNonceCount()

    • setMaxNonceCount

      public void setMaxNonceCount(int maxNonceCount)

    • getMaxNonceAge

      public long getMaxNonceAge()

    • setMaxNonceAge

      public void setMaxNonceAge(long maxNonceAgeInMillis)

    • getAlgorithm

      public String getAlgorithm()

    • setAlgorithm

      public void setAlgorithm(String algorithm)

    • isUserHashing

      public boolean isUserHashing()

    • setUserHashing

      public void setUserHashing(boolean userHashing)

    • getAuthMethod

      public String getAuthMethod()
      Returns:
      The name of the authentication method

    • secureResponse

      public boolean secureResponse(javax.servlet.ServletRequest req, javax.servlet.ServletResponse res, boolean mandatory, Authentication.User validatedUser) throws ServerAuthException
      Description copied from interface: Authenticator
      is response secure
      Parameters:
      req - the request
      res - the response
      mandatory - if security is mandator
      validatedUser - the user that was validated
      Returns:
      true if response is secure
      Throws:
      ServerAuthException - if unable to test response

    • validateRequest

      public Authentication validateRequest(javax.servlet.ServletRequest req, javax.servlet.ServletResponse res, boolean mandatory) throws ServerAuthException
      Description copied from interface: Authenticator
      Validate a request
      Parameters:
      req - The request
      res - The response
      mandatory - True if authentication is mandatory.
      Returns:
      An Authentication. If Authentication is successful, this will be a Authentication.User. If a response has been sent by the Authenticator (which can be done for both successful and unsuccessful authentications), then the result will implement Authentication.ResponseSent. If Authentication is not mandatory, then a Authentication.Deferred may be returned.
      Throws:
      ServerAuthException - if unable to validate request

    • parseDigest

      private DigestAuthenticator.Digest parseDigest(String method, String credentials)

    • resolveHashedUserName

      protected String resolveHashedUserName(String hashedUserName)

    • resolveEncodedUserName

      protected String resolveEncodedUserName(String encodedUserName)

    • login

      public UserIdentity login(String username, Object credentials, javax.servlet.ServletRequest request)
      Description copied from class: LoginAuthenticator
      If the UserIdentity is not null after this method calls LoginService.login(String, Object, ServletRequest), it is assumed that the user is fully authenticated and we need to change the session id to prevent session fixation vulnerability. If the UserIdentity is not necessarily fully authenticated, then subclasses must override this method and determine when the UserIdentity IS fully authenticated and renew the session id.
      Overrides:
      login in class LoginAuthenticator
      Parameters:
      username - the username of the client to be authenticated
      credentials - the user's credential
      request - the inbound request that needs authentication

    • newNonce

      public String newNonce(Request request)

    • checkNonce

      private int checkNonce(DigestAuthenticator.Digest digest)

    • newOpaque

      private String newOpaque(String nonce)

    • verifyOpaque

      private boolean verifyOpaque(DigestAuthenticator.Digest digest)

    • newMac

      private Mac newMac()