org.apache.jena.atlas.web.auth
Class PreemptiveBasicAuthenticator

java.lang.Object
  org.apache.jena.atlas.web.auth.PreemptiveBasicAuthenticator

All Implemented Interfaces:

HttpAuthenticator

public class PreemptiveBasicAuthenticator
extends Object
implements HttpAuthenticator

A decorator for other authenticators that may be used to enable preemptive basic authentication.

This can only be used with servers that support Basic HTTP authentication. For any other authentication scheme the use of this authenticator will result in authentication failures.

Security Concerns

It is important to note that preemptive basic authentication is less secure because it can expose credentials to servers that do not require them.

Standard vs Proxy Authentication

Doing preemptive authentication requires knowing in advance whether you will be doing standard or proxy authentication i.e. whether the remote server will challenge with 401 or 407. If you need both you can take advantage of this being a decorator and simply layer multiple instances of this.

However you must remember that this only works for Basic HTTP authentication, any other authentication scheme cannot be done preemptively because it requires a more complex and secure challenge response process.

Constructor Summary

PreemptiveBasicAuthenticator(HttpAuthenticator authenticator)
Creates a new decorator over the given authenticator

PreemptiveBasicAuthenticator(HttpAuthenticator authenticator, boolean forProxy)
Creates a new decorator over the given authenticator

Method Summary

void	apply(org.apache.http.impl.client.AbstractHttpClient client, org.apache.http.protocol.HttpContext httpContext, URI target) Applies any necessary authentication methods to the given HTTP Client
void	invalidate() Invalidates the authenticator

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

PreemptiveBasicAuthenticator

public PreemptiveBasicAuthenticator(HttpAuthenticator authenticator)

Creates a new decorator over the given authenticator

Parameters:

authenticator - Authenticator to decorate

PreemptiveBasicAuthenticator

public PreemptiveBasicAuthenticator(HttpAuthenticator authenticator,
                                    boolean forProxy)

Creates a new decorator over the given authenticator

Parameters:

authenticator - Authenticator to decorate

forProxy - Whether preemptive authentication is for a proxy

Method Detail

apply

public void apply(org.apache.http.impl.client.AbstractHttpClient client,
                  org.apache.http.protocol.HttpContext httpContext,
                  URI target)

Description copied from interface: HttpAuthenticator

Applies any necessary authentication methods to the given HTTP Client

The target parameter indicates the URI to which the request is being made and so may be used by an authenticator to determine whether it actually needs to apply any authentication or to scope authentication appropriately.

Specified by:

apply in interface HttpAuthenticator

Parameters:

client - HTTP Client

httpContext - HTTP Context

target - Target URI to which code wants to authenticate

invalidate

public void invalidate()

Description copied from interface: HttpAuthenticator

Invalidates the authenticator

Allows code to inform the authenticator that any cached authentication information should be invalidated. This can be useful after an authentication attempt fails or after a certain amount of time is passed. For many authenticators this may actually be a no-op since when using standard HTTP authentication typically you authenticate on every request and there are no cached authentication information. However more complex authentication mechanisms such as Form Based authentication may have cached information that discarding will force subsequent requests to re-authenticate.

Specified by:

invalidate in interface HttpAuthenticator