Package com.floragunn.searchguard.auth

Interface HTTPAuthenticator

  • All Known Implementing Classes:
    HTTPBasicAuthenticator, HTTPClientCertAuthenticator, HTTPProxyAuthenticator, HTTPProxyAuthenticator2
    public interface HTTPAuthenticator
    Search Guard custom HTTP authenticators need to implement this interface.

    A HTTP authenticator extracts AuthCredentials from a RestRequest

    Implementation classes must provide a public constructor

    public MyHTTPAuthenticator(org.elasticsearch.common.settings.Settings settings, java.nio.file.Path configPath)

    The constructor should not throw any exception in case of an initialization problem. Instead catch all exceptions and log a appropriate error message. A logger can be instantiated like:

    private final Logger log = LogManager.getLogger(this.getClass());

    Custom authenticators is a commercial feature. To make them work you need to obtain a license here: https://floragunn.com

    • Method Detail

      • getType

        String getType()
        The type (name) of the authenticator. Only for logging.
        Returns:
        the type

      • extractCredentials

        AuthCredentials extractCredentials​(org.elasticsearch.rest.RestRequest request,
                                   org.elasticsearch.common.util.concurrent.ThreadContext context)
                            throws org.elasticsearch.ElasticsearchSecurityException
        Extract AuthCredentials from RestRequest
        Parameters:
        request - The rest request
        context - The current thread context
        Returns:
        The authentication credentials (complete or incomplete) or null when no credentials are found in the request

        When the credentials could be fully extracted from the request .markComplete() must be called on the AuthCredentials which are returned. If the authentication flow needs another roundtrip with the request originator do not mark it as complete.

        Throws:
        org.elasticsearch.ElasticsearchSecurityException

      • reRequestAuthentication

        boolean reRequestAuthentication​(org.elasticsearch.rest.RestChannel channel,
                                AuthCredentials credentials)
        If the extractCredentials() call was not successful or the authentication flow needs another roundtrip this method will be called. If the custom HTTP authenticator does not support this method is a no-op and false should be returned. If the custom HTTP authenticator does support re-request authentication or supports authentication flows with multiple roundtrips then the response should be sent (through the channel) and true must be returned.
        Parameters:
        channel - The rest channel to sent back the response via channel.sendResponse()
        credentials - The credentials from the prior authentication attempt
        Returns:
        false if re-request is not supported/necessary, true otherwise. If true is returned channel.sendResponse() must be called so that the request completes.