Package com.floragunn.searchguard.auth.api

Interface AuthenticationBackend

All Known Subinterfaces:

AuthenticationBackend, SyncAuthenticationBackend

All Known Implementing Classes:

InternalAuthenticationBackend, NoOpAuthenticationBackend

public interface AuthenticationBackend

Search Guard custom authentication backends need to implement this interface.

Authentication backends verify AuthCredentials and, if successfully verified, return a User.

Implementation classes must provide a public constructor

public MyHTTPAuthenticator(org.elasticsearch.common.settings.Settings settings, java.nio.file.Path configPath)

The constructor should not throw any exception in case of an initialization problem. Instead catch all exceptions and log a appropriate error message. A logger can be instantiated like:

private final Logger log = LogManager.getLogger(this.getClass());

Custom authenticators is a commercial feature. To make them work you need to obtain a license here: https://floragunn.com

Nested Class Summary

Nested Classes

Modifier and Type	Interface	Description
static class	AuthenticationBackend.UserCachingPolicy

Method Summary

Modifier and Type	Method	Description
void	authenticate(AuthCredentials credentials, Consumer<User> onSuccess, Consumer<Exception> onFailure)	Validate credentials and return an authenticated user (or throw an ElasticsearchSecurityException)
boolean	exists(User user)	Lookup for a specific user in the authentication backend
String	getType()	The type (name) of the authenticator.
default AuthenticationBackend.UserCachingPolicy	userCachingPolicy()	Are users produced by this authentication backend allowed to be cached in a node-local heap-based cache? In most cases, ALWAYS can be returned here.

Method Detail

getType

String getType()

The type (name) of the authenticator. Only for logging.

Returns:

the type

authenticate

void authenticate(AuthCredentials credentials,
                  Consumer<User> onSuccess,
                  Consumer<Exception> onFailure)

Validate credentials and return an authenticated user (or throw an ElasticsearchSecurityException)

Results of this method are normally cached so that we not need to query the backend for every authentication attempt.

Parameters:

The - credentials to be validated, never null

Throws:

org.elasticsearch.ElasticsearchSecurityException - in case an authentication failure (when credentials are incorrect, the user does not exist or the backend is not reachable)

exists

boolean exists(User user)

Lookup for a specific user in the authentication backend

Parameters:

user - The user for which the authentication backend should be queried. If the authentication backend supports user attributes in combination with impersonation the attributes needs to be added to user by calling user.addAttributes()

Returns:

true if the user exists in the authentication backend, false otherwise. Before return call user.addAttributes() as explained above.

userCachingPolicy

default AuthenticationBackend.UserCachingPolicy userCachingPolicy()

Are users produced by this authentication backend allowed to be cached in a node-local heap-based cache? In most cases, ALWAYS can be returned here. Return false if the user objects are not suitable for caching AND retrieval of users is fast.