Package com.axelor.auth.pac4j.local

Class AxelorApiKeyAuthenticator

java.lang.Object
com.axelor.auth.pac4j.local.AxelorApiKeyAuthenticator
All Implemented Interfaces:
org.pac4j.core.credentials.authenticator.Authenticator
public class AxelorApiKeyAuthenticator extends Object implements org.pac4j.core.credentials.authenticator.Authenticator
Authenticator implementation for API key-based authentication.

The authenticator performs the following validations:

  • Verifies the API key is present and has the correct format
  • Validates the token against the stored digest
  • Checks if the token has not expired
  • Checks if the client IP address is allowed, when the token is restricted to IP addresses
  • Confirms the associated user account is active

When authentication is successful, the authenticator updates the "last used" date of the token.

  • Field Details

  • Constructor Details

    • AxelorApiKeyAuthenticator

      public AxelorApiKeyAuthenticator()

  • Method Details

    • validate

      public Optional<org.pac4j.core.credentials.Credentials> validate(org.pac4j.core.context.CallContext ctx, org.pac4j.core.credentials.Credentials credentials)
      Specified by:
      validate in interface org.pac4j.core.credentials.authenticator.Authenticator

    • extractApiKey

      protected AxelorApiKeyAuthenticator.ApiKey extractApiKey(org.pac4j.core.credentials.TokenCredentials tokenCredentials)
      Extracts the key and the token composing the API key of the given credentials.
      Parameters:
      tokenCredentials - the credentials holding the API key
      Returns:
      the key and the token extracted from the API key
      Throws:
      org.pac4j.core.exception.BadCredentialsException - if the API key is missing or malformed

    • validateUser

      protected UserToken validateUser(AxelorApiKeyAuthenticator.ApiKey apiKey)
      Finds the user token matching the given API key.
      Parameters:
      apiKey - the key and the token extracted from the API key
      Returns:
      the matching user token, owned by an active user
      Throws:
      org.pac4j.core.exception.AccountNotFoundException - if the API key is invalid or expired, or if its owner is disabled

    • isAllowedAddress

      protected boolean isAllowedAddress(UserToken userToken, String remoteAddr)
      Checks whether the API key can be used from the given address.
      Parameters:
      userToken - the API key
      remoteAddr - the client IP address
      Returns:
      true if the API key isn't restricted to IP addresses or the address is allowed