Package com.axelor.auth.pac4j.local

Class AxelorApiKeyClient

java.lang.Object
org.pac4j.core.util.InitializableObject
org.pac4j.core.client.BaseClient
org.pac4j.core.client.DirectClient
org.pac4j.http.client.direct.HeaderClient
com.axelor.auth.pac4j.local.AxelorApiKeyClient
All Implemented Interfaces:
StatelessClient, org.pac4j.core.client.Client
public class AxelorApiKeyClient extends org.pac4j.http.client.direct.HeaderClient implements StatelessClient
Direct client for API key-based authentication.

Reads the API key from the API-KEY request header and delegates its validation to AxelorApiKeyAuthenticator.

Being a StatelessClient, it authenticates each request on its own and never lets a session be created.

Rejected API keys never reach a Shiro realm, so they are reported to the CredentialsHandler for the failed login to be tracked.

  • Field Summary

    Fields inherited from class org.pac4j.core.client.BaseClient

    logger, saveProfileInSession

  • Constructor Summary

    Constructors
    Constructor
    Description
    AxelorApiKeyClient(AxelorApiKeyAuthenticator axelorApiKeyAuthenticator, CredentialsHandler credentialsHandler)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    Optional<org.pac4j.core.credentials.Credentials>
    getCredentials(org.pac4j.core.context.CallContext ctx)
    Extracts the API key credentials from the request.
    boolean
    hasCredentials(org.pac4j.core.context.WebContext context)
    Whether the request carries an API key.
    protected Optional<org.pac4j.core.credentials.Credentials>
    internalValidateCredentials(org.pac4j.core.context.CallContext ctx, org.pac4j.core.credentials.Credentials credentials)
    Validates the extracted credentials against the authenticator.

    Methods inherited from class org.pac4j.http.client.direct.HeaderClient

    getHeaderName, getPrefixHeader, internalInit, setHeaderName, setPrefixHeader, toString

    Methods inherited from class org.pac4j.core.client.DirectClient

    afterInternalInit, beforeInternalInit, checkCredentials, getLogoutAction, getRedirectionAction, processLogout

    Methods inherited from class org.pac4j.core.client.BaseClient

    addAuthorizationGenerator, addAuthorizationGenerators, findSessionLogoutHandler, getAuthenticator, getAuthorizationGenerators, getConfig, getCredentialsExtractor, getCustomProperties, getLogger, getName, getProfileCreator, getProfileFactoryWhenNotAuthenticated, getSaveProfileInSession, getSaveProfileInSession, getUserProfile, isMultiProfile, isMultiProfile, notifySessionRenewal, renewUserProfile, setAuthenticator, setAuthenticatorIfUndefined, setAuthorizationGenerator, setAuthorizationGenerators, setAuthorizationGenerators, setConfig, setCredentialsExtractor, setCredentialsExtractorIfUndefined, setCustomProperties, setMultiProfile, setName, setProfileCreator, setProfileCreatorIfUndefined, setProfileFactoryWhenNotAuthenticated, setSaveProfileInSession, validateCredentials

    Methods inherited from class org.pac4j.core.util.InitializableObject

    getInitialized, getLastAttempt, getMaxAttempts, getMinTimeIntervalBetweenAttemptsInMilliseconds, getNbAttempts, init, init, init, init, isInitialized, isInitializing, reinit, setMaxAttempts, setMinTimeIntervalBetweenAttemptsInMilliseconds, shouldInitialize

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

    Methods inherited from interface com.axelor.auth.pac4j.local.StatelessClient

    disableSessionCreation

  • Constructor Details

  • Method Details

    • hasCredentials

      public boolean hasCredentials(org.pac4j.core.context.WebContext context)
      Whether the request carries an API key.
      Specified by:
      hasCredentials in interface StatelessClient
      Parameters:
      context - the web context
      Returns:
      true if the API-KEY header is present

    • getCredentials

      public Optional<org.pac4j.core.credentials.Credentials> getCredentials(org.pac4j.core.context.CallContext ctx)
      Extracts the API key credentials from the request.

      Session creation is disabled as soon as an API key is found, so that authenticating with an API key never creates a session.

      Specified by:
      getCredentials in interface org.pac4j.core.client.Client
      Overrides:
      getCredentials in class org.pac4j.core.client.BaseClient
      Parameters:
      ctx - the call context
      Returns:
      the extracted credentials, or empty if the request carries no API key

    • internalValidateCredentials

      protected Optional<org.pac4j.core.credentials.Credentials> internalValidateCredentials(org.pac4j.core.context.CallContext ctx, org.pac4j.core.credentials.Credentials credentials)
      Validates the extracted credentials against the authenticator.

      The authenticator rejects invalid credentials before any Shiro login is attempted, so such failures are reported to the CredentialsHandler, along with the submitted API key when it could be extracted.

      Overrides:
      internalValidateCredentials in class org.pac4j.core.client.BaseClient
      Parameters:
      ctx - the call context
      credentials - the credentials to validate
      Returns:
      the validated credentials, or empty if they were rejected