HttpAuthenticationMechanism to indicate the result (status)
of the authentication process.
For the result from HttpAuthenticationMechanism#validateRequest(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, javax.security.enterprise.authentication.mechanism.http.HttpMessageContext)
an AuthenticationStatus must be transformed by the Java EE server into the corresponding JASPIC (JSR 196) AuthStatus
according to the following rules:
After the transformation as outlined above the transformed result has to be processed by the Java EE server as specified by the Servlet Container Profile of the JASPIC 1.1 spec (chapter 3).
Implementation Note
while the JASPIC Servlet Container Profile is the authoritative
source on how to process the AuthStatus.SUCCESS result and this specification puts no constraints
of any kind on that, the expectation is that Java EE servers in practice will mainly look at the
result being AuthStatus.SUCCESS or not AuthStatus.SUCCESS. Simply said, if the result is
AuthStatus.SUCCESS the authenticated identity (if any) must be set (established) for the current HTTP request,
otherwise not.
The return value of SecurityContext#authenticate(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, javax.security.enterprise.authentication.mechanism.http.AuthenticationParameters)
, which is also of type AuthenticationStatus, strongly relates to the outcome of the HttpAuthenticationMechanism#validateRequest
method as described above, but must be transformed by the Java EE server from the corresponding outcome of the
HttpServletRequest#authenticate(javax.servlet.http.HttpServletResponse) call as follows:
true to AuthenticationStatus.SUCCESS false to [last status] (see below) ServletException or IOException to AuthenticationStatus.SEND_FAILURE
When an HttpAuthenticationMechanism was used [last status] must be
the value returned by HttpAuthenticationMechanism#validateRequest.
When a JASPIC ServerAuthModule (SAM) was used and an HttpAuthenticationMechanism was not used
Java EE servers are encouraged, but not required, to set [last status] to the value returned by
ServerAuthModule#validateRequest transformed as follows:
When a Java EE Server proprietary identity store equivalent was used and an
HttpAuthenticationMechanism was not used
Java EE servers are encouraged, but not required, to set [last status] to a value
that logically corresponds to the description of each enum constant of AuthenticationStatus. This outcome
should never be depended on by application code as being portable.
Application code calling SecurityContext#authenticate is expected to act on all possible
values of AuthenticationStatus.
| Modifier and Type | Field and Description |
|---|---|
| public static final AuthenticationStatus | NOT_DONE
The authentication mechanism was called, but decided not to authenticate. |
| public static final AuthenticationStatus | SEND_CONTINUE
The authentication mechanism was called and a multi-step authentication dialog with the caller has been started (for instance, the caller has been redirected to a login page). |
| public static final AuthenticationStatus | SEND_FAILURE
The authentication mechanism was called but the caller was not successfully authenticated and therefor the caller principal will not be made available. |
| public static final AuthenticationStatus | SUCCESS
The authentication mechanism was called and the caller was successfully authenticated. |
| Access | Constructor and Description |
|---|---|
| private |
| Modifier and Type | Method and Description |
|---|---|
| public static AuthenticationStatus | |
| public static AuthenticationStatus[] |
| NOT_DONE | back to summary |
|---|---|
| public static final AuthenticationStatus NOT_DONE The authentication mechanism was called, but decided not to authenticate. This status would be typically returned in pre-emptive security; the authentication mechanism is called, but authentication is optional and would only take place when for instance a specific request header is present. | |
| SEND_CONTINUE | back to summary |
|---|---|
| public static final AuthenticationStatus SEND_CONTINUE The authentication mechanism was called and a multi-step authentication dialog with the caller has been started (for instance, the caller has been redirected to a login page). Simply said authentication is "in progress". Calling application code (if any) should not write to the response when this status is received. | |
| SEND_FAILURE | back to summary |
|---|---|
| public static final AuthenticationStatus SEND_FAILURE The authentication mechanism was called but the caller was not successfully authenticated and therefor the caller principal will not be made available. Note that this status should be used to indicate a logical problem (such as a credential not matching or a caller ID that can not be found). Exceptions should be used for system level problems (such as a database connection timing out). | |
| SUCCESS | back to summary |
|---|---|
| public static final AuthenticationStatus SUCCESS The authentication mechanism was called and the caller was successfully authenticated. After the Java EE server has processed this outcome, the caller principal is available. | |
| AuthenticationStatus | back to summary |
|---|---|
| private AuthenticationStatus() | |
| valueOf | back to summary |
|---|---|
| public static AuthenticationStatus valueOf(String name) | |
| values | back to summary |
|---|---|
| public static AuthenticationStatus[] values() | |