Modifier and Type	Class and Description
public static enum	DigestAuthenticator.AuthDigest This enum exists because RFC 7616 and Java use different names for some digests.
public static class	DigestAuthenticator.DigestInfo
public static class	DigestAuthenticator.NonceInfo

Field Summary

Modifier and Type	Field and Description
private List<DigestAuthenticator.AuthDigest>	algorithms Algorithms to use for WWW-Authenticate challenges.
private static final DigestAuthenticator.AuthDigest	FALLBACK_DIGEST
protected String	key Private key.
protected long	lastTimestamp The last timestamp used to generate a nonce.
protected final Object	lastTimestampLock
private final Log	log Hides org.apache.catalina.authenticator.AuthenticatorBase.log.
private static final String	NONCE_DIGEST
protected int	nonceCacheSize Maximum number of server nonces to keep in the cache.
protected int	nonceCountWindowSize The window size to use to track seen nonce count values for a given nonce.
protected Map<String, DigestAuthenticator.NonceInfo>	nonces List of server nonce values currently being tracked
protected long	nonceValidity How long server nonces are valid for in milliseconds.
protected String	opaque Opaque string.
private static final Map<String, DigestAuthenticator.AuthDigest>	PERMITTED_ALGORITHMS
protected static final String	QOP Tomcat's DIGEST implementation only supports auth quality of protection.
protected boolean	validateUri Should the URI be validated as required by RFC2617?

Inherited from org.apache.catalina.authenticator.AuthenticatorBase:: alwaysUseSession AUTH_HEADER_NAME cache changeSessionIdOnAuthentication context disableProxyCaching jaspicCallbackHandlerClass REALM_NAME securePagesWithPragma secureRandomAlgorithm secureRandomClass secureRandomProvider sendAuthInfoResponseHeaders sessionIdGenerator sm sso

Constructor Summary

Access	Constructor and Description
public	DigestAuthenticator()

Method Summary

Modifier and Type	Method and Description
protected boolean	doAuthenticate(Request Request we are processing request, HttpServletResponse Response we are creating response) Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.doAuthenticate. Authenticate the user making this request, based on the specified login configuration.
protected String	Returns: The generated nonce generateNonce(Request HTTP Servlet request request) Generate a unique token.
public String	getAlgorithms()
protected String	getAuthMethod() Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.getAuthMethod. Return the authentication method, which is vendor-specific and not defined by HttpServletRequest.
public String	getKey()
public int	getNonceCacheSize()
public int	getNonceCountWindowSize()
public long	getNonceValidity()
public String	getOpaque()
private void	initAlgorithms(List<DigestAuthenticator.AuthDigest> algorithms)
protected boolean	isPreemptiveAuthPossible(Request The request to check for credentials request) Overrides org.apache.catalina.authenticator.AuthenticatorBase.isPreemptiveAuthPossible. Can the authenticator perform preemptive authentication for the given request?
public boolean	isValidateUri()
protected static String	Returns: The unquoted string removeQuotes(String The quoted string quotedString, boolean `true` if quotes were required quotesRequired) Removes the quotes on a string.
protected static String	Returns: The unquoted string removeQuotes(String The quoted string quotedString) Removes the quotes on a string.
public void	setAlgorithms(String algorithmsString)
protected void	setAuthenticateHeader(HttpServletRequest HTTP Servlet request request, HttpServletResponse HTTP Servlet response response, String nonce token nonce, boolean `true` to add a stale parameter isNonceStale) Generates the WWW-Authenticate header(s) as per RFC 7616.
public void	setKey(String key)
public void	setNonceCacheSize(int nonceCacheSize)
public void	setNonceCountWindowSize(int nonceCountWindowSize)
public void	setNonceValidity(long nonceValidity)
public void	setOpaque(String opaque)
public void	setValidateUri(boolean validateUri)
protected void	startInternal() Overrides org.apache.catalina.authenticator.AuthenticatorBase.startInternal. Start this component and implement the requirements of `org.apache.catalina.util.LifecycleBase#startInternal()`.

Field Detail

algorithms	back to summary
private List<DigestAuthenticator.AuthDigest> algorithms Algorithms to use for WWW-Authenticate challenges.

FALLBACK_DIGEST	back to summary
private static final DigestAuthenticator.AuthDigest FALLBACK_DIGEST

key	back to summary
protected String key Private key.

lastTimestamp	back to summary
protected long lastTimestamp The last timestamp used to generate a nonce. Each nonce should get a unique timestamp.

lastTimestampLock	back to summary
protected final Object lastTimestampLock

log	back to summary
private final Log log Hides org.apache.catalina.authenticator.AuthenticatorBase.log.

NONCE_DIGEST	back to summary
private static final String NONCE_DIGEST

nonceCacheSize	back to summary
protected int nonceCacheSize Maximum number of server nonces to keep in the cache. If not specified, the default value of 1000 is used.

nonceCountWindowSize	back to summary
protected int nonceCountWindowSize The window size to use to track seen nonce count values for a given nonce. If not specified, the default of 100 is used.

nonces	back to summary
protected Map<String, DigestAuthenticator.NonceInfo> nonces List of server nonce values currently being tracked

nonceValidity	back to summary
protected long nonceValidity How long server nonces are valid for in milliseconds. Defaults to 5 minutes.

opaque	back to summary
protected String opaque Opaque string.

PERMITTED_ALGORITHMS	back to summary
private static final Map<String, DigestAuthenticator.AuthDigest> PERMITTED_ALGORITHMS

QOP	back to summary
protected static final String QOP Tomcat's DIGEST implementation only supports auth quality of protection.

validateUri	back to summary
protected boolean validateUri Should the URI be validated as required by RFC2617? Can be disabled in reverse proxies where the proxy has modified the URI.

Constructor Detail

DigestAuthenticator	back to summary
public DigestAuthenticator()

Method Detail

doAuthenticate back to summary

doAuthenticate	back to summary
protected boolean doAuthenticate(Request request, HttpServletResponse response) throws IOException Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.doAuthenticate. Authenticate the user making this request, based on the specified login configuration. Return `true` if any specified constraint has been satisfied, or `false` if we have created a response challenge already. Parameters request:Request Request we are processing response:HttpServletResponse Response we are creating Returns:boolean Doc from org.apache.catalina.authenticator.AuthenticatorBase.doAuthenticate. `true` if the the user was authenticated, otherwise `false`, in which case an authentication challenge will have been written to the response Annotations @Override Exceptions IOException: if an input/output error occurs

protected boolean doAuthenticate(Request request, HttpServletResponse response) throws IOException

Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.doAuthenticate.

Authenticate the user making this request, based on the specified login configuration. Return true if any specified constraint has been satisfied, or false if we have created a response challenge already.

Parameters

request:Request: Request we are processing
response:HttpServletResponse: Response we are creating

Returns:boolean

Doc from org.apache.catalina.authenticator.AuthenticatorBase.doAuthenticate.

true if the the user was authenticated, otherwise false, in which case an authentication challenge will have been written to the response

Annotations

@Override

Exceptions

IOException:: if an input/output error occurs

generateNonce	back to summary
protected String generateNonce(Request request) Generate a unique token. The token is generated according to the following pattern. NOnceToken = Base64 ( NONCE_DIGEST ( client-IP ":" time-stamp ":" private-key ) ). Parameters request:Request HTTP Servlet request Returns:String The generated nonce

generateNonce

back to summary

protected String generateNonce(Request request)

Generate a unique token. The token is generated according to the following pattern. NOnceToken = Base64 ( NONCE_DIGEST ( client-IP ":" time-stamp ":" private-key ) ).

Parameters

request:Request: HTTP Servlet request

Returns:String

The generated nonce

getAlgorithms	back to summary
public String getAlgorithms()

getAuthMethod	back to summary
protected String getAuthMethod() Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.getAuthMethod. Doc from org.apache.catalina.authenticator.AuthenticatorBase.getAuthMethod. Return the authentication method, which is vendor-specific and not defined by HttpServletRequest. Returns:String the authentication method, which is vendor-specific and not defined by HttpServletRequest. Annotations @Override

getAuthMethod

back to summary

protected String getAuthMethod()

Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.getAuthMethod.

Doc from org.apache.catalina.authenticator.AuthenticatorBase.getAuthMethod.

Return the authentication method, which is vendor-specific and not defined by HttpServletRequest.

Returns:String

the authentication method, which is vendor-specific and not defined by HttpServletRequest.

Annotations

@Override

getKey	back to summary
public String getKey()

getNonceCacheSize	back to summary
public int getNonceCacheSize()

getNonceCountWindowSize	back to summary
public int getNonceCountWindowSize()

getNonceValidity	back to summary
public long getNonceValidity()

getOpaque	back to summary
public String getOpaque()

initAlgorithms	back to summary
private void initAlgorithms(List<DigestAuthenticator.AuthDigest> algorithms)

isPreemptiveAuthPossible back to summary

isPreemptiveAuthPossible	back to summary
protected boolean isPreemptiveAuthPossible(Request request) Overrides org.apache.catalina.authenticator.AuthenticatorBase.isPreemptiveAuthPossible. Doc from org.apache.catalina.authenticator.AuthenticatorBase.isPreemptiveAuthPossible. Can the authenticator perform preemptive authentication for the given request? Parameters request:Request The request to check for credentials Returns:boolean `true` if preemptive authentication is possible, otherwise `false` Annotations @Override

protected boolean isPreemptiveAuthPossible(Request request)

Overrides org.apache.catalina.authenticator.AuthenticatorBase.isPreemptiveAuthPossible.

Doc from org.apache.catalina.authenticator.AuthenticatorBase.isPreemptiveAuthPossible.

Can the authenticator perform preemptive authentication for the given request?

Parameters

request:Request: The request to check for credentials

Returns:boolean

true if preemptive authentication is possible, otherwise false

Annotations

@Override

isValidateUri	back to summary
public boolean isValidateUri()

removeQuotes back to summary

removeQuotes	back to summary
protected static String removeQuotes(String quotedString, boolean quotesRequired) Removes the quotes on a string. RFC2617 states quotes are optional for all parameters except realm. Parameters quotedString:String The quoted string quotesRequired:boolean `true` if quotes were required Returns:String The unquoted string

protected static String removeQuotes(String quotedString, boolean quotesRequired)

Removes the quotes on a string. RFC2617 states quotes are optional for all parameters except realm.

Parameters

quotedString:String: The quoted string
quotesRequired:boolean: true if quotes were required

Returns:String

The unquoted string

removeQuotes	back to summary
protected static String removeQuotes(String quotedString) Removes the quotes on a string. Parameters quotedString:String The quoted string Returns:String The unquoted string

removeQuotes

back to summary

protected static String removeQuotes(String quotedString)

Removes the quotes on a string.

Parameters

quotedString:String: The quoted string

Returns:String

The unquoted string

setAlgorithms	back to summary
public void setAlgorithms(String algorithmsString)

setAuthenticateHeader back to summary

setAuthenticateHeader	back to summary
protected void setAuthenticateHeader(HttpServletRequest request, HttpServletResponse response, String nonce, boolean isNonceStale) Generates the WWW-Authenticate header(s) as per RFC 7616. Parameters request:HttpServletRequest HTTP Servlet request response:HttpServletResponse HTTP Servlet response nonce:String nonce token isNonceStale:boolean `true` to add a stale parameter

protected void setAuthenticateHeader(HttpServletRequest request, HttpServletResponse response, String nonce, boolean isNonceStale)

Generates the WWW-Authenticate header(s) as per RFC 7616.

Parameters

request:HttpServletRequest: HTTP Servlet request
response:HttpServletResponse: HTTP Servlet response
nonce:String: nonce token
isNonceStale:boolean: true to add a stale parameter

setKey	back to summary
public void setKey(String key)

setNonceCacheSize	back to summary
public void setNonceCacheSize(int nonceCacheSize)

setNonceCountWindowSize	back to summary
public void setNonceCountWindowSize(int nonceCountWindowSize)

setNonceValidity	back to summary
public void setNonceValidity(long nonceValidity)

setOpaque	back to summary
public void setOpaque(String opaque)

setValidateUri	back to summary
public void setValidateUri(boolean validateUri)

startInternal back to summary

startInternal	back to summary
protected void startInternal() throws LifecycleException Overrides org.apache.catalina.authenticator.AuthenticatorBase.startInternal. Doc from org.apache.catalina.valves.ValveBase.startInternal. Start this component and implement the requirements of `org.apache.catalina.util.LifecycleBase#startInternal()`. Annotations @Override Exceptions LifecycleException: if this component detects a fatal error that prevents this component from being used

protected void startInternal() throws LifecycleException

Overrides org.apache.catalina.authenticator.AuthenticatorBase.startInternal.

Doc from org.apache.catalina.valves.ValveBase.startInternal.

Start this component and implement the requirements of org.apache.catalina.util.LifecycleBase#startInternal().

Annotations

@Override

Exceptions

LifecycleException:: if this component detects a fatal error that prevents this component from being used

org.apache.catalina.authenticator back to summary

public final Enum DigestAuthenticator.AuthDigest

Class Inheritance

extends Enum<DigestAuthenticator.AuthDigest>

java.lang.Object
java.lang.Enum
org.apache.catalina.authenticator.DigestAuthenticator.AuthDigest

This enum exists because RFC 7616 and Java use different names for some digests.

Field Summary

Modifier and Type	Field and Description
private final String	javaName
public static final DigestAuthenticator.AuthDigest	MD5
private final String	rfcName
public static final DigestAuthenticator.AuthDigest	SHA_256
public static final DigestAuthenticator.AuthDigest	SHA_512_256

Constructor Summary

Access	Constructor and Description
private	AuthDigest(String javaName, String rfcName)

Method Summary

Modifier and Type	Method and Description
public String	getJavaName()
public String	getRfcName()
public static DigestAuthenticator.AuthDigest	valueOf(String name)
public static DigestAuthenticator.AuthDigest[]	values()

Inherited from java.lang.Enum:: clone compareTo describeConstable equals finalize getDeclaringClass hashCode name ordinal toString valueOf

Field Detail

javaName	back to summary
private final String javaName

MD5	back to summary
public static final DigestAuthenticator.AuthDigest MD5

rfcName	back to summary
private final String rfcName

SHA_256	back to summary
public static final DigestAuthenticator.AuthDigest SHA_256

SHA_512_256	back to summary
public static final DigestAuthenticator.AuthDigest SHA_512_256

Constructor Detail

AuthDigest	back to summary
private AuthDigest(String javaName, String rfcName)

Method Detail

getJavaName	back to summary
public String getJavaName()

getRfcName	back to summary
public String getRfcName()

valueOf	back to summary
public static DigestAuthenticator.AuthDigest valueOf(String name)

values	back to summary
public static DigestAuthenticator.AuthDigest[] values()

org.apache.catalina.authenticator back to summary

public Class DigestAuthenticator.DigestInfo

Class Inheritance

extends Object

java.lang.Object
org.apache.catalina.authenticator.DigestAuthenticator.DigestInfo

Field Summary

Modifier and Type	Field and Description
private DigestAuthenticator.AuthDigest	algorithm
private String	cnonce
private final String	key
private String	method
private String	nc
private String	nonce
private final Map<String, DigestAuthenticator.NonceInfo>	nonces
private boolean	nonceStale
private final long	nonceValidity
private final String	opaque
private String	opaqueReceived
private String	qop
private String	realmName
private String	response
private String	uri
private String	userName
private boolean	validateUri

Constructor Summary

Access	Constructor and Description
public	DigestInfo(String opaque, long nonceValidity, String key, Map<String, DigestAuthenticator.NonceInfo> nonces, boolean validateUri)

Method Summary

Modifier and Type	Method and Description
public Principal	authenticate(Realm realm)
public String	getUsername()
public boolean	isNonceStale()
public boolean	parse(Request request, String authorization)
public boolean	validate(Request request) Deprecated
public boolean	validate(Request request, List<DigestAuthenticator.AuthDigest> algorithms)

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

algorithm	back to summary
private DigestAuthenticator.AuthDigest algorithm

cnonce	back to summary
private String cnonce

key	back to summary
private final String key

method	back to summary
private String method

nc	back to summary
private String nc

nonce	back to summary
private String nonce

nonces	back to summary
private final Map<String, DigestAuthenticator.NonceInfo> nonces

nonceStale	back to summary
private boolean nonceStale

nonceValidity	back to summary
private final long nonceValidity

opaque	back to summary
private final String opaque

opaqueReceived	back to summary
private String opaqueReceived

qop	back to summary
private String qop

realmName	back to summary
private String realmName

response	back to summary
private String response

uri	back to summary
private String uri

userName	back to summary
private String userName

validateUri	back to summary
private boolean validateUri

Constructor Detail

DigestInfo	back to summary
public DigestInfo(String opaque, long nonceValidity, String key, Map<String, DigestAuthenticator.NonceInfo> nonces, boolean validateUri)

Method Detail

authenticate	back to summary
public Principal authenticate(Realm realm)

getUsername	back to summary
public String getUsername()

isNonceStale	back to summary
public boolean isNonceStale()

parse	back to summary
public boolean parse(Request request, String authorization)

validate	back to summary
public boolean validate(Request request) Deprecated Annotations @Deprecated

validate	back to summary
public boolean validate(Request request, List<DigestAuthenticator.AuthDigest> algorithms)

org.apache.catalina.authenticator back to summary

public Class DigestAuthenticator.NonceInfo

Class Inheritance

extends Object

java.lang.Object
org.apache.catalina.authenticator.DigestAuthenticator.NonceInfo

Field Summary

Modifier and Type	Field and Description
private int	count
private final int	offset
private final boolean[]	seen
private final long	timestamp

Constructor Summary

Access	Constructor and Description
public	NonceInfo(long currentTime, int seenWindowSize)

Method Summary

Modifier and Type	Method and Description
public long	getTimestamp()
public synchronized boolean	nonceCountValid(long nonceCount)

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

count	back to summary
private int count

offset	back to summary
private final int offset

seen	back to summary
private final boolean[] seen

timestamp	back to summary
private final long timestamp

Constructor Detail

NonceInfo	back to summary
public NonceInfo(long currentTime, int seenWindowSize)

Method Detail

getTimestamp	back to summary
public long getTimestamp()

nonceCountValid	back to summary
public synchronized boolean nonceCountValid(long nonceCount)

public Class DigestAuthenticator

Nested and Inner Type Summary

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

public final Enum DigestAuthenticator.AuthDigest

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

public Class DigestAuthenticator.DigestInfo

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

public Class DigestAuthenticator.NonceInfo

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail