📄️ 3.3.38. AuthN Guards — Bearer / API-Key / JWT
Juneau REST servers ship two opt-in authentication (AuthN) guards in org.apache.juneau.rest.server.auth plus an @Auth Principal argument resolver. A separate, optional sub-module — juneau-rest-server-auth-jwt — adds JWT verification on top via nimbus-jose-jwt. The core juneau-rest-server jar stays JWT-free; teams that don't want JWT pay zero classpath cost.
📄️ 3.3.39. AuthN Filter Framework — Servlet-Layer Authentication
The org.apache.juneau.rest.server.auth package provides a pluggable servlet-filter authentication framework that runs at the servlet container layer — before Juneau's request routing — so a single URL can support multiple overlapping authentication schemes, short-circuit on the first success, and aggregate roles when more than one scheme succeeds.
📄️ 3.3.40. REST Authenticator — Resource-Level Authentication
The RestAuthenticator SPI provides an ergonomic, in-resource way to resolve a request's Principal and roles for @Rest resources — so roleGuard, RoleBasedRestGuard, @Auth Principal injection, and req.isUserInRole(...) all "just work" without container-managed security or a servlet-layer filter.
📄️ 3.3.41. SAML 2.0 AuthN Support (juneau-rest-server-auth-saml)
The opt-in juneau-rest-server-auth-saml module adds SAML 2.0 single-sign-on (Web Browser SSO Profile) to juneau-rest-server by wrapping OpenSAML 5.x behind the AuthFilter / TokenValidator SPIs that ship in juneau-rest-server.
📄️ 3.3.42. OAuth 2.0 / OIDC AuthN Support (juneau-rest-server-auth-oauth)
The opt-in juneau-rest-server-auth-oauth module adds OAuth 2.0 + OIDC bearer-token validation, RFC 7662 token introspection, RFC 6749 client-side grant flows, and OIDC discovery to juneau-rest-server by wrapping the Nimbus OAuth 2.0 SDK (com.nimbusds:oauth2-oidc-sdk) behind the AuthFilter / TokenValidator SPIs.
📄️ 3.3.43. OIDC Relying Party Login (juneau-rest-server-auth-oidc-rp)
The opt-in juneau-rest-server-auth-oidc-rp module turns a Juneau REST server into a complete OpenID Connect Relying Party — the "Log in with Google / Okta / Entra ID / Keycloak" end-to-end glue. It orchestrates the interactive browser login dance (authorization redirect → callback → session) on top of the building blocks in juneau-rest-server-auth-oauth, wrapping the Nimbus OAuth 2.0 SDK (com.nimbusds:oauth2-oidc-sdk) behind Juneau facades.