Package org.apache.juneau.rest.server.auth

Annotation Interface Auth

@Target(PARAMETER)
@Retention(RUNTIME)
@Documented
public @interface Auth

Marks a @RestOp-method parameter as the authenticated Principal for the current request.

When a request reaches an op handler annotated with @Auth, the framework's AuthArg resolver pulls the Principal previously stashed by an upstream AuthN guard (such as BearerTokenGuard or ApiKeyGuard) on the request attributes under the "juneau.principal" key.

If an annotated parameter is reached without a principal being stashed (i.e. no guard ran, or the request was made on an unguarded path) the resolver returns null — the guard chain is the contract that guarantees a non-null value; this annotation only requests the lookup.

Type-driven equivalent:

For convenience, the framework also resolves a bare Principal (or ClaimsPrincipal) parameter without any annotation — the type alone is enough to trigger the same lookup. Use @Auth when you want the intent to be self-documenting on the parameter list or you want to disambiguate against another arg resolver that might claim the parameter first.

Example:

@RestGet(path="/me") public Profile me(@Auth Principal p) { return profileService.lookup(p.getName()); } @RestGet(path="/claims") public String scope(@Auth ClaimsPrincipal p) { return p.getClaim("scope", String.class).orElse(""); }

See Also:

• AuthArg
• BearerTokenGuard
• ApiKeyGuard
• ClaimsPrincipal
• AuthN Guards — Bearer / API-Key / JWT

Since:

10.0.0