Package org.apache.juneau.rest.server.auth

Interface TokenValidator

All Known Implementing Classes:
JwtTokenValidator, OAuthIntrospectionValidator, StubBearerTokenValidator
Functional Interface:
This is a functional interface and can therefore be used as the assignment target for a lambda expression or method reference.
@FunctionalInterface public interface TokenValidator
SPI for verifying an opaque bearer token and producing the associated Principal.

BearerTokenGuard extracts the token from the Authorization: Bearer <token> header and delegates verification to a TokenValidator the host supplies. The validator is the authoritative source of "is this token still good?" — signature, expiry, audience, issuer, revocation, etc.

Implementations:

  • JWT — the optional juneau-rest-server-auth-jwt sub-module ships JwtTokenValidator, which performs JWKS-backed signature verification with full iss / aud / exp / nbf / algorithm-allowlist enforcement.
  • Opaque token — e.g. a 32-byte random token stored in a database; the validator looks the token up in the store and returns the associated user record wrapped as a Principal.
  • Introspection — e.g. RFC 7662 token introspection over HTTP against the issuing IdP; the validator caches successful responses for a short TTL.
Contract

On success, return a non-null Principal. On failure, throw AuthenticationException with a WWW-Authenticate challenge string set via AuthenticationException.wwwAuthenticate(String). Returning null is treated as failure by the guard but produces a generic challenge — throwing is preferred so the failure reason surfaces in the response body.

The supplied token string is exactly what followed "Bearer " in the Authorization header — the guard does not pre-trim or unquote. Validators should treat it as untrusted input (no logging of full tokens, no exception messages echoing the token, etc.).

See Also:
Since:
10.0.0

  • Method Summary

    Modifier and Type
    Method
    Description
    Principal
    validate(String token)
    Validates the supplied bearer token and returns the associated Principal.

  • Method Details

    • validate

      Principal validate(String token) throws AuthenticationException
      Validates the supplied bearer token and returns the associated Principal.
      Parameters:
      token - The raw token string from Authorization: Bearer <token>. Never null.
      Returns:
      The authenticated principal. Must not be null on success.
      Throws:
      AuthenticationException - If the token is invalid, expired, revoked, or otherwise unacceptable.