Package org.apache.juneau.rest.server.auth

package org.apache.juneau.rest.server.auth
Authentication (AuthN) guards, servlet-layer filters, SPIs, and request-time helpers for juneau-rest-server.
Guard-level authentication (RestGuard)

BearerTokenGuard and ApiKeyGuard are framework-level guard implementations that run inside the Juneau request pipeline (after servlet routing). They stash the resolved Principal on the request under "juneau.principal" so downstream handlers can read it via @Auth Principal or req.getAttributes().get(PRINCIPAL_ATTR).

Servlet-layer authentication (AuthFilter)

This package also ships a two-layer pluggable servlet-filter authentication framework that runs at the servlet container layer — before Juneau's request routing:

Layer 1 — Standalone filters: each concrete AuthFilter subclass (BearerTokenAuthFilter, ApiKeyAuthFilter) is also a jakarta.servlet.Filter and can be registered directly with a servlet container or Spring Boot's FilterRegistrationBean.

Layer 2 — AuthFilterChain orchestrator: composes multiple AuthFilter instances with first-success principal resolution, role aggregation across all successful filters, and all-failure aggregation into a single 401 response.

Optional<AuthResult> three-state contract

authenticate(HttpServletRequest) returns:

Principal and role surface

On success the chain wraps the request in AuthenticatedRequestWrapper, which overrides HttpServletRequest.getUserPrincipal(), HttpServletRequest.isUserInRole(String), HttpServletRequest.getRemoteUser(), and ServletRequest.getAttribute(String) for the "juneau.principal" key. This makes RoleBasedRestGuard and @Auth Principal arg injection work with zero changes.

SPIs

TokenValidator and ApiKeyStore are the backing SPIs for both the guard-level and filter-level authentication classes. No third-party crypto / JOSE dependency is pulled in by this package — users who want JWT verification add the optional juneau-rest-server-auth-jwt sub-module (which plugs into the TokenValidator SPI from this package).

See Also:
Since:
10.0.0