org.yamcs.security

Interface AuthModule

All Known Implementing Classes:

BasicAuthModule

public interface AuthModule

Interface implemented by the Authentication and Authorization modules. Each user has a list of privileges and a list of roles. The roles are used for the Commanding system to decide in which queue will be put the commands sent by the user. Usually the roles are associated to privileges but this class makes no assumption about that. The authenticateHttp(ChannelHandlerContext, HttpRequest) is called at the reception of the http request and returns an authentication token that is used later on to check for privileges and roles. Note that while the authenticateHttp(ChannelHandlerContext, HttpRequest) method is asynchronous, the other methods are supposed to return fast, so the information about the user privileges has to be cached. For the short lived REST requests the privilege check follows in quick succesion the authenticate call. For the websocket, however the check privilege it can come a long time after the authenticate so in case the token expires, a preemptive renewal strategy has to be implemented.

Author:

nm

Method Summary

Modifier and Type	Method and Description
CompletableFuture<AuthenticationToken>	authenticateHttp(io.netty.channel.ChannelHandlerContext ctx, io.netty.handler.codec.http.HttpRequest req) Authenticate the request and return a CompletableFuture to indicate the completion.
String[]	getRoles(AuthenticationToken authenticationToken) Get the list of roles of the user.
User	getUser(AuthenticationToken authToken) returns the user authenticated by the token
boolean	hasPrivilege(AuthenticationToken authenticationToken, Privilege.Type type, String privilege)
boolean	hasRole(AuthenticationToken authenticationToken, String role)

Method Detail

authenticateHttp

CompletableFuture<AuthenticationToken> authenticateHttp(io.netty.channel.ChannelHandlerContext ctx,
                                                        io.netty.handler.codec.http.HttpRequest req)

Authenticate the request and return a CompletableFuture to indicate the completion. Possibly send already an answer on the ctx.

Parameters:

ctx -

req -

Returns:

an AuthenticationToken that will be passed later in the checkPrivileges methods

getRoles

String[] getRoles(AuthenticationToken authenticationToken)
           throws InvalidAuthenticationToken

Get the list of roles of the user.

Parameters:

authenticationToken -

Returns:

the roles of the calling user

Throws:

InvalidAuthenticationToken - thrown in case the authentication token is not (anymore) valid

hasRole

boolean hasRole(AuthenticationToken authenticationToken,
                String role)
         throws InvalidAuthenticationToken

Parameters:

authenticationToken -

role -

Returns:

true if the user identified by the token is part of the requested role

Throws:

InvalidAuthenticationToken - thrown in case the authentication token is not (anymore) valid

hasPrivilege

boolean hasPrivilege(AuthenticationToken authenticationToken,
                     Privilege.Type type,
                     String privilege)
              throws InvalidAuthenticationToken

Parameters:

authenticationToken -

type -

privilege -

Returns:

true if the user identified by the token has the privilege

Throws:

InvalidAuthenticationToken - thrown in case the authentication token is not (anymore) valid

getUser

User getUser(AuthenticationToken authToken)

returns the user authenticated by the token

Parameters:

authToken -

Returns:

the authenticated user