Code Monkey home page Code Monkey logo

ratpack-pac4j's Introduction

pac4j is an easy and powerful security framework for Java to authenticate users, get their profiles and manage authorizations in order to secure web applications and web services.

It provides a comprehensive set of concepts and components. It is available for most frameworks/tools and supports most authentication/authorization mechanisms. It is licensed under the Apache 2 license.

JDK pac4j Usage of Lombok
17 v6.x Yes
11 v5.x No
8 v4.x No

Available implementations (Get started by clicking on your framework):

JEESpring Web MVC (Spring Boot)Spring Webflux (Spring Boot)Apache ShiroSpring Security (Spring Boot)

CAS serverSyncopeApache Knox

Play 2.xVertxSpark JavaRatpackJAX-RSDropwizard

JavalinPippoUndertowLagomAkka HTTPJooby

Authentication mechanisms:

OAuth (Facebook, Twitter, Google...) - SAML - CAS - OpenID Connect - HTTP - Google App Engine - Kerberos (SPNEGO/Negotiate)

LDAP - SQL - JWT - MongoDB - CouchDB - IP address - REST API

Authorization mechanisms:

Roles - Anonymous/remember-me/(fully) authenticated - Profile type, attribute

CORS - CSRF - Security headers - IP address, HTTP method


Versions

The latest released version is the Maven Central, available in the Maven central repository. The next version is under development.

Read the documentation for more information.

Need help?

You can use the mailing lists or the commercial support.

Supported by

CAS in the cloud The CAS and pac4j consulting company

ratpack-pac4j's People

Contributors

leleuj avatar rnett avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar

Forkers

leleuj rnett

ratpack-pac4j's Issues

`RatpackPac4j#requireAuth` should add `WWW-Authenticate` header on a 401

I'm testing an app using the following versions in my gradle config:

    compile group: 'io.ratpack', name: 'ratpack-groovy', version: '1.5.4'
    compile group: 'org.slf4j', name: 'slf4j-simple', version: '1.7.25'
//    compile ratpack.dependency('pac4j') // Don't use this, because we need the org.pac4j version
    compile group: 'org.pac4j', name: 'ratpack-pac4j', version: '2.0.0'
    compile group: 'org.pac4j', name: 'pac4j-core', version: '2.2.1'
    compile group: 'org.pac4j', name: 'pac4j-jwt', version: '2.2.1'
    compile group: 'org.pac4j', name: 'pac4j-http', version: '2.2.1'

I find that when I use this handler:

all RatpackPac4j.requireAuth(HeaderClient)

Unauthorized requests get rejected correctly with a 401 status, but I believe a WWW-Authenticate: ... header should be added, and it is not.

Checking the source code leads me to suspect RatpackPac4j#login, which sets the 401 code, but does not add this header:

  public static <C extends Credentials, U extends CommonProfile> Promise<U> login(Context ctx, Class<? extends Client> clientType) {
    if (isDirect(clientType)) {
      return userProfile(ctx)
        .flatMap(p -> {
          if (p.isPresent()) {
            Optional<U> cast = Types.cast(p);
            return Promise.value(cast);
          } else {
            return performDirectAuthentication(ctx, clientType);
          }
        })
        .route(p -> !p.isPresent(), p -> ctx.clientError(401))
        .map(Optional::get);
    } else {
      return userProfile(ctx)
        .route(p -> !p.isPresent(), p -> initiateAuthentication(ctx, clientType))
        .map(Optional::get)
        .map(Types::<U>cast);
    }

Thanks!

Pac4j stateless authentication

Ratpack-pac4j integration strictly bounds to HTTP session. This is not eligible for implementing stateless RESTful API.

Referring to pac4j documentation we should cache UserProfile using LocalCachingAuthenticator and use this approach as default behavior for all "direct clients".

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.