pac4j / ratpack-pac4j Goto Github PK
View Code? Open in Web Editor NEWpac4j security library for Ratpack: OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...
pac4j security library for Ratpack: OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...
I'm testing an app using the following versions in my gradle config:
compile group: 'io.ratpack', name: 'ratpack-groovy', version: '1.5.4'
compile group: 'org.slf4j', name: 'slf4j-simple', version: '1.7.25'
// compile ratpack.dependency('pac4j') // Don't use this, because we need the org.pac4j version
compile group: 'org.pac4j', name: 'ratpack-pac4j', version: '2.0.0'
compile group: 'org.pac4j', name: 'pac4j-core', version: '2.2.1'
compile group: 'org.pac4j', name: 'pac4j-jwt', version: '2.2.1'
compile group: 'org.pac4j', name: 'pac4j-http', version: '2.2.1'
I find that when I use this handler:
all RatpackPac4j.requireAuth(HeaderClient)
Unauthorized requests get rejected correctly with a 401 status, but I believe a WWW-Authenticate: ...
header should be added, and it is not.
Checking the source code leads me to suspect RatpackPac4j#login
, which sets the 401 code, but does not add this header:
public static <C extends Credentials, U extends CommonProfile> Promise<U> login(Context ctx, Class<? extends Client> clientType) {
if (isDirect(clientType)) {
return userProfile(ctx)
.flatMap(p -> {
if (p.isPresent()) {
Optional<U> cast = Types.cast(p);
return Promise.value(cast);
} else {
return performDirectAuthentication(ctx, clientType);
}
})
.route(p -> !p.isPresent(), p -> ctx.clientError(401))
.map(Optional::get);
} else {
return userProfile(ctx)
.route(p -> !p.isPresent(), p -> initiateAuthentication(ctx, clientType))
.map(Optional::get)
.map(Types::<U>cast);
}
Thanks!
Ratpack-pac4j integration strictly bounds to HTTP session. This is not eligible for implementing stateless RESTful API.
Referring to pac4j documentation we should cache UserProfile
using LocalCachingAuthenticator
and use this approach as default behavior for all "direct clients".
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.