Package dev.relism.flash.ext.security

Class SecurityExtension

java.lang.Object
dev.relism.flash.ext.security.SecurityExtension
All Implemented Interfaces:
dev.relism.flash.extension.FlashExtension
public class SecurityExtension extends Object implements dev.relism.flash.extension.FlashExtension
Flash security: the authentication chain, the policies security annotations declare, sessions, and the /auth/logout and /auth/methods routes. Mechanisms register through mechanism(dev.relism.flash.ext.security.AuthenticationMechanism), directly or from their own extensions, and are tried in registration order before the session cookie. 

 app.install(new SecurityExtension().users(users).roles(roles))
    .install(new OidcExtension(OidcProvider.of("sso", issuer, clientId, secret)));

  • Field Details

    • POLICY

      public static final dev.relism.flash.routing.MiddlewareKey POLICY
      The node security annotations mount under, for middleware that must run before or after it.

  • Constructor Details

    • SecurityExtension

      public SecurityExtension()

  • Method Details

    • users

      public SecurityExtension users(UserResolver<?> users)
      Resolves SecurityIdentity.user — default: the principal itself.

    • roles

      public SecurityExtension roles(RoleResolver roles)
      Required by RolesAllowed; a handler that declares roles without one fails the boot.

    • entryPoint

      public SecurityExtension entryPoint(AuthenticationEntryPoint entryPoint)
      Replaces the default: a browser is redirected to sign in, anything else gets 401 with every challenge.

    • sessions

      public SecurityExtension sessions(SessionStore sessions)

    • sessionTimeout

      public SecurityExtension sessionTimeout(Duration sessionTimeout)

    • loginPage

      public SecurityExtension loginPage(String loginPage)
      Where a browser signs in. Unset: straight to the only LoginMethod when it is a redirect, /login otherwise. Set it when the application's page knows ways in the list does not, like a provider picked by email.

    • origin

      public SecurityExtension origin(String origin)
      Where the application is served, e.g. https://app.example: what session cookies, sign-in callbacks and token audiences are built from. Unset, each request's own Request.origin() is used, which the client chooses — set it wherever that matters, which is every deployment.

    • mechanism

      public SecurityExtension mechanism(AuthenticationMechanism mechanism)

    • loginMethod

      public SecurityExtension loginMethod(LoginMethod method)

    • refresher

      public SecurityExtension refresher(Class<? extends Principal> type, SessionRefresher refresher)

    • schemes

      public List<SecurityScheme> schemes()
      The schemes of every registered mechanism, in registration order.

    • origin

      public String origin(dev.relism.flash.models.Request req)
      The configured origin(String), or the one req names when none is.

    • authenticate

      public SecurityIdentity authenticate(dev.relism.flash.models.Request req)
      The caller, or null when no mechanism recognises a credential.
      Throws:
      AuthenticationFailedException - a mechanism recognised one and rejected it

    • policy

      public SecurityPolicy policy(Class<?> type)
      The policy type's annotations declare, checked against this configuration — declaring roles without a RoleResolver fails here, at boot. null for no annotations.

    • enforce

      public dev.relism.flash.routing.Middleware enforce(SecurityPolicy policy)

    • enforce

      public dev.relism.flash.routing.Middleware enforce(SecurityPolicy policy, AuthenticationEntryPoint anonymous)
      anonymous answers a caller without credentials on this route instead of the configured entry point.

    • enforce

      public dev.relism.flash.routing.Middleware enforce(SecurityPolicy policy, AuthenticationEntryPoint anonymous, List<AuthenticationMechanism> mechanisms)
      A route only mechanisms authenticate: every other credential, the session cookie included, is no credential at all here — a bearer route that must not be reached with a browser's cookie or with another mechanism's token.

    • signIn

      public void signIn(dev.relism.flash.models.Request req, dev.relism.flash.models.Response res, Principal principal)
      Starts a session for principal lasting the configured timeout.

    • signIn

      public void signIn(dev.relism.flash.models.Request req, dev.relism.flash.models.Response res, Principal principal, Instant expiresAt)

    • signOut

      public String signOut(dev.relism.flash.models.Request req, dev.relism.flash.models.Response res)
      Ends the caller's session and returns where the browser goes next.

    • configure

      public void configure(dev.relism.flash.extension.FlashRegistrar<?> app, dev.relism.flash.extension.FlashContext ctx)
      Specified by:
      configure in interface dev.relism.flash.extension.FlashExtension