Authentication

Wisdom proposed a very simple security layer letting you secure your endpoints. This model is inspired form the Play 2 Framework security support.

Implementing a authentication service

The first step is to implement a service checking if the current session is authenticated. Such a class must implement the Authenticator interface.

The following snippet is a basic implementation checking if the property username is contained in the session ( and if it’s admin):

include::{sourcedir}/controllers/security/MyAuthenticator.java[tags=authenticator]

The implementation provides three methods:

  • getUserName determines the username of the currently authenticated user

  • onUnauthorized defines the actions to do when the user is not authenticated

  • getName() returns the identifier of this authenticator service. This identifier is used for selection (see below).

Annotating your action method or controller

Once you have your authenticator service, you can annotate your action method or controller (this is equivalent to annotating all methods) with the @Authenticated annotation:

include::{sourcedir}/controllers/security/SecretKeeperController.java[tags=authenticated]

Once annotated, access to your method invokes the authenticator service to check if the current context / session / request is authenticated. If not the onUnauthorized method is called and its result is used as the response.

Selecting the right authentication service

You can have several authenticator service at the same time. To select the authenticator to use:

@Authenticated("id")

The id is the String returned by the getName() method. If the specified authenticator is not available, an unauthorized response is returned.