Package org.microproxy

Interface ProxyAuthenticator

All Known Implementing Classes:
ScriptedProxy
public interface ProxyAuthenticator
Decides which clients may use the proxy. By default it validates Proxy-Authorization: Basic credentials with authenticate(String, String); override authenticate(HttpRequest, FlowContext) for other schemes (Bearer tokens, API keys, ...) or other answers.

Whatever the scheme, the proxy removes Proxy-Authorization from every request before filters see it, so credentials are never forwarded.

  • Method Details

    • authenticate

      boolean authenticate(String userName, String password)
      Validates Basic credentials (for the default authenticate(HttpRequest, FlowContext)).
      Parameters:
      userName - the authenticated user name, or null if unknown
      password - the client password
      Returns:
      whether the credentials are accepted

    • getRealm

      default String getRealm()
      Returns the realm advertised in the default Proxy-Authenticate; null for the default.
      Returns:
      the realm advertised in the default Proxy-Authenticate; null for the default

    • authenticate

      default AuthResult authenticate(HttpRequest request, FlowContext flow)
      Decides whether request may proceed, and as which user. It sees the requests a client sends to the proxy: plain requests and CONNECTs, not the requests inside an intercepted session (they carry no proxy credentials; the session's CONNECT was authenticated). Unless authenticateEveryRequest(), only until one is accepted on each client connection.

      The accepted user name becomes ClientDetails.getUserName(), which filters, trackers and the ChainedProxyManager see. It runs on the client connection's thread and may block, e.g. to ask an identity service.

      The default reads Proxy-Authorization: Basic: it accepts the user when authenticate(String, String) agrees, and rejects with the default challenge otherwise (without asking when the credentials are missing or malformed).

      Parameters:
      request - the request being handled
      flow - the client connection, with its address and TLS session
      Returns:
      AuthResult.accept(java.lang.String), or AuthResult.reject() with the answer to send

    • authenticateEveryRequest

      default boolean authenticateEveryRequest()
      Whether to authenticate every request rather than the first one accepted on each client connection, e.g. because tokens expire. Requests inside an intercepted session are still covered by their CONNECT. Off by default.
      Returns:
      whether to authenticate every request rather than the first one accepted on each client connection, e.g. because tokens expire