Package org.imixs.security.oidc

Class OidcAuthenticationMechanism

java.lang.Object
org.imixs.security.oidc.OidcAuthenticationMechanism
All Implemented Interfaces:
jakarta.security.enterprise.authentication.mechanism.http.HttpAuthenticationMechanism
@ApplicationScoped public class OidcAuthenticationMechanism extends Object implements jakarta.security.enterprise.authentication.mechanism.http.HttpAuthenticationMechanism
CombinedAuthenticationMechanism provides a custom Jakarta Security AuthenticationMechanism that supports both OpenID Connect (OIDC) login and Bearer token authentication. This mechanism checks for an existing session-based OIDC login, or a Bearer token in the Authorization header of an incoming request. It delegates token validation to the BearerTokenValidator and integrates with Jakarta Security APIs to register authenticated identity and roles. This hybrid approach allows supporting browser-based logins and API clients in a single security mechanism.

  • Constructor Summary

    Constructors
    Constructor
    Description
    OidcAuthenticationMechanism()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    jakarta.security.enterprise.AuthenticationStatus
    validateRequest(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, jakarta.security.enterprise.authentication.mechanism.http.HttpMessageContext context)
     

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface jakarta.security.enterprise.authentication.mechanism.http.HttpAuthenticationMechanism

    cleanSubject, secureResponse

  • Constructor Details

    • OidcAuthenticationMechanism

      public OidcAuthenticationMechanism()

  • Method Details

    • validateRequest

      public jakarta.security.enterprise.AuthenticationStatus validateRequest(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, jakarta.security.enterprise.authentication.mechanism.http.HttpMessageContext context) throws jakarta.security.enterprise.AuthenticationException
      Specified by:
      validateRequest in interface jakarta.security.enterprise.authentication.mechanism.http.HttpAuthenticationMechanism
      Throws:
      jakarta.security.enterprise.AuthenticationException