public static void timeSensitiveInit ( Env env , AuthAPI authzAPI , AuthzFacade facade , final DirectAAFUserPass directAAFUserPass ) throws Exception { /** * Basic Auth, quick Validation * * Responds OK or NotAuthorized */ authzAPI . route ( env , HttpMethods . GET , "/authn/basicAuth" , new Code ( facade , "Is given BasicAuth valid?" , true ) { @ Override public void handle ( AuthzTrans trans , HttpServletRequest req , HttpServletResponse resp ) throws Exception { Principal p = trans . getUserPrincipal ( ) ; if ( p instanceof BasicPrincipal ) { // the idea is that if call is made with this credential, and it's a BasicPrincipal, it's ok // otherwise, it wouldn't have gotten here. resp . setStatus ( HttpStatus . OK_200 ) ; } else if ( p instanceof X509Principal ) { // have to check Basic Auth here, because it might be CSP. String ba = req . getHeader ( "Authorization" ) ; if ( ba . startsWith ( "Basic " ) ) { String decoded = Symm . base64noSplit . decode ( ba . substring ( 6 ) ) ; int colon = decoded . indexOf ( ' ' ) ; if ( directAAFUserPass . validate ( decoded . substring ( 0 , colon ) , CredVal . Type . PASSWORD , decoded . substring ( colon + 1 ) . getBytes ( ) ) ) { resp . setStatus ( HttpStatus . OK_200 ) ; } else { resp . setStatus ( HttpStatus . FORBIDDEN_403 ) ; } } } else if ( p == null ) { trans . error ( ) . log ( "Transaction not Authenticated... no Principal" ) ; resp . setStatus ( HttpStatus . FORBIDDEN_403 ) ; } else { trans . checkpoint ( "Basic Auth Check Failed: This wasn't a Basic Auth Trans" ) ; // For Auth Security questions, we don't give any info to client on why failed resp . setStatus ( HttpStatus . FORBIDDEN_403 ) ; } } } , "text/plain" ) ; /** * returns whether a given Credential is valid */ authzAPI . route ( POST , "/authn/validate" , API . CRED_REQ , new Code ( facade , "Is given Credential valid?" , true ) { @ Override public void handle ( AuthzTrans trans , HttpServletRequest req , HttpServletResponse resp ) throws Exception { Result < Date > r = context . doesCredentialMatch ( trans , req , resp ) ; if ( r . isOK ( ) ) { resp . setStatus ( HttpStatus . OK_200 ) ; } else { // For Security, we don't give any info out on why failed, other than forbidden resp . setStatus ( HttpStatus . FORBIDDEN_403 ) ; } } } ) ; /** * returns whether a given Credential is valid */ authzAPI . route ( GET , "/authn/cert/id/:id" , API . CERTS , new Code ( facade , "Get Cert Info by ID" , true ) { @ Override public void handle ( AuthzTrans trans , HttpServletRequest req , HttpServletResponse resp ) throws Exception { Result < Void > r = context . getCertInfoByID ( trans , req , resp , pathParam ( req , ":id" ) ) ; if ( r . isOK ( ) ) { resp . setStatus ( HttpStatus . OK_200 ) ; } else { // For Security, we don't give any info out on why failed, other than forbidden resp . setStatus ( HttpStatus . FORBIDDEN_403 ) ; } } } ) ; }
TIME SENSITIVE APIs