@ Override public AuthenticationMechanismOutcome authenticate ( HttpServerExchange exchange , SecurityContext securityContext ) { List < String > authHeaders = exchange . getRequestHeaders ( ) . get ( AUTHORIZATION ) ; if ( authHeaders != null ) { String bearerToken = null ; for ( String current : authHeaders ) { if ( current . toLowerCase ( Locale . ENGLISH ) . startsWith ( "bearer " ) ) { bearerToken = current . substring ( 7 ) ; if ( UndertowLogger . SECURITY_LOGGER . isTraceEnabled ( ) ) { UndertowLogger . SECURITY_LOGGER . tracef ( "Bearer token: %s" , bearerToken ) ; } try { identityManager = securityContext . getIdentityManager ( ) ; JWTCredential credential = new JWTCredential ( bearerToken , authContextInfo ) ; if ( UndertowLogger . SECURITY_LOGGER . isTraceEnabled ( ) ) { UndertowLogger . SECURITY_LOGGER . tracef ( "Bearer token: %s" , bearerToken ) ; } // Install the JWT principal as the caller Account account = identityManager . verify ( credential . getName ( ) , credential ) ; if ( account != null ) { JsonWebToken jwtPrincipal = ( JsonWebToken ) account . getPrincipal ( ) ; securityContext . authenticationComplete ( account , "MP-JWT" , false ) ; // Workaround authenticated JWTPrincipal not being installed as user principal // https://issues.jboss.org/browse/WFLY-9212 org . jboss . security . SecurityContext jbSC = SecurityContextAssociation . getSecurityContext ( ) ; Subject subject = jbSC . getUtil ( ) . getSubject ( ) ; jbSC . getUtil ( ) . createSubjectInfo ( jwtPrincipal , bearerToken , subject ) ; RoleGroup roles = extract ( subject ) ; jbSC . getUtil ( ) . setRoles ( roles ) ; UndertowLogger . SECURITY_LOGGER . debugf ( "Authenticated caller(%s) for path(%s) with roles: %s" , credential . getName ( ) , exchange . getRequestPath ( ) , account . getRoles ( ) ) ; return AuthenticationMechanismOutcome . AUTHENTICATED ; } else { UndertowLogger . SECURITY_LOGGER . info ( "Failed to authenticate JWT bearer token" ) ; return AuthenticationMechanismOutcome . NOT_AUTHENTICATED ; } } catch ( Exception e ) { UndertowLogger . SECURITY_LOGGER . infof ( e , "Failed to validate JWT bearer token" ) ; return AuthenticationMechanismOutcome . NOT_AUTHENTICATED ; } } } } // No suitable header has been found in this request, return AuthenticationMechanismOutcome . NOT_ATTEMPTED ; }
Extract the Authorization header and validate the bearer token if it exists . If it does and is validated this builds the org . jboss . security . SecurityContext authenticated Subject that drives the container APIs as well as the authorization layers .