Requires reading first Advanced Pipeline and the Authentication Feature.
Authentication feature creates an
AuthenticationPipeline which is executed right after the
in the call pipeline. All authentication protocols such as basic, digest, oauth are implemented as interceptors on
AuthenticationPipeline has two phases:
CheckAuthentication – phase for checking if a user is already authenticated before all authentication mechanisms kick in.
RequestAuthentication – phase for authentication mechanisms to plug into.
The subject of the pipeline is an
- Auth provider interceptor tries to find a
Principal in the context of the current call.
- If the principal is found, it is returned, and the pipeline is finished.
- If the principal is not found, the provider will add a challenge to
- At the end of the pipeline, if there is no principal, we start calling challenges in order.
- Whichever challenge succeeds first wins.
- Basic auth examines the
- If it’s missing or invalid, or the user is not recognized, a 401 Unauthorized is sent back to the client, and the current call ends.
- The browser displays a login dialog, and after credentials are provided, it makes a new HTTP request with a proper
- Basic auth provider examines the new header, extracts credentials, and verifies them.
- If the credentials are valid, the principal is attached to the call. If not, a 401 is returned to the client again.