pac4j / ratpack-pac4j

pac4j security library for Ratpack: OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...

This org.pac4j:ratpack-pac4j library is a mirror of the official Ratpack / pac4j module (io.ratpack:ratpack-pac4j) with newer versions of pac4j (as the Ratpack 1.x stream is stuck to pac4j v1.8.x).

Pac4j	Ratpack	New org.pac4j:ratpack-pac4j	Changes	Official io.ratpack:ratpack-pac4j
v1.8.x	v1.4.6	v1.4.6	No changes: both modules are identical	v1.4.6
v2.x (v2.1.0)	v1.5.0	v2.0.0	The method signatures have changed: CommonProfile replaces UserProfile and HttpAction replaces RequiresHttpAction	it doesn't exist
v3.x (v3.3.0)	v1.5.0	v3.0.0	Created a RatpackSessionStore and manually retrieved the client_name.	it doesn't exist
v5.x	v1.9.0	v4.x		it doesn't exist
v6.x	v1.9.0	v5.x		it doesn't exist

See the official documentation and the demo.

ratpack-pac4j's Issues

`RatpackPac4j#requireAuth` should add `WWW-Authenticate` header on a 401

I'm testing an app using the following versions in my gradle config:

    compile group: 'io.ratpack', name: 'ratpack-groovy', version: '1.5.4'
    compile group: 'org.slf4j', name: 'slf4j-simple', version: '1.7.25'
//    compile ratpack.dependency('pac4j') // Don't use this, because we need the org.pac4j version
    compile group: 'org.pac4j', name: 'ratpack-pac4j', version: '2.0.0'
    compile group: 'org.pac4j', name: 'pac4j-core', version: '2.2.1'
    compile group: 'org.pac4j', name: 'pac4j-jwt', version: '2.2.1'
    compile group: 'org.pac4j', name: 'pac4j-http', version: '2.2.1'

I find that when I use this handler:

all RatpackPac4j.requireAuth(HeaderClient)

Unauthorized requests get rejected correctly with a 401 status, but I believe a WWW-Authenticate: ... header should be added, and it is not.

Checking the source code leads me to suspect RatpackPac4j#login, which sets the 401 code, but does not add this header:

  public static <C extends Credentials, U extends CommonProfile> Promise<U> login(Context ctx, Class<? extends Client> clientType) {
    if (isDirect(clientType)) {
      return userProfile(ctx)
        .flatMap(p -> {
          if (p.isPresent()) {
            Optional<U> cast = Types.cast(p);
            return Promise.value(cast);
          } else {
            return performDirectAuthentication(ctx, clientType);
          }
        })
        .route(p -> !p.isPresent(), p -> ctx.clientError(401))
        .map(Optional::get);
    } else {
      return userProfile(ctx)
        .route(p -> !p.isPresent(), p -> initiateAuthentication(ctx, clientType))
        .map(Optional::get)
        .map(Types::<U>cast);
    }

Thanks!

Upgrade to pac4j v2.1

Pac4j stateless authentication

Ratpack-pac4j integration strictly bounds to HTTP session. This is not eligible for implementing stateless RESTful API.

Referring to pac4j documentation we should cache UserProfile using LocalCachingAuthenticator and use this approach as default behavior for all "direct clients".