Oak Documentation

General

The token based authentication has been completely refactor in Oak and has the following general characteristics.

• Dedicated API for managing login tokens defined in the package org.apache.jackrabbit.oak.spi.security.authentication.token.
• Pluggable configuration of the new token management API
• Complete separation of token based authentication into a separate LoginModule.

Token Authentication

As of Oak the token based authentication is handled by a dedicated TokenLoginModule. It is both responsible for creating new login tokens and validating TokenCredentials passed to the repository login.

This token specific login module implementation obtains the TokenProvider from the security configuration as defined for the content repository. The token management implementation present with a given repository can be changed or extended at runtime (see section Configuration below).

Token Management API

Oak 1.0 defines the following interfaces used to manage login tokens:

• [TokenConfiguration]: Interface to obtain a TokenProvider instance (see section configuration below).
• TokenProvider: Interface to read and manage login tokens.
• TokenInfo: Information associated with a given login token and token validity.

In addition Oak comes with a default implementation of the provider interface that is able to aggregate multiple TokenProviders:

• CompositeTokenConfiguration: Extension of the CompositeConfiguration to combined different token management implementations.
• CompositeTokenProvider: Aggregation of the TokenProvider implementations defined by the configurations contained the CompositeTokenConfiguration

See section Pluggability for an example.

Characteristics of the Default Implementation

The characteristics of the default token management implementation is described in section Token Management : The Default Implementation.

Configuration

The configuration options of the default implementation are described in the Configuration section.

Pluggability

The default security setup as present with Oak 1.0 is able to deal with custom token management implementations and will collect multiple implementations within CompositeTokenConfiguration present with the SecurityProvider. The CompositeTokenConfiguration itself will combine the different TokenProvider implementations using the CompositeTokenProvider.

In an OSGi setup the following steps are required in order to add a custom token provider implementation:

• implement TokenProvider interface
• expose the custom provider by your custom TokenConfiguration service
• make the configuration available to the Oak repository.

@Component()
@Service({TokenConfiguration.class, SecurityConfiguration.class})
public class MyTokenConfiguration extends ConfigurationBase implements TokenConfiguration {

    public TokenConfigurationImpl() {
        super();
    }

    public TokenConfigurationImpl(SecurityProvider securityProvider) {
        super(securityProvider, securityProvider.getParameters(NAME));
    }

    @Activate
    private void activate(Map<String, Object> properties) {
        setParameters(ConfigurationParameters.of(properties));
    }

    //----------------------------------------------< SecurityConfiguration >---
    @Nonnull
    @Override
    public String getName() {
        return NAME;
    }

    //-------------------------------------------------< TokenConfiguration >---
    @Nonnull
    @Override
    public TokenProvider getTokenProvider(Root root) {
        return new MyTokenProvider(root, getParameters());
    }
}