org.gbif.ws.security

Class GbifAuthServiceImpl

java.lang.Object

org.gbif.ws.security.GbifAuthServiceImpl

All Implemented Interfaces:

GbifAuthService

@Service
public class GbifAuthServiceImpl
extends Object
implements GbifAuthService

The GBIF authentication scheme is modelled after the Amazon scheme on how to sign REST HTTP requests using a private key. It uses the standard HTTP Authorization header to transport the following information: Authorization: GBIF applicationKey:signature

The header starts with the authentication scheme (GBIF), followed by the plain applicationKey (the public key) and a unique signature for the very request which is generated using a fixed set of request attributes which are then encrypted by a standard HMAC-SHA1 algorithm.

A POST request with a GBIF header would look like this:

 POST /dataset HTTP/1.1
 Host: api.gbif.org
 Date: Mon, 26 Mar 2007 19:37:58 +0000
 x-gbif-user: trobertson
 Content-MD5: LiFThEP4Pj2TODQXa/oFPg==
 Authorization: GBIF gbif.portal:frJIUN8DYpKDtOLCwo//yllqDzg=
 

When signing an HTTP request in addition to the Authorization header some additional custom headers are added which are used to sign and digest the message.
x-gbif-user is added to transport a proxied user in which the application is acting.
Content-MD5 is added if a body entity exists. See Content-MD5 header specs: http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.15

Constructor Summary

Constructors

Constructor and Description
GbifAuthServiceImpl(SigningService signingService, Md5EncodeService md5EncodeService, AppKeyProvider appKeyProvider)

Method Summary

Modifier and Type	Method and Description
boolean	isValidRequest(GbifHttpServletRequestWrapper request)
GbifHttpServletRequestWrapper	signRequest(String username, GbifHttpServletRequestWrapper request) Signs a request by adding a Content-MD5 and Authorization header.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

GbifAuthServiceImpl

public GbifAuthServiceImpl(SigningService signingService,
                           Md5EncodeService md5EncodeService,
                           @Autowired(required=false)
                           AppKeyProvider appKeyProvider)

Method Detail

isValidRequest

public boolean isValidRequest(GbifHttpServletRequestWrapper request)

Specified by:

isValidRequest in interface GbifAuthService

signRequest

public GbifHttpServletRequestWrapper signRequest(String username,
                                                 GbifHttpServletRequestWrapper request)

Signs a request by adding a Content-MD5 and Authorization header. For PUT/POST requests that contain a body entity the Content-MD5 header is created using the same JSON mapper for serialization as the clients use.

Other formats than JSON are not supported currently !!!

Specified by:

signRequest in interface GbifAuthService