Mailing-List: contact user-help@shiro.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@shiro.apache.org
Received-SPF: pass (nike.apache.org: domain of dominicfarr@gmail.com
 designates 209.85.216.176 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <1395342365122-7579814.post@n2.nabble.com>
References: <1395342365122-7579814.post@n2.nabble.com>
From: Dominic Farr <dominicfarr@gmail.com>
Date: Thu, 20 Mar 2014 22:47:24 +0000
Message-ID: 
 <CABi1WniQomyUwH_Ybb1VoKf9dJU9GbRX7byCtMk4mN5uPrZemA@mail.gmail.com>
Subject: Re: Shiro and REST with HMAC Authentication Tokens
To: shiro <user@shiro.apache.org>
Content-Type: multipart/alternative; boundary=001a1133cbc8b2cef404f5118e26

--001a1133cbc8b2cef404f5118e26
Content-Type: text/plain; charset=UTF-8

Shiro correctly divides everything web/http away from
authentication/authorization. separation of concerns.

Your realm's doGetAuthenticationInfo method should gather information about
the user, including what you need to match any password or hash. Returns
a AuthenticationInfo.

Your call to subject.login takes AuthenticationToken which is in your web
layer, which has access to your http request.

Both AuthenticationToken and AuthenticationInfo are passed to
your CredentialsMatcher in the shiro classes when you call login

As long as your tokens contain the right information to perform a match you
should be able to create a CredentialsMatcher that works for you.....I
think?

Does that make sense? If not, sorry, it's late.

-d


On 20 March 2014 19:06, rawc <rawlinc+shiro@gmail.com> wrote:

> I'm am planning on using Shiro and an Amazon-like authentication scheme to
> secure my REST API. My initial thoughts are to create a custom
> authentication token and a custom realm that supports the custom
> authentication token. The token will be an HMACAuthenticationToken and will
> hold the client's API key and HMAC. In my custom realm I will retrieve the
> client's API secret from a database based on the API key found in the
> authentication token, then use the secret and information from the HTTP
> request to verify that the HMAC value passed in from the client is correct.
> The only problem is I don't see a way to access the HTTP Request from
> within
> the custom realm. Am I approaching this the right way? If so, how do I
> access the HTTP request within the realm. If not, how should I be
> approaching this? The only other way I've thought of doing this is adding a
> third property to the HMACAuthenticationToken that will hold the message
> string that will be used verify the HMAC value provided by the client (i.e.
> instead of assembling the message string in the realm from information in
> the HTTP request I would assemble the message string at the time the
> HMACAuthenticationToken is created and add it into the token). Thanks in
> advance.
>
>
>
> --
> View this message in context:
> http://shiro-user.582556.n2.nabble.com/Shiro-and-REST-with-HMAC-Authentication-Tokens-tp7579814.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>

--001a1133cbc8b2cef404f5118e26
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Shiro correctly divides everything web/http away from auth=
entication/authorization. separation of concerns.=C2=A0<div><br></div><div>=
Your realm&#39;s doGetAuthenticationInfo method should gather information a=
bout the user, including what you need to match any password or hash. Retur=
ns a=C2=A0AuthenticationInfo.</div>

<div><br></div><div>Your call to subject.login takes=C2=A0AuthenticationTok=
en which is in your web layer, which has access to your http request.</div>=
<div><br></div><div>Both=C2=A0AuthenticationToken and AuthenticationInfo ar=
e passed to your=C2=A0CredentialsMatcher in the shiro classes when you call=
 login=C2=A0</div>

<div><br></div><div>As long as your tokens contain the right information to=
 perform a match you should be able to create a=C2=A0CredentialsMatcher tha=
t works for you.....I think?</div><div><br></div><div>Does that make sense?=
 If not, sorry, it&#39;s late.</div>

<div><br></div><div>-d</div></div><div class=3D"gmail_extra"><br><br><div c=
lass=3D"gmail_quote">On 20 March 2014 19:06, rawc <span dir=3D"ltr">&lt;<a =
href=3D"mailto:rawlinc+shiro@gmail.com" target=3D"_blank">rawlinc+shiro@gma=
il.com</a>&gt;</span> wrote:<br>

<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">I&#39;m am planning on using Shiro and an Am=
azon-like authentication scheme to<br>
secure my REST API. My initial thoughts are to create a custom<br>
authentication token and a custom realm that supports the custom<br>
authentication token. The token will be an HMACAuthenticationToken and will=
<br>
hold the client&#39;s API key and HMAC. In my custom realm I will retrieve =
the<br>
client&#39;s API secret from a database based on the API key found in the<b=
r>
authentication token, then use the secret and information from the HTTP<br>
request to verify that the HMAC value passed in from the client is correct.=
<br>
The only problem is I don&#39;t see a way to access the HTTP Request from w=
ithin<br>
the custom realm. Am I approaching this the right way? If so, how do I<br>
access the HTTP request within the realm. If not, how should I be<br>
approaching this? The only other way I&#39;ve thought of doing this is addi=
ng a<br>
third property to the HMACAuthenticationToken that will hold the message<br=
>
string that will be used verify the HMAC value provided by the client (i.e.=
<br>
instead of assembling the message string in the realm from information in<b=
r>
the HTTP request I would assemble the message string at the time the<br>
HMACAuthenticationToken is created and add it into the token). Thanks in<br=
>
advance.<br>
<br>
<br>
<br>
--<br>
View this message in context: <a href=3D"http://shiro-user.582556.n2.nabble=
.com/Shiro-and-REST-with-HMAC-Authentication-Tokens-tp7579814.html" target=
=3D"_blank">http://shiro-user.582556.n2.nabble.com/Shiro-and-REST-with-HMAC=
-Authentication-Tokens-tp7579814.html</a><br>


Sent from the Shiro User mailing list archive at Nabble.com.<br>
</blockquote></div><br></div>

--001a1133cbc8b2cef404f5118e26--