1 /*
2 * JBoss, Home of Professional Open Source.
3 * Copyright 2014 Red Hat, Inc., and individual contributors
4 * as indicated by the @author tags.
5 *
6 * Licensed under the Apache License, Version 2.0 (the "License");
7 * you may not use this file except in compliance with the License.
8 * You may obtain a copy of the License at
9 *
10 * http://www.apache.org/licenses/LICENSE-2.0
11 *
12 * Unless required by applicable law or agreed to in writing, software
13 * distributed under the License is distributed on an "AS IS" BASIS,
14 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 * See the License for the specific language governing permissions and
16 * limitations under the License.
17 */
18 package io.undertow.security.api;
19
20 /**
21 * Enumeration to indicate the authentication mode in use.
22 *
23 * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
24 */
25 public enum AuthenticationMode {
26
27 /**
28 * Where the authentication mode is set to pro-active each request on arrival will be passed to the defined authentication
29 * mechanisms to eagerly perform authentication if there is sufficient information available in order to do so.
30 *
31 * A pro-active authentication could be possible for a number of reasons such as already having a SSL connection
32 * established, an identity being cached against the current session or even a browser sending in authentication headers.
33 *
34 * Running in pro-active mode the sending of the challenge to the client is still driven by the constraints defined so this
35 * is not the same as mandating security for all paths. For some mechanisms such as Digest this is a recommended mode as
36 * without it there is a risk that clients are sending in headers with unique nonce counts that go unverified risking that a
37 * malicious client could make use of them. This is also useful for applications that wish to make use of the current
38 * authenticated user if one exists without mandating that authentication occurs.
39 */
40 PRO_ACTIVE,
41
42 /**
43 * When running in constraint driven mode the authentication mechanisms are only executed where the constraint that mandates
44 * authentication is triggered, for all other requests no authentication occurs unless requested by the internal APIs which
45 * may be exposed using the Servlet APIs.
46 */
47 CONSTRAINT_DRIVEN;
48
49 }
50