com.atlassian.asap.service.api

Enum ValidationResult.Decision

java.lang.Object

java.lang.Enum<ValidationResult.Decision>

com.atlassian.asap.service.api.ValidationResult.Decision

All Implemented Interfaces:

Serializable, Comparable<ValidationResult.Decision>

Enclosing interface:

ValidationResult

public static enum ValidationResult.Decision
extends Enum<ValidationResult.Decision>

The overall decision as to whether or not the request has satisfied the validator's requirements.

Usage Note

The names used for the Decision values and their documentation reflect the standard use of the terms "authentication" and "authorization" in the security industry. Specifically, "authentication" is about identification (proving who you are) and "authorization" is about permission (associating who you are with what you are allowed to do).

In the early days of HTTP, "authentication" and "authorization" were largely synonymous because the access controls were so simple that no distinction existed between these two concepts. An HTML page was restricted with a username and password, and if you were able to successfully authenticate, then that implicitly meant that you were authorized to access its content. Through this unfortunate accident of history, the HTTP protocol calls the 401 status "Unauthorized". Semantically, however, a "401 Unauthorized" status really means that the client is not authenticated, and a "403 Forbidden" status means that the client is authenticated but not authorized.

Enum Constant Summary

Enum Constants

Enum Constant and Description
ABSTAIN ASAP authentication was not used for this request.
AUTHORIZED ASAP authentication was successful, and the token satisfied all of the validator's authorization requirements.
NOT_AUTHENTICATED ASAP authentication was attempted, but the Authorization header was missing, could not be parsed as containing a valid token, or is otherwise unacceptable.
NOT_AUTHORIZED ASAP authentication was attempted by the client, but at least one of the validation constraints could not be satisfied (for example, if the token is not from an issuer that is authorized to use this resource).
NOT_VERIFIED ASAP authentication is required, but no matching public key could be located to verify it.
REJECTED ASAP authentication is explicitly disallowed, but an authentication header specifying an ASAP token was found.

Method Summary

Modifier and Type	Method and Description
boolean	isOk() If true, then the validation was successful (either an appropriate token was found or none was needed).
static ValidationResult.Decision	valueOf(String name) Returns the enum constant of this type with the specified name.
static ValidationResult.Decision[]	values() Returns an array containing the constants of this enum type, in the order they are declared.

Methods inherited from class java.lang.Enum

clone, compareTo, equals, finalize, getDeclaringClass, hashCode, name, ordinal, toString, valueOf

Methods inherited from class java.lang.Object

getClass, notify, notifyAll, wait, wait, wait

Enum Constant Detail

NOT_AUTHENTICATED

public static final ValidationResult.Decision NOT_AUTHENTICATED

ASAP authentication was attempted, but the Authorization header was missing, could not be parsed as containing a valid token, or is otherwise unacceptable.

Example reasons for this result include:

• The enforcement policy is REQUIRE, but the Authorization header is missing or does not contain a valid JWT.
• The token's issuer does not match its key ID.
• The token's audience is not valid (the token is meant for somebody else, not us).
• The token has invalid time information, such as claiming to have been created far in the future.
• The token has expired.

Expected HTTP Status: 401 Unauthorized (See the Usage Note)

NOT_VERIFIED

public static final ValidationResult.Decision NOT_VERIFIED

ASAP authentication is required, but no matching public key could be located to verify it.

This could be either a temporary problem accessing the key service or a permanent failure if the key does not exist. Either way, since the authenticity of the token could not be verified, its contents cannot be trusted.

Expected HTTP Status: 401 Unauthorized (See the Usage Note)

NOT_AUTHORIZED

public static final ValidationResult.Decision NOT_AUTHORIZED

ASAP authentication was attempted by the client, but at least one of the validation constraints could not be satisfied (for example, if the token is not from an issuer that is authorized to use this resource).

Expected HTTP Status: 403 Forbidden

AUTHORIZED

public static final ValidationResult.Decision AUTHORIZED

ASAP authentication was successful, and the token satisfied all of the validator's authorization requirements.

REJECTED

public static final ValidationResult.Decision REJECTED

ASAP authentication is explicitly disallowed, but an authentication header specifying an ASAP token was found.

Note that since the REJECT policy refuses all ASAP tokens regardless of their contents, tokens are not passed through their normal validity checks. Any token received is assumed to pass authentication and rejected as unauthorized, instead.

Expected HTTP Status: 403 Forbidden

ABSTAIN

public static final ValidationResult.Decision ABSTAIN

ASAP authentication was not used for this request.

One of the following conditions applies:

• The policy is IGNORE and it is unknown whether any token may have been provided, because the Authorization header was not examined.
• The policy is OPTIONAL and no token was provided.
• The policy is REJECT and no token was provided.

Method Detail

values

public static ValidationResult.Decision[] values()

Returns an array containing the constants of this enum type, in the order they are declared. This method may be used to iterate over the constants as follows:

for (ValidationResult.Decision c : ValidationResult.Decision.values())
    System.out.println(c);

Returns:

an array containing the constants of this enum type, in the order they are declared

valueOf

public static ValidationResult.Decision valueOf(String name)

Returns the enum constant of this type with the specified name. The string must match exactly an identifier used to declare an enum constant in this type. (Extraneous whitespace characters are not permitted.)

Parameters:

name - the name of the enum constant to be returned.

Returns:

the enum constant with the specified name

Throws:

IllegalArgumentException - if this enum type has no constant with the specified name

NullPointerException - if the argument is null

isOk

public boolean isOk()

If true, then the validation was successful (either an appropriate token was found or none was needed).

Returns:

true if this decision allows a request to proceed