com.atlassian.confluence.plugins.rest.asap

Class AsapAuthorizer

java.lang.Object

com.atlassian.confluence.plugins.rest.asap.AsapAuthorizer

public class AsapAuthorizer
extends Object

Determines whether a given ASAP token (Jwt claim) is allowed access to a resource protected by a given AsapAuthorizationConfig.

Authorization is based on the AsapAuthorizationConfig.getRequiredIssuers() list in the config: if the token was issued by one of those issuers, access is granted.

Constructor Summary

Constructors

Constructor and Description
AsapAuthorizer()

Method Summary

Modifier and Type	Method and Description
void	authorize(AsapAuthorizationConfig config, Optional<com.atlassian.asap.api.Jwt> asapJwt) Authorizes the optional jwt token against the config.
boolean	isAuthorized(AsapAuthorizationConfig config, com.atlassian.asap.api.Jwt jwt) Checks the list of issuers against the jwt token.
void	throwIfMandatory(AsapAuthorizationConfig config) Checks whether the AsapAuthorizationConfig is mandatory, and throws an AuthorizationFailedException if it is

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AsapAuthorizer

public AsapAuthorizer()

Method Detail

authorize

public void authorize(AsapAuthorizationConfig config,
                      Optional<com.atlassian.asap.api.Jwt> asapJwt)

Authorizes the optional jwt token against the config. Checks to see that the config supports ASAP auth Then performs the authorization against the JWT token if it is present, or confirms that the config is not mandator if the JWT token is missing.

Parameters:

config -

asapJwt -

Throws:

AuthorizationFailedException - if asap isn't allowed, or the JWT token is not authorized, or jwt token is missing and ASAP is mandatory

isAuthorized

public boolean isAuthorized(AsapAuthorizationConfig config,
                            com.atlassian.asap.api.Jwt jwt)

Checks the list of issuers against the jwt token.

This check succeeds if ASAP is allowed, and the requiredIssuers of the config contains the issuer of the jwt token, or if asap is allowed and there are no requiredIssuers in the config

Returns:

true if the request is authorized to proceed

throwIfMandatory

public void throwIfMandatory(AsapAuthorizationConfig config)

Checks whether the AsapAuthorizationConfig is mandatory, and throws an AuthorizationFailedException if it is

Parameters:

config -

Throws:

AuthorizationFailedException - if the config specifies ASAP as mandatory