The handler package contains the classes used to authenticate a user. It contains
the AuthenticationHandler interface which is used to validate credentials. It also
contains the PasswordEncoders which are used by implementations of the AuthenticationHandler
to provide conversion from plain text to whatever the password is encoded as in the data
store.
The package also contains a well-defined exception heirarchy to allow fine-grained error
messages to be displayed.
Examples of AuthenticationHandlers implementations:
- If the credentials are a Userid and Password, then it submits them to an
external Kerberos, LDAP, or JDBC authority for validation.
- If the credentials are a Certificate, then it verifies the Issuer chain
against some list of reliable CAs, checks the date to make sure it hasn't
expired, and checks the CRL to make sure it wasn't revoked.
- If authentication has been done by the Servlet Container or by a Filter, then
the Credentials have been extracted from the HttpRequest object. Notably, this
will include the REMOTE_USER. Such Credentials are implicitly trusted and self
validating, so an AuthenticationHandler recognizing such an object will indicate
that it is valid without inspecting its contents.