CODEWITHSUNDEEP
pac4j
stackoverflowed
stackoverflowed

Reputation: 927

In which order are pac4j client used

I have an application using pac4j and use multiple authentication clients to secure my routes (both direct and indirect) like this: Secure("AnonymousClient", "FacebookClient", "JWTClient"). I don't really understand in which order the clients are used though. It seems to be from right to left and 401 is returned if none of the clients could build a profile. Am I right? Is it the same order for the authorizers?

Upvotes: 0

Views: 320

Answers (1)

stackoverflowed
stackoverflowed

Reputation: 927

Seems to be much more complicated than that. From the comments in DefaultSecurityLogic.java:

First, if the user is not authenticated (no profile) and if some clients have been defined in the clients parameter, a login is tried for the direct clients.

Then, if the user has profile, authorizations are checked according to the authorizers configuration. If the authorizations are valid, the user is granted access. Otherwise, a 403 error page is displayed.

Finally, if the user is still not authenticated (no profile), he is redirected to the appropriate identity provider if the first defined client is an indirect one in the clients configuration. Otherwise, a 401 error page is displayed.

Upvotes: 1

Related Questions