---
title: "Create an external authentication plugin"
slug: "dpo-api-server-plugins-create-an-external-authentication-plugin"
updated: 2026-10-27T20:13:21Z
published: 2026-10-27T20:13:21Z
canonical: "docs.onespan.com/dpo-api-server-plugins-create-an-external-authentication-plugin"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onespan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create an external authentication plugin

## Introduction

When an end user needs to verify their identity with an External Authentication Method, one of your company servers, not the DigipassONE Server, authenticates the end user. This section refers to this company server as the RP Server.

When the App SDK receives a request for authentication using an External Authentication Method, your app sends the user verification data to your RP server. See *Using an External authentication method* in the [iOS](/dpoa/docs/s3suite94-implementing-authentication-in-your-app-1#using-an-external-authentication-method), [Android](/dpoa/docs/s3suite94-android-implementing-authentication-in-your-app-1#using-an-external-authentication-method) or [Web](/dpoa/docs/s3suite94-web-implementing-authentication-in-your-web-app-1#using-an-external-authentication-method) Developer Guide. On successful user verification, your RP Server must return a credential. The DigipassONE Server’s JWT External Authentication plugin can validate this credential only if it is a JWT with standard [claims](/dpoa/docs/s3suite94-claim-set-1). If your RP Server cannot return such a JWT, then the DigipassONE Server’s [JWT External Authentication](/dpoa/docs/s3suite94-configure-a-jwt-external-authentication-method-1) plugin won't work for you. If the user verification data is username and password, then you can use a [Password External Authentication](/dpoa/docs/s3suite94-configure-a-password-external-authentication-method-1) method. Otherwise, you must create a custom External Authentication plugin to validate the credential that your RP Server returns. The rest of this section describes how to create a custom External Authentication plugin.

![](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/image1(2).png?sv=2026-02-06&spr=https&st=2026-10-29T01%3A40%3A17Z&se=2026-10-29T02%3A40%3A17Z&sr=c&sp=r&sig=x2WsOSZnHBz6zY29vrwpdcNwElUR7N2qXYnRo0xsuxk%3D)

**Figure 10** External Authentication

Your custom External Authentication plugin is a class that implements DigipassONE's ISessionManager interface. Your ISessionManager class only needs to implement the onVerifyRequest() method. Your ISessionManager class can optionally implement the onResponse() method. Any other methods are ignored. The API Server calls your onVerifyRequest() method when it receives either a VERIFY or an INIT_ADAPTIVE request, then it calls your onResponse() method when the processing of the request is complete.

For information about building and deploying custom API Server plugins, see [Create a plugin](/dpoa/docs/s3suite94-create-a-custom-api-server-plugin-1).

## Interface

```java
/**
* Called on a VERIFY or an INIT_ADAPTIVE request to the REST API. The implementation should
* verify user session (if required) and add the associated userName into
* jsonRequest.userName.
* Parameters:
* request - HTTP request from client.
* jsonRequest - REST request from client.
* response - HTTP response to client.
* jsonResponse - a JSON data that will be merged with Authentication
* Server response before sending it to the client.
* Throws:
* BadSessionException - if the session is invalid.
* BadRequestException - if the request is invalid.
* InternalErrorException - if another error occurred.
*/
void onVerifyRequest​(javax.servlet.http.HttpServletRequest request,
        com.google.gson.JsonObject jsonRequest,
        javax.servlet.http.HttpServletResponse response,
        com.google.gson.JsonObject jsonResponse)

/**
* Called after every response from the Auth Server (doesn't matter if
* successful or failed).
* Parameters:
* request - HTTP request from client.
* jsonRequest - REST request from client.
* response - HTTP response to client.
* jsonResponse - REST response from Authentication Server to be sent
* to the client.
*/
default void onResponse​(javax.servlet.http.HttpServletRequest request,
        com.google.gson.JsonObject jsonRequest,
        javax.servlet.http.HttpServletResponse response,
        com.google.gson.JsonObject jsonResponse)
```

## Description

The steps are described below.

1. Retrieve the credential from the jsonRequest parameter

The processing steps differ depending on whether Adaptive Authentication or Quick Authentication is being performed with the External Authentication Method.

**Adaptive authentication**

The request parameter contains "VERIFY". Retrieve the credential sent by the RP Server from the method.data.credential inside the jsonRequest parameter.

**Quick authentication**

The request parameter contains "INIT_ADAPTIVE". The completedMethods object in the jsonRequest parameter contains the data associated with External Authentication Methods. Because there could be multiple External Authentication Methods, completedMethods is an array.

The onVerifyRequest() method has to iterate through each object in the completedMethods array. In practice, there should only be one object in the array, because multiple authentication methods defeats the purpose of Quick Authentication. Verify that the object in the completedMethods array has type field set to "External Auth". Then retrieve the credential sent by the RP Server from the object's data.credential field.

See the *REST API Reference* for details about the [VERIFY](/dpoa/docs/s3suite94-reference-restapi-fido-authentication-1#verify) and [INIT_ADAPTIVE](/dpoa/docs/s3suite94-adaptive-authentication-1#initadaptive) operations.

2. Validate the credential or throw an exception

Validate the credential sent from your RP server. If validation is unsuccessful, your onVerifyRequest() must throw one of the following exceptions:

- BadSessionException: The credential is invalid. For example, it expired.
- BadRequestException: The request did not provide a credential.
- InternalErrorException: Another error occurred.

3. Extract the userName from the credential if validation succeeds

Extract the userName from the credential and assign it to method.data.userName in the jsonRequest parameter.

Formerly known as Digipass S3 Server.

Formerly known as Digipass S3.