/**
* Called on a VERIFY or an INIT_ADAPTIVE request to the REST API. The implementation should
* verify user session (if required) and add the associated userName into
* jsonRequest.userName.
* Parameters:
* request - HTTP request from client.
* jsonRequest - REST request from client.
* response - HTTP response to client.
* jsonResponse - a JSON data that will be merged with Authentication
* Server response before sending it to the client.
* Throws:
* BadSessionException - if the session is invalid.
* BadRequestException - if the request is invalid.
* InternalErrorException - if another error occurred.
*/
void onVerifyRequest(javax.servlet.http.HttpServletRequest request,
com.google.gson.JsonObject jsonRequest,
javax.servlet.http.HttpServletResponse response,
com.google.gson.JsonObject jsonResponse)
/**
* Called after every response from the Auth Server (doesn't matter if
* successful or failed).
* Parameters:
* request - HTTP request from client.
* jsonRequest - REST request from client.
* response - HTTP response to client.
* jsonResponse - REST response from Authentication Server to be sent
* to the client.
*/
default void onResponse(javax.servlet.http.HttpServletRequest request,
com.google.gson.JsonObject jsonRequest,
javax.servlet.http.HttpServletResponse response,
com.google.gson.JsonObject jsonResponse)Description
The steps are described below.
1. Retrieve the credential from the jsonRequest parameter
The processing steps differ depending on whether Adaptive Authentication or Quick Authentication is being performed with the External Authentication Method.
Adaptive Authentication
The request parameter contains "VERIFY". Retrieve the credential sent by the RP Server from the method.data.credential inside the jsonRequest parameter.
Quick Authentication
The request parameter contains "INIT_ADAPTIVE". The completedMethods object in the jsonRequest parameter contains the data associated with External Authentication Methods. Because there could be multiple External Authentication Methods, completedMethods is an array.
The onVerifyRequest() method has to iterate through each object in the completedMethods array. In practice, there should only be one object in the array, because multiple authentication methods defeats the purpose of Quick Authentication. Verify that the object in the completedMethods array has type field set to "External Auth". Then retrieve the credential sent by the RP Server from the object's data.credential field.
See the REST API Reference for details about the VERIFY and INIT_ADAPTIVE operations.
2. Validate the credential or throw an exception
Validate the credential sent from your RP server. If validation is unsuccessful, your onVerifyRequest() must throw one of the following exceptions:
BadSessionException: The credential is invalid. For example, it expired.
BadRequestException: The request did not provide a credential.
InternalErrorException: Another error occurred.
3. Extract the userName from the credential if validation succeeds
Extract the userName from the credential and assign it to method.data.userName in the jsonRequest parameter.