# Package org.modeshape.jcr.security

ModeShape JCR repositories have a pluggable authentication and authorization framework.

See: Description

- Interface Summary
  Interface | Description
  --- | ---
  AdvancedAuthorizationProvider | An interface that can authorize access to specific resources within repositories.
  AdvancedAuthorizationProvider.Context | The context in which the calling session is operating, and which contains session-related information that a provider implementation may find useful.
  AuthenticationProvider | An interface used by a ModeShape `Repository` for authenticating users when they create new `sessions` using `Repository.login(javax.jcr.Credentials, String)` and related methods.
  AuthorizationProvider | An interface that can authorize access to specific resources within repositories.
  JaasProvider.SubjectResolver | An extension point for the JaasProvider class that allows for custom logic for finding the current JAAS Subject, if not already available via the `Subject.getSubject(AccessController.getContext())` method.
  SecurityContext | A security context provides a pluggable means to support disparate authentication and authorization mechanisms that specify the user name and roles.

- Class Summary
  Class | Description
  --- | ---
  AnonymousProvider | An implementation of `AuthenticationProvider` that allows for anonymous authentication and role-based authorization of a supplied set of allowed roles.
  AuthenticationProviders | An implementation of `AuthenticationProvider` that represents an ordered list of other `AuthenticationProvider` implementations.
  JaasProvider | An implementation of `AuthenticationProvider` that uses a supplied JAAS policy to perform all authentication and role-based authorization.
  JaasSecurityContext | JAAS-based `security context` that provides authentication and authorization through the JAAS `login context`.
  JaasSecurityContext.UserPasswordCallbackHandler | A simple `callback handler` implementation that attempts to provide a user ID and password to any callbacks that it handles.
  JaccSubjectResolver | A class that can resolve the current JAAS `Subject` using the JACC API.
  ServletProvider | An implementation of `AuthenticationProvider` that delegates to the `HttpServletRequest` referenced by the supplied `ServletCredentials` instances for all authentication and role-based authorization.
  ServletProvider.ServletSecurityContext |
  SimplePrincipal | Default local implementation of the principal.

## Package org.modeshape.jcr.security Description

ModeShape JCR repositories have a pluggable authentication and authorization framework. Out of the box, each repository is configured to support authenticating and authorizing using JAAS, HTTP servlet (if the servlet library is on the classpath), and (if configured) anonymous logins. In addition, Each repository can also be configured with customzied authenticators.

Creating a custom authenticator is a matter of properly implementing `AuthenticationProvider` and configuring the repository to use that class. Each authenticator is responsible for authenticating the supplied `Credentials` and returning an ExecutionContext that will represent the user, including its embedded `SecurityContext` (for simple role-based authorization) or `AuthorizationProvider` (for a combination of path- and role-based authorization).

Copyright © 2008-2014 JBoss, a division of Red Hat. All Rights Reserved.