# Class DigestAuthenticator

java.lang.Object
org.apache.catalina.util.LifecycleBase
org.apache.catalina.util.LifecycleMBeanBase
org.apache.catalina.valves.ValveBase
org.apache.catalina.authenticator.AuthenticatorBase
org.apache.catalina.authenticator.DigestAuthenticator

All Implemented Interfaces:
  `RegistrationListener, MBeanRegistration, Authenticator, Contained, JmxEnabled, Lifecycle, Valve`

public class DigestAuthenticator extends AuthenticatorBase
An Authenticator and Valve implementation of HTTP DIGEST Authentication, as outlined in RFC 7616: "HTTP Digest Authentication"

## Nested Class Summary

Nested Classes
Modifier and Type
Class
Description
`static enum`
`DigestAuthenticator.AuthDigest`
This enum exists because RFC 7616 and Java use different names for some digests.
`static class`
`DigestAuthenticator.DigestInfo`
`static class`
`DigestAuthenticator.NonceInfo`

### Nested classes/interfaces inherited from class AuthenticatorBase

`AuthenticatorBase.AllowCorsPreflight`

### Nested classes/interfaces inherited from interface Lifecycle

`Lifecycle.SingleUse`

## Field Summary

Fields
Modifier and Type
Field
Description
`protected String`
`key`
Private key.
`protected long`
`lastTimestamp`
The last timestamp used to generate a nonce.
`protected final Object`
`lastTimestampLock`
`protected int`
`nonceCacheSize`
Maximum number of server nonces to keep in the cache.
`protected int`
`nonceCountWindowSize`
The window size to use to track seen nonce count values for a given nonce.
`protected Map<String, DigestAuthenticator.NonceInfo>`
`nonces`
List of server nonce values currently being tracked
`protected long`
`nonceValidity`
How long server nonces are valid for in milliseconds.
`protected String`
`opaque`
Opaque string.
`protected static final String`
`QOP`
Tomcat's DIGEST implementation only supports auth quality of protection.
`protected boolean`
`validateUri`
Should the URI be validated as required by RFC2617?

### Fields inherited from class AuthenticatorBase

`alwaysUseSession, AUTH_HEADER_NAME, cache, changeSessionIdOnAuthentication, context, disableProxyCaching, jaspicCallbackHandlerClass, REALM_NAME, securePagesWithPragma, secureRandomAlgorithm, secureRandomClass, secureRandomProvider, sendAuthInfoResponseHeaders, sessionIdGenerator, sm, sso`

### Fields inherited from class ValveBase

`asyncSupported, container, containerLog, next`

### Fields inherited from interface Lifecycle

`AFTER_DESTROY_EVENT, AFTER_INIT_EVENT, AFTER_START_EVENT, AFTER_STOP_EVENT, BEFORE_DESTROY_EVENT, BEFORE_INIT_EVENT, BEFORE_START_EVENT, BEFORE_STOP_EVENT, CONFIGURE_START_EVENT, CONFIGURE_STOP_EVENT, PERIODIC_EVENT, START_EVENT, STOP_EVENT`

## Constructor Summary

Constructors
Constructor
Description
`DigestAuthenticator()`

## Method Summary

Modifier and Type
Method
Description
`protected boolean`
`doAuthenticate(Request request, HttpServletResponse response)`
Authenticate the user making this request, based on the specified login configuration.
`protected String`
`generateNonce(Request request)`
Generate a unique token.
`String`
`getAlgorithms()`
`protected String`
`getAuthMethod()`
Return the authentication method, which is vendor-specific and not defined by HttpServletRequest.
`String`
`getKey()`
`int`
`getNonceCacheSize()`
`int`
`getNonceCountWindowSize()`
`long`
`getNonceValidity()`
`String`
`getOpaque()`
`protected boolean`
`isPreemptiveAuthPossible(Request request)`
Can the authenticator perform preemptive authentication for the given request?
`boolean`
`isValidateUri()`
`void`
`setAlgorithms(String algorithmsString)`
`protected void`
`setAuthenticateHeader(HttpServletRequest request, HttpServletResponse response, String nonce, boolean isNonceStale)`
Generates the WWW-Authenticate header(s) as per RFC 7616.
`void`
`setKey(String key)`
`void`
`setNonceCacheSize(int nonceCacheSize)`
`void`
`setNonceCountWindowSize(int nonceCountWindowSize)`
`void`
`setNonceValidity(long nonceValidity)`
`void`
`setOpaque(String opaque)`
`void`
`setValidateUri(boolean validateUri)`
`protected void`
`startInternal()`
Start this component and implement the requirements of `LifecycleBase.startInternal()`.

### Methods inherited from class AuthenticatorBase

`allowCorsPreflightBypass, associate, authenticate, changeSessionID, checkForCachedAuthentication, doLogin, getAllowCorsPreflight, getAlwaysUseSession, getCache, getChangeSessionIdOnAuthentication, getContainer, getDisableProxyCaching, getJaspicCallbackHandlerClass, getRealmName, getSecurePagesWithPragma, getSecureRandomAlgorithm, getSecureRandomClass, getSecureRandomProvider, invoke, isContinuationRequired, isSendAuthInfoResponseHeaders, login, logout, notify, reauthenticateFromSSO, register, register, setAllowCorsPreflight, setAlwaysUseSession, setCache, setChangeSessionIdOnAuthentication, setContainer, setDisableProxyCaching, setJaspicCallbackHandlerClass, setSecurePagesWithPragma, setSecureRandomAlgorithm, setSecureRandomClass, setSecureRandomProvider, setSendAuthInfoResponseHeaders, stopInternal`

### Methods inherited from class ValveBase

`backgroundProcess, getDomainInternal, getNext, getObjectNameKeyProperties, initInternal, isAsyncSupported, setAsyncSupported, setNext, toString`

### Methods inherited from class LifecycleMBeanBase

`destroyInternal, getDomain, getObjectName, postDeregister, postRegister, preDeregister, preRegister, register, setDomain, unregister, unregister`

### Methods inherited from class LifecycleBase

`addLifecycleListener, destroy, findLifecycleListeners, fireLifecycleEvent, getState, getStateName, getThrowOnFailure, init, removeLifecycleListener, setState, setState, setThrowOnFailure, start, stop`

### Methods inherited from class Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait`

## Field Details

### QOP

protected static final String QOP
Tomcat's DIGEST implementation only supports auth quality of protection.

See Also:
  - Constant Field Values

### nonces

protected Map<String, DigestAuthenticator.NonceInfo> nonces
List of server nonce values currently being tracked

### lastTimestamp

protected long lastTimestamp
The last timestamp used to generate a nonce. Each nonce should get a unique timestamp.

### lastTimestampLock

protected final Object lastTimestampLock

### nonceCacheSize

protected int nonceCacheSize
Maximum number of server nonces to keep in the cache. If not specified, the default value of 1000 is used.

### nonceCountWindowSize

protected int nonceCountWindowSize
The window size to use to track seen nonce count values for a given nonce. If not specified, the default of 100 is used.

### key

protected String key
Private key.

### nonceValidity

protected long nonceValidity
How long server nonces are valid for in milliseconds. Defaults to 5 minutes.

### opaque

protected String opaque
Opaque string.

### validateUri

protected boolean validateUri
Should the URI be validated as required by RFC2617? Can be disabled in reverse proxies where the proxy has modified the URI.

## Constructor Details

### DigestAuthenticator

public DigestAuthenticator()

## Method Details

### getNonceCountWindowSize

public int getNonceCountWindowSize()

### setNonceCountWindowSize

public void setNonceCountWindowSize(int nonceCountWindowSize)

### getNonceCacheSize

public int getNonceCacheSize()

### setNonceCacheSize

public void setNonceCacheSize(int nonceCacheSize)

### getKey

public String getKey()

### setKey

public void setKey(String key)

### getNonceValidity

public long getNonceValidity()

### setNonceValidity

public void setNonceValidity(long nonceValidity)

### getOpaque

public String getOpaque()

### setOpaque

public void setOpaque(String opaque)

### isValidateUri

public boolean isValidateUri()

### setValidateUri

public void setValidateUri(boolean validateUri)

### getAlgorithms

public String getAlgorithms()

### setAlgorithms

public void setAlgorithms(String algorithmsString)

### doAuthenticate

protected boolean doAuthenticate(Request request, HttpServletResponse response) throws IOException
Authenticate the user making this request, based on the specified login configuration. Return `true` if any specified constraint has been satisfied, or `false` if we have created a response challenge already.

Specified by:
  `doAuthenticate` in class `AuthenticatorBase`
Parameters:
  `request` - Request we are processing
  `response` - Response we are creating
Returns:
  `true` if the user was authenticated, otherwise `false`, in which case an authentication challenge will have been written to the response
Throws:
  `IOException` - if an input/output error occurs

### getAuthMethod

protected String getAuthMethod()
Description copied from class: `AuthenticatorBase`
Return the authentication method, which is vendor-specific and not defined by HttpServletRequest.

Specified by:
  `getAuthMethod` in class `AuthenticatorBase`
Returns:
  the authentication method, which is vendor-specific and not defined by HttpServletRequest.

### generateNonce

protected String generateNonce(Request request)
Generate a unique token. The token is generated according to the following pattern. NOnceToken = Base64 ( NONCE_DIGEST ( client-IP ":" time-stamp ":" private-key ) ).

Parameters:
  `request` - HTTP Servlet request
Returns:
  The generated nonce

### setAuthenticateHeader

protected void setAuthenticateHeader(HttpServletRequest request, HttpServletResponse response, String nonce, boolean isNonceStale)
Generates the WWW-Authenticate header(s) as per RFC 7616.

Parameters:
  `request` - HTTP Servlet request
  `response` - HTTP Servlet response
  `nonce` - nonce token
  `isNonceStale` - `true` to add a stale parameter

### isPreemptiveAuthPossible

protected boolean isPreemptiveAuthPossible(Request request)
Description copied from class: `AuthenticatorBase`
Can the authenticator perform preemptive authentication for the given request?

Overrides:
  `isPreemptiveAuthPossible` in class `AuthenticatorBase`
Parameters:
  `request` - The request to check for credentials
Returns:
  `true` if preemptive authentication is possible, otherwise `false`

### startInternal

protected void startInternal() throws LifecycleException
Description copied from class: `ValveBase`
Start this component and implement the requirements of `LifecycleBase.startInternal()`.

Overrides:
  `startInternal` in class `AuthenticatorBase`
Throws:
  `LifecycleException` - if this component detects a fatal error that prevents this component from being used