Authentication class abstract interface

Who is calling and what they may do: the user's identity, their authorities and whether they are authenticated.

The same type has two lives. Before a login it is the login request: a username and the password the user typed, not yet trusted. An AuthenticationManager checks it and returns a new one for the authenticated user, with the user's authorities and their password erased. That second one is stored in the SecurityContext, where every access check (@PreAuthorize, the web rules) reads it.

Application code usually only reads it: to know who is logged in, to write an audit entry, or to filter data by owner. It is a Principal, so with spring_boot_starter_security a controller parameter of type Principal (or Authentication) receives the current one.

// Record who changed the price.
final authentication = SecurityContextHolder.getContext().authentication;
if (authentication != null && authentication.isAuthenticated) {
  audit.record('price changed', by: authentication.name);
}

Spring (Java):

Authentication authentication =
    SecurityContextHolder.getContext().getAuthentication();
if (authentication != null && authentication.isAuthenticated()) {
  audit.record("price changed", authentication.getName());
}
Implemented types
Implementers

Properties

authorities → List<GrantedAuthority>
The permissions of the user, such as ROLE_ADMIN or SCOPE_read.
no setter
credentials → Object?
The secret that proves the identity, usually the typed password.
no setter
details → Object?
Extra facts about the login, such as the client's address and session id; null when nobody set them.
no setter
hashCode → int
The hash code for this object.
no setterinherited
isAuthenticated ↔ bool
Whether this object can be trusted as a checked identity.
getter/setter pair
name → String
The name that identifies the user or client, such as a user name or a client id.
no setterinherited
principal → Object?
The identity: the typed username in a login request; after the login, usually the UserDetails of the user (a Jwt for a bearer token).
no setter
runtimeType → Type
A representation of the runtime type of the object.
no setterinherited

Methods

noSuchMethod(Invocation invocation) → dynamic
Invoked when a nonexistent method or property is accessed.
inherited
toString() → String
A string representation of this object.
inherited

Operators

operator ==(Object other) → bool
The equality operator.
inherited