Package org.asynchttpclient.netty.channel

Class PrincipalScopedPartitionKey

  • public final class PrincipalScopedPartitionKey
extends Object
    Channel-pool partition key for schemes that authenticate the connection rather than the request.

    NTLM and Negotiate complete a handshake once and the server then treats every later request arriving on that socket as coming from the identity that authenticated it. The regular partition key describes only where the connection goes, so a socket one principal authenticated could be handed to a request belonging to another, and the server would serve it as the first principal. Nothing on the wire shows the identity changed, because the second request carries no authentication headers of its own.

    Folding that identity into the key keeps those connections separated. Basic and Digest need no such thing: they authenticate each request and their credentials travel with it.

    If a site that offers a connection to the pool and a site that polls for one ever disagree about whether to scope, the poll simply misses and a new connection is opened. That costs reuse, never correctness, which is the right way round for this to fail.

    • Method Detail

      • scope

        public static Object scope​(Object baseKey,
                           Realm realm)
        Wraps baseKey with the authenticated identity when realm uses a scheme that authenticates the connection, and returns baseKey unchanged otherwise. Every site that derives a pool key must apply this the same way.

      • proxyLogin

        @Nullable
public static @Nullable Realm proxyLogin​(@Nullable
                                         @Nullable Realm proxyRealm,
                                         @Nullable
                                         @Nullable ProxyServer proxy)
        The login a proxy hop runs as. A SOCKS handshake always sends the proxy's own realm, even after a cross-origin redirect has cleared the future's.

      • scope

        public static Object scope​(Object baseKey,
                           @Nullable
                           @Nullable Realm realm,
                           @Nullable
                           @Nullable Realm proxyRealm,
                           boolean proxyHopIsPerConnection)
        As scope(Object, Realm), but also keyed by the identity that authenticated the connection to a proxy: a tunnel is one socket, so it belongs to both.

      • authenticatesTheConnection

        public static boolean authenticatesTheConnection​(@Nullable
                                                 @Nullable Realm realm)
        Whether the scheme authenticates the connection rather than the request. It needs no principal: an ambient Kerberos login carries none and still binds the socket.

      • anyHopAuthenticatesTheConnection

        public static boolean anyHopAuthenticatesTheConnection​(NettyResponseFuture<?> future)

      • authenticatesTheConnection

        public static boolean authenticatesTheConnection​(@Nullable
                                                 @Nullable Realm realm,
                                                 @Nullable
                                                 @Nullable Realm proxyRealm,
                                                 boolean proxyHopIsPerConnection)
        Either hop, since a CONNECT tunnel is one socket.

      • proxyHopIsPerConnection

        public static boolean proxyHopIsPerConnection​(@Nullable
                                              @Nullable ProxyServer proxy,
                                              Uri uri)
        Whether the proxy authenticates the connection itself, whatever the scheme: a SOCKS login does, and so does the CONNECT that opens a tunnel, since the proxy sees no request after it. Plain HTTP through an HTTP proxy sends its credentials with every request instead.

      • hashCode

        public int hashCode()
        Overrides:
        hashCode in class Object