Package org.mockserver.authentication

Interface AuthenticationHandler

All Known Implementing Classes:

ChainedAuthenticationHandler, ControlPlaneAuthenticationHandlerFactory.DenyAllAuthenticationHandler, JWTAuthenticationHandler, MTLSAuthenticationHandler, OidcAuthenticationHandler

public interface AuthenticationHandler

Implementations delegate in BOTH directions — check which way before editing one. MTLSAuthenticationHandler, JWTAuthenticationHandler and ControlPlaneAuthenticationHandlerFactory.DenyAllAuthenticationHandler implement only controlPlaneRequestAuthenticated(org.mockserver.model.HttpRequest) and inherit the default authenticate(org.mockserver.model.HttpRequest), so the boolean method holds their logic. OidcAuthenticationHandler inverts this: it overrides authenticate(org.mockserver.model.HttpRequest) (to surface a verified principal) and its controlPlaneRequestAuthenticated(org.mockserver.model.HttpRequest) is a one-line delegation back to it.

The enforcement point (HttpState.evaluateControlPlaneAuthentication) calls authenticate(org.mockserver.model.HttpRequest), so for OIDC the boolean method is not on the enforcement path. It carries no independent logic, so hardening authenticate(org.mockserver.model.HttpRequest) covers it — but an edit made only to the boolean method of a handler that overrides authenticate(org.mockserver.model.HttpRequest) will have no effect.

Method Summary

Modifier and Type	Method	Description
default AuthenticationResult	authenticate(HttpRequest request)	Richer authentication that additionally surfaces the VERIFIED principal, the source of verification, and a redaction-safe subset of claims/scopes for audit.
boolean	controlPlaneRequestAuthenticated(HttpRequest request)	Legacy boolean SPI: returns true if the control-plane request is authenticated.

Method Details

controlPlaneRequestAuthenticated

boolean controlPlaneRequestAuthenticated(HttpRequest request)

Legacy boolean SPI: returns true if the control-plane request is authenticated. Implementations may throw AuthenticationException to signal a 401 with a specific reason. Existing and third-party handlers implement only this method.

authenticate

default AuthenticationResult authenticate(HttpRequest request)

Richer authentication that additionally surfaces the VERIFIED principal, the source of verification, and a redaction-safe subset of claims/scopes for audit.

Default-adapts the legacy controlPlaneRequestAuthenticated(org.mockserver.model.HttpRequest) so existing handlers need ZERO changes: a true outcome becomes an authenticated-but-anonymous result (principal null, source "none"), preserving byte-for-byte behaviour. May throw AuthenticationException (401) exactly as the boolean method does.