[SHIRO-414] Create generic HttpAuthenticationFilter supporting multiple HTTP authentication schemes

• Type: New Feature
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Fix Version/s: 2.0.0
• Component/s: Authentication (log-in), Web
• Assignee: Unassigned
• Reporter: Les Hazlewood
• Created: 17/Jan/13 17:50
• Updated: 06/Mar/23 08:06

Description

The BasicHttpAuthentication filter assumes HTTP's 'Basic' authentication scheme. But HTTP Authentication can support multiple schemes - instead of creating a filter per scheme, like we assume today, it probably makes sense to have a single filter that can support multiple schemes.

This issue is to create a general HttpAuthenticationFilter that allows one or more pluggable Schemes. Each Scheme should be able to resolve an authentication token based on the Authorization header value.

Existing authc filters (e.g. BasicHttpAuthenticationFilter) can leverage this new concept if necessary - they would just be a filter that comes pre-configured with a single scheme.