[SLING-1155] Add logout method to Authenticator

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Engine 2.0.4, Engine 2.0.6
• Fix Version/s: Auth Core 1.0.0
• Component/s: Authentication
• Assignee: Felix Meschberger
• Reporter: Felix Meschberger
• Created: 15/Oct/09 13:19
• Updated: 27/Aug/10 08:50
• Resolved: 18/Jan/10 08:55

Description

With the Sling Engine 2.0.4 the Authenticator interface has been introduced to support a generic way to have a user authenticated. This allows for an authentication agnostic way to force a user to login.

The drawback of the current solution is, that neither authentication handlers nor the Authenticator interface provide APi to logout a user again. This should be fixed as follows:

• Add an Authenticator.logout() method which logs out a user in a similar way the login method logs a user in
• Add a new AuthenticationHandler2 interface extending the AuthenticationHandler interface and providing a dropAuthentication method
  which mirrors the AuthenticationHandler.requestAuthentication method.
• Add a LogoutServlet calling Authenticator.logout in a similar manner as the LoginServlet calls the login method

Authentication handlers supporting logging out just implement the AuthenticationHandler2 interface while still registering as a plain AuthenticationHandler. The Authenticator implementation in the Sling Engine bundle identifies the authentication handlers correctly to call or to not call the dropAuthentication method.

Issue Links

• is part of: SLING-966 Make internal sling authentication publicly available