Package de.businesscode.bcdui.subjectsettings.services

package de.businesscode.bcdui.subjectsettings.services

Authenticates a trusted backend caller acting on behalf of a BCD-UI user for a single request, with no browser session involved (e.g. a bot acting for a user, or an AI agent's MCP endpoint).

The two concerns are deliberately kept orthogonal:

• RequestSession scopes the login limited to just the current request.
• OnBehalfIdentityRealm decides who the caller may act as - a shared secret establishes client trust, then the asserted on-behalf identity is resolved to a BCD-UI user id.

The pieces:

• RequestAuthenticationFilter - reads the request headers (client secret, asserted on-behalf idType/id) and reports the outcome as an HTTP status; Delegates the verification to the Realm.
• RequestAuthenticationToken - the raw, not-yet-verified assertion built from those headers, passed to subject.login(token).
• OnBehalfIdentityRealm - the Shiro Realm that verifies the shared secret and resolves the asserted identity to a BCD-UI user id.
• UserIdResolver and DefaultUserIdResolver - pluggable resolution of the asserted identifying attribute to a technical user id.
• RequestSession - binds the resulting Subject to the current thread and, on close(), destroys any session created along the way.

See RequestAuthenticationFilter's class javadoc for the shiro.ini configuration.

Related Packages

Package	Description
de.businesscode.bcdui.subjectsettings
de.businesscode.bcdui.subjectsettings.config
de.businesscode.bcdui.subjectsettings.oauth2

Class	Description
DefaultUserIdResolver	Default UserIdResolver: treats idType as the id of a BindingItem on bcd_sec_user, and looks up the user whose trimmed value there contains idValue in its list e.g. idType "phone" matches a project-added "phone" BindingItem in bcd_sec_user.
OnBehalfIdentityRealm	Verifies a trusted backend caller's on-behalf-of identity assertion (see RequestAuthenticationFilter/RequestAuthenticationToken): a shared secret establishes that the caller is a trusted client at all, then the asserted idType/onBehalfId is resolved to a BCD-UI technical user id.
RequestAuthenticationFilter	Servlet filter for a trusted backend caller acting on behalf of a BCD-UI user without that user having a browser session - e.g. a bot acting for a user.
RequestAuthenticationToken	Carries the raw, not-yet-verified assertion (the shared client secret plus the asserted on-behalf idType/id, and any additional project-specific attributes) - verifying the secret and resolving the identity to a BCD-UI user id is OnBehalfIdentityRealm's job (via subject.login(token)),
RequestSession	Scopes a Shiro login to just the current request: logs in the given (not yet verified - see OnBehalfIdentityRealm) on-behalf-of identity assertion, binds the resulting Subject to the current thread, and on close() unbinds it again and destroys any session that got created along the way - so these short-lived, per-call sessions never outlive the request or linger in the session store until they time out naturally.
UserIdResolver	Resolves an arbitrary identifying attribute (already established to come from a trusted client - see RequestAuthenticationFilter) to a BCD-UI technical user id.