Authentication Interface

[floralvikings]

Given the following:

1. User information is stored in the ExecutionContext
2. A variable number of strings are required to authenticate
   • Usually, but not necessarily exactly, two (think two-factor auth)
3. Authentication can be handled by multiple backends; SQL, Mongo, Flat Files, APIs, etc...

It seems reasonable to have an interface for authentication, something like the following

public interface Authenticator<T extends ExecutionContext>
{
    /**
     * Authenticate the user with the given credentials, populating the given ExecutionContext
     * IF AND ONLY IF the authentication is successful.
     *
     * @param context The context that will be populated with user data IF the authentication
     * is successful.  If the authentication is not successful, the context should remain 
     * unmodified.
     *
     * @param credentials One or more Strings identifying the user.
     *
     * @return true if the authentication was a success and the context was populated with user
     * data, false if the authentication was a failure and the context was not modified.
     *
     * @throws AuthenticationException If there is an unexpected exception when handling the 
     * authentication.
     */
    bool authenticate(T context, String... credentials) throws AuthenticationException;

    /**
     * Deauthenticate the user with the given credentials, depopulating the given 
     * ExecutionContext IF AND ONLY IF the authentication is successful.
     *
     * @param context The context that will be depopulated with user data IF the 
     * deauthentication is successful.  If the deauthentication is not successful,
     * the context should remain unmodified.  
     * (Maybe not, just a rough draft)
     *
     * @param credentials One or more Strings identifying the user.
     *
     * @throws AuthenticationException If there is an unexpected exception when handling the 
     * authentication.
     */
    void deauthenticate(T context, String... credentials) throws AuthenticationException;

    /**
     * Update the user with the given credentials from the given 
     * ExecutionContext.
     *
     * @param context The context that will be used to update user data.  
     * The context should remain unmodified.
     *
     * @param credentials One or more Strings identifying the user.
     *
     * @throws AuthenticationException If there is an unexpected exception when handling the 
     * update.
     */
    void update(T context, String... credentials) throws AuthenticationException;
}

Since the generic type of Server is also <T extends ExecutionContext> it should be an enormous pain drop right in without causing problems.

There'd have to be a way to access it (preferably from a Message containing the credentials); maybe a new interface like AuthenticationRequest or something that has a method returning credentials? That way a Message implementation could implement both interfaces.

That would result in some gross casting, though, so maybe it should be implemented as a part of the ExecutionContext?

Anyway, definitely an idea worth exploring.