HTTP Basic Authentication Properties

The HttpAuthenticationLoginModule provider authenticates the user with given credentials (user name and password) against the secured Web server using a GET against a URL that requires basic authentication, and can be configured to retrieve a cookie with the configured name and add it to the JAAS subject to facilitate single sign-on (SSO).

Configure this provider to authenticate the user by:

Using only the specified user name and password.
Using only the specified client value or values.
Attempting token authentication. If that fails, revert to basic authentication using the supplied user name and password. You may find this helpful when using the same security configuration for authenticating users with a token, such as device users hitting the network edge, and when DCN requests from within a firewall present a user name and password but no token.

Note: The HttpAuthenticationLoginModule allows token validation by connecting to an HTTP server capable of validating the token specified in the HTTP header and cookie set in the session.

HttpAuthenticationLoginModule Configuration Options
Configuration Option	Default Value	Description
URL	None	The HTTP or HTTPS URL that authenticates the user. For SSO, this is the server URL from which SAP Mobile Server acquires the SSO cookie/token.
Disable certificate validation	False	(Optional) The default is false. If set to true, this property disables certificate validation when establishing an HTTPS connection to the SWS using the configured URL. Set to true only for configuration debugging.
SSO cookie name	None	(Optional) Name of the cookie set in the session between the LoginModule and the secured Web server, and holds the SSO token for single sign-on. The provider looks for this cookie in the connection to the secured Web server. If the cookie is found, it is added to the authenticated subject as a named credential. The authentication provider ignores the status code when an SSO cookie is found in the session; authentication succeeds regardless of the return status code.
Roles HTTP header	None	(Optional) The name of an HTTP header that the server may return. The header value contains a comma-separated list of roles to be granted.
Successful connection status code	200	HTTP status code interpreted as successful when connection is established to the secured Web server.
HTTP connection timeout interval	60 seconds	The value, in seconds, after which an HTTP connection request to the Web-based authentication service times out. If the HTTP connection made in this module (for either user authentication or configuration validation) does not have a timeout set, and attempts to connect to a Web-based authentication service that is unresponsive, the connection also becomes unresponsive, which could potentially cause SAP Mobile Server to become unresponsive. Setting the timeout interval ensures that authentication failure is reported without waiting indefinitely for the server to respond.
SendClientHttpValuesAs	None	Comma-separated list of strings that indicate how to send ClientHttpValuesToSend to the HTTP server. For example: `SendClientHttpValuesAs=header:header_name, cookie: cookie_name` This property does not apply if the user is to be authenticated using only the supplied user name and password .
ClientHttpValuesToSend	None	A comma-separated list of client HTTP values to be sent to the HTTP server. For example: `ClientHttpValuesToSend=client_personalization_key, client_cookie_name` Set this property if you are using token authentication. Setting this property triggers token authentication. Only token authentication is attempted, unless TryBasicAuthIfTokenAuthFails is configured to true in conjunction with ClientHttpValuesToSend. This property does not apply if the user is to be authenticated using only the supplied user name and password .
SendPasswordAsCookie	None	Deprecated. Use only for backward compatibility. New configurations should configure token authentication using SendClientHttpValuesAs and ClientHttpValuesToSend. Sends the password to the URL as a cookie with this name. If not specified, the password is not sent in a cookie. This property is normally used when there is a cookie-based SSO mechanism in use (for example, SiteMinder), and the client has put an SSO token into the password. The token can be propagated from the personalization keys and HTTP header and cookies to the secured Web server without impacting the password field.
TryBasicAuthIfTokenAuthFails	False	Specifies whether the provider should attempt basic authentication using the specified user name and password credentials if token authentication is configured and fails. This property is applicable only if token authentication is enabled. This property does not apply if the user is to be authenticated using only the supplied user name and password .
UsernameHttpHeader	None	HTTP response header name returned by the HTTP server with the user name retrieved from the token. Upon successful authentication, the retrieved user name is added as a SecNamePrincipal. This property does not apply if the user is to be authenticated using only the supplied user name and password .
regexForUsernameMatch	None	Regular expression used for matching the supplied user name with the user name returned by the HTTP server in the UsernameHttpHeader. The string "{username}" in the regex is replaced with the specified user name before using it. If specified, it matches the user name retrieved from the UsernameHttpHeader to the user name specified in the callback handler. If the user names do not match, authentication fails. If the user names match, both the specified user name and the retrieved user name are added as SecNamePrincipals to the authenticated subject. This property does not apply if the user is to be authenticated using only the supplied user name and password .
TokenExpirationTimeHttpHeader	None	HTTP response header name that is returned by the HTTP server with the validity period of the token in milliseconds since the start of January 1, 1970. If the header is returned in the HTTP response from the secured Web server, the token is cached for the duration it remains valid unless TokenExpirationInterval is also configured. If this response header is not returned with the token, it might result in unintended use of the token attached to the authenticated context even after it has expired. This property does not apply if the user is to be authenticated using only the supplied user name and password .
TokenExpirationInterval	0	Specifies the interval, in milliseconds to be deducted from the actual expiration time returned in TokenExpirationTimeHttpHeader. This ensures that the token credential retrieved from the authenticated session remains valid until it is passed to the SWS for single sign-on to access MBOs. Note: This property does not apply if the user should be authenticated using only the supplied user name and password. Note: If the configured TokenExpirationInterval value exceeds the amount of time the token is valid, authentication by the HttpAuthenticationLoginModule fails even if the token is validated successfully by the secured Web server.
CredentialName	None	Name to set in the authentication credential that contains the token returned in SSOCookieName. If this property is not configured, the SSOCookieName is set as the name of the token credential.
providerDescription	None	(Optional). When enabled, allows the administrator to associate a description with the provider instance. Using a provider description makes it easier to differentiate between multiple instances of the same provider type: for example, when you have multiple login modules of the same type stacked in a security configuration, each targeting a different repository.