::nsmcp::BearerAuthenticator ::nsmcp::BearerAuthenticator authenticate credentialInfo grant issue revoke ::nsmcp::Authenticator ::nsmcp::Authenticator authenticate ::nsmcp::BearerAuthenticator->::nsmcp::Authenticator ::nsmcp::Object ::nsmcp::Object dict getdef ::nsmcp::Authenticator->::nsmcp::Object

Class ::nsmcp::BearerAuthenticator

::nsmcp::BearerAuthenticator[i] create ... \
           [ -store:required store:required ]
Only the table name enters the blueprint. Credential records live in nsv.
Defined in /usr/local/ns/tcl/nsmcp/security.tcl

Class Relations

  • class: ::nx::Class[i]
  • superclass: ::nsmcp::Authenticator[i]

Methods (to be applied on instances)

  • authenticate (scripted, public)

     <instance of nsmcp::BearerAuthenticator[i]> authenticate \
    authorization server

    Authenticate a bearer header for the selected server. Validate token syntax, resolve its digest and check expiry before creating a request-owned context.

    Parameters:
    authorization (required)
    Authorization header supplied by the caller.
    server (required)
    Selected NaviServer virtual-server name.
    Returns:
    A RequestContext object, or an HTTP 401 error on rejection.

    Testcases:
    No testcase defined.

  • credentialInfo (scripted, public)

     <instance of nsmcp::BearerAuthenticator[i]> credentialInfo digest

    Read retained metadata for a credential digest. Return only the digest-indexed grant record, never a bearer token.

    Parameters:
    digest (required)
    Hexadecimal SHA-256 credential digest.
    Returns:
    The credential record, or an empty result when it is absent.

    Testcases:
    No testcase defined.

  • grant (scripted, public)

     <instance of nsmcp::BearerAuthenticator[i]> grant token principal \
    permissions targets expires

    Grant a supplied bearer token to a principal and target set. Validate token length and expiry, then store the digest-indexed grant without retaining the token itself.

    Parameters:
    token (required)
    High-entropy bearer token; only its digest is retained.
    principal (required)
    Authenticated principal identifier.
    permissions (required)
    Explicit permission names granted to the credential.
    targets (required)
    Server names which the credential may target.
    expires (required)
    Expiry timestamp in epoch seconds, or zero for no expiry.
    Returns:
    The hexadecimal token digest.

    Testcases:
    No testcase defined.

  • issue (scripted, public)

     <instance of nsmcp::BearerAuthenticator[i]> issue principal \
    permissions targets expires

    Create and grant a new bearer credential. Generate a high-entropy token, store only its digest and grants, and return the secret to the administrator once.

    Parameters:
    principal (required)
    Authenticated principal identifier.
    permissions (required)
    Explicit permission names granted to the credential.
    targets (required)
    Server names which the credential may target.
    expires (required)
    Expiry timestamp in epoch seconds, or zero for no expiry.
    Returns:
    A dictionary containing token, digest and expires.

    Testcases:
    No testcase defined.

  • revoke (scripted, public)

     <instance of nsmcp::BearerAuthenticator[i]> revoke digest

    Revoke a digest-indexed credential. Remove the retained grant if present; do not require the original bearer token.

    Parameters:
    digest (required)
    Hexadecimal SHA-256 credential digest.
    Returns:
    The shared-store deletion result.

    Testcases:
    No testcase defined.