Configuration structure

The following configuration fragment defines a domain SSO1 that requires the reverse proxy to reauthenticate on an established session (after an inactivity time-out of 300 seconds) and to terminate the session after a period of user inactivity (time-out of 1800 seconds). The domain defines initial authentication, session unlocking methods and authentication stepup methods:

<AuthEngine name="TheAuthEngine" classPath="/opt/nevisauth/plugin:/var/opt/nevisauth/default/plugin">
  <Domain name="SSO1" default="true" reauthInterval="300" inactiveInterval="1800">
    <Entry method="authenticate" state="LoginUidPw"/>
    <Entry method="unlock" state="LoginUidPw/>
    <Entry method="stepup" state="LoginOneTimePw"/>
  </Domain>
  <AuthState name="LoginUidPw" ...>
    <ResultCond name="ok" next="LoginOneTimePw"/>
    ...
  </AuthState>
  <AuthState name="LoginChangePw" ...>
    ...
  </AuthState>
  <AuthState name="LoginOneTimePw" ...>
    <ResultCond name="ok" next="AuthDone"/>
    ...
  </AuthState>
  <AuthState name="AuthDone" ...>
    ...
  </AuthState>
  <AccessController>
    ..
  </AccessController>
</AuthEngine>

Classpath configuration

It is possible to configure nevisAuth with a separate classloader for the authentication plug-ins (AuthStates). This allows a separation of the classpath of the container and of nevisAuth itself.

By default, the system loads the AuthState classpath by using a PARENT_FIRST classloader strategy, that is, it loads classes from the container's runtime environment first. The nevisAuth package sets the default AuthEngine classPath (if not configured) as follows:

/opt/nevisauth/plugin:/var/opt/nevisauth/$INSTANCE/plugin

This means that

• The system loads nevisAuth's standard AuthStates and their implementation-specific dependencies from the software directory (/opt/nevisauth/plugin or according to the classPath of the AuthEngine) by default.
• It is possible to copy setup-specific AuthStates to /var/opt/nevisauth/$INSTANCE/plugin, to be automatically located by nevisAuth. Alternatively, you can place the plug-ins in a separate location and extend the classPath attribute of the AuthEngine accordingly.

AuthStates can also define their own classpaths via the classPath and classLoadStrategy attributes in the same way.