com.sap.core.connectivity.api.authentication

## Interface AuthenticationHeaderProvider

-     public interface AuthenticationHeaderProvider

  The AuthenticationHeaderProvider provided methods for generation of authentication headers for access to on-premise systems and applications deployed on the same HCP landscape.
  Web applications can access AuthenticationHeaderProvider via JNDI lookup or resource injection.

- - ### Method Summary

    Methods
    Modifier and Type | Method and Description
    --- | ---
    `AuthenticationHeader` | `getAppToAppSSOHeader(String requestURL)` Generates authentication header for SSO with other applications on the same landscape.
    `AuthenticationHeader` | `getApptoAppSSOHeader(String requestURL, DestinationConfiguration desitnation)` Generates authentication header for SSO with other applications or systems.
    `List<AuthenticationHeader>` | `getOAuth2SAMLBearerAssertionHeaders(DestinationConfiguration destinationConfiguration)` Generates authentication headers for OAuth2SAMLBearerAssertion destination. OAuth access token will be generated for destinations with authentication type OAuth2SAMLBearerAssertion in order OAuth-protected resources to be consumed.
    `AuthenticationHeader` | `getPrincipalPropagationHeader()` Generates header for principal propagation to on-premise systems.
    `AuthenticationHeader` | `getSAPAssertionHeader(DestinationConfiguration destinationConfiguration)` Generates authentication header for SAPAssertionSSO destination. SAP assertion ticket will be generated for destinations with authentication type SAPAssertionSSO in order to propagate the currently logged on user to a SAP back-end system.

- - ### Method Detail

    - #### getAppToAppSSOHeader

          AuthenticationHeader getAppToAppSSOHeader(String requestURL)

      Generates authentication header for SSO with other applications on the same landscape. Generated header can be used only once and only for the specified request URL.
      SSO Header is valid only between applications which are working on behalf of one and the same account for which SSO is allowed.
      There are three prerequisites for using application-to-application SSO:
      - Both applications should work on behalf of the same account
      - Principal Propagation must be enabled for the account
      - The receiving application must use SAML2 authentication
      Before adding this header ensure that there is no other header with the same name injected in the request. The name of AppToAppSSOHeader can be accessed via `AuthenticationHeader.getName()`.
      Parameters:
        `requestURL` - the URL for which the generated headers will be used.
      Returns:
        Authentication header which can be used for SSO with other applications on the same landscape.

    - #### getApptoAppSSOHeader

          AuthenticationHeader getApptoAppSSOHeader(String requestURL,
                                                  DestinationConfiguration desitnation)

      Generates authentication header for SSO with other applications or systems. Generated header can be used only once and only for the specified request URL.
      This method allows for example changing the audience attribute of the issued SAML2 assertion so that it can be sent to applications or systems outside of the current account.
      If the passed `DestinationConfiguration` has an attribute with name saml2_audience then its value will be set as the audience attribute of the issued SAML2 assertion. If not then calling this method will have return the same value as calling `getAppToAppSSOHeader(String)`.
      There are three prerequisites for using application-to-application SSO:
      - The receiving system or application must use SAML2 authentication
      - The local configuration should be added as trusted SAML IDP in the receiving system or application
      - Principal Propagation must be enabled for the sending account
      Before adding this header ensure that there is no other header with the same name injected in the request. The name of AppToAppSSOHeader can be accessed via `AuthenticationHeader.getName()`.
      Parameters:
        `requestURL` - the URL for which the generated headers will be used.
        `desitnation` - the destination configuration
      Returns:
        Authentication header which can be used for SSO with other systems that trust the local configuration of the account.

    - #### getPrincipalPropagationHeader

          AuthenticationHeader getPrincipalPropagationHeader()

      Generates header for principal propagation to on-premise systems.
      Returns:
        Authentication header which can be used for principal propagation to on-premise systems.

    - #### getSAPAssertionHeader

          AuthenticationHeader getSAPAssertionHeader(DestinationConfiguration destinationConfiguration)

      Generates authentication header for SAPAssertionSSO destination.
      SAP assertion ticket will be generated for destinations with authentication type SAPAssertionSSO in order to propagate the currently logged on user to a SAP back-end system. Note that generation of such assertion ticket is CPU intensive operation and should be generated only once per user session.
      Before adding this header ensure that there is no other header with the same name injected in the request. The name of SAPAssertionHeader can be accessed via `AuthenticationHeader.getName()`.
      Parameters:
        `destinationConfiguration` - the SAPAssertionSSO destination for which an authentication header will be generated.
      Returns:
        the generated authentication header.
      Throws:
        `IllegalArgumentException` - when configuration properties are not well configured or authentication type is not SAPAssertionSSO.

    - #### getOAuth2SAMLBearerAssertionHeaders

          List<AuthenticationHeader> getOAuth2SAMLBearerAssertionHeaders(DestinationConfiguration destinationConfiguration)

      Generates authentication headers for OAuth2SAMLBearerAssertion destination.
      OAuth access token will be generated for destinations with authentication type OAuth2SAMLBearerAssertion in order OAuth-protected resources to be consumed. The generation of access tokens is time consuming operation. To avoid this issue there is a build-in user<->token cache which takes care to auto-renovate tokens before they expire, i.e when a token is about to expire, a new token is created shortly before the expiration of the old one.
      Parameters:
        `destinationConfiguration` - the OAuth2SAMLBearerAssertion destination for which authentication headers will be generated.
      Returns:
        the generated authentication headers.
      Throws:
        `IllegalArgumentException` - when configuration properties are not well configured or authentication type is not OAuth2SAMLBearerAssertion.

Copyright © 2016 SAP. All Rights Reserved.