{
  "bundles": [
    {
      "@type": "NXBundle",
      "artifactId": "nuxeo-platform-login-token",
      "artifactVersion": "2023.55.23",
      "bundleGroup": {
        "@type": "NXBundleGroup",
        "bundleIds": [
          "org.nuxeo.ecm.platform.login",
          "org.nuxeo.ecm.platform.login.cas2",
          "org.nuxeo.ecm.platform.login.digest",
          "org.nuxeo.ecm.platform.login.shibboleth",
          "org.nuxeo.ecm.platform.login.token",
          "org.nuxeo.ecm.platform.login.token.jsf"
        ],
        "hierarchyPath": "/grp:org.nuxeo.ecm.platform/grp:org.nuxeo.ecm.platform.login",
        "id": "grp:org.nuxeo.ecm.platform.login",
        "name": "org.nuxeo.ecm.platform.login",
        "parentIds": [
          "grp:org.nuxeo.ecm.platform"
        ],
        "readmes": [],
        "version": "2023.55"
      },
      "bundleId": "org.nuxeo.ecm.platform.login.token",
      "components": [
        {
          "@type": "NXComponent",
          "componentClass": "org.nuxeo.ecm.tokenauth.service.TokenAuthenticationServiceImpl",
          "documentation": "\n    Service to manage generation and storage of\n    authentication tokens. Each token\n    is unique and persisted in the\n    back-end with the user information it\n    is bound to: user name,\n    application name, device name, device description, permission.\n\n    @author Antoine Taillefer\n    (ataillefer@nuxeo.com)\n  \n",
          "documentationHtml": "<p>\nService to manage generation and storage of\nauthentication tokens. Each token\nis unique and persisted in the\nback-end with the user information it\nis bound to: user name,\napplication name, device name, device description, permission.\n</p><p>\n(ataillefer&#64;nuxeo.com)\n</p><p></p>",
          "extensionPoints": [],
          "extensions": [],
          "hierarchyPath": "/grp:org.nuxeo.ecm.platform/grp:org.nuxeo.ecm.platform.login/org.nuxeo.ecm.platform.login.token/org.nuxeo.ecm.login.token.TokenAuthenticationService",
          "name": "org.nuxeo.ecm.login.token.TokenAuthenticationService",
          "requirements": [],
          "resolutionOrder": 420,
          "services": [
            {
              "@type": "NXService",
              "componentId": "org.nuxeo.ecm.login.token.TokenAuthenticationService",
              "hierarchyPath": "/grp:org.nuxeo.ecm.platform/grp:org.nuxeo.ecm.platform.login/org.nuxeo.ecm.platform.login.token/org.nuxeo.ecm.login.token.TokenAuthenticationService/Services/org.nuxeo.ecm.tokenauth.service.TokenAuthenticationService",
              "id": "org.nuxeo.ecm.tokenauth.service.TokenAuthenticationService",
              "overriden": false,
              "version": "2023.55.23"
            }
          ],
          "startOrder": 241,
          "version": "2023.55.23",
          "xmlFileContent": "<?xml version=\"1.0\"?>\n<component name=\"org.nuxeo.ecm.login.token.TokenAuthenticationService\">\n\n  <documentation>\n    Service to manage generation and storage of\n    authentication tokens. Each token\n    is unique and persisted in the\n    back-end with the user information it\n    is bound to: user name,\n    application name, device name, device description, permission.\n\n    @author Antoine Taillefer\n    (ataillefer@nuxeo.com)\n  </documentation>\n\n  <implementation\n    class=\"org.nuxeo.ecm.tokenauth.service.TokenAuthenticationServiceImpl\" />\n\n  <service>\n    <provide\n      interface=\"org.nuxeo.ecm.tokenauth.service.TokenAuthenticationService\" />\n  </service>\n\n</component>\n",
          "xmlFileName": "/OSGI-INF/token-authentication-framework.xml",
          "xmlPureComponent": false
        },
        {
          "@type": "NXComponent",
          "documentationHtml": "",
          "extensionPoints": [],
          "extensions": [
            {
              "@type": "NXContribution",
              "documentationHtml": "",
              "extensionPoint": "org.nuxeo.ecm.core.schema.TypeService--schema",
              "hierarchyPath": "/grp:org.nuxeo.ecm.platform/grp:org.nuxeo.ecm.platform.login/org.nuxeo.ecm.platform.login.token/org.nuxeo.ecm.login.token.directory.types/Contributions/org.nuxeo.ecm.login.token.directory.types--schema",
              "id": "org.nuxeo.ecm.login.token.directory.types--schema",
              "registrationOrder": 24,
              "targetComponentName": {
                "rawName": "service:org.nuxeo.ecm.core.schema.TypeService",
                "name": "org.nuxeo.ecm.core.schema.TypeService",
                "type": "service"
              },
              "version": "2023.55.23",
              "xml": "<extension point=\"schema\" target=\"org.nuxeo.ecm.core.schema.TypeService\">\n    <schema name=\"authtoken\" src=\"directoryschema/authtoken.xsd\"/>\n  </extension>"
            }
          ],
          "hierarchyPath": "/grp:org.nuxeo.ecm.platform/grp:org.nuxeo.ecm.platform.login/org.nuxeo.ecm.platform.login.token/org.nuxeo.ecm.login.token.directory.types",
          "name": "org.nuxeo.ecm.login.token.directory.types",
          "requirements": [],
          "resolutionOrder": 421,
          "services": [],
          "startOrder": 245,
          "version": "2023.55.23",
          "xmlFileContent": "<?xml version=\"1.0\"?>\n<component name=\"org.nuxeo.ecm.login.token.directory.types\">\n\n  <extension target=\"org.nuxeo.ecm.core.schema.TypeService\"\n    point=\"schema\">\n    <schema name=\"authtoken\" src=\"directoryschema/authtoken.xsd\" />\n  </extension>\n\n</component>\n",
          "xmlFileName": "/OSGI-INF/token-authentication-directory-types.xml",
          "xmlPureComponent": true
        },
        {
          "@type": "NXComponent",
          "documentationHtml": "",
          "extensionPoints": [],
          "extensions": [
            {
              "@type": "NXContribution",
              "documentationHtml": "",
              "extensionPoint": "org.nuxeo.ecm.directory.GenericDirectory--directories",
              "hierarchyPath": "/grp:org.nuxeo.ecm.platform/grp:org.nuxeo.ecm.platform.login/org.nuxeo.ecm.platform.login.token/org.nuxeo.ecm.login.token.directory.contrib/Contributions/org.nuxeo.ecm.login.token.directory.contrib--directories",
              "id": "org.nuxeo.ecm.login.token.directory.contrib--directories",
              "registrationOrder": 8,
              "targetComponentName": {
                "rawName": "service:org.nuxeo.ecm.directory.GenericDirectory",
                "name": "org.nuxeo.ecm.directory.GenericDirectory",
                "type": "service"
              },
              "version": "2023.55.23",
              "xml": "<extension point=\"directories\" target=\"org.nuxeo.ecm.directory.GenericDirectory\">\n\n    <directory extends=\"template-directory\" name=\"authTokens\">\n      <schema>authtoken</schema>\n      <idField>token</idField>\n      <table>auth_tokens</table>\n      <types>\n        <type>system</type>\n      </types>\n      <permissions>\n        <permission name=\"Read\">\n          <group>__Nobody__</group>\n        </permission>\n      </permissions>\n      <cacheEntryName>authTokens-entry-cache</cacheEntryName>\n      <cacheEntryWithoutReferencesName>authTokens-entry-cache-noref</cacheEntryWithoutReferencesName>\n    </directory>\n\n  </extension>"
            }
          ],
          "hierarchyPath": "/grp:org.nuxeo.ecm.platform/grp:org.nuxeo.ecm.platform.login/org.nuxeo.ecm.platform.login.token/org.nuxeo.ecm.login.token.directory.contrib",
          "name": "org.nuxeo.ecm.login.token.directory.contrib",
          "requirements": [],
          "resolutionOrder": 422,
          "services": [],
          "startOrder": 244,
          "version": "2023.55.23",
          "xmlFileContent": "<?xml version=\"1.0\"?>\n<component name=\"org.nuxeo.ecm.login.token.directory.contrib\">\n\n  <extension target=\"org.nuxeo.ecm.directory.GenericDirectory\" point=\"directories\">\n\n    <directory name=\"authTokens\" extends=\"template-directory\">\n      <schema>authtoken</schema>\n      <idField>token</idField>\n      <table>auth_tokens</table>\n      <types>\n        <type>system</type>\n      </types>\n      <permissions>\n        <permission name=\"Read\">\n          <group>__Nobody__</group>\n        </permission>\n      </permissions>\n      <cacheEntryName>authTokens-entry-cache</cacheEntryName>\n      <cacheEntryWithoutReferencesName>authTokens-entry-cache-noref</cacheEntryWithoutReferencesName>\n    </directory>\n\n  </extension>\n</component>\n",
          "xmlFileName": "/OSGI-INF/token-authentication-directory-contrib.xml",
          "xmlPureComponent": true
        },
        {
          "@type": "NXComponent",
          "documentationHtml": "",
          "extensionPoints": [],
          "extensions": [
            {
              "@type": "NXContribution",
              "documentationHtml": "",
              "extensionPoint": "org.nuxeo.ecm.core.io.MarshallerRegistry--marshallers",
              "hierarchyPath": "/grp:org.nuxeo.ecm.platform/grp:org.nuxeo.ecm.platform.login/org.nuxeo.ecm.platform.login.token/org.nuxeo.ecm.tokenauth.io.marshallers/Contributions/org.nuxeo.ecm.tokenauth.io.marshallers--marshallers",
              "id": "org.nuxeo.ecm.tokenauth.io.marshallers--marshallers",
              "registrationOrder": 15,
              "targetComponentName": {
                "rawName": "service:org.nuxeo.ecm.core.io.MarshallerRegistry",
                "name": "org.nuxeo.ecm.core.io.MarshallerRegistry",
                "type": "service"
              },
              "version": "2023.55.23",
              "xml": "<extension point=\"marshallers\" target=\"org.nuxeo.ecm.core.io.MarshallerRegistry\">\n    <register class=\"org.nuxeo.ecm.tokenauth.io.AuthenticationTokenWriter\" enable=\"true\"/>\n    <register class=\"org.nuxeo.ecm.tokenauth.io.AuthenticationTokenListWriter\" enable=\"true\"/>\n  </extension>"
            }
          ],
          "hierarchyPath": "/grp:org.nuxeo.ecm.platform/grp:org.nuxeo.ecm.platform.login/org.nuxeo.ecm.platform.login.token/org.nuxeo.ecm.tokenauth.io.marshallers",
          "name": "org.nuxeo.ecm.tokenauth.io.marshallers",
          "requirements": [],
          "resolutionOrder": 423,
          "services": [],
          "startOrder": 611,
          "version": "2023.55.23",
          "xmlFileContent": "<?xml version=\"1.0\"?>\n<component name=\" org.nuxeo.ecm.tokenauth.io.marshallers\">\n  <extension target=\"org.nuxeo.ecm.core.io.MarshallerRegistry\" point=\"marshallers\">\n    <register class=\"org.nuxeo.ecm.tokenauth.io.AuthenticationTokenWriter\" enable=\"true\" />\n    <register class=\"org.nuxeo.ecm.tokenauth.io.AuthenticationTokenListWriter\" enable=\"true\" />\n  </extension>\n</component>\n",
          "xmlFileName": "/OSGI-INF/token-authentication-marshallers-contrib.xml",
          "xmlPureComponent": true
        },
        {
          "@type": "NXComponent",
          "documentationHtml": "",
          "extensionPoints": [],
          "extensions": [
            {
              "@type": "NXContribution",
              "documentationHtml": "",
              "extensionPoint": "org.nuxeo.ecm.core.cache.CacheService--caches",
              "hierarchyPath": "/grp:org.nuxeo.ecm.platform/grp:org.nuxeo.ecm.platform.login/org.nuxeo.ecm.platform.login.token/org.nuxeo.ecm.login.token.cache.contrib/Contributions/org.nuxeo.ecm.login.token.cache.contrib--caches",
              "id": "org.nuxeo.ecm.login.token.cache.contrib--caches",
              "registrationOrder": 5,
              "targetComponentName": {
                "rawName": "service:org.nuxeo.ecm.core.cache.CacheService",
                "name": "org.nuxeo.ecm.core.cache.CacheService",
                "type": "service"
              },
              "version": "2023.55.23",
              "xml": "<extension point=\"caches\" target=\"org.nuxeo.ecm.core.cache.CacheService\">\n\n    <cache name=\"authTokens-entry-cache\">\n      <ttl>5</ttl><!-- minutes -->\n      <option name=\"maxSize\">1000</option>\n      <option name=\"concurrencyLevel\">10</option>\n    </cache>\n    <!-- CacheDescriptor doesn't support @copy in this branch, so duplicate the settings -->\n    <cache name=\"authTokens-entry-cache-noref\">\n      <ttl>5</ttl><!-- minutes -->\n      <option name=\"maxSize\">1000</option>\n      <option name=\"concurrencyLevel\">10</option>\n    </cache>\n\n  </extension>"
            }
          ],
          "hierarchyPath": "/grp:org.nuxeo.ecm.platform/grp:org.nuxeo.ecm.platform.login/org.nuxeo.ecm.platform.login.token/org.nuxeo.ecm.login.token.cache.contrib",
          "name": "org.nuxeo.ecm.login.token.cache.contrib",
          "requirements": [],
          "resolutionOrder": 424,
          "services": [],
          "startOrder": 243,
          "version": "2023.55.23",
          "xmlFileContent": "<?xml version=\"1.0\"?>\n<component name=\"org.nuxeo.ecm.login.token.cache.contrib\">\n\n  <extension target=\"org.nuxeo.ecm.core.cache.CacheService\" point=\"caches\">\n\n    <cache name=\"authTokens-entry-cache\">\n      <ttl>${nuxeo.tokenauth.cache.ttl:=5}</ttl><!-- minutes -->\n      <option name=\"maxSize\">${nuxeo.tokenauth.cache.maxSize:=1000}</option>\n      <option name=\"concurrencyLevel\">${nuxeo.tokenauth.cache.concurrencyLevel:=10}</option>\n    </cache>\n    <!-- CacheDescriptor doesn't support @copy in this branch, so duplicate the settings -->\n    <cache name=\"authTokens-entry-cache-noref\">\n      <ttl>${nuxeo.tokenauth.cache.ttl:=5}</ttl><!-- minutes -->\n      <option name=\"maxSize\">${nuxeo.tokenauth.cache.maxSize:=1000}</option>\n      <option name=\"concurrencyLevel\">${nuxeo.tokenauth.cache.concurrencyLevel:=10}</option>\n    </cache>\n\n  </extension>\n</component>\n",
          "xmlFileName": "/OSGI-INF/token-authentication-cache-contrib.xml",
          "xmlPureComponent": true
        },
        {
          "@type": "NXComponent",
          "documentationHtml": "",
          "extensionPoints": [],
          "extensions": [
            {
              "@type": "NXContribution",
              "documentation": "\n      Authentication plugin using a token to validate\n      identity. This token is sent as a HTTP request header.\n\n      The user is retrieved looking into a directory mapping unique tokens to user names.\n\n      Set the allowAnonymous parameter to true to\n      allow token authentication for anonymous user.\n\n      @author\n      Antoine Taillefer (ataillefer@nuxeo.com)\n    \n",
              "documentationHtml": "<p>\nAuthentication plugin using a token to validate\nidentity. This token is sent as a HTTP request header.\n</p><p>\nThe user is retrieved looking into a directory mapping unique tokens to user names.\n</p><p>\nSet the allowAnonymous parameter to true to\nallow token authentication for anonymous user.\n</p><p>\nAntoine Taillefer (ataillefer&#64;nuxeo.com)\n</p><p></p>",
              "extensionPoint": "org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService--authenticators",
              "hierarchyPath": "/grp:org.nuxeo.ecm.platform/grp:org.nuxeo.ecm.platform.login/org.nuxeo.ecm.platform.login.token/org.nuxeo.ecm.login.token.authentication.contrib/Contributions/org.nuxeo.ecm.login.token.authentication.contrib--authenticators",
              "id": "org.nuxeo.ecm.login.token.authentication.contrib--authenticators",
              "registrationOrder": 8,
              "targetComponentName": {
                "rawName": "service:org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService",
                "name": "org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService",
                "type": "service"
              },
              "version": "2023.55.23",
              "xml": "<extension point=\"authenticators\" target=\"org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService\">\n\n    <documentation>\n      Authentication plugin using a token to validate\n      identity. This token is sent as a HTTP request header.\n\n      The user is retrieved looking into a directory mapping unique tokens to user names.\n\n      Set the allowAnonymous parameter to true to\n      allow token authentication for anonymous user.\n\n      @author\n      Antoine Taillefer (ataillefer@nuxeo.com)\n    </documentation>\n\n    <authenticationPlugin class=\"org.nuxeo.ecm.platform.ui.web.auth.token.TokenAuthenticator\" enabled=\"true\" name=\"TOKEN_AUTH\">\n      <parameters>\n        <parameter name=\"allowAnonymous\">false</parameter>\n      </parameters>\n    </authenticationPlugin>\n\n  </extension>"
            },
            {
              "@type": "NXContribution",
              "documentation": "\n      Override Automation specific authentication chain to\n      use token authentication just after basic one.\n    \n",
              "documentationHtml": "<p>\nOverride Automation specific authentication chain to\nuse token authentication just after basic one.\n</p><p></p>",
              "extensionPoint": "org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService--specificChains",
              "hierarchyPath": "/grp:org.nuxeo.ecm.platform/grp:org.nuxeo.ecm.platform.login/org.nuxeo.ecm.platform.login.token/org.nuxeo.ecm.login.token.authentication.contrib/Contributions/org.nuxeo.ecm.login.token.authentication.contrib--specificChains",
              "id": "org.nuxeo.ecm.login.token.authentication.contrib--specificChains",
              "registrationOrder": 3,
              "targetComponentName": {
                "rawName": "service:org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService",
                "name": "org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService",
                "type": "service"
              },
              "version": "2023.55.23",
              "xml": "<extension point=\"specificChains\" target=\"org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService\">\n\n    <documentation>\n      Override Automation specific authentication chain to\n      use token authentication just after basic one.\n    </documentation>\n\n    <specificAuthenticationChain name=\"Automation\">\n\n      <urlPatterns>\n        <url>(.*)/automation.*</url>\n      </urlPatterns>\n      <replacementChain>\n        <plugin>AUTOMATION_BASIC_AUTH</plugin>\n        <plugin>TOKEN_AUTH</plugin>\n        <plugin>OAUTH2_AUTH</plugin>\n        <plugin>JWT_AUTH</plugin>\n      </replacementChain>\n    </specificAuthenticationChain>\n\n    <specificAuthenticationChain name=\"RestAPI\">\n      <urlPatterns>\n        <url>(.*)/api/v.*</url>\n      </urlPatterns>\n      <replacementChain>\n        <plugin>AUTOMATION_BASIC_AUTH</plugin>\n        <plugin>TOKEN_AUTH</plugin>\n        <plugin>OAUTH2_AUTH</plugin>\n        <plugin>JWT_AUTH</plugin>\n      </replacementChain>\n    </specificAuthenticationChain>\n\n\n\n    <documentation>\n      Use token authentication if the related request\n      header is sent.\n    </documentation>\n\n    <specificAuthenticationChain name=\"TokenAuth\">\n      <headers>\n        <header name=\"X-Authentication-Token\">.*</header>\n      </headers>\n      <replacementChain>\n        <plugin>TOKEN_AUTH</plugin>\n      </replacementChain>\n    </specificAuthenticationChain>\n\n  </extension>"
            },
            {
              "@type": "NXContribution",
              "documentationHtml": "",
              "extensionPoint": "org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService--startURL",
              "hierarchyPath": "/grp:org.nuxeo.ecm.platform/grp:org.nuxeo.ecm.platform.login/org.nuxeo.ecm.platform.login.token/org.nuxeo.ecm.login.token.authentication.contrib/Contributions/org.nuxeo.ecm.login.token.authentication.contrib--startURL",
              "id": "org.nuxeo.ecm.login.token.authentication.contrib--startURL",
              "registrationOrder": 5,
              "targetComponentName": {
                "rawName": "service:org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService",
                "name": "org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService",
                "type": "service"
              },
              "version": "2023.55.23",
              "xml": "<extension point=\"startURL\" target=\"org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService\">\n\n    <startURLPattern>\n      <patterns>\n        <pattern>acquire_token.jsp</pattern>\n      </patterns>\n    </startURLPattern>\n\n  </extension>"
            }
          ],
          "hierarchyPath": "/grp:org.nuxeo.ecm.platform/grp:org.nuxeo.ecm.platform.login/org.nuxeo.ecm.platform.login.token/org.nuxeo.ecm.login.token.authentication.contrib",
          "name": "org.nuxeo.ecm.login.token.authentication.contrib",
          "requirements": [
            "org.nuxeo.ecm.automation.server.auth.config"
          ],
          "resolutionOrder": 622,
          "services": [],
          "startOrder": 242,
          "version": "2023.55.23",
          "xmlFileContent": "<?xml version=\"1.0\"?>\n<component name=\"org.nuxeo.ecm.login.token.authentication.contrib\">\n\n  <!-- Replace Automation specific authentication chain -->\n  <require>org.nuxeo.ecm.automation.server.auth.config</require>\n\n  <extension target=\"org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService\" point=\"authenticators\">\n\n    <documentation>\n      Authentication plugin using a token to validate\n      identity. This token is sent as a HTTP request header.\n\n      The user is retrieved looking into a directory mapping unique tokens to user names.\n\n      Set the allowAnonymous parameter to true to\n      allow token authentication for anonymous user.\n\n      @author\n      Antoine Taillefer (ataillefer@nuxeo.com)\n    </documentation>\n\n    <authenticationPlugin name=\"TOKEN_AUTH\" enabled=\"true\"\n      class=\"org.nuxeo.ecm.platform.ui.web.auth.token.TokenAuthenticator\">\n      <parameters>\n        <parameter name=\"allowAnonymous\">false</parameter>\n      </parameters>\n    </authenticationPlugin>\n\n  </extension>\n\n  <extension target=\"org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService\" point=\"specificChains\">\n\n    <documentation>\n      Override Automation specific authentication chain to\n      use token authentication just after basic one.\n    </documentation>\n\n    <specificAuthenticationChain name=\"Automation\">\n\n      <urlPatterns>\n        <url>(.*)/automation.*</url>\n      </urlPatterns>\n      <replacementChain>\n        <plugin>AUTOMATION_BASIC_AUTH</plugin>\n        <plugin>TOKEN_AUTH</plugin>\n        <plugin>OAUTH2_AUTH</plugin>\n        <plugin>JWT_AUTH</plugin>\n      </replacementChain>\n    </specificAuthenticationChain>\n\n    <specificAuthenticationChain name=\"RestAPI\">\n      <urlPatterns>\n        <url>(.*)/api/v.*</url>\n      </urlPatterns>\n      <replacementChain>\n        <plugin>AUTOMATION_BASIC_AUTH</plugin>\n        <plugin>TOKEN_AUTH</plugin>\n        <plugin>OAUTH2_AUTH</plugin>\n        <plugin>JWT_AUTH</plugin>\n      </replacementChain>\n    </specificAuthenticationChain>\n\n\n\n    <documentation>\n      Use token authentication if the related request\n      header is sent.\n    </documentation>\n\n    <specificAuthenticationChain name=\"TokenAuth\">\n      <headers>\n        <header name=\"X-Authentication-Token\">.*</header>\n      </headers>\n      <replacementChain>\n        <plugin>TOKEN_AUTH</plugin>\n      </replacementChain>\n    </specificAuthenticationChain>\n\n  </extension>\n\n  <extension target=\"org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService\" point=\"startURL\">\n\n    <startURLPattern>\n      <patterns>\n        <pattern>acquire_token.jsp</pattern>\n      </patterns>\n    </startURLPattern>\n\n  </extension>\n\n</component>\n",
          "xmlFileName": "/OSGI-INF/token-authentication-contrib.xml",
          "xmlPureComponent": true
        }
      ],
      "fileName": "nuxeo-platform-login-token-2023.55.23.jar",
      "groupId": "org.nuxeo.ecm.platform",
      "hierarchyPath": "/grp:org.nuxeo.ecm.platform/grp:org.nuxeo.ecm.platform.login/org.nuxeo.ecm.platform.login.token",
      "id": "org.nuxeo.ecm.platform.login.token",
      "location": "",
      "manifest": "Manifest-Version: 1.0\r\nCreated-By: Maven JAR Plugin 3.4.2\r\nBuild-Jdk-Spec: 17\r\nBundle-ManifestVersion: 1\r\nBundle-Name: Nuxeo token authentication plugin\r\nBundle-SymbolicName: org.nuxeo.ecm.platform.login.token;singleton:=true\r\nBundle-Version: 1.0.0\r\nRequire-Bundle: org.nuxeo.ecm.platform.login\r\nNuxeo-Component: OSGI-INF/token-authentication-framework.xml,OSGI-INF/to\r\n ken-authentication-directory-types.xml,OSGI-INF/token-authentication-di\r\n rectory-contrib.xml,OSGI-INF/token-authentication-contrib.xml,OSGI-INF/\r\n token-authentication-marshallers-contrib.xml,OSGI-INF/token-authenticat\r\n ion-cache-contrib.xml\r\n\r\n",
      "maxResolutionOrder": 622,
      "minResolutionOrder": 420,
      "packages": [],
      "readme": {
        "blobProviderId": "default",
        "content": "# Nuxeo Platform Login Token\n\nThis repo hosts the source code of a plugin for Nuxeo Platform that allows a token-based authentication.\n\nThe associated JIRA issue is: [NXP-10268] [1]\n\n## Building and deploying\n\n- Install a Nuxeo server, version 5.6 or higher.\n\n- Install maven 2.2.1+ and build _nuxeo-platform-login-token_ by running:\n\n        mvn clean install\n\n- Deploy _nuxeo-platform-login-token_ in the Nuxeo server by running:\n\n        cp target/nuxeo-platform-login-token-5.7-SNAPSHOT.jar $NUXEO_HOME/nxserver/plugins/\n\n- Start Nuxeo and have a try!\n\n## Goal\n\nThe main goal of this module is to allow a client device to authenticate against a Nuxeo server using a token acquired during a handshake phase and then stored locally for a regular use.\nThis way, the client does not need to store any user secret information such as login / password that could be found easily on a file system for example. If a specific device token is compromised (e.g. laptop theft), the user can revoke the device token in the web interface and generate a new one independent token for new device with their usual user credentials.\n\nA token is bound on the server to a triplet defined by:\n\n- a user name\n- an application name\n- a device identifier\n\nThis way a single user can have multiple tokens for different applications on different devices.\n\nFor example: the user _joe_ could have 3 tokens:\n\n- one for the Nuxeo Drive client on his Linux box\n- one for the Nuxeo Drive client on his Windows box\n- one for a Nuxeo Automation client application on his Linux box\n\nThe module includes a UI for the user to manage their tokens.\nFor now a token can only be revoked, but for later we are planning of setting an expiration date on tokens with a possibility to renew them.\n\n## Implementation\n\n### Handshake phase\n\nThe ``TokenAuthenticationServlet``, protected by basic authentication and mapped on the ``/authentication/token`` URL pattern, allows to get a unique token given some user information passed as request parameters:\n``applicationName``, ``deviceId``, ``deviceDescription`` and ``permission``.\n\nThe token is sent as plain text in the response body.\n\nAn error response will be sent with a 400 status code if one of the required parameters is null or empty.\nAll parameters are required except for the device description. The parameters are URI decoded by the Servlet.\n\nFor example, you could execute the following command to acquire a token:\n\n    curl -H 'Authorization:Basic **********************' -G 'http://server:port/nuxeo/authentication/token?applicationName=Nuxeo%20Drive&deviceId=device-1&deviceDescription=My%20Linux%20box&permission=rw'\n\nWhile the device description can typically be edited by the user (for instance in the JSF UI), both the Application Name and the device identifier should not change once the token has been generated.\n\n### Token bindings\n\nThe ``TokenAuthenticationService`` handles the token generation and storage of the token bindings.\n\n- A token is randomly generated using the ``UUID`` class from the JDK which ensures that it is unique and secure.\n- Token bindings are persisted in a SQL directory, using the token as a primary key.\n\nLooking back at the example of _joe_ and his 3 tokens, the server would hold these 3 token bindings:\n\n- {'tokenA', 'joe', 'Nuxeo Drive', 'device-1'}\n- {'tokenB', 'joe', 'Nuxeo Drive', 'device-2'}\n- {'tokenC', 'joe', 'Automation client', 'device-1'}\n\n### Authentication plugin\n\nThe module contributes a new ``authenticationPlugin`` called ``TOKEN_AUTH``, that handles authentication with a token sent as a request header.\nIt uses the ``TokenAuthenticationService`` to search for a user name bound to the given token.\n\nThis authentication plugin is configured to be used with the ``Trusting_LM`` ``LoginModule`` plugin =>\nno password check is done, a principal will be created from the user name if the user exists in the user directory.\n\nThe token must be put in a request header called ``X-Authentication-Token``.\n\nThe automation-specific authentication chain is overridden to use the ``TOKEN_AUTH`` plugin just after the basic authentication one.\nA specific authentication chain is also mapped on the token request header.\n\n    <extension\n      target=\"org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService\"\n      point=\"specificChains\">\n\n      <specificAuthenticationChain name=\"Automation\">\n        <urlPatterns>\n          <url>(.*)/automation.*</url>\n        </urlPatterns>\n        <replacementChain>\n          <plugin>AUTOMATION_BASIC_AUTH</plugin>\n          <plugin>TOKEN_AUTH</plugin>\n          <plugin>ANONYMOUS_AUTH</plugin>\n        </replacementChain>\n      </specificAuthenticationChain>\n\n      <specificAuthenticationChain name=\"TokenAuth\">\n        <headers>\n          <header name=\"X-Authentication-Token\">.*</header>\n        </headers>\n        <replacementChain>\n          <plugin>TOKEN_AUTH</plugin>\n        </replacementChain>\n      </specificAuthenticationChain>\n\n    </extension>\n\n### UI\n\nThe module provides the ``auth_token_bindings.xhtml`` view that includes the ``authTokenBindings`` layout to display the list of token bindings for the current user, with a _Revoke_ action on each token.\n\nFor now, as this module is mostly dedicated to [Nuxeo Drive] [2] (also see [NXP-10269] [3]), it only provides a layout and XHTML view for listing token bindings,\nbut does not include this view by default in the User Center. It will be used in the specific _Nuxeo Drive_ tab of the User Center.\n\n\n## About Nuxeo\n\nNuxeo provides a modular, extensible Java-based [open source software\nplatform for enterprise content management] [5] and packaged applications\nfor [document management] [6], [digital asset management] [7] and\n[case management] [8]. Designed by developers for developers, the Nuxeo\nplatform offers a modern architecture, a powerful plug-in model and\nextensive packaging capabilities for building content applications.\n\nMore information on: <http://www.nuxeo.com/>\n\n[1]: https://jira.nuxeo.com/browse/NXP-10268\n[2]: https://github.com/nuxeo/nuxeo-drive\n[3]: https://jira.nuxeo.com/browse/NXP-10269\n[5]: http://www.nuxeo.com/en/products/ep\n[6]: http://www.nuxeo.com/en/products/document-management\n[7]: http://www.nuxeo.com/en/products/dam\n[8]: http://www.nuxeo.com/en/products/case-management\n",
        "digest": "3b35d33d52743addaaeae11bcfcfb8bb",
        "encoding": "UTF-8",
        "length": 6297,
        "mimeType": "text/plain",
        "name": "README.md"
      },
      "requirements": [
        "org.nuxeo.ecm.platform.login"
      ],
      "version": "2023.55.23"
    }
  ],
  "creationDate": 1793874281513,
  "key": "Nuxeo Platform-2023.55",
  "name": "Nuxeo Platform",
  "operations": [],
  "packages": [],
  "pluginSnapshots": {},
  "releaseDate": 1793874281513,
  "version": "2023.55"
}