允许sdk支持多种身份验证方案的Java设计模式

Question

I am designing an sdk/client library for a http api. The api support multiple authentication mechanisms: basic auth, oauth, digest etc.

My client library is simple at the moment like this:

public MyAPIRestClient implements MyAPIClient {

   public MyAPIRestClient(String endpoint, String user, String pass){
    login(user, pass)
   }

   public void login(String user, String pass){
    //http code to login and get a cookie etc.
   }

   public Book getBook(String name){
    // http code to get a book
   }

}

What is the best design pattern to enable me to have multiple authentication mechanisms, without having to code all possible auth methods in the same client class? And to enable future auth mechanisms to easily be injected?

Answer 1

It is an odd thing to do you by yourself when this matter is very complex, difficult and has very good mature solutions including Apache Shiro and Spring Security. But I assume it's just an exercise in design patterns.

I would probably go for the chain of responsibility pattern. Have a generic interface like:

interface Authenticator {
    /**
    * Analyze the request and return an Authentication object
    * upon success, or null otherwise
    */
    Authentication authenticate(HttpServletRequest request);
}

Implement it for each authentication mechanism, checking cookies, POST data or what have you.

Then, call them like:

public Authentication authenticateRequest(HttpServletRequest request) {
    for (Authenticator ator : supportedAuthenticators) {
        Authentication a = ator.authenticate(request);
        if (a != null) {
            // Logged in successfully!
            return a;
        }
    }
    throw new LoginFailed();
}

Answer 2

The first thing that came to my mind is the strategy pattern:

public abstract class Authenticator{ //or interface
    public abstract boolean login(String user, String password);
}

The Authenticator is the pattern. You can extend/implement it with various authentication methods. In your main class you hold a specific pattern in a member, which you then call directly:

public class Main{
    private Authenticator auth;

    //choose auth in constructor or by choosing it in a List in some GUI
    //and create an Object that extends/implements Authenticator

    public void login(String user, String password){
        if(auth.login(user, password)){
            //do whatever is needed to complete login
        }
    }

}

This way you have minute control over which authentification method(s) are used.

If you change auth to an array or ArrayList, it is essentially the same as @Konrad Garus answer.

Answer 3

我建议使用一个具有基本身份验证方法签名的接口，并且实现类可以对这些身份验证方法进行不同的定义。