---
schema_version: "1"
id: bab2546fc95c7306d8424a3b5c4a457afb16a73b1b2abf6e27be29c6d5a23003
title: Authentication Handler
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/mule-sdk/latest/authentication-handler.md
canonical_url: https://docs.mulesoft.com/mule-sdk/latest/authentication-handler
source_site: docs.mulesoft.com
content_type: documentation
content_hash: d2b560f4d9a96e29f4c1563c9b256477f00934563ae80998181d1aff7980fbca
description: MuleSoft Documentation Site
release: "1.13"
latest: true
---
---
product: Mule SDK
version: 1.13
is-latest-version: true
---

# Authentication Handler

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

This handler allows you to configure the current context’s authentication, which is used for
encryption and inbound authentication, based on a given request.

## How to Use the Authentication Handler

When you add a parameter of type `AuthenticationHandler` to your operation, the Authentication
Handler instance from the current context will be injected in runtime. You can use this instance to
check the current authentication (if there is any) and set a new one.

The Authentication Handler interface provides the following methods:

- `createCredentialsBuilder` returns a builder that is used to create a `Credentials` instance.

- `createAuthentication`, when given an instance of `Credentials`, creates an `Authentication`
  instance.

- `setAuthentication`, when given an `Authentication`, sets that value as the current context’s
  authentication. Optionally, you can also provide a List of security providers (the names) that
  will be added to the `SecurityManager`.

- `getAuthentication` returns the `Authentication` from the current context. There may be no
  `Authentication` for the current context.

## Usage Example

Imagine that after receiving an HTTP Request, you want to authenticate and store the credentials on
the current context’s Authentication Handler. You can use the `basic-security-filter` operation from
the HTTP Connector for this use case.

This simplified example shows how the `basic-security-filter` is implemented:

```java
public class HttpOperations {

  /**
   * Authenticates received HTTP requests. Must be used after a listener component.
   */
  @Throws(BasicSecurityErrorTypeProvider.class)
  public void basicSecurityFilter(@ParameterGroup(name = "Security Filter") HttpBasicAuthenticationFilter filter,
                                  AuthenticationHandler authenticationHandler) { (1)
    try {
      filter.authenticate(authenticationHandler);
    } catch (BasicUnauthorisedException e) {
      throw new ModuleException(BASIC_AUTHENTICATION, e);
    } catch (SecurityProviderNotFoundException | SecurityException | UnknownAuthenticationTypeException e) {
      throw new ModuleException(SERVER_SECURITY, e);
    }
  }
 // ...
}
```

<table><tbody><tr><td><i data-value="1"></i><b>1</b></td><td>The operation has an <code>AuthenticationHandler</code> parameter that will be injected in runtime.</td></tr></tbody></table>

```java
public class HttpBasicAuthenticationFilter {

  @Parameter
  private String realm;

  @Parameter
  @Optional
  @NullSafe
  private List<String> securityProviders;

  @Parameter
  @Optional(defaultValue = "#[attributes]")
  HttpRequestAttributes attributes; (1)

  public void authenticate(AuthenticationHandler authenticationHandler)
      throws SecurityException, SecurityProviderNotFoundException, UnknownAuthenticationTypeException {
    String header = attributes.getHeaders().get("Authorization".toLowerCase());

    if ((header != null) && header.startsWith("Basic ")) {

      String username = retrieveUsername(header);
      String password = retrievePassword(header);


      Credentials credentials = authenticationHandler.createCredentialsBuilder() (2)
          .withUsername(username)
          .withPassword(password.toCharArray())
          .build();

      try {
        Authentication authentication = authenticationHandler.createAuthentication(credentials); (3)
        authenticationHandler.setAuthentication(securityProviders, authentication); (4)
      } catch (UnauthorisedException e) { (5)
        throw new BasicUnauthorisedException(authFailedForUser(username), e);
      }

    } else if (header == null) {
      throw new BasicUnauthorisedException(null, "HTTP basic authentication", "HTTP listener");
    } else {
      throw new UnsupportedAuthenticationSchemeException("Http Basic filter doesn't know how to handle header " + header));
    }
  }

}
```

<table><tbody><tr><td><i data-value="1"></i><b>1</b></td><td><code>HttpRequestAttributes</code> from where the username and password will be taken.</td></tr><tr><td><i data-value="2"></i><b>2</b></td><td><code>Credentials</code> are created with the information taken from the request.</td></tr><tr><td><i data-value="3"></i><b>3</b></td><td>An <code>Authentication</code> is created based on <code>Credentials</code>.</td></tr><tr><td><i data-value="4"></i><b>4</b></td><td>The authentication information is checked against the <code>securityProviders</code> and set to the handler.</td></tr><tr><td><i data-value="5"></i><b>5</b></td><td>When the authentication information is invalid, and an exception is thrown.</td></tr></tbody></table>

If there is another operation in the flow that has an Authentication Handler as a parameter, the
instance that is injected will be the same as the one that is handled on the
`basic-authentication-filter` operation. This way, by using the `getAuthentication` method, you will
get the `Authentication` with the credentials from the HTTP Request.