Support HTTP Authentication in HttpClient

[raccoonback]

Summary

Add flexible HTTP authentication framework to HttpClient with support for custom authentication mechanisms including SPNEGO/Negotiate, OAuth, Bearer tokens, and Basic authentication.

Changes

httpAuthentication - For immediate credential computation

HttpClient.httpAuthentication(
                               BiPredicate<HttpClientRequest, HttpClientResponse> retryPredicate,
                               BiConsumer<HttpClientRequest, SocketAddress> authenticator)

HttpClient.httpAuthentication(
                               BiPredicate<HttpClientRequest, HttpClientResponse> retryPredicate,
                               BiConsumer<HttpClientRequest, SocketAddress> authenticator,
                               int maxRetries)

httpAuthenticationWhen - For deferred credential retrieval

HttpClient.httpAuthenticationWhen(
                                 BiPredicate<HttpClientRequest, HttpClientResponse> retryPredicate,
                                 BiFunction<HttpClientRequest, SocketAddress, Mono<Void>> authenticator)

HttpClient.httpAuthenticationWhen(
                                 BiPredicate<HttpClientRequest, HttpClientResponse> retryPredicate,
                                 BiFunction<HttpClientRequest, SocketAddress, Mono<Void>> authenticator,
                                 int maxRetries)

Key Features

• Flexible authentication framework: Support for any HTTP-based authentication flow
• Configurable retry mechanism: Custom predicate to determine when to retry authentication
• Configurable max retries: Set maximum authentication retry attempts (default: 1)
• Retry tracking: authenticationRetryCount() method in HttpClientInfos to track retry attempts
• Exception handling: New HttpClientAuthenticationException for authentication failures

Authentication Flow

1. Initial request sent to protected resource
2. Server responds with authentication challenge (e.g., 401 Unauthorized)
3. Retry predicate evaluates response to determine if authentication is needed
4. Authenticator adds credentials to request headers
5. Request retried with authentication credentials
6. Process repeats up to maxRetries if authentication continues to fail

Related Issue

Fixes #3079

[raccoonback]

I tested Kerberos authentication using the krb5 available at https://formulae.brew.sh/formula/krb5.

[raccoonback]

@violetagg
Hello!
Please check this PR when you have a chance. 😃

[wendigo]

This is so great! Looking forward to get this in :)

[wendigo]

I can provide some guidance around APIs and configuration. Not every kerberos-enabled client uses JAAS, therefore the direct Subject/SPNEGO token support should be provided

[raccoonback]

@wendigo
Hello!
Thank you for the great point. 😀

I was thinking of allowing users to implement the SpnegoAuthenticator interface, similar to JaasAuthenticator, to support custom authentication logic if needed.

If I understood you correctly, you're suggesting that we should provide a way for users to directly supply a Subject, as in the example below:

public class DirectSubjectAuthenticator implements SpnegoAuthenticator {

    // ...
    private Subject subject;

    @Override
    public Subject login() throws LoginException {
        return subject;
    }

    // ...
}

Would you be able to share a more concrete example or use case?
It would help refine the design in the right direction.

[wendigo]

Sure @raccoonback.

I'd like to use reactor-netty in the trino CLI/JDBC/client libraries.

We support delegated/constrained/unconstrained kerberos authentication. Relevant code is here:

https://github.com/trinodb/trino/tree/master/client/trino-client/src/main/java/io/trino/client/auth/kerberos

This is how we add it to the okhttp: https://github.com/trinodb/trino/blob/master/client/trino-client/src/main/java/io/trino/client/auth/kerberos/SpnegoHandler.java

Configurability is important as we expose configuration that allows the user to pass remote service name, service principal name, whether to canonicalize hostname: https://github.com/trinodb/trino/blob/master/client/trino-client/src/main/java/io/trino/client/auth/kerberos/SpnegoHandler.java#L50C5-L54C48

[raccoonback]

@violetagg
I think supporting not only JAAS-based authentication but also allowing the user to provide a GSSCredential directly could improve configurability and flexibility.
This would be especially useful in environments where JAAS is not preferred or where credentials need to be managed programmatically.
What do you think about this direction?

cc. @wendigo

[violetagg]

I'm currently on vacation. When I return I'll check it. На нд, 27.07.2025 г. в 18:21 KOSEUNGBIN ***@***.***> написа:

…

*raccoonback* left a comment (reactor/reactor-netty#3813) <#3813 (comment)> @violetagg <https://github.com/violetagg> I think supporting not only JAAS-based authentication but also allowing the user to provide a GSSCredential directly could improve configurability and flexibility. This would be especially useful in environments where JAAS is not preferred or where credentials need to be managed programmatically. What do you think about this direction? cc. @wendigo <https://github.com/wendigo> — Reply to this email directly, view it on GitHub <#3813 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAFKCVJR2CIDYFH4XV65ZID3KTU6LAVCNFSM6AAAAAB75EX2K6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTCMRUGQ4DSNBVGA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[raccoonback]

@wendigo
I've added GSSCredential-based SPNEGO authentication and support for service name and canonical hostname configuration.
Thank you for the suggestion.

[raccoonback]

@violetagg
Hello.
I would appreciate it if you could review this PR.
Thanks!

[violetagg]

@violetagg Hello. I would appreciate it if you could review this PR. Thanks!

I'm just returning fro vacation, will check it in the next days or so

[raccoonback]

@violetagg
Hello.
I would appreciate it if you could review this PR.
Thanks!

[violetagg]

I will check this one ... just need to finalise some other tasks.

[raccoonback]

@violetagg
I’ve applied all the review comments.
Please take another look. 🙂

[raccoonback]

@violetagg
I’ve applied all the review comments!
Please take another look.

[raccoonback]

@violetagg
Hello.
I'd appreciate it if you could review this PR.

[violetagg]

Let's also expose the number of authentication retries similar to reactor.netty.http.client.HttpClientInfos#redirectedFrom, it might be helpful when users need to decide whether want to continue the retry or not. What do you think?

[raccoonback]

Let's also expose the number of authentication retries similar to reactor.netty.http.client.HttpClientInfos#redirectedFrom, it might be helpful when users need to decide whether want to continue the retry or not. What do you think?

@violetagg
That’s an excellent suggestion. I’ll go ahead and add it.

[raccoonback]

@violetagg
Hello.
I've reflect it.
Please check this PR!

[raccoonback]

@violetagg
Hello.
I've reflect it.
Please check this PR. 😀😃