Groovy / Maven

Micronaut Basic Auth

Learn how to secure a Micronaut application using 'Basic' HTTP Authentication Scheme.

Sergio del Amo

On this guide

In this section

Getting Started

In this guide, we will create a Micronaut application written in Groovy and secure it with HTTP Basic Auth.

RFC7617 defines the "Basic" Hypertext Transfer Protocol (HTTP) authentication scheme, which transmits credentials as user-id/password pairs, encoded using Base64.

What you will need

To complete this guide, you will need the following:

Some time on your hands
A decent text editor or IDE (e.g. IntelliJ IDEA)
JDK 21 or greater installed with JAVA_HOME configured appropriately

Solution

We recommend that you follow the instructions in the next sections and create the application step by step. However, you can go right to the completed example.

Download and unzip the source

Writing the Application

Create an application using the Micronaut Command Line Interface or with Micronaut Launch.

mn create-app example.micronaut.micronautguide \
    --features=security \
    --build=maven \
    --lang=groovy \
    --test=spock

Note	If you don’t specify the `--build` argument, Gradle with the Kotlin DSL is used as the build tool. If you don’t specify the `--lang` argument, Java is used as the language. If you don’t specify the `--test` argument, JUnit is used for Java and Kotlin, and Spock is used for Groovy.

The previous command creates a Micronaut application with the default package example.micronaut in a directory named micronautguide.

If you use Micronaut Launch, select Micronaut Application as application type and add security features.

Note	If you have an existing Micronaut application and want to add the functionality described here, you can view the dependency and configuration changes from the specified features, and apply those changes to your application.

Diff

Setup IntelliJ IDEA to develop Micronaut Applications.

Authentication Provider

To keep this guide simple, create a naive AuthenticationProvider to simulate user authentication.

groovy/src/main/groovy/example/micronaut/AuthenticationProviderUserPassword.groovy

package example.micronaut

import io.micronaut.core.annotation.NonNull
import io.micronaut.core.annotation.Nullable
import io.micronaut.http.HttpRequest
import io.micronaut.security.authentication.AuthenticationFailureReason
import io.micronaut.security.authentication.AuthenticationRequest
import io.micronaut.security.authentication.AuthenticationResponse
import io.micronaut.security.authentication.provider.HttpRequestAuthenticationProvider
import jakarta.inject.Singleton

@Singleton // 
class AuthenticationProviderUserPassword<B> implements HttpRequestAuthenticationProvider<B> { // 

    AuthenticationResponse authenticate(
            @Nullable HttpRequest<B> httpRequest,
            @NonNull AuthenticationRequest<String, String> authenticationRequest
    ) {
        return authenticationRequest.identity == "sherlock" && authenticationRequest.secret == "password"
                ? AuthenticationResponse.success(authenticationRequest.getIdentity())
                : AuthenticationResponse.failure(AuthenticationFailureReason.CREDENTIALS_DO_NOT_MATCH)
    }
}

1	Use `jakarta.inject.Singleton` to designate a class as a singleton.
2	A Micronaut Authentication Provider implements the interface `io.micronaut.security.authentication.provider.HttpRequestAuthenticationProvider`.

Controllers

Create HomeController which resolves the base URL /:

groovy/src/main/groovy/example/micronaut/HomeController.groovy

package example.micronaut

import groovy.transform.CompileStatic
import io.micronaut.http.MediaType
import io.micronaut.http.annotation.Controller
import io.micronaut.http.annotation.Get
import io.micronaut.http.annotation.Produces
import io.micronaut.security.annotation.Secured
import io.micronaut.security.rules.SecurityRule

import java.security.Principal

@CompileStatic
@Secured(SecurityRule.IS_AUTHENTICATED) // 
@Controller // 
class HomeController {

    @Produces(MediaType.TEXT_PLAIN) // 
    @Get // 
    String index(Principal principal) { // 
        principal.name
    }
}

1	Annotate with `io.micronaut.security.Secured` to configure secured access. The `isAuthenticated()` expression will allow access only to authenticated users.
2	Annotate with `io.micronaut.http.annotation.Controller` to designate the class as a Micronaut controller.
3	You can specify the HTTP verb that a controller action responds to. To respond to a GET request, use the `io.micronaut.http.annotation.Get` annotation.
4	If a user is authenticated, the Micronaut framework will bind the user object to an argument of type `java.security.Principal` (if present).

WWW-Authenticate

Replace the default Exception Handler for AuthorizationExceptionHandler, the exception raised when a request is not authorized.

groovy/src/main/groovy/example/micronaut/DefaultAuthorizationExceptionHandlerReplacement.groovy

package example.micronaut

import io.micronaut.context.annotation.Replaces
import io.micronaut.core.annotation.Nullable
import io.micronaut.http.HttpRequest
import io.micronaut.http.HttpResponse
import io.micronaut.http.MutableHttpResponse
import io.micronaut.http.server.exceptions.response.ErrorResponseProcessor
import io.micronaut.security.authentication.AuthorizationException
import io.micronaut.security.authentication.DefaultAuthorizationExceptionHandler
import io.micronaut.security.config.RedirectConfiguration
import io.micronaut.security.config.RedirectService
import io.micronaut.security.errors.PriorToLoginPersistence
import jakarta.inject.Singleton

import static io.micronaut.http.HttpHeaders.WWW_AUTHENTICATE
import static io.micronaut.http.HttpStatus.FORBIDDEN
import static io.micronaut.http.HttpStatus.UNAUTHORIZED

@Singleton // 
@Replaces(DefaultAuthorizationExceptionHandler) // 
class DefaultAuthorizationExceptionHandlerReplacement extends DefaultAuthorizationExceptionHandler {

    DefaultAuthorizationExceptionHandlerReplacement(
            ErrorResponseProcessor<?> errorResponseProcessor,
            RedirectConfiguration redirectConfiguration,
            RedirectService redirectService,
            @Nullable PriorToLoginPersistence priorToLoginPersistence
    ) {
        super(errorResponseProcessor, redirectConfiguration, redirectService, priorToLoginPersistence)
    }

    @Override
    protected MutableHttpResponse<?> httpResponseWithStatus(HttpRequest request,
                                                            AuthorizationException e) {
        if (e.isForbidden()) {
            return HttpResponse.status(FORBIDDEN)
        }
        HttpResponse.status(UNAUTHORIZED)
                .header(WWW_AUTHENTICATE, 'Basic realm="Micronaut Guide"')
    }
}

The previous code adds the WWW-Authenticate header to indicate the authentication scheme.

1	Use `jakarta.inject.Singleton` to designate a class as a singleton.
2	Specify that `DefaultAuthorizationExceptionHandlerReplacement` replaces the bean `DefaultAuthorizationExceptionHandler`

Tests

Create a test to verify the user authentication flow via Basic Auth.

groovy/src/test/groovy/example/micronaut/BasicAuthSpec.groovy

package example.micronaut

import io.micronaut.http.HttpRequest
import io.micronaut.http.HttpResponse
import io.micronaut.http.client.HttpClient
import io.micronaut.http.client.annotation.Client
import io.micronaut.http.client.exceptions.HttpClientResponseException
import io.micronaut.test.extensions.spock.annotation.MicronautTest
import jakarta.inject.Inject
import spock.lang.Specification

import static io.micronaut.http.HttpStatus.OK
import static io.micronaut.http.HttpStatus.UNAUTHORIZED
import static io.micronaut.http.MediaType.TEXT_PLAIN

@MicronautTest // 
class BasicAuthSpec extends Specification {

    @Inject
    @Client("/")
    HttpClient client // 

    void "by default every endpoint is secured"() {
        when: 'Accessing a secured URL without authenticating'
        client.toBlocking().exchange(HttpRequest.GET('/').accept(TEXT_PLAIN)) // 

        then: 'returns unauthorized'
        HttpClientResponseException e = thrown() // 
        e.status == UNAUTHORIZED
        e.response.headers.contains("WWW-Authenticate")
        e.response.headers.get("WWW-Authenticate") == 'Basic realm="Micronaut Guide"'
    }

    void "Verify HTTP Basic Auth works"() {
        when: 'A secured URL is accessed with Basic Auth'
        HttpRequest request = HttpRequest.GET('/')
                .basicAuth("sherlock", "password") // 
        HttpResponse<String> rsp = client.toBlocking().exchange(request, String) // 

        then: 'the endpoint can be accessed'
        rsp.status == OK
        rsp.body() == 'sherlock' // 
    }
}

1	Annotate the class with `@MicronautTest` so the Micronaut framework will initialize the application context and the embedded server. More info.
2	Inject the `HttpClient` bean and point it to the embedded server.
3	Creating HTTP Requests is easy thanks to the Micronaut framework fluid API.
4	If you attempt to access a secured endpoint without authentication, 401 is returned
5	By using `basicAuth` method, you populate the `Authorization` header with user-id:password pairs, encoded using Base64.
6	The Micronaut `HttpClient` simplifies parsing the HTTP response payload to Java objects. In this example, we parse the response to `String`.
7	Use `.body()` to retrieve the parsed payload.

Use the Micronaut HTTP Client and Basic Auth

If you want to access a secured endpoint, you can also use a Micronaut HTTP Client and supply the Basic Auth as the Authorization header value.

First create a @Client with a method home which accepts an Authorization HTTP header.

groovy/src/test/groovy/example/micronaut/AppClient.groovy

package example.micronaut

import groovy.transform.CompileStatic
import io.micronaut.http.annotation.Consumes
import io.micronaut.http.annotation.Get
import io.micronaut.http.annotation.Header
import io.micronaut.http.client.annotation.Client

import static io.micronaut.http.MediaType.TEXT_PLAIN

@CompileStatic
@Client("/")
interface AppClient {

    @Consumes(TEXT_PLAIN) // 
    @Get
    String home(@Header String authorization) // 
}

1	The method consumes plain text, so the Micronaut framework includes the HTTP header `Accept: text/plain`.
2	The first character of the parameter name is capitalized and that value (`Authorization`) is used as the HTTP header name. To change the parameter name, specify the `@Header` annotation value.

Create a test which uses the previous @Client

groovy/src/test/groovy/example/micronaut/BasicAuthClientSpec.groovy

package example.micronaut

import io.micronaut.test.extensions.spock.annotation.MicronautTest
import jakarta.inject.Inject
import spock.lang.Specification

@MicronautTest // 
class BasicAuthClientSpec extends Specification {

    @Inject
    AppClient appClient // 

    void "Verify HTTP Basic Auth works"() {
        when:
        String credsEncoded = "sherlock:password".bytes.encodeBase64()
        String rsp = appClient.home("Basic $credsEncoded") // 

        then:
        rsp == 'sherlock'
    }
}

1	Annotate the class with `@MicronautTest` so the Micronaut framework will initialize the application context and the embedded server. More info.
2	Inject the `AppClient` bean.
3	Generate Basic Auth header value and pass it as the parameter value.

Testing the Application

To run the tests:

./mvnw test

Running the Application

To run the application, use the ./mvnw mn:run command, which starts the application on port 8080.

To test the running application, issue a GET request to localhost:8080 with a Basic Authentication header. One way to do this is with curl:

curl -v -u sherlock:password localhost:8080

If you open http://localhost:8080 in a browser, a login dialog pops up due to the WWW-Authenticate header.

Next Steps

See the Micronaut security documentation to learn more.

Help with the Micronaut Framework

The Micronaut Foundation sponsored the creation of this Guide. A variety of consulting and support services are available.

License

Note	All guides are released with an Apache License 2.0 for the code and a Creative Commons Attribution 4.0 license for the writing and media (images).