barrel_mcp_auth_basic (barrel_mcp v2.0.2)

View Source

Basic HTTP authentication provider for barrel_mcp.

Implements HTTP Basic Authentication (RFC 7617). Suitable for simple deployments, development, or when using TLS.

Configuration Options

  • credentials - Map of username to password or auth info
  • verifier - Custom verification function
  • realm - Realm for WWW-Authenticate header
  • hash_passwords - If true, stored passwords are SHA256 hashes

See also: barrel_mcp_auth.

Summary

Functions

authenticate(Request, State)

Authenticate a request using Basic auth.

challenge(Reason, State)

Generate WWW-Authenticate challenge.

hash_password(Password)

Hash a password using the default modern algorithm (PBKDF2-SHA256). Use hash_password/2 to choose explicitly.

hash_password(Password, Opts)

Hash a password using the chosen algorithm.

init(Opts)

Initialize the Basic auth provider.

verify_password(Password, Stored)

Verify a plaintext Password against a Stored hash. Accepts both the modern pbkdf2-sha256$... format and legacy hex SHA-256 digests (the latter for one release, with a logger warning on match). Returns ok or {error, invalid_credentials}.

Functions

authenticate(Request, State)

-spec authenticate(map(), map()) ->
                      {ok, barrel_mcp_auth:auth_info()} | {error, barrel_mcp_auth:auth_error()}.

Authenticate a request using Basic auth.

challenge(Reason, State)

-spec challenge(barrel_mcp_auth:auth_error(), map()) -> {integer(), map(), binary()}.

Generate WWW-Authenticate challenge.

hash_password(Password)

-spec hash_password(Password :: binary()) -> binary().

Hash a password using the default modern algorithm (PBKDF2-SHA256). Use hash_password/2 to choose explicitly.

hash_password(Password, Opts)

-spec hash_password(Password :: binary(), Opts :: map()) -> binary().

Hash a password using the chosen algorithm.

Opts may contain:

  • algorithm — pbkdf2-sha256 (default) or sha256-hex (deprecated; kept for migration only).
  • iterations — PBKDF2 iteration count (default 100000).

Stored format for the modern hash: pbkdf2-sha256$<iters>$<base64(salt)>$<base64(hash)>.

init(Opts)

-spec init(map()) -> {ok, map()}.

Initialize the Basic auth provider.

verify_password(Password, Stored)

-spec verify_password(Password :: binary(), Stored :: binary()) -> ok | {error, invalid_credentials}.

Verify a plaintext Password against a Stored hash. Accepts both the modern pbkdf2-sha256$... format and legacy hex SHA-256 digests (the latter for one release, with a logger warning on match). Returns ok or {error, invalid_credentials}.