Authentication

Authentication

wamp2spring supports both transport-level identity and WAMP-level authentication.

Transport principal

If the underlying servlet or reactive transport already exposes a Principal, that identity can be associated with the WAMP session.

When no WAMP auth method is negotiated, the session can still be established using the transport principal, or as anonymous if no principal is available.

WAMP authentication flow

During session establishment:

1. The client sends HELLO with a realm and optional requested auth methods.
2. The server accepts the client-supplied realm value but does not partition routing by realm.
3. If a matching WampAuthenticationProvider is available, the server issues CHALLENGE.
4. The client responds with AUTHENTICATE.
5. On success, the server establishes the session and returns WELCOME with auth metadata.

If no requested auth method is supported, session establishment fails with the appropriate WAMP error.

Built-in provider implementations

The current codebase includes these provider implementations:

• TicketWampAuthenticationProvider
• WampCraAuthenticationProvider
• WampScramAuthenticationProvider
• DynamicAuthenticationProvider

Custom authentication providers

You can add one or more Spring beans implementing WampAuthenticationProvider.

Each provider:

• declares the auth method name it handles
• creates a challenge for HELLO
• validates the AUTHENTICATE response
• returns the resulting principal and auth metadata

Session metadata

After successful authentication, the WAMP session stores metadata such as:

• WAMP session id
• client-supplied realm from HELLO
• peer roles
• auth method
• auth provider
• authenticated principal

That metadata is then available to routing, authorization, and application-level processing.