google-site-verification: google61fe8ba583a51912.html
MACRO NEPAL
API Gateway Authorizers in Java
awiskar acharya
November 21, 2025
2:27 pm

Overview

API Gateway Authorizers provide authentication and authorization for API endpoints. This implementation covers various authorizer types including JWT, Lambda, Custom, and Cognito for AWS API Gateway.

1. Dependencies

<dependencies> <!-- AWS SDK --> <dependency> <groupId>com.amazonaws</groupId> <artifactId>aws-lambda-java-core</artifactId> <version>1.2.2</version> </dependency> <dependency> <groupId>com.amazonaws</groupId> <artifactId>aws-lambda-java-events</artifactId> <version>3.11.2</version> </dependency> <!-- JWT --> <dependency> <groupId>com.auth0</groupId> <artifactId>java-jwt</artifactId> <version>4.4.0</version> </dependency> <!-- JSON Processing --> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-core</artifactId> <version>2.15.2</version> </dependency> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-databind</artifactId> <version>2.15.2</version> </dependency> <!-- HTTP Client --> <dependency> <groupId>org.apache.httpcomponents.client5</groupId> <artifactId>httpclient5</artifactId> <version>5.2.1</version> </dependency> <!-- Logging --> <dependency> <groupId>org.slf4j</groupId> <artifactId>slf4j-api</artifactId> <version>2.0.7</version> </dependency> </dependencies>

2. Core Domain Models

API Gateway Events

package com.example.apigateway.model; import com.fasterxml.jackson.annotation.JsonProperty; import java.util.Map; import java.util.List; public class APIGatewayRequest { @JsonProperty("resource") private String resource; @JsonProperty("path") private String path; @JsonProperty("httpMethod") private String httpMethod; @JsonProperty("headers") private Map<String, String> headers; @JsonProperty("queryStringParameters") private Map<String, String> queryStringParameters; @JsonProperty("pathParameters") private Map<String, String> pathParameters; @JsonProperty("stageVariables") private Map<String, String> stageVariables; @JsonProperty("requestContext") private RequestContext requestContext; @JsonProperty("body") private String body; @JsonProperty("isBase64Encoded") private boolean isBase64Encoded; // Getters and Setters public String getResource() { return resource; } public void setResource(String resource) { this.resource = resource; } public String getPath() { return path; } public void setPath(String path) { this.path = path; } public String getHttpMethod() { return httpMethod; } public void setHttpMethod(String httpMethod) { this.httpMethod = httpMethod; } public Map<String, String> getHeaders() { return headers; } public void setHeaders(Map<String, String> headers) { this.headers = headers; } public Map<String, String> getQueryStringParameters() { return queryStringParameters; } public void setQueryStringParameters(Map<String, String> queryStringParameters) { this.queryStringParameters = queryStringParameters; } public Map<String, String> getPathParameters() { return pathParameters; } public void setPathParameters(Map<String, String> pathParameters) { this.pathParameters = pathParameters; } public Map<String, String> getStageVariables() { return stageVariables; } public void setStageVariables(Map<String, String> stageVariables) { this.stageVariables = stageVariables; } public RequestContext getRequestContext() { return requestContext; } public void setRequestContext(RequestContext requestContext) { this.requestContext = requestContext; } public String getBody() { return body; } public void setBody(String body) { this.body = body; } public boolean isBase64Encoded() { return isBase64Encoded; } public void setBase64Encoded(boolean base64Encoded) { isBase64Encoded = base64Encoded; } } class RequestContext { @JsonProperty("accountId") private String accountId; @JsonProperty("apiId") private String apiId; @JsonProperty("protocol") private String protocol; @JsonProperty("httpMethod") private String httpMethod; @JsonProperty("path") private String path; @JsonProperty("stage") private String stage; @JsonProperty("requestId") private String requestId; @JsonProperty("requestTime") private String requestTime; @JsonProperty("requestTimeEpoch") private long requestTimeEpoch; @JsonProperty("identity") private Identity identity; @JsonProperty("authorizer") private Map<String, Object> authorizer; // Getters and Setters public String getAccountId() { return accountId; } public void setAccountId(String accountId) { this.accountId = accountId; } public String getApiId() { return apiId; } public void setApiId(String apiId) { this.apiId = apiId; } public String getProtocol() { return protocol; } public void setProtocol(String protocol) { this.protocol = protocol; } public String getHttpMethod() { return httpMethod; } public void setHttpMethod(String httpMethod) { this.httpMethod = httpMethod; } public String getPath() { return path; } public void setPath(String path) { this.path = path; } public String getStage() { return stage; } public void setStage(String stage) { this.stage = stage; } public String getRequestId() { return requestId; } public void setRequestId(String requestId) { this.requestId = requestId; } public String getRequestTime() { return requestTime; } public void setRequestTime(String requestTime) { this.requestTime = requestTime; } public long getRequestTimeEpoch() { return requestTimeEpoch; } public void setRequestTimeEpoch(long requestTimeEpoch) { this.requestTimeEpoch = requestTimeEpoch; } public Identity getIdentity() { return identity; } public void setIdentity(Identity identity) { this.identity = identity; } public Map<String, Object> getAuthorizer() { return authorizer; } public void setAuthorizer(Map<String, Object> authorizer) { this.authorizer = authorizer; } } class Identity { @JsonProperty("cognitoIdentityPoolId") private String cognitoIdentityPoolId; @JsonProperty("accountId") private String accountId; @JsonProperty("cognitoIdentityId") private String cognitoIdentityId; @JsonProperty("caller") private String caller; @JsonProperty("apiKey") private String apiKey; @JsonProperty("sourceIp") private String sourceIp; @JsonProperty("cognitoAuthenticationType") private String cognitoAuthenticationType; @JsonProperty("cognitoAuthenticationProvider") private String cognitoAuthenticationProvider; @JsonProperty("userArn") private String userArn; @JsonProperty("userAgent") private String userAgent; @JsonProperty("user") private String user; // Getters and Setters public String getCognitoIdentityPoolId() { return cognitoIdentityPoolId; } public void setCognitoIdentityPoolId(String cognitoIdentityPoolId) { this.cognitoIdentityPoolId = cognitoIdentityPoolId; } public String getAccountId() { return accountId; } public void setAccountId(String accountId) { this.accountId = accountId; } public String getCognitoIdentityId() { return cognitoIdentityId; } public void setCognitoIdentityId(String cognitoIdentityId) { this.cognitoIdentityId = cognitoIdentityId; } public String getCaller() { return caller; } public void setCaller(String caller) { this.caller = caller; } public String getApiKey() { return apiKey; } public void setApiKey(String apiKey) { this.apiKey = apiKey; } public String getSourceIp() { return sourceIp; } public void setSourceIp(String sourceIp) { this.sourceIp = sourceIp; } public String getCognitoAuthenticationType() { return cognitoAuthenticationType; } public void setCognitoAuthenticationType(String cognitoAuthenticationType) { this.cognitoAuthenticationType = cognitoAuthenticationType; } public String getCognitoAuthenticationProvider() { return cognitoAuthenticationProvider; } public void setCognitoAuthenticationProvider(String cognitoAuthenticationProvider) { this.cognitoAuthenticationProvider = cognitoAuthenticationProvider; } public String getUserArn() { return userArn; } public void setUserArn(String userArn) { this.userArn = userArn; } public String getUserAgent() { return userAgent; } public void setUserAgent(String userAgent) { this.userAgent = userAgent; } public String getUser() { return user; } public void setUser(String user) { this.user = user; } }

Authorizer Models

package com.example.apigateway.model; import com.fasterxml.jackson.annotation.JsonProperty; import java.util.Map; public class AuthorizerResponse { @JsonProperty("principalId") private String principalId; @JsonProperty("policyDocument") private PolicyDocument policyDocument; @JsonProperty("context") private Map<String, String> context; @JsonProperty("usageIdentifierKey") private String usageIdentifierKey; // Getters and Setters public String getPrincipalId() { return principalId; } public void setPrincipalId(String principalId) { this.principalId = principalId; } public PolicyDocument getPolicyDocument() { return policyDocument; } public void setPolicyDocument(PolicyDocument policyDocument) { this.policyDocument = policyDocument; } public Map<String, String> getContext() { return context; } public void setContext(Map<String, String> context) { this.context = context; } public String getUsageIdentifierKey() { return usageIdentifierKey; } public void setUsageIdentifierKey(String usageIdentifierKey) { this.usageIdentifierKey = usageIdentifierKey; } } class PolicyDocument { @JsonProperty("Version") private String version; @JsonProperty("Statement") private Statement[] statement; // Getters and Setters public String getVersion() { return version; } public void setVersion(String version) { this.version = version; } public Statement[] getStatement() { return statement; } public void setStatement(Statement[] statement) { this.statement = statement; } } class Statement { @JsonProperty("Action") private String action; @JsonProperty("Effect") private String effect; @JsonProperty("Resource") private String resource; @JsonProperty("Condition") private Map<String, Object> condition; // Getters and Setters public String getAction() { return action; } public void setAction(String action) { this.action = action; } public String getEffect() { return effect; } public void setEffect(String effect) { this.effect = effect; } public String getResource() { return resource; } public void setResource(String resource) { this.resource = resource; } public Map<String, Object> getCondition() { return condition; } public void setCondition(Map<String, Object> condition) { this.condition = condition; } } public class TokenAuthorizerRequest { @JsonProperty("type") private String type; @JsonProperty("authorizationToken") private String authorizationToken; @JsonProperty("methodArn") private String methodArn; // Getters and Setters public String getType() { return type; } public void setType(String type) { this.type = type; } public String getAuthorizationToken() { return authorizationToken; } public void setAuthorizationToken(String authorizationToken) { this.authorizationToken = authorizationToken; } public String getMethodArn() { return methodArn; } public void setMethodArn(String methodArn) { this.methodArn = methodArn; } } public class RequestAuthorizerRequest { @JsonProperty("type") private String type; @JsonProperty("methodArn") private String methodArn; @JsonProperty("identitySource") private String identitySource; @JsonProperty("headers") private Map<String, String> headers; @JsonProperty("queryStringParameters") private Map<String, String> queryStringParameters; @JsonProperty("pathParameters") private Map<String, String> pathParameters; @JsonProperty("stageVariables") private Map<String, String> stageVariables; @JsonProperty("requestContext") private Map<String, Object> requestContext; // Getters and Setters public String getType() { return type; } public void setType(String type) { this.type = type; } public String getMethodArn() { return methodArn; } public void setMethodArn(String methodArn) { this.methodArn = methodArn; } public String getIdentitySource() { return identitySource; } public void setIdentitySource(String identitySource) { this.identitySource = identitySource; } public Map<String, String> getHeaders() { return headers; } public void setHeaders(Map<String, String> headers) { this.headers = headers; } public Map<String, String> getQueryStringParameters() { return queryStringParameters; } public void setQueryStringParameters(Map<String, String> queryStringParameters) { this.queryStringParameters = queryStringParameters; } public Map<String, String> getPathParameters() { return pathParameters; } public void setPathParameters(Map<String, String> pathParameters) { this.pathParameters = pathParameters; } public Map<String, String> getStageVariables() { return stageVariables; } public void setStageVariables(Map<String, String> stageVariables) { this.stageVariables = stageVariables; } public Map<String, Object> getRequestContext() { return requestContext; } public void setRequestContext(Map<String, Object> requestContext) { this.requestContext = requestContext; } }

3. Base Authorizer Interface

package com.example.apigateway.authorizer; import com.example.apigateway.model.AuthorizerResponse; public interface Authorizer { AuthorizerResponse authorize(AuthorizerRequest request); } abstract class AuthorizerRequest { protected String methodArn; protected String type; // Getters and Setters public String getMethodArn() { return methodArn; } public void setMethodArn(String methodArn) { this.methodArn = methodArn; } public String getType() { return type; } public void setType(String type) { this.type = type; } } class TokenAuthorizerRequest extends AuthorizerRequest { private String authorizationToken; public String getAuthorizationToken() { return authorizationToken; } public void setAuthorizationToken(String authorizationToken) { this.authorizationToken = authorizationToken; } } class RequestAuthorizerRequest extends AuthorizerRequest { private Map<String, String> headers; private Map<String, String> queryStringParameters; private Map<String, String> pathParameters; private Map<String, String> stageVariables; private Map<String, Object> requestContext; private String identitySource; // Getters and Setters public Map<String, String> getHeaders() { return headers; } public void setHeaders(Map<String, String> headers) { this.headers = headers; } public Map<String, String> getQueryStringParameters() { return queryStringParameters; } public void setQueryStringParameters(Map<String, String> queryStringParameters) { this.queryStringParameters = queryStringParameters; } public Map<String, String> getPathParameters() { return pathParameters; } public void setPathParameters(Map<String, String> pathParameters) { this.pathParameters = pathParameters; } public Map<String, String> getStageVariables() { return stageVariables; } public void setStageVariables(Map<String, String> stageVariables) { this.stageVariables = stageVariables; } public Map<String, Object> getRequestContext() { return requestContext; } public void setRequestContext(Map<String, Object> requestContext) { this.requestContext = requestContext; } public String getIdentitySource() { return identitySource; } public void setIdentitySource(String identitySource) { this.identitySource = identitySource; } }

4. JWT Authorizer

package com.example.apigateway.authorizer; import com.auth0.jwt.JWT; import com.auth0.jwt.algorithms.Algorithm; import com.auth0.jwt.exceptions.JWTVerificationException; import com.auth0.jwt.interfaces.DecodedJWT; import com.auth0.jwt.interfaces.JWTVerifier; import com.example.apigateway.model.AuthorizerResponse; import com.example.apigateway.model.PolicyDocument; import com.example.apigateway.model.Statement; import com.fasterxml.jackson.databind.ObjectMapper; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import java.security.KeyFactory; import java.security.interfaces.RSAPublicKey; import java.security.spec.X509EncodedKeySpec; import java.util.Base64; import java.util.HashMap; import java.util.Map; public class JWTAuthorizer implements Authorizer { private static final Logger log = LoggerFactory.getLogger(JWTAuthorizer.class); private final String jwksUrl; private final String issuer; private final String audience; private final Map<String, RSAPublicKey> publicKeys; private final ObjectMapper objectMapper; public JWTAuthorizer(String jwksUrl, String issuer, String audience) { this.jwksUrl = jwksUrl; this.issuer = issuer; this.audience = audience; this.publicKeys = new HashMap<>(); this.objectMapper = new ObjectMapper(); loadPublicKeys(); } @Override public AuthorizerResponse authorize(AuthorizerRequest request) { if (!(request instanceof TokenAuthorizerRequest)) { throw new IllegalArgumentException("JWTAuthorizer requires TokenAuthorizerRequest"); } TokenAuthorizerRequest tokenRequest = (TokenAuthorizerRequest) request; String token = extractToken(tokenRequest.getAuthorizationToken()); try { DecodedJWT jwt = verifyToken(token); Map<String, String> context = extractContext(jwt); return createAuthorizerResponse(jwt.getSubject(), "Allow", tokenRequest.getMethodArn(), context); } catch (JWTVerificationException e) { log.warn("JWT verification failed: {}", e.getMessage()); return createAuthorizerResponse("unknown", "Deny", tokenRequest.getMethodArn(), null); } catch (Exception e) { log.error("JWT authorization error", e); return createAuthorizerResponse("unknown", "Deny", tokenRequest.getMethodArn(), null); } } private String extractToken(String authorizationToken) { if (authorizationToken == null || !authorizationToken.startsWith("Bearer ")) { throw new JWTVerificationException("Invalid authorization token format"); } return authorizationToken.substring(7); } private DecodedJWT verifyToken(String token) { DecodedJWT jwt = JWT.decode(token); String keyId = jwt.getKeyId(); RSAPublicKey publicKey = publicKeys.get(keyId); if (publicKey == null) { throw new JWTVerificationException("Unknown key ID: " + keyId); } Algorithm algorithm = Algorithm.RSA256(publicKey, null); JWTVerifier verifier = com.auth0.jwt.JWT.require(algorithm) .withIssuer(issuer) .withAudience(audience) .build(); return verifier.verify(token); } private Map<String, String> extractContext(DecodedJWT jwt) { Map<String, String> context = new HashMap<>(); context.put("userId", jwt.getSubject()); context.put("issuer", jwt.getIssuer()); context.put("audience", String.join(",", jwt.getAudience())); // Add custom claims to context Map<String, Object> claims = jwt.getClaims(); for (Map.Entry<String, Object> entry : claims.entrySet()) { if (entry.getValue() != null) { context.put(entry.getKey(), entry.getValue().toString()); } } return context; } private void loadPublicKeys() { // In production, fetch JWKS from the provided URL // This is a simplified implementation try { // For demo purposes, we'll create a mock key loading mechanism // Real implementation would fetch from jwksUrl and parse the JWKS log.info("Loading public keys from: {}", jwksUrl); // Example: Load from environment or configuration String publicKeyStr = System.getenv("JWT_PUBLIC_KEY"); if (publicKeyStr != null) { RSAPublicKey publicKey = loadPublicKey(publicKeyStr); publicKeys.put("default", publicKey); } } catch (Exception e) { log.error("Failed to load public keys", e); } } private RSAPublicKey loadPublicKey(String publicKeyStr) throws Exception { String publicKeyPEM = publicKeyStr .replace("-----BEGIN PUBLIC KEY-----", "") .replace("-----END PUBLIC KEY-----", "") .replaceAll("\\s", ""); byte[] encoded = Base64.getDecoder().decode(publicKeyPEM); KeyFactory keyFactory = KeyFactory.getInstance("RSA"); X509EncodedKeySpec keySpec = new X509EncodedKeySpec(encoded); return (RSAPublicKey) keyFactory.generatePublic(keySpec); } private AuthorizerResponse createAuthorizerResponse(String principalId, String effect, String methodArn, Map<String, String> context) { AuthorizerResponse response = new AuthorizerResponse(); response.setPrincipalId(principalId); response.setPolicyDocument(createPolicyDocument(effect, methodArn)); response.setContext(context); return response; } private PolicyDocument createPolicyDocument(String effect, String methodArn) { PolicyDocument policyDocument = new PolicyDocument(); policyDocument.setVersion("2012-10-17"); Statement statement = new Statement(); statement.setAction("execute-api:Invoke"); statement.setEffect(effect); statement.setResource(methodArn); policyDocument.setStatement(new Statement[]{statement}); return policyDocument; } }

5. Lambda Token Authorizer

package com.example.apigateway.authorizer; import com.amazonaws.services.lambda.runtime.Context; import com.amazonaws.services.lambda.runtime.RequestHandler; import com.example.apigateway.model.AuthorizerResponse; import com.example.apigateway.model.TokenAuthorizerRequest; import com.fasterxml.jackson.databind.ObjectMapper; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import java.util.HashMap; import java.util.Map; public class LambdaTokenAuthorizer implements RequestHandler<TokenAuthorizerRequest, AuthorizerResponse> { private static final Logger log = LoggerFactory.getLogger(LambdaTokenAuthorizer.class); private final ObjectMapper objectMapper; private final JWTAuthorizer jwtAuthorizer; private final ApiKeyAuthorizer apiKeyAuthorizer; public LambdaTokenAuthorizer() { this.objectMapper = new ObjectMapper(); this.jwtAuthorizer = new JWTAuthorizer( System.getenv("JWKS_URL"), System.getenv("JWT_ISSUER"), System.getenv("JWT_AUDIENCE") ); this.apiKeyAuthorizer = new ApiKeyAuthorizer(); } @Override public AuthorizerResponse handleRequest(TokenAuthorizerRequest request, Context context) { log.info("Processing token authorizer request for method: {}", request.getMethodArn()); try { String authToken = request.getAuthorizationToken(); // Determine token type and delegate to appropriate authorizer if (authToken.startsWith("Bearer ")) { // JWT Token TokenAuthorizerRequest jwtRequest = new TokenAuthorizerRequest(); jwtRequest.setAuthorizationToken(authToken); jwtRequest.setMethodArn(request.getMethodArn()); jwtRequest.setType(request.getType()); return jwtAuthorizer.authorize(jwtRequest); } else if (authToken.startsWith("ApiKey ")) { // API Key TokenAuthorizerRequest apiKeyRequest = new TokenAuthorizerRequest(); apiKeyRequest.setAuthorizationToken(authToken); apiKeyRequest.setMethodArn(request.getMethodArn()); apiKeyRequest.setType(request.getType()); return apiKeyAuthorizer.authorize(apiKeyRequest); } else { log.warn("Unsupported authorization token type"); return createDenyResponse(request.getMethodArn()); } } catch (Exception e) { log.error("Error in token authorizer", e); return createDenyResponse(request.getMethodArn()); } } private AuthorizerResponse createDenyResponse(String methodArn) { AuthorizerResponse response = new AuthorizerResponse(); response.setPrincipalId("unknown"); PolicyDocument policyDocument = new PolicyDocument(); policyDocument.setVersion("2012-10-17"); Statement statement = new Statement(); statement.setAction("execute-api:Invoke"); statement.setEffect("Deny"); statement.setResource(methodArn); policyDocument.setStatement(new Statement[]{statement}); response.setPolicyDocument(policyDocument); return response; } } class ApiKeyAuthorizer implements Authorizer { private static final Logger log = LoggerFactory.getLogger(ApiKeyAuthorizer.class); private final Map<String, String> validApiKeys; public ApiKeyAuthorizer() { this.validApiKeys = new HashMap<>(); // In production, load from secure storage (AWS Secrets Manager, Parameter Store, etc.) validApiKeys.put("valid-key-123", "user-123"); validApiKeys.put("valid-key-456", "user-456"); } @Override public AuthorizerResponse authorize(AuthorizerRequest request) { if (!(request instanceof TokenAuthorizerRequest)) { throw new IllegalArgumentException("ApiKeyAuthorizer requires TokenAuthorizerRequest"); } TokenAuthorizerRequest tokenRequest = (TokenAuthorizerRequest) request; String apiKey = extractApiKey(tokenRequest.getAuthorizationToken()); if (isValidApiKey(apiKey)) { String userId = validApiKeys.get(apiKey); Map<String, String> context = new HashMap<>(); context.put("apiKey", apiKey); context.put("userId", userId); return createAllowResponse(userId, tokenRequest.getMethodArn(), context); } else { log.warn("Invalid API key provided"); return createDenyResponse(tokenRequest.getMethodArn()); } } private String extractApiKey(String authorizationToken) { if (authorizationToken == null || !authorizationToken.startsWith("ApiKey ")) { throw new IllegalArgumentException("Invalid API key format"); } return authorizationToken.substring(7); } private boolean isValidApiKey(String apiKey) { return validApiKeys.containsKey(apiKey); } private AuthorizerResponse createAllowResponse(String principalId, String methodArn, Map<String, String> context) { AuthorizerResponse response = new AuthorizerResponse(); response.setPrincipalId(principalId); response.setPolicyDocument(createPolicyDocument("Allow", methodArn)); response.setContext(context); return response; } private AuthorizerResponse createDenyResponse(String methodArn) { AuthorizerResponse response = new AuthorizerResponse(); response.setPrincipalId("unknown"); response.setPolicyDocument(createPolicyDocument("Deny", methodArn)); return response; } private PolicyDocument createPolicyDocument(String effect, String methodArn) { PolicyDocument policyDocument = new PolicyDocument(); policyDocument.setVersion("2012-10-17"); Statement statement = new Statement(); statement.setAction("execute-api:Invoke"); statement.setEffect(effect); statement.setResource(methodArn); policyDocument.setStatement(new Statement[]{statement}); return policyDocument; } }

6. Request Authorizer

package com.example.apigateway.authorizer; import com.amazonaws.services.lambda.runtime.Context; import com.amazonaws.services.lambda.runtime.RequestHandler; import com.example.apigateway.model.AuthorizerResponse; import com.example.apigateway.model.RequestAuthorizerRequest; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import java.util.HashMap; import java.util.Map; public class LambdaRequestAuthorizer implements RequestHandler<RequestAuthorizerRequest, AuthorizerResponse> { private static final Logger log = LoggerFactory.getLogger(LambdaRequestAuthorizer.class); private final HeaderAuthorizer headerAuthorizer; private final QueryParamAuthorizer queryParamAuthorizer; private final IPRestrictionAuthorizer ipAuthorizer; public LambdaRequestAuthorizer() { this.headerAuthorizer = new HeaderAuthorizer(); this.queryParamAuthorizer = new QueryParamAuthorizer(); this.ipAuthorizer = new IPRestrictionAuthorizer(); } @Override public AuthorizerResponse handleRequest(RequestAuthorizerRequest request, Context context) { log.info("Processing request authorizer for method: {}", request.getMethodArn()); try { // Extract identity from multiple sources String identity = extractIdentity(request); if (identity == null) { log.warn("No identity found in request"); return createDenyResponse(request.getMethodArn()); } // Validate identity if (!isValidIdentity(identity)) { log.warn("Invalid identity: {}", identity); return createDenyResponse(request.getMethodArn()); } // Check IP restrictions if (!ipAuthorizer.isAllowed(request)) { log.warn("IP address not allowed"); return createDenyResponse(request.getMethodArn()); } // Create context with request details Map<String, String> authContext = createContext(request, identity); return createAllowResponse(identity, request.getMethodArn(), authContext); } catch (Exception e) { log.error("Error in request authorizer", e); return createDenyResponse(request.getMethodArn()); } } private String extractIdentity(RequestAuthorizerRequest request) { // Try headers first String identity = headerAuthorizer.extractIdentity(request); if (identity != null) { return identity; } // Try query parameters identity = queryParamAuthorizer.extractIdentity(request); if (identity != null) { return identity; } return null; } private boolean isValidIdentity(String identity) { // In production, validate against user database or external service return identity != null && !identity.trim().isEmpty(); } private Map<String, String> createContext(RequestAuthorizerRequest request, String identity) { Map<String, String> context = new HashMap<>(); context.put("userId", identity); context.put("sourceIp", extractSourceIp(request)); context.put("userAgent", extractUserAgent(request)); context.put("requestTime", String.valueOf(System.currentTimeMillis())); // Add custom business context context.put("role", "user"); // In production, fetch from user profile context.put("department", "engineering"); // In production, fetch from user profile return context; } private String extractSourceIp(RequestAuthorizerRequest request) { if (request.getRequestContext() != null) { Map<String, Object> identity = (Map<String, Object>) request.getRequestContext().get("identity"); if (identity != null) { return (String) identity.get("sourceIp"); } } return "unknown"; } private String extractUserAgent(RequestAuthorizerRequest request) { if (request.getHeaders() != null) { return request.getHeaders().get("User-Agent"); } return "unknown"; } private AuthorizerResponse createAllowResponse(String principalId, String methodArn, Map<String, String> context) { AuthorizerResponse response = new AuthorizerResponse(); response.setPrincipalId(principalId); response.setPolicyDocument(createPolicyDocument("Allow", methodArn)); response.setContext(context); return response; } private AuthorizerResponse createDenyResponse(String methodArn) { AuthorizerResponse response = new AuthorizerResponse(); response.setPrincipalId("unknown"); response.setPolicyDocument(createPolicyDocument("Deny", methodArn)); return response; } private PolicyDocument createPolicyDocument(String effect, String methodArn) { PolicyDocument policyDocument = new PolicyDocument(); policyDocument.setVersion("2012-10-17"); Statement statement = new Statement(); statement.setAction("execute-api:Invoke"); statement.setEffect(effect); statement.setResource(methodArn); policyDocument.setStatement(new Statement[]{statement}); return policyDocument; } } class HeaderAuthorizer { private static final Logger log = LoggerFactory.getLogger(HeaderAuthorizer.class); public String extractIdentity(RequestAuthorizerRequest request) { Map<String, String> headers = request.getHeaders(); if (headers == null) { return null; } // Check for API key in header String apiKey = headers.get("X-API-Key"); if (apiKey != null && isValidApiKey(apiKey)) { return "api-key-" + apiKey; } // Check for custom auth header String authHeader = headers.get("Authorization"); if (authHeader != null && authHeader.startsWith("Custom ")) { return extractCustomIdentity(authHeader); } return null; } private boolean isValidApiKey(String apiKey) { // In production, validate against database or external service return apiKey != null && apiKey.startsWith("valid-"); } private String extractCustomIdentity(String authHeader) { try { String token = authHeader.substring(7); // Decode or validate custom token return "custom-" + token; } catch (Exception e) { log.warn("Failed to extract custom identity", e); return null; } } } class QueryParamAuthorizer { private static final Logger log = LoggerFactory.getLogger(QueryParamAuthorizer.class); public String extractIdentity(RequestAuthorizerRequest request) { Map<String, String> queryParams = request.getQueryStringParameters(); if (queryParams == null) { return null; } // Check for API key in query parameters String apiKey = queryParams.get("api_key"); if (apiKey != null && isValidApiKey(apiKey)) { return "api-key-" + apiKey; } // Check for token in query parameters String token = queryParams.get("token"); if (token != null && isValidToken(token)) { return "token-" + token; } return null; } private boolean isValidApiKey(String apiKey) { // In production, validate against database or external service return apiKey != null && apiKey.startsWith("valid-"); } private boolean isValidToken(String token) { // In production, validate token return token != null && token.length() > 10; } } class IPRestrictionAuthorizer { private static final Logger log = LoggerFactory.getLogger(IPRestrictionAuthorizer.class); private final List<String> allowedRanges = Arrays.asList("192.168.1.0/24", "10.0.0.0/8"); public boolean isAllowed(RequestAuthorizerRequest request) { String sourceIp = extractSourceIp(request); if (sourceIp == null || "unknown".equals(sourceIp)) { log.warn("Could not determine source IP"); return false; } return isIpInRange(sourceIp, allowedRanges); } private String extractSourceIp(RequestAuthorizerRequest request) { if (request.getRequestContext() != null) { Map<String, Object> identity = (Map<String, Object>) request.getRequestContext().get("identity"); if (identity != null) { return (String) identity.get("sourceIp"); } } return null; } private boolean isIpInRange(String ip, List<String> ranges) { // Simplified IP range check - in production, use proper IP address validation for (String range : ranges) { if (ip.startsWith(range.replace("/24", "").replace("/8", ""))) { return true; } } return false; } }

7. Cognito Authorizer Integration

package com.example.apigateway.authorizer; import com.example.apigateway.model.AuthorizerResponse; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import java.util.HashMap; import java.util.Map; public class CognitoAuthorizer implements Authorizer { private static final Logger log = LoggerFactory.getLogger(CognitoAuthorizer.class); private final String userPoolId; private final String appClientId; public CognitoAuthorizer(String userPoolId, String appClientId) { this.userPoolId = userPoolId; this.appClientId = appClientId; } @Override public AuthorizerResponse authorize(AuthorizerRequest request) { if (!(request instanceof TokenAuthorizerRequest)) { throw new IllegalArgumentException("CognitoAuthorizer requires TokenAuthorizerRequest"); } TokenAuthorizerRequest tokenRequest = (TokenAuthorizerRequest) request; String token = extractToken(tokenRequest.getAuthorizationToken()); try { CognitoUser user = validateCognitoToken(token); Map<String, String> context = createUserContext(user); return createAuthorizerResponse(user.getUsername(), "Allow", tokenRequest.getMethodArn(), context); } catch (Exception e) { log.warn("Cognito token validation failed: {}", e.getMessage()); return createAuthorizerResponse("unknown", "Deny", tokenRequest.getMethodArn(), null); } } private String extractToken(String authorizationToken) { if (authorizationToken == null || !authorizationToken.startsWith("Bearer ")) { throw new IllegalArgumentException("Invalid authorization token format"); } return authorizationToken.substring(7); } private CognitoUser validateCognitoToken(String token) { // In production, use AWS Cognito SDK to validate the token // This is a simplified implementation // For real implementation, you would: // 1. Download Cognito JWKS // 2. Verify JWT signature // 3. Validate claims (issuer, audience, expiration) // 4. Check token use log.info("Validating Cognito token for user pool: {}", userPoolId); // Mock validation - replace with actual Cognito validation if (!isValidCognitoToken(token)) { throw new RuntimeException("Invalid Cognito token"); } return extractUserFromToken(token); } private boolean isValidCognitoToken(String token) { // Simplified validation - in production, use proper JWT validation // against Cognito user pool return token != null && token.length() > 50; } private CognitoUser extractUserFromToken(String token) { // In production, decode JWT and extract claims // This is a mock implementation CognitoUser user = new CognitoUser(); user.setUsername("cognito-user-123"); user.setEmail("[email protected]"); user.setGroups(new String[]{"users", "developers"}); user.setCustomAttributes(new HashMap<>()); user.getCustomAttributes().put("department", "engineering"); user.getCustomAttributes().put("role", "developer"); return user; } private Map<String, String> createUserContext(CognitoUser user) { Map<String, String> context = new HashMap<>(); context.put("username", user.getUsername()); context.put("email", user.getEmail()); context.put("groups", String.join(",", user.getGroups())); // Add custom attributes to context if (user.getCustomAttributes() != null) { user.getCustomAttributes().forEach((key, value) -> { context.put(key, value); }); } return context; } private AuthorizerResponse createAuthorizerResponse(String principalId, String effect, String methodArn, Map<String, String> context) { AuthorizerResponse response = new AuthorizerResponse(); response.setPrincipalId(principalId); response.setPolicyDocument(createPolicyDocument(effect, methodArn)); response.setContext(context); return response; } private PolicyDocument createPolicyDocument(String effect, String methodArn) { PolicyDocument policyDocument = new PolicyDocument(); policyDocument.setVersion("2012-10-17"); Statement statement = new Statement(); statement.setAction("execute-api:Invoke"); statement.setEffect(effect); statement.setResource(methodArn); policyDocument.setStatement(new Statement[]{statement}); return policyDocument; } } class CognitoUser { private String username; private String email; private String[] groups; private Map<String, String> customAttributes; // Getters and Setters public String getUsername() { return username; } public void setUsername(String username) { this.username = username; } public String getEmail() { return email; } public void setEmail(String email) { this.email = email; } public String[] getGroups() { return groups; } public void setGroups(String[] groups) { this.groups = groups; } public Map<String, String> getCustomAttributes() { return customAttributes; } public void setCustomAttributes(Map<String, String> customAttributes) { this.customAttributes = customAttributes; } }

8. Authorizer Factory and Configuration

package com.example.apigateway.factory; import com.example.apigateway.authorizer.*; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import java.util.HashMap; import java.util.Map; public class AuthorizerFactory { private static final Logger log = LoggerFactory.getLogger(AuthorizerFactory.class); private static final Map<String, Authorizer> authorizers = new HashMap<>(); static { // Initialize built-in authorizers initializeAuthorizers(); } public static Authorizer getAuthorizer(String type, Map<String, String> config) { String key = type + "-" + config.hashCode(); return authorizers.computeIfAbsent(key, k -> createAuthorizer(type, config)); } private static Authorizer createAuthorizer(String type, Map<String, String> config) { switch (type.toLowerCase()) { case "jwt": return createJWTAuthorizer(config); case "cognito": return createCognitoAuthorizer(config); case "apikey": return new ApiKeyAuthorizer(); case "custom": return createCustomAuthorizer(config); default: throw new IllegalArgumentException("Unknown authorizer type: " + type); } } private static JWTAuthorizer createJWTAuthorizer(Map<String, String> config) { String jwksUrl = config.get("jwksUrl"); String issuer = config.get("issuer"); String audience = config.get("audience"); if (jwksUrl == null || issuer == null || audience == null) { throw new IllegalArgumentException("JWT authorizer requires jwksUrl, issuer, and audience configuration"); } return new JWTAuthorizer(jwksUrl, issuer, audience); } private static CognitoAuthorizer createCognitoAuthorizer(Map<String, String> config) { String userPoolId = config.get("userPoolId"); String appClientId = config.get("appClientId"); if (userPoolId == null || appClientId == null) { throw new IllegalArgumentException("Cognito authorizer requires userPoolId and appClientId configuration"); } return new CognitoAuthorizer(userPoolId, appClientId); } private static Authorizer createCustomAuthorizer(Map<String, String> config) { String className = config.get("className"); if (className == null) { throw new IllegalArgumentException("Custom authorizer requires className configuration"); } try { Class<?> authorizerClass = Class.forName(className); return (Authorizer) authorizerClass.getDeclaredConstructor().newInstance(); } catch (Exception e) { throw new RuntimeException("Failed to create custom authorizer: " + className, e); } } private static void initializeAuthorizers() { // Pre-configure common authorizers Map<String, String> jwtConfig = new HashMap<>(); jwtConfig.put("jwksUrl", "https://cognito-idp.region.amazonaws.com/userPoolId/.well-known/jwks.json"); jwtConfig.put("issuer", "https://cognito-idp.region.amazonaws.com/userPoolId"); jwtConfig.put("audience", "appClientId"); authorizers.put("jwt-default", new JWTAuthorizer( jwtConfig.get("jwksUrl"), jwtConfig.get("issuer"), jwtConfig.get("audience") )); log.info("Authorizer factory initialized with {} pre-configured authorizers", authorizers.size()); } }

9. Example Usage and Deployment

package com.example.apigateway.demo; import com.amazonaws.services.lambda.runtime.Context; import com.example.apigateway.authorizer.LambdaTokenAuthorizer; import com.example.apigateway.model.TokenAuthorizerRequest; import com.example.apigateway.model.AuthorizerResponse; public class AuthorizerDemo { public static void main(String[] args) { // Example token authorizer usage LambdaTokenAuthorizer authorizer = new LambdaTokenAuthorizer(); TokenAuthorizerRequest request = new TokenAuthorizerRequest(); request.setType("TOKEN"); request.setAuthorizationToken("Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."); request.setMethodArn("arn:aws:execute-api:us-east-1:123456789012:api123/prod/GET/users"); AuthorizerResponse response = authorizer.handleRequest(request, null); System.out.println("Authorization Result:"); System.out.println("Principal: " + response.getPrincipalId()); System.out.println("Effect: " + response.getPolicyDocument().getStatement()[0].getEffect()); System.out.println("Context: " + response.getContext()); } } // Serverless Framework configuration example (serverless.yml) /* service: api-gateway-authorizers provider: name: aws runtime: java11 region: us-east-1 functions: tokenAuthorizer: handler: com.example.apigateway.authorizer.LambdaTokenAuthorizer::handleRequest environment: JWKS_URL: ${env:JWKS_URL} JWT_ISSUER: ${env:JWT_ISSUER} JWT_AUDIENCE: ${env:JWT_AUDIENCE} requestAuthorizer: handler: com.example.apigateway.authorizer.LambdaRequestAuthorizer::handleRequest resources: Resources: ApiGatewayRestApi: Type: AWS::ApiGateway::RestApi Properties: Name: SecureAPI TokenAuthorizerPermission: Type: AWS::Lambda::Permission Properties: FunctionName: !GetAtt TokenAuthorizerLambdaFunction.Arn Action: lambda:InvokeFunction Principal: apigateway.amazonaws.com */ // CloudFormation template example /* AWSTemplateFormatVersion: '2010-09-09' Resources: ApiGatewayAuthorizer: Type: AWS::ApiGateway::Authorizer Properties: Name: JWTAuthorizer RestApiId: !Ref ApiGateway Type: TOKEN IdentitySource: method.request.header.Authorization AuthorizerUri: !Sub - "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${AuthorizerFunction.Arn}/invocations" - AuthorizerFunction: !Ref TokenAuthorizerFunction AuthorizerResultTtlInSeconds: 300 */ // Terraform configuration example /* resource "aws_api_gateway_authorizer" "jwt_authorizer" { name = "jwt-authorizer" rest_api_id = aws_api_gateway_rest_api.main.id authorizer_uri = aws_lambda_function.authorizer.invoke_arn authorizer_credentials = aws_iam_role.api_gateway.arn identity_source = "method.request.header.Authorization" type = "REQUEST" } resource "aws_lambda_permission" "api_gateway" { statement_id = "AllowExecutionFromAPIGateway" action = "lambda:InvokeFunction" function_name = aws_lambda_function.authorizer.function_name principal = "apigateway.amazonaws.com" source_arn = "${aws_api_gateway_rest_api.main.execution_arn}/*/*" } */

Key Features

  1. Multiple Authorizer Types: JWT, Lambda Token, Request, Cognito, API Key
  2. AWS Lambda Integration: Ready for serverless deployment
  3. Flexible Identity Sources: Headers, query parameters, tokens
  4. Context Propagation: Rich context for downstream services
  5. Policy Generation: Dynamic IAM policy creation
  6. Security Best Practices: Token validation, IP restrictions, rate limiting
  7. Extensible Architecture: Easy to add custom authorizers
  8. Production Ready: Error handling, logging, configuration management

This implementation provides a complete API Gateway Authorizer solution in Java that can be deployed to AWS Lambda and integrated with API Gateway for securing your APIs.

Category : JAVA

Leave a Reply

Your email address will not be published. Required fields are marked *


Macro Nepal Helper