Proxy Authentication for Jena 4.3+ SPARQL Clients

For Jena’s JDK-based HTTP stack, introduced in Jena 4.3, configure the transport passed to the query builder. A SPARQL endpoint password and a proxy password can be requested by different machines.

import java.net.InetSocketAddress;
import java.net.ProxySelector;
import java.net.http.HttpClient;
import org.apache.jena.sparql.exec.http.QueryExecutionHTTP;

var http = HttpClient.newBuilder()
    .proxy(ProxySelector.of(
        new InetSocketAddress("proxy.example", 8080)))
    .authenticator(proxyAuthenticator)
    .build();

var execution = QueryExecutionHTTP.service(endpointUrl)
    .httpClient(http)
    .query("ASK { ?s ?p ?o }")
    .build();

The fragment constructs a query execution. endpointUrl is the actual SPARQL service URL; proxyAuthenticator is an application-supplied java.net.Authenticator. Execute and close the query execution through the application’s normal query lifecycle.

In that authenticator’s getPasswordAuthentication method, return the proxy’s PasswordAuthentication only when getRequestorType() == RequestorType.PROXY and the requesting host and port match the configured intermediary. Return null for unrelated challenges. Attaching this object to the client keeps the choice local to that client.

Read what the proxy is asking for

A 407 response identifies a proxy authentication challenge. Its Proxy-Authenticate header tells you the offered schemes; the status alone does not distinguish Basic from NTLM or another scheme.

Match that offer against the deployed JDK client’s capabilities and authentication policy. Supplying username and password does not add an unsupported scheme. For HTTPS destinations, also inspect the JDK’s jdk.http.auth.tunneling.disabledSchemes policy; ordinary HTTP proxying has a separate disabledSchemes setting. The JDK’s Basic-authentication defaults for CONNECT are one such policy check.

Historical Jena examples using Apache HttpClient and SimpleNTAuthenticator belong to an older transport generation. If the corporate proxy requires an authentication mechanism unavailable in the current transport, arrange a supported integration with the network administrator instead of trying to cast those old authentication objects into the modern builder.