Examples with AccessDeniedException org.springframework.security.access.AccessDeniedException used on opensource projects

Example 6 with AccessDeniedException

use of org.springframework.security.access.AccessDeniedException in project spring-security-oauth by spring-projects.

the class OAuth2RestTemplateTests method testTokenIsResetIfInvalid.

@Test
public void testTokenIsResetIfInvalid() throws Exception {
    DefaultOAuth2AccessToken token = new DefaultOAuth2AccessToken("TEST");
    token.setExpiration(new Date(System.currentTimeMillis() - 1000));
    restTemplate.getOAuth2ClientContext().setAccessToken(token);
    restTemplate.setAccessTokenProvider(new StubAccessTokenProvider() {

        @Override
        public OAuth2AccessToken obtainAccessToken(OAuth2ProtectedResourceDetails details, AccessTokenRequest parameters) throws UserRedirectRequiredException, AccessDeniedException {
            throw new UserRedirectRequiredException("http://foo.com", Collections.<String, String>emptyMap());
        }
    });
    try {
        OAuth2AccessToken newToken = restTemplate.getAccessToken();
        assertNotNull(newToken);
        fail("Expected UserRedirectRequiredException");
    } catch (UserRedirectRequiredException e) {
    // planned
    }
    // context token should be reset as it clearly is invalid at this point
    assertNull(restTemplate.getOAuth2ClientContext().getAccessToken());
}

Example 7 with AccessDeniedException

use of org.springframework.security.access.AccessDeniedException in project camel by apache.

the class SpringSecurityAuthorizationPolicy method beforeProcess.

protected void beforeProcess(Exchange exchange) throws Exception {
    List<ConfigAttribute> attributes = accessPolicy.getConfigAttributes();
    try {
        Authentication authToken = getAuthentication(exchange.getIn());
        if (authToken == null) {
            CamelAuthorizationException authorizationException = new CamelAuthorizationException("Cannot find the Authentication instance.", exchange);
            throw authorizationException;
        }
        Authentication authenticated = authenticateIfRequired(authToken);
        // Attempt authorization with exchange
        try {
            this.accessDecisionManager.decide(authenticated, exchange, attributes);
        } catch (AccessDeniedException accessDeniedException) {
            exchange.getIn().setHeader(Exchange.AUTHENTICATION_FAILURE_POLICY_ID, getId());
            AuthorizationFailureEvent event = new AuthorizationFailureEvent(exchange, attributes, authenticated, accessDeniedException);
            publishEvent(event);
            throw accessDeniedException;
        }
        publishEvent(new AuthorizedEvent(exchange, attributes, authenticated));
    } catch (RuntimeException exception) {
        exchange.getIn().setHeader(Exchange.AUTHENTICATION_FAILURE_POLICY_ID, getId());
        CamelAuthorizationException authorizationException = new CamelAuthorizationException("Cannot access the processor which has been protected.", exchange, exception);
        throw authorizationException;
    }
}

Example 8 with AccessDeniedException

use of org.springframework.security.access.AccessDeniedException in project spring-security by spring-projects.

the class ExceptionTranslationFilter method doFilter.

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
    HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) res;
    try {
        chain.doFilter(request, response);
        logger.debug("Chain processed normally");
    } catch (IOException ex) {
        throw ex;
    } catch (Exception ex) {
        // Try to extract a SpringSecurityException from the stacktrace
        Throwable[] causeChain = throwableAnalyzer.determineCauseChain(ex);
        RuntimeException ase = (AuthenticationException) throwableAnalyzer.getFirstThrowableOfType(AuthenticationException.class, causeChain);
        if (ase == null) {
            ase = (AccessDeniedException) throwableAnalyzer.getFirstThrowableOfType(AccessDeniedException.class, causeChain);
        }
        if (ase != null) {
            handleSpringSecurityException(request, response, chain, ase);
        } else {
            // Rethrow ServletExceptions and RuntimeExceptions as-is
            if (ex instanceof ServletException) {
                throw (ServletException) ex;
            } else if (ex instanceof RuntimeException) {
                throw (RuntimeException) ex;
            }
            // as we've already covered all the possibilities for doFilter
            throw new RuntimeException(ex);
        }
    }
}

Example 9 with AccessDeniedException

use of org.springframework.security.access.AccessDeniedException in project spring-security-oauth by spring-projects.

the class ClientScopeVoter method vote.

public int vote(Authentication authentication, Object object, Collection<ConfigAttribute> attributes) {
    int result = ACCESS_ABSTAIN;
    if (!(authentication instanceof OAuth2Authentication)) {
        return result;
    }
    OAuth2Authentication oauth2Authentication = (OAuth2Authentication) authentication;
    OAuth2Request clientAuthentication = oauth2Authentication.getOAuth2Request();
    ClientDetails client = clientDetailsService.loadClientByClientId(clientAuthentication.getClientId());
    Set<String> scopes = clientAuthentication.getScope();
    if (oauth2Authentication.isClientOnly() && clientAuthoritiesAreScopes) {
        scopes = AuthorityUtils.authorityListToSet(clientAuthentication.getAuthorities());
    }
    for (ConfigAttribute attribute : attributes) {
        if (this.supports(attribute)) {
            result = ACCESS_GRANTED;
            for (String scope : scopes) {
                if (!client.getScope().contains(scope)) {
                    result = ACCESS_DENIED;
                    break;
                }
            }
            if (result == ACCESS_DENIED && throwException) {
                InsufficientScopeException failure = new InsufficientScopeException("Insufficient scope for this resource", client.getScope());
                throw new AccessDeniedException(failure.getMessage(), failure);
            }
            return result;
        }
    }
    return result;
}

Example 10 with AccessDeniedException

use of org.springframework.security.access.AccessDeniedException in project dhis2-core by dhis2.

the class InterpretationController method deleteObject.

@Override
public void deleteObject(@PathVariable String uid, HttpServletRequest request, HttpServletResponse response) throws Exception {
    Interpretation interpretation = interpretationService.getInterpretation(uid);
    if (interpretation == null) {
        throw new WebMessageException(WebMessageUtils.notFound("Interpretation does not exist: " + uid));
    }
    if (!currentUserService.getCurrentUser().equals(interpretation.getUser()) && !currentUserService.currentUserIsSuper()) {
        throw new AccessDeniedException("You are not allowed to delete this interpretation.");
    }
    interpretationService.deleteInterpretation(interpretation);
}