Examples with UserContext com.epam.pipeline.security.UserContext used on opensource projects

Example 1 with UserContext

use of com.epam.pipeline.security.UserContext in project cloud-pipeline by epam.

the class GrantPermissionManager method changeOwner.

@Transactional(propagation = Propagation.REQUIRED)
public AclSecuredEntry changeOwner(final Long id, final AclClass aclClass, final String userName) {
    Assert.isTrue(StringUtils.isNotBlank(userName), "User name is required " + "to change owner of an object.");
    final AbstractSecuredEntity entity = entityManager.load(aclClass, id);
    final UserContext userContext = userManager.loadUserContext(userName);
    Assert.notNull(userContext, String.format("The user with name %s doesn't exist.", userName));
    if (entity.getOwner().equalsIgnoreCase(userName)) {
        LOGGER.info("The resource you're trying to change owner is already owned by this user.");
        return new AclSecuredEntry(entity);
    }
    aclService.changeOwner(entity, userName);
    return new AclSecuredEntry(entityManager.changeOwner(aclClass, id, userName));
}

Example 2 with UserContext

use of com.epam.pipeline.security.UserContext in project cloud-pipeline by epam.

the class AuthManager method createSchedulerSecurityContext.

/**
 * @return A default UserContext for scheduled operations
 */
public SecurityContext createSchedulerSecurityContext() {
    SecurityContext context = SecurityContextHolder.createEmptyContext();
    UserContext userContext = new UserContext(defaultAdminId, defaultAdmin);
    Collection<GrantedAuthority> authorities = AuthorityUtils.createAuthorityList("ROLE_ADMIN");
    context.setAuthentication(new JwtAuthenticationToken(userContext, authorities));
    return context;
}

Example 3 with UserContext

use of com.epam.pipeline.security.UserContext in project cloud-pipeline by epam.

the class SAMLProxyFilter method authenticate.

private void authenticate(String samlResponse, Response decoded, String endpointId, ExternalServiceEndpoint endpoint) throws IOException, SAMLException {
    try (FileReader metadataReader = new FileReader(new File(endpoint.getMetadataPath()))) {
        CustomSamlClient client = CustomSamlClient.fromMetadata(endpointId, metadataReader, RESPONSE_SKEW);
        client.setMaxAuthenticationAge(MAX_AUTHENTICATION_AGE);
        SamlResponse parsedResponse = client.validate(decoded);
        String userName = parsedResponse.getNameID().toUpperCase();
        PipelineUser loadedUser = userManager.loadUserByName(userName);
        if (loadedUser == null) {
            throw new UsernameNotFoundException(messageHelper.getMessage(MessageConstants.ERROR_USER_NAME_NOT_FOUND, userName));
        }
        LOGGER.debug("Found user by name {}", userName);
        UserContext userContext = new UserContext(loadedUser);
        userContext.setExternal(endpoint.isExternal());
        SecurityContextHolder.getContext().setAuthentication(new SAMLProxyAuthentication(samlResponse, parsedResponse, userContext));
    }
}

Example 4 with UserContext

use of com.epam.pipeline.security.UserContext in project cloud-pipeline by epam.

the class DockerRegistryManager method issueTokenForDockerRegistry.

/**
 * Checks permissions for a requested docker registry and issues a valid JWT token,
 * if action is allowed. Otherwise 401 code will be returned to registry. See documentation
 * for details https://docs.docker.com/registry/spec/auth/token/#requesting-a-token
 * @param userName  requesting permission
 * @param token     provided by docker client, should be a valid Cloud Pipeline token
 * @param dockerRegistryHost    id of docker registry
 * @param scope     requested action in format
 *                  'scope=repository:samalba/my-app:push,repository:samalba/my-test:push'
 * @return
 */
public JwtRawToken issueTokenForDockerRegistry(String userName, String token, String dockerRegistryHost, String scope) {
    LOGGER.debug("Processing authorization request from registry {} for user {} and scope {}", dockerRegistryHost, userName, scope);
    UserContext user = dockerAuthService.verifyTokenForDocker(userName, token, dockerRegistryHost);
    DockerRegistry dockerRegistry = loadByNameOrId(dockerRegistryHost);
    if (dockerRegistry == null) {
        throw new DockerAuthorizationException(dockerRegistryHost, messageHelper.getMessage(MessageConstants.ERROR_REGISTRY_NOT_FOUND, dockerRegistryHost));
    }
    try {
        List<DockerRegistryClaim> claims = parseAndValidateScope(userName, dockerRegistry, scope);
        JwtRawToken jwtRawToken = dockerAuthService.issueDockerToken(user, dockerRegistryHost, claims);
        LOGGER.debug("Successfully issued JWT token for registry {} user {} and scope {}", dockerRegistry, userName, scope);
        return jwtRawToken;
    } catch (IllegalArgumentException e) {
        throw new DockerAuthorizationException(dockerRegistryHost, e.getMessage());
    }
}

Example 5 with UserContext

use of com.epam.pipeline.security.UserContext in project cloud-pipeline by epam.

the class SAMLUserDetailsServiceImplTest method testLoadUserBySAMLWithCreation.

@Test
public void testLoadUserBySAMLWithCreation() {
    user.setUserName(USER_NAME);
    Mockito.when(userManager.loadUserByName(Matchers.anyString())).thenReturn(null);
    Mockito.when(userManager.createUser(Matchers.anyString(), Matchers.anyListOf(Long.class), Matchers.anyListOf(String.class), Matchers.anyMapOf(String.class, String.class), Matchers.any())).thenReturn(user);
    UserContext actualUserContext = userDetailsService.loadUserBySAML(credential);
    Assert.assertEquals(expectedUserContext.getUsername(), actualUserContext.getUsername());
    Assert.assertEquals(expectedUserContext.getGroups(), actualUserContext.getGroups());
}