Examples with ModuleAuthentication com.evolveum.midpoint.authentication.api.config.ModuleAuthentication used on opensource projects

Example 11 with ModuleAuthentication

use of com.evolveum.midpoint.authentication.api.config.ModuleAuthentication in project midpoint by Evolveum.

the class AuthSequenceUtil method doRemoteFilter.

public static void doRemoteFilter(ServletRequest req, ServletResponse res, FilterChain chain, RemoteAuthenticationFilter remoteFilter) throws IOException, ServletException {
    Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
    boolean sendedRequest = false;
    if (authentication instanceof MidpointAuthentication) {
        MidpointAuthentication mpAuthentication = (MidpointAuthentication) authentication;
        RemoteModuleAuthenticationImpl moduleAuthentication = (RemoteModuleAuthenticationImpl) mpAuthentication.getProcessingModuleAuthentication();
        if (moduleAuthentication != null && RequestState.SENDED.equals(moduleAuthentication.getRequestState())) {
            sendedRequest = true;
        }
        boolean requiresAuthentication = remoteFilter.requiresAuth((HttpServletRequest) req, (HttpServletResponse) res);
        if (!requiresAuthentication && sendedRequest) {
            AuthenticationServiceException exception = new AuthenticationServiceException("web.security.flexAuth.oidc.not.response");
            remoteFilter.unsuccessfulAuth((HttpServletRequest) req, (HttpServletResponse) res, exception);
        } else {
            if (moduleAuthentication != null && requiresAuthentication && sendedRequest) {
                moduleAuthentication.setRequestState(RequestState.RECEIVED);
            }
            remoteFilter.doAuth(req, res, chain);
        }
    } else {
        throw new AuthenticationServiceException("Unsupported type of Authentication");
    }
}

Example 12 with ModuleAuthentication

use of com.evolveum.midpoint.authentication.api.config.ModuleAuthentication in project midpoint by Evolveum.

the class AuthSequenceUtil method existLoginPageForActualAuthModule.

public static boolean existLoginPageForActualAuthModule() {
    ModuleAuthentication authModule = AuthUtil.getProcessingModuleIfExist();
    if (authModule == null) {
        return false;
    }
    String moduleType = authModule.getNameOfModuleType();
    return DescriptorLoaderImpl.existPageUrlByAuthName(moduleType);
}

Example 13 with ModuleAuthentication

use of com.evolveum.midpoint.authentication.api.config.ModuleAuthentication in project midpoint by Evolveum.

the class AbstractPageRemoteAuthenticationSelect method getProviders.

private List<IdentityProvider> getProviders() {
    List<IdentityProvider> providers = new ArrayList<>();
    Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
    if (authentication instanceof MidpointAuthentication) {
        MidpointAuthentication mpAuthentication = (MidpointAuthentication) authentication;
        ModuleAuthentication moduleAuthentication = mpAuthentication.getProcessingModuleAuthentication();
        if (moduleAuthentication instanceof RemoteModuleAuthentication) {
            providers = ((RemoteModuleAuthentication) moduleAuthentication).getProviders();
            if (providers.isEmpty()) {
                String key = getErrorKeyEmptyProviders();
                error(getString(key));
            }
            return providers;
        }
        String key = getErrorKeyUnsupportedType();
        error(getString(key));
        return providers;
    }
    String key = "web.security.flexAuth.unsupported.auth.type";
    error(getString(key));
    return providers;
}

Example 14 with ModuleAuthentication

use of com.evolveum.midpoint.authentication.api.config.ModuleAuthentication in project midpoint by Evolveum.

the class PageEmailNonse method getMailNoncePolicy.

private NonceCredentialsPolicyType getMailNoncePolicy(PrismObject<UserType> user) {
    SecurityPolicyType securityPolicy = resolveSecurityPolicy(user);
    LOGGER.trace("Found security policy: {}", securityPolicy);
    if (securityPolicy == null) {
        getSession().error(getString("PageForgotPassword.send.nonce.failed"));
        LOGGER.error("No security policy, cannot process nonce credential");
        // we do not want to provide any information to the attacker.
        throw new RestartResponseException(PageEmailNonse.class);
    }
    if (securityPolicy.getCredentials() == null) {
        getSession().error(getString("PageForgotPassword.send.nonce.failed"));
        LOGGER.error("No credential for security policy, cannot process nonce credential");
        // we do not want to provide any information to the attacker.
        throw new RestartResponseException(PageEmailNonse.class);
    }
    if (securityPolicy.getCredentials().getNonce() == null) {
        getSession().error(getString("PageForgotPassword.send.nonce.failed"));
        LOGGER.error("No nonce credential for security policy, cannot process nonce credential");
        // we do not want to provide any information to the attacker.
        throw new RestartResponseException(PageEmailNonse.class);
    }
    Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
    if (!(authentication instanceof MidpointAuthentication)) {
        getSession().error(getString("PageForgotPassword.send.nonce.failed"));
        LOGGER.error("Bad type of authentication, support only MidpointAuthentication, but is " + authentication != null ? authentication.getClass().getName() : null);
        throw new RestartResponseException(PageEmailNonse.class);
    }
    ModuleAuthentication moduleAuthentication = ((MidpointAuthentication) authentication).getProcessingModuleAuthentication();
    if (!(moduleAuthentication instanceof CredentialModuleAuthentication) && !AuthenticationModuleNameConstants.MAIL_NONCE.equals(moduleAuthentication.getNameOfModuleType())) {
        getSession().error(getString("PageForgotPassword.send.nonce.failed"));
        LOGGER.error("Bad type of module authentication, support only EmailNonceModuleAuthentication, but is " + moduleAuthentication != null ? moduleAuthentication.getClass().getName() : null);
        throw new RestartResponseException(PageEmailNonse.class);
    }
    CredentialModuleAuthentication nonceAuth = (CredentialModuleAuthentication) moduleAuthentication;
    String credentialName = nonceAuth.getCredentialName();
    if (credentialName == null) {
        getSession().error(getString("PageForgotPassword.send.nonce.failed"));
        LOGGER.error("EmailNonceModuleAuthentication " + nonceAuth.getNameOfModule() + " haven't define name of credential");
        throw new RestartResponseException(PageEmailNonse.class);
    }
    NonceCredentialsPolicyType credentialByName = null;
    for (NonceCredentialsPolicyType credential : securityPolicy.getCredentials().getNonce()) {
        if (credentialName != null && credentialName.equals(credential.getName())) {
            credentialByName = credential;
        }
    }
    if (credentialByName == null) {
        getSession().error(getString("PageForgotPassword.send.nonce.failed"));
        LOGGER.error("Couldn't find nonce credentials by name " + credentialName);
        throw new RestartResponseException(PageEmailNonse.class);
    }
    return credentialByName;
}

Example 15 with ModuleAuthentication

use of com.evolveum.midpoint.authentication.api.config.ModuleAuthentication in project midpoint by Evolveum.

the class PageResetPasswordConfirmation method init.

private void init(final PageParameters pageParameters) {
    PageParameters params = pageParameters;
    if (params == null) {
        params = getPageParameters();
    }
    OperationResult result = new OperationResult(OPERATION_FINISH_REGISTRATION);
    if (params == null) {
        LOGGER.error("Confirmation link is not valid. No credentials provided in it");
        String msg = createStringResource("PageSelfRegistration.invalid.registration.link").getString();
        getSession().error(createStringResource(msg));
        result.recordFatalError(msg);
        initLayout(result);
        return;
    }
    StringValue userNameValue = params.get(SchemaConstants.USER_ID);
    Validate.notEmpty(userNameValue.toString());
    StringValue tokenValue = params.get(SchemaConstants.TOKEN);
    Validate.notEmpty(tokenValue.toString());
    UsernamePasswordAuthenticationToken token = authenticateUser(userNameValue.toString(), tokenValue.toString(), result);
    if (token == null) {
        initLayout(result);
        return;
    } else {
        // SecurityContextHolder.getContext().setAuthentication(token);
        MidPointPrincipal principal = (MidPointPrincipal) token.getPrincipal();
        Collection<Authorization> authz = principal.getAuthorities();
        if (authz != null) {
            for (Authorization authzI : authz) {
                authzI.getAction().removeIf(action -> action.contains(AuthorizationConstants.NS_AUTHORIZATION_UI));
            }
        }
        AuthorizationType authorizationType = new AuthorizationType();
        authorizationType.getAction().add(AuthorizationConstants.AUTZ_UI_SELF_CREDENTIALS_URL);
        Authorization selfServiceCredentialsAuthz = new Authorization(authorizationType);
        authz.add(selfServiceCredentialsAuthz);
        AuthenticationSequenceType sequence = SecurityPolicyUtil.createPasswordResetSequence();
        Map<Class<?>, Object> sharedObjects = new HashMap<>();
        AuthenticationModulesType modules = new AuthenticationModulesType();
        LoginFormAuthenticationModuleType loginForm = new LoginFormAuthenticationModuleType();
        loginForm.name(SecurityPolicyUtil.DEFAULT_MODULE_NAME);
        modules.loginForm(loginForm);
        AuthModule authModule = null;
        AuthenticationChannel channel = null;
        try {
            channel = channelFactory.createAuthChannel(sequence.getChannel());
            authModule = moduleFactory.createModuleFilter(loginForm, sequence.getChannel().getUrlSuffix(), null, sharedObjects, modules, null, channel);
        } catch (Exception e) {
            LOGGER.error("Couldn't build filter for module moduleFactory", e);
        }
        MidpointAuthentication mpAuthentication = new MidpointAuthentication(sequence);
        List<AuthModule> authModules = new ArrayList<>();
        authModules.add(authModule);
        mpAuthentication.setAuthModules(authModules);
        mpAuthentication.setSessionId(Session.get().getId());
        ModuleAuthentication moduleAuthentication = authModule.getBaseModuleAuthentication();
        moduleAuthentication.setAuthentication(token);
        moduleAuthentication.setState(AuthenticationModuleState.SUCCESSFULLY);
        mpAuthentication.addAuthentications(moduleAuthentication);
        mpAuthentication.setPrincipal(principal);
        mpAuthentication.setAuthorities(token.getAuthorities());
        mpAuthentication.setAuthenticationChannel(channel);
        SecurityContextHolder.getContext().setAuthentication(mpAuthentication);
        setResponsePage(PageResetPassword.class);
    }
    initLayout(result);
}