Examples with SecurityConstraint com.sun.enterprise.deployment.web.SecurityConstraint used on opensource projects

Example 6 with SecurityConstraint

use of com.sun.enterprise.deployment.web.SecurityConstraint in project Payara by payara.

the class WebBundleDescriptorImpl method combineSecurityConstraints.

@Override
protected void combineSecurityConstraints(Set<SecurityConstraint> firstScSet, Set<SecurityConstraint> secondScSet) {
    Set<String> allUrlPatterns = new HashSet<String>();
    for (SecurityConstraint sc : firstScSet) {
        for (WebResourceCollection wrc : sc.getWebResourceCollections()) {
            allUrlPatterns.addAll(wrc.getUrlPatterns());
        }
    }
    for (SecurityConstraint sc : secondScSet) {
        SecurityConstraint newSc = new SecurityConstraintImpl((SecurityConstraintImpl) sc);
        boolean addSc = false;
        Iterator<WebResourceCollection> iter = newSc.getWebResourceCollections().iterator();
        while (iter.hasNext()) {
            WebResourceCollection wrc = iter.next();
            Set<String> urlPatterns = wrc.getUrlPatterns();
            urlPatterns.removeAll(allUrlPatterns);
            boolean isEmpty = (urlPatterns.isEmpty());
            addSc = (addSc || (!isEmpty));
            if (isEmpty) {
                iter.remove();
            }
        }
        if (addSc) {
            firstScSet.add(newSc);
        }
    }
}

Example 7 with SecurityConstraint

use of com.sun.enterprise.deployment.web.SecurityConstraint in project Payara by payara.

the class DynamicWebServletRegistrationImpl method processServletSecurityElement.

void processServletSecurityElement(ServletSecurityElement servletSecurityElement, WebBundleDescriptor wbd, WebComponentDescriptor wcd) {
    Set<String> urlPatterns = ServletSecurityHandler.getUrlPatternsWithoutSecurityConstraint(wcd);
    if (urlPatterns.size() > 0) {
        SecurityConstraint securityConstraint = ServletSecurityHandler.createSecurityConstraint(wbd, urlPatterns, servletSecurityElement.getRolesAllowed(), servletSecurityElement.getEmptyRoleSemantic(), servletSecurityElement.getTransportGuarantee(), null);
        // we know there is one WebResourceCollection there
        WebResourceCollection webResColl = securityConstraint.getWebResourceCollections().iterator().next();
        for (HttpMethodConstraintElement httpMethodConstraintElement : servletSecurityElement.getHttpMethodConstraints()) {
            String httpMethod = httpMethodConstraintElement.getMethodName();
            ServletSecurityHandler.createSecurityConstraint(wbd, urlPatterns, httpMethodConstraintElement.getRolesAllowed(), httpMethodConstraintElement.getEmptyRoleSemantic(), httpMethodConstraintElement.getTransportGuarantee(), httpMethod);
            // exclude this from the top level constraint
            webResColl.addHttpMethodOmission(httpMethod);
        }
    }
}

Example 8 with SecurityConstraint

use of com.sun.enterprise.deployment.web.SecurityConstraint in project Payara by payara.

the class ServletSecurityHandler method getUrlPatternsWithoutSecurityConstraint.

/**
 * Given a WebComponentDescriptor, find the set of urlPattern which does not have
 * any existing url pattern in SecurityConstraint
 * @param webCompDesc
 * @return a list of url String
 */
public static Set<String> getUrlPatternsWithoutSecurityConstraint(WebComponentDescriptor webCompDesc) {
    Set<String> urlPatternsWithoutSC = new HashSet<String>(webCompDesc.getUrlPatternsSet());
    WebBundleDescriptor webBundleDesc = webCompDesc.getWebBundleDescriptor();
    Enumeration<SecurityConstraint> eSecConstr = webBundleDesc.getSecurityConstraints();
    while (eSecConstr.hasMoreElements()) {
        SecurityConstraint sc = eSecConstr.nextElement();
        for (WebResourceCollection wrc : sc.getWebResourceCollections()) {
            urlPatternsWithoutSC.removeAll(wrc.getUrlPatterns());
        }
    }
    return urlPatternsWithoutSC;
}

Example 9 with SecurityConstraint

use of com.sun.enterprise.deployment.web.SecurityConstraint in project Payara by payara.

the class WsUtil method updateServletEndpointRuntime.

public void updateServletEndpointRuntime(WebServiceEndpoint endpoint) {
    // Copy the value of the servlet impl bean class into
    // the runtime information.  This way, we'll still
    // remember it after the servlet-class element has been
    // replaced with the name of the container's servlet class.
    endpoint.saveServletImplClass();
    WebComponentDescriptor webComp = (WebComponentDescriptor) endpoint.getWebComponentImpl();
    WebBundleDescriptor bundle = webComp.getWebBundleDescriptor();
    WebServicesDescriptor webServices = bundle.getWebServices();
    Collection endpoints = webServices.getEndpointsImplementedBy(webComp);
    if (endpoints.size() > 1) {
        String msg = "Servlet " + endpoint.getWebComponentLink() + " implements " + endpoints.size() + " web service endpoints " + " but must only implement 1";
        throw new IllegalStateException(msg);
    }
    if (endpoint.getEndpointAddressUri() == null) {
        Set urlPatterns = webComp.getUrlPatternsSet();
        if (urlPatterns.size() == 1) {
            // Set endpoint-address-uri runtime info to uri.
            // Final endpoint address will still be relative to context roo
            String uri = (String) urlPatterns.iterator().next();
            endpoint.setEndpointAddressUri(uri);
            // Set transport guarantee in runtime info if transport
            // guarantee is INTEGRAL or CONDIFIDENTIAL for any
            // security constraint with this url-pattern.
            Collection constraints = bundle.getSecurityConstraintsForUrlPattern(uri);
            for (Iterator i = constraints.iterator(); i.hasNext(); ) {
                SecurityConstraint next = (SecurityConstraint) i.next();
                UserDataConstraint dataConstraint = next.getUserDataConstraint();
                String guarantee = (dataConstraint != null) ? dataConstraint.getTransportGuarantee() : null;
                if ((guarantee != null) && (guarantee.equals(UserDataConstraint.INTEGRAL_TRANSPORT) || guarantee.equals(UserDataConstraint.CONFIDENTIAL_TRANSPORT))) {
                    endpoint.setTransportGuarantee(guarantee);
                    break;
                }
            }
        } else {
            String msg = "Endpoint " + endpoint.getEndpointName() + " has not been assigned an endpoint address " + " and is associated with servlet " + webComp.getCanonicalName() + " , which has " + urlPatterns.size() + " url patterns";
            throw new IllegalStateException(msg);
        }
    }
}