Examples with AuthChainType com.tremolosecurity.config.xml.AuthChainType used on opensource projects

Example 1 with AuthChainType

use of com.tremolosecurity.config.xml.AuthChainType in project OpenUnison by TremoloSecurity.

the class LoadAuthChainsFromK8s method createAuthChain.

private AuthChainType createAuthChain(JSONObject item, String name) throws Exception {
    AuthChainType act = new AuthChainType();
    act.setName(name);
    JSONObject spec = (JSONObject) item.get("spec");
    act.setLevel(((Long) spec.get("level")).intValue());
    Boolean finishOnRequiredSucess = (Boolean) spec.get("finishOnRequiredSucess");
    if (finishOnRequiredSucess != null) {
        act.setFinishOnRequiredSucess(finishOnRequiredSucess);
    } else {
        act.setFinishOnRequiredSucess(false);
    }
    String root = (String) spec.get("root");
    if (root != null) {
        act.setRoot(root);
    }
    JSONObject jsonCompliance = (JSONObject) spec.get("compliance");
    if (jsonCompliance != null) {
        AuthLockoutType alt = new AuthLockoutType();
        alt.setEnabled((Boolean) jsonCompliance.get("enabled"));
        alt.setMaxFailedAttempts(((Integer) jsonCompliance.get("maxLockoutTime")));
        alt.setNumFailedAttribute((String) jsonCompliance.get("numFailedAttribute"));
        alt.setLastFailedAttribute((String) jsonCompliance.get("lastFailedAttribute"));
        alt.setLastSucceedAttribute((String) jsonCompliance.get("lastSucceedAttribute"));
        alt.setUpdateAttributesWorkflow((String) jsonCompliance.get("updateAttributesWorkflow"));
        alt.setUidAttributeName((String) jsonCompliance.get("uidAttributeName"));
        act.setCompliance(alt);
    }
    JSONArray mechs = (JSONArray) spec.get("authMechs");
    for (Object o : mechs) {
        JSONObject mech = (JSONObject) o;
        AuthMechType amt = new AuthMechType();
        amt.setName((String) mech.get("name"));
        amt.setRequired((String) mech.get("required"));
        amt.setParams(new AuthMechParamType());
        JSONObject jsonObj = (JSONObject) mech.get("params");
        for (Object ok : jsonObj.keySet()) {
            String paramName = (String) ok;
            Object val = jsonObj.get(paramName);
            if (val instanceof String) {
                ParamWithValueType pt = new ParamWithValueType();
                pt.setName(paramName);
                pt.setValue((String) val);
                amt.getParams().getParam().add(pt);
            } else {
                JSONArray vals = (JSONArray) val;
                for (Object ov : vals) {
                    ParamWithValueType pt = new ParamWithValueType();
                    pt.setName(paramName);
                    pt.setValue((String) ov);
                    amt.getParams().getParam().add(pt);
                }
            }
        }
        JSONArray secretParams = (JSONArray) mech.get("secretParams");
        if (secretParams != null) {
            HttpCon nonwatchHttp = this.k8sWatch.getK8s().createClient();
            String token = this.k8sWatch.getK8s().getAuthToken();
            try {
                for (Object ox : secretParams) {
                    JSONObject secretParam = (JSONObject) ox;
                    String paramName = (String) secretParam.get("name");
                    String secretName = (String) secretParam.get("secretName");
                    String secretKey = (String) secretParam.get("secretKey");
                    String secretValue = this.k8sWatch.getSecretValue(secretName, secretKey, token, nonwatchHttp);
                    ParamWithValueType pt = new ParamWithValueType();
                    pt.setName(paramName);
                    pt.setValue(secretValue);
                    amt.getParams().getParam().add(pt);
                }
            } finally {
                nonwatchHttp.getHttp().close();
                nonwatchHttp.getBcm().close();
            }
        }
        act.getAuthMech().add(amt);
    }
    return act;
}

Example 2 with AuthChainType

use of com.tremolosecurity.config.xml.AuthChainType in project OpenUnison by TremoloSecurity.

the class LoadAuthChainsFromK8s method modifyObject.

@Override
public void modifyObject(TremoloType cfg, JSONObject item) throws ProvisioningException {
    String rawJson = item.toJSONString();
    StringBuffer b = new StringBuffer();
    b.setLength(0);
    OpenUnisonConfigLoader.integrateIncludes(b, rawJson);
    try {
        JSONObject newRoot = (JSONObject) new JSONParser().parse(b.toString());
        JSONObject metadata = (JSONObject) newRoot.get("metadata");
        if (metadata == null) {
            throw new ProvisioningException("No metadata");
        }
        String name = (String) metadata.get("name");
        logger.info("Modifying authentication chain " + name);
        try {
            AuthChainType act = this.createAuthChain(item, name);
            synchronized (GlobalEntries.getGlobalEntries().getConfigManager().getAuthChains()) {
                GlobalEntries.getGlobalEntries().getConfigManager().getAuthChains().put(name, act);
            }
            synchronized (GlobalEntries.getGlobalEntries().getConfigManager().getCfg()) {
                AuthChainType curAct = null;
                for (AuthChainType itAct : GlobalEntries.getGlobalEntries().getConfigManager().getCfg().getAuthChains().getChain()) {
                    if (itAct.getName().equals(act.getName())) {
                        curAct = itAct;
                        break;
                    }
                }
                if (curAct != null) {
                    GlobalEntries.getGlobalEntries().getConfigManager().getCfg().getAuthChains().getChain().remove(curAct);
                }
                GlobalEntries.getGlobalEntries().getConfigManager().getCfg().getAuthChains().getChain().add(act);
            }
        } catch (Exception e) {
            logger.warn("Could not initialize authentication chain " + name, e);
        }
    } catch (ParseException e) {
        throw new ProvisioningException("Could not parse custom authorization", e);
    }
}

Example 3 with AuthChainType

use of com.tremolosecurity.config.xml.AuthChainType in project OpenUnison by TremoloSecurity.

the class RegisterPasswordResetAuth method doGet.

@Override
public void doGet(HttpServletRequest request, HttpServletResponse response, AuthStep as) throws IOException, ServletException {
    HttpSession session = ((HttpServletRequest) request).getSession();
    HashMap<String, Attribute> authParams = (HashMap<String, Attribute>) session.getAttribute(ProxyConstants.AUTH_MECH_PARAMS);
    UrlHolder holder = (UrlHolder) request.getAttribute(ProxyConstants.AUTOIDM_CFG);
    RequestHolder reqHolder = ((AuthController) request.getSession().getAttribute(ProxyConstants.AUTH_CTL)).getHolder();
    String urlChain = holder.getUrl().getAuthChain();
    AuthChainType act = holder.getConfig().getAuthChains().get(reqHolder.getAuthChainName());
    AuthMechType amt = act.getAuthMech().get(as.getId());
    AuthController ac = ((AuthController) request.getSession().getAttribute(ProxyConstants.AUTH_CTL));
    AuthInfo au = ac.getAuthInfo();
    Attribute uid = au.getAttribs().get(this.uidAttribute);
    if (uid == null) {
        logger.warn("Attribute : '" + this.uidAttribute + "' does not exist");
        as.setSuccess(false);
    } else {
        ResetUserPasswordOnLogout logoutHandler = new ResetUserPasswordOnLogout(this.workflowName, this.uidAttribute, uid.getValues().get(0));
        LogoutUtil.insertFirstLogoutHandler(request, logoutHandler);
        as.setSuccess(true);
    }
    holder.getConfig().getAuthManager().nextAuth(request, response, session, false);
}

Example 4 with AuthChainType

use of com.tremolosecurity.config.xml.AuthChainType in project OpenUnison by TremoloSecurity.

the class OpenUnisonUtils method exportSPMetaData.

private static void exportSPMetaData(Options options, CommandLine cmd, TremoloType tt, KeyStore ks) throws Exception, KeyStoreException, NoSuchAlgorithmException, UnrecoverableKeyException, CertificateEncodingException, MarshallingException {
    logger.info("Finding mechanism...");
    String mechanismName = loadOption(cmd, "mechanismName", options);
    MechanismType saml2Mech = loadMechanismType(mechanismName, tt);
    logger.info("...found");
    logger.info("Finding chain...");
    String chainName = loadOption(cmd, "chainName", options);
    AuthChainType act = loadChainType(chainName, tt);
    logger.info("Looking for correct mechanism on the chain...");
    AuthMechType currentMechanism = null;
    for (AuthMechType amt : act.getAuthMech()) {
        if (amt.getName().equalsIgnoreCase(mechanismName)) {
            currentMechanism = amt;
            break;
        }
    }
    if (currentMechanism == null) {
        System.err.println("Unknown chain on mechanism");
        System.exit(1);
    }
    InitializationService.initialize();
    logger.info("loading url base");
    String urlBase = loadOption(cmd, "urlBase", options);
    String url = urlBase + saml2Mech.getUri();
    SecureRandom random = new SecureRandom();
    byte[] idBytes = new byte[20];
    random.nextBytes(idBytes);
    String id = "f" + Hex.encodeHexString(idBytes);
    EntityDescriptorBuilder edb = new EntityDescriptorBuilder();
    EntityDescriptorImpl ed = (EntityDescriptorImpl) edb.buildObject();
    ed.setID(id);
    ed.setEntityID(url);
    SPSSODescriptorBuilder spb = new SPSSODescriptorBuilder();
    SPSSODescriptorImpl sp = (SPSSODescriptorImpl) spb.buildObject();
    ed.getRoleDescriptors().add(sp);
    HashMap<String, ParamWithValueType> params = new HashMap<String, ParamWithValueType>();
    for (ParamWithValueType pt : currentMechanism.getParams().getParam()) {
        params.put(pt.getName(), pt);
    }
    boolean assertionsSigned = params.get("assertionsSigned") != null && params.get("assertionsSigned").getValue().equalsIgnoreCase("true");
    sp.setWantAssertionsSigned(assertionsSigned);
    sp.addSupportedProtocol("urn:oasis:names:tc:SAML:2.0:protocol");
    SingleLogoutServiceBuilder slsb = new SingleLogoutServiceBuilder();
    SingleLogoutService sls = slsb.buildObject();
    sls.setLocation(url);
    sls.setBinding("urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect");
    sp.getSingleLogoutServices().add(sls);
    sls = slsb.buildObject();
    sls.setLocation(url);
    sls.setBinding("urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST");
    sp.getSingleLogoutServices().add(sls);
    AssertionConsumerServiceBuilder acsb = new AssertionConsumerServiceBuilder();
    AssertionConsumerService acs = acsb.buildObject();
    acs.setLocation(url);
    acs.setBinding("urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST");
    acs.setIndex(0);
    acs.setIsDefault(true);
    sp.getAssertionConsumerServices().add(acs);
    acs = acsb.buildObject();
    acs.setLocation(url);
    acs.setBinding("urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect");
    acs.setIndex(1);
    sp.getAssertionConsumerServices().add(acs);
    if (params.get("spSigKey") != null && !params.get("spSigKey").getValue().isEmpty()) {
        String alias = params.get("spSigKey").getValue();
        X509Certificate certFromKS = (X509Certificate) ks.getCertificate(alias);
        if (certFromKS == null) {
            throw new Exception("Certificate '" + params.get("spSigKey").getValue() + "' not found");
        }
        PrivateKey keyFromKS = (PrivateKey) ks.getKey(alias, tt.getKeyStorePassword().toCharArray());
        KeyDescriptorBuilder kdb = new KeyDescriptorBuilder();
        KeyDescriptor kd = kdb.buildObject();
        kd.setUse(UsageType.SIGNING);
        KeyInfoBuilder kib = new KeyInfoBuilder();
        KeyInfo ki = kib.buildObject();
        X509DataBuilder x509b = new X509DataBuilder();
        X509Data x509 = x509b.buildObject();
        X509CertificateBuilder certb = new X509CertificateBuilder();
        org.opensaml.xmlsec.signature.X509Certificate cert = certb.buildObject();
        cert.setValue(new String(Base64.encode(certFromKS.getEncoded())));
        x509.getX509Certificates().add(cert);
        ki.getX509Datas().add(x509);
        kd.setKeyInfo(ki);
        sp.getKeyDescriptors().add(kd);
    }
    if (params.get("spEncKey") != null && !params.get("spEncKey").getValue().isEmpty()) {
        String alias = params.get("spEncKey").getValue();
        X509Certificate certFromKS = (X509Certificate) ks.getCertificate(alias);
        if (certFromKS == null) {
            throw new Exception("Certificate '" + params.get("spEncKey").getValue() + "' not found");
        }
        PrivateKey keyFromKS = (PrivateKey) ks.getKey(alias, tt.getKeyStorePassword().toCharArray());
        KeyDescriptorBuilder kdb = new KeyDescriptorBuilder();
        KeyDescriptor kd = kdb.buildObject();
        kd.setUse(UsageType.ENCRYPTION);
        KeyInfoBuilder kib = new KeyInfoBuilder();
        KeyInfo ki = kib.buildObject();
        X509DataBuilder x509b = new X509DataBuilder();
        X509Data x509 = x509b.buildObject();
        X509CertificateBuilder certb = new X509CertificateBuilder();
        org.opensaml.xmlsec.signature.X509Certificate cert = certb.buildObject();
        cert.setValue(new String(Base64.encode(certFromKS.getEncoded())));
        x509.getX509Certificates().add(cert);
        ki.getX509Datas().add(x509);
        kd.setKeyInfo(ki);
        sp.getKeyDescriptors().add(kd);
    }
    EntityDescriptorMarshaller marshaller = new EntityDescriptorMarshaller();
    // Marshall the Subject
    Element assertionElement = marshaller.marshall(ed);
    String xml = net.shibboleth.utilities.java.support.xml.SerializeSupport.prettyPrintXML(assertionElement);
    logger.info(xml);
}

Example 5 with AuthChainType

use of com.tremolosecurity.config.xml.AuthChainType in project OpenUnison by TremoloSecurity.

the class OpenUnisonUtils method importMetaData.

private static void importMetaData(Options options, CommandLine cmd, String unisonXMLFile, TremoloType ttRead, TremoloType ttWrite, String ksPath, KeyStore ks) throws Exception, Base64DecodingException, CertificateException, KeyStoreException, IOException, NoSuchAlgorithmException, FileNotFoundException, JAXBException, PropertyException {
    logger.info("Finding mechanism...");
    String mechanismName = loadOption(cmd, "mechanismName", options);
    MechanismType saml2Mech = loadMechanismType(mechanismName, ttWrite);
    logger.info("...found");
    logger.info("Finding chain...");
    String chainName = loadOption(cmd, "chainName", options);
    AuthChainType act = loadChainType(chainName, ttWrite);
    boolean createDefault = cmd.hasOption("createDefault");
    logger.info("Create default configuration? : " + createDefault);
    logger.info("Loading metadata...");
    String pathToMetaData = loadOption(cmd, "pathToMetaData", options);
    logger.info("...loaded");
    EntityDescriptor ed = loadIdPMetaData(pathToMetaData, ks, ttRead);
    IDPSSODescriptor idp = ed.getIDPSSODescriptor("urn:oasis:names:tc:SAML:2.0:protocol");
    logger.info("Looking for correct mechanism on the chain...");
    AuthMechType currentMechanism = null;
    for (AuthMechType amt : act.getAuthMech()) {
        if (amt.getName().equalsIgnoreCase(mechanismName)) {
            currentMechanism = amt;
            break;
        }
    }
    boolean newMech = true;
    if (currentMechanism != null) {
        logger.info("Updating existing mechanism");
        newMech = false;
    } else {
        logger.info("Creating new mechanism");
        currentMechanism = new AuthMechType();
        currentMechanism.setName(mechanismName);
        currentMechanism.setRequired("required");
        currentMechanism.setParams(new AuthMechParamType());
        act.getAuthMech().add(currentMechanism);
        newMech = true;
    }
    HashMap<String, ParamWithValueType> params = new HashMap<String, ParamWithValueType>();
    for (ParamWithValueType pt : currentMechanism.getParams().getParam()) {
        params.put(pt.getName(), pt);
    }
    importMetaData(ks, ed, idp, currentMechanism, params);
    if (newMech && createDefault) {
        setDefaults(ks, ed, idp, currentMechanism, params);
    }
    storeMethod(unisonXMLFile, ttWrite, ksPath, ks);
}