Examples with AuthChainType com.tremolosecurity.config.xml.AuthChainType used on opensource projects

Example 46 with AuthChainType

use of com.tremolosecurity.config.xml.AuthChainType in project OpenUnison by TremoloSecurity.

the class OAuth2Bearer method doGet.

@Override
public void doGet(HttpServletRequest request, HttpServletResponse response, AuthStep as) throws IOException, ServletException {
    String basicHdr = request.getHeader("Authorization");
    boolean fromHeader = true;
    if (basicHdr == null) {
        basicHdr = request.getParameter("access_token");
        fromHeader = false;
    }
    HttpSession session = ((HttpServletRequest) request).getSession();
    HashMap<String, Attribute> authParams = (HashMap<String, Attribute>) session.getAttribute(ProxyConstants.AUTH_MECH_PARAMS);
    UrlHolder holder = (UrlHolder) request.getAttribute(ProxyConstants.AUTOIDM_CFG);
    String urlChain = holder.getUrl().getAuthChain();
    AuthChainType act = holder.getConfig().getAuthChains().get(urlChain);
    AuthMechType amt = act.getAuthMech().get(as.getId());
    String realmName = authParams.get("realm").getValues().get(0);
    String scope = null;
    if (authParams.get("scope") != null) {
        scope = authParams.get("scope").getValues().get(0);
    }
    ConfigManager cfg = (ConfigManager) request.getAttribute(ProxyConstants.TREMOLO_CFG_OBJ);
    String accessToken = null;
    if (basicHdr == null) {
        as.setExecuted(false);
        sendFail(response, realmName, scope, null, null);
        return;
    } else {
        if (fromHeader) {
            accessToken = basicHdr.substring(basicHdr.indexOf(' ') + 1);
        } else {
            accessToken = basicHdr;
        }
    }
    processToken(request, response, as, session, authParams, act, realmName, scope, cfg, accessToken);
}

Example 47 with AuthChainType

use of com.tremolosecurity.config.xml.AuthChainType in project OpenUnison by TremoloSecurity.

the class LoadAuthChainsFromK8s method addObject.

@Override
public void addObject(TremoloType cfg, JSONObject item) throws ProvisioningException {
    String rawJson = item.toJSONString();
    StringBuffer b = new StringBuffer();
    b.setLength(0);
    OpenUnisonConfigLoader.integrateIncludes(b, rawJson);
    try {
        JSONObject newRoot = (JSONObject) new JSONParser().parse(b.toString());
        JSONObject metadata = (JSONObject) newRoot.get("metadata");
        if (metadata == null) {
            throw new ProvisioningException("No metadata");
        }
        String name = (String) metadata.get("name");
        logger.info("Adding authentication chain " + name);
        try {
            AuthChainType act = this.createAuthChain(item, name);
            synchronized (GlobalEntries.getGlobalEntries().getConfigManager().getAuthChains()) {
                GlobalEntries.getGlobalEntries().getConfigManager().getAuthChains().put(name, act);
            }
            synchronized (GlobalEntries.getGlobalEntries().getConfigManager().getCfg()) {
                AuthChainType curAct = null;
                for (AuthChainType itAct : GlobalEntries.getGlobalEntries().getConfigManager().getCfg().getAuthChains().getChain()) {
                    if (itAct.getName().equals(act.getName())) {
                        curAct = itAct;
                        break;
                    }
                }
                if (curAct != null) {
                    GlobalEntries.getGlobalEntries().getConfigManager().getCfg().getAuthChains().getChain().remove(curAct);
                }
                GlobalEntries.getGlobalEntries().getConfigManager().getCfg().getAuthChains().getChain().add(act);
            }
        } catch (Exception e) {
            logger.warn("Could not initialize authentication chain " + name, e);
        }
    } catch (ParseException e) {
        throw new ProvisioningException("Could not parse custom authorization", e);
    }
}

Example 48 with AuthChainType

use of com.tremolosecurity.config.xml.AuthChainType in project OpenUnison by TremoloSecurity.

the class TokenData method jwtToAuthInfo.

private AuthInfo jwtToAuthInfo(TokenData td, String uidAttr, AuthChainType act, String subjectAuthMethod) throws ServletException {
    String filter = "";
    if (td.subjectUid == null) {
        filter = "(!(objectClass=*))";
    } else {
        filter = equal(uidAttr, td.subjectUid).toString();
    }
    try {
        String root = act.getRoot();
        if (root == null || root.trim().isEmpty()) {
            root = GlobalEntries.getGlobalEntries().getConfigManager().getCfg().getLdapRoot();
        }
        AuthChainType actForSubject = GlobalEntries.getGlobalEntries().getConfigManager().getAuthChains().get(subjectAuthMethod);
        if (actForSubject == null) {
            logger.warn(new StringBuilder("No authentication chain named '").append(subjectAuthMethod).append("'"));
        }
        LDAPSearchResults res = GlobalEntries.getGlobalEntries().getConfigManager().getMyVD().search(root, 2, filter, new ArrayList<String>());
        if (res.hasMore()) {
            LDAPEntry entry = res.next();
            AuthInfo authInfo = new AuthInfo(entry.getDN(), null, actForSubject != null ? actForSubject.getName() : null, actForSubject != null ? actForSubject.getLevel() : 0);
            User user = new User(entry);
            user = this.getMapper().mapUser(user);
            for (String attrName : user.getAttribs().keySet()) {
                authInfo.getAttribs().put(attrName, user.getAttribs().get(attrName));
            }
            if (authInfo.getAttribs().get(uidAttr) == null) {
                authInfo.getAttribs().put(uidAttr, new Attribute(uidAttr, td.subjectUid));
            }
            return authInfo;
        } else {
            String dn = new StringBuilder().append(uidAttr).append("=").append(td.subjectUid).append(",ou=oauth2,").append(GlobalEntries.getGlobalEntries().getConfigManager().getCfg().getLdapRoot()).toString();
            AuthInfo authInfo = new AuthInfo(dn, null, actForSubject != null ? actForSubject.getName() : null, actForSubject != null ? actForSubject.getLevel() : 0);
            for (Object key : td.root.keySet()) {
                Attribute attr = new Attribute(key.toString());
                if (attr.getName().equalsIgnoreCase("sub")) {
                    authInfo.getAttribs().put(uidAttr, new Attribute(uidAttr, (String) td.root.get(key)));
                }
                if (td.root.get(key) instanceof JSONArray) {
                    attr.getValues().addAll(((JSONArray) td.root.get(key)));
                } else {
                    attr.getValues().add(td.root.get(key).toString());
                }
                authInfo.getAttribs().put((String) key, attr);
                return authInfo;
            }
        }
    } catch (LDAPException | ProvisioningException e) {
        throw new ServletException("Could not lookup sts subject", e);
    }
    return null;
}

Example 49 with AuthChainType

use of com.tremolosecurity.config.xml.AuthChainType in project OpenUnison by TremoloSecurity.

the class TokenData method clientCredentialsGrant.

private void clientCredentialsGrant(HttpServletRequest request, HttpServletResponse response, String clientID, String clientSecret, AuthController ac, UrlHolder holder) throws Exception, IOException, ServletException {
    OpenIDConnectTrust trust = this.trusts.get(clientID);
    if (trust == null) {
        String errorMessage = new StringBuilder().append("Trust '").append(clientID).append("' not found").toString();
        logger.warn(errorMessage);
        throw new Exception(errorMessage);
    }
    if (!trust.isEnableClientCredentialGrant()) {
        logger.error(new StringBuilder().append("Trust '").append(clientID).append("' does not support the client_credentials grant").toString());
        response.sendError(403);
        return;
    }
    String authChain = trust.getAuthChain();
    if (authChain == null) {
        if (trust.isPublicEndpoint()) {
            StringBuffer b = new StringBuffer();
            b.append("IdP does not have an authenticaiton chain configured, but is set to public");
            throw new ServletException(b.toString());
        } else {
            if (clientSecret == null || !clientSecret.equals(trust.getClientSecret())) {
                logger.warn(new StringBuilder().append("Invalid client secret for '").append(clientID).append("'"));
                response.sendError(401);
            } else {
                HttpSession session = request.getSession();
                AuthInfo authData = new AuthInfo();
                authData.setUserDN(new StringBuilder().append("uid=").append(clientID).append(",ou=oauth2,").append(GlobalEntries.getGlobalEntries().getConfigManager().getCfg().getLdapRoot()).toString());
                authData.setAuthLevel(0);
                authData.setAuthChain("anonymous");
                authData.getAttribs().put("uid", new Attribute("uid", clientID));
                authData.getAttribs().put("sub", new Attribute("sub", clientID));
                authData.getAttribs().put("client", new Attribute("client", "true"));
                authData.getAttribs().put("auth_chain", new Attribute("auth_chain", "anonymous"));
                authData.getAttribs().put("objectClass", new Attribute("objectClass", GlobalEntries.getGlobalEntries().getConfigManager().getCfg().getUserObjectClass()));
                ((AuthController) session.getAttribute(ProxyConstants.AUTH_CTL)).setAuthInfo(authData);
                AuthChainType act = holder.getConfig().getAuthChains().get(authChain);
                OpenIDConnectTransaction transaction = new OpenIDConnectTransaction();
                transaction.setClientID(clientID);
                session.setAttribute(OpenIDConnectIdP.TRANSACTION_DATA, transaction);
                ClientCredentialsGrantPostAuth postAuth = new ClientCredentialsGrantPostAuth(transaction, trust, this);
                request.setAttribute(PostAuthSuccess.POST_AUTH_ACTION, postAuth);
                postAuth.runAfterSuccessfulAuthentication(request, response, holder, act, null, ac, null);
            }
            return;
        }
    }
    HttpSession session = request.getSession();
    AuthInfo authData = ((AuthController) session.getAttribute(ProxyConstants.AUTH_CTL)).getAuthInfo();
    AuthChainType act = holder.getConfig().getAuthChains().get(authChain);
    OpenIDConnectTransaction transaction = new OpenIDConnectTransaction();
    transaction.setClientID(clientID);
    session.setAttribute(OpenIDConnectIdP.TRANSACTION_DATA, transaction);
    ClientCredentialsGrantPostAuth postAuth = new ClientCredentialsGrantPostAuth(transaction, trust, this);
    request.setAttribute(PostAuthSuccess.POST_AUTH_ACTION, postAuth);
    if (authData == null || !authData.isAuthComplete() && !(authData.getAuthLevel() < act.getLevel())) {
        nextTokenAuth(request, response, session, false, act);
    } else {
        if (authData.getAuthLevel() < act.getLevel()) {
            // step up authentication, clear existing auth data
            session.removeAttribute(ProxyConstants.AUTH_CTL);
            holder.getConfig().createAnonUser(session);
            nextTokenAuth(request, response, session, false, act);
        } else {
            // authenticated, next step
            postAuth.runAfterSuccessfulAuthentication(request, response, holder, act, null, ac, null);
        }
    }
}

Example 50 with AuthChainType

use of com.tremolosecurity.config.xml.AuthChainType in project OpenUnison by TremoloSecurity.

the class TokenData method stsImpersontion.

private void stsImpersontion(HttpServletRequest request, HttpServletResponse response, String clientID, AuthController ac, UrlHolder holder, StsRequest stsRequest, OpenIDConnectTrust trust) throws ServletException, IOException {
    String authChain = trust.getAuthChain();
    if (authChain == null) {
        StringBuffer b = new StringBuffer();
        b.append("IdP does not have an authenticaiton chain configured");
        throw new ServletException(b.toString());
    }
    HttpSession session = request.getSession();
    AuthInfo authData = ((AuthController) session.getAttribute(ProxyConstants.AUTH_CTL)).getAuthInfo();
    AuthChainType act = holder.getConfig().getAuthChains().get(authChain);
    OpenIDConnectTransaction transaction = new OpenIDConnectTransaction();
    transaction.setClientID(clientID);
    session.setAttribute(OpenIDConnectIdP.TRANSACTION_DATA, transaction);
    TokenPostAuth postAuth = new TokenPostAuth(transaction, trust, stsRequest, this);
    request.setAttribute(PostAuthSuccess.POST_AUTH_ACTION, postAuth);
    if (authData == null || !authData.isAuthComplete() && !(authData.getAuthLevel() < act.getLevel())) {
        nextTokenAuth(request, response, session, false, act);
    } else {
        if (authData.getAuthLevel() < act.getLevel()) {
            // step up authentication, clear existing auth data
            session.removeAttribute(ProxyConstants.AUTH_CTL);
            holder.getConfig().createAnonUser(session);
            nextTokenAuth(request, response, session, false, act);
        } else {
            // authenticated, next step
            postAuth.runAfterSuccessfulAuthentication(request, response, holder, act, null, ac, null);
        }
    }
}