Examples with AuthChainType com.tremolosecurity.config.xml.AuthChainType used on opensource projects

Example 26 with AuthChainType

use of com.tremolosecurity.config.xml.AuthChainType in project OpenUnison by TremoloSecurity.

the class AcknowledgeAuthMech method doPost.

@Override
public void doPost(HttpServletRequest req, HttpServletResponse resp, AuthStep as) throws ServletException, IOException {
    if (req.getParameter("acknowledge") == null) {
        this.doGet(req, resp, as);
        return;
    }
    // SharedSession.getSharedSession().getSession(req.getSession().getId());
    HttpSession session = ((HttpServletRequest) req).getSession();
    UrlHolder holder = (UrlHolder) req.getAttribute(ProxyConstants.AUTOIDM_CFG);
    RequestHolder reqHolder = ((AuthController) req.getSession().getAttribute(ProxyConstants.AUTH_CTL)).getHolder();
    HashMap<String, Attribute> authParams = (HashMap<String, Attribute>) session.getAttribute(ProxyConstants.AUTH_MECH_PARAMS);
    String urlChain = holder.getUrl().getAuthChain();
    AuthChainType act = holder.getConfig().getAuthChains().get(reqHolder.getAuthChainName());
    AuthMechType amt = act.getAuthMech().get(as.getId());
    if (req.getParameter("acknowledge") != null && req.getParameter("acknowledge").equalsIgnoreCase("yes")) {
        as.setSuccess(true);
    } else {
        as.setSuccess(false);
    }
    String redirectToURL = req.getParameter("target");
    if (redirectToURL != null && !redirectToURL.isEmpty()) {
        reqHolder.setURL(redirectToURL);
    }
    holder.getConfig().getAuthManager().nextAuth(req, resp, session, false);
}

Example 27 with AuthChainType

use of com.tremolosecurity.config.xml.AuthChainType in project OpenUnison by TremoloSecurity.

the class AnonAuth method setAnonCtx.

private void setAnonCtx(HttpServletRequest request, HttpServletResponse response, AuthStep as) throws ServletException, IOException {
    // SharedSession.getSharedSession().getSession(req.getSession().getId());
    HttpSession session = request.getSession();
    UrlHolder holder = (UrlHolder) request.getAttribute(ProxyConstants.AUTOIDM_CFG);
    String urlChain = holder.getUrl().getAuthChain();
    AuthChainType act = holder.getConfig().getAuthChains().get(urlChain);
    AuthMechType amt = act.getAuthMech().get(as.getId());
    createSession(session, act);
    as.setSuccess(true);
    holder.getConfig().getAuthManager().nextAuth(request, response, session, false);
}

Example 28 with AuthChainType

use of com.tremolosecurity.config.xml.AuthChainType in project OpenUnison by TremoloSecurity.

the class AuthMgrSys method doAuthMgr.

public void doAuthMgr(HttpServletRequest request, HttpServletResponse response, NextSys nextSys, AuthStep as) throws ServletException, IOException {
    // String prefix = "/auth";
    // uri = uri.substring(prefix.length());
    String uri = request.getRequestURI();
    UrlHolder holder = (UrlHolder) request.getAttribute(ProxyConstants.AUTOIDM_CFG);
    ConfigManager cfgMgr = (ConfigManager) request.getAttribute(ProxyConstants.TREMOLO_CFG_OBJ);
    AuthController actl = (AuthController) request.getSession().getAttribute(ProxyConstants.AUTH_CTL);
    String actName = "";
    if (actl != null && actl.getHolder() == null && holder == null) {
        AuthMechanism authMech = cfgMgr.getAuthMech(request.getRequestURI());
        if (authMech != null) {
            String finalURL = authMech.getFinalURL(request, response);
            if (finalURL != null) {
                try {
                    holder = cfgMgr.findURL(finalURL);
                    String urlChain = holder.getUrl().getAuthChain();
                    AuthChainType act = holder.getConfig().getAuthChains().get(urlChain);
                    HashMap<String, Attribute> params = new HashMap<String, Attribute>();
                    ProxyUtil.loadParams(request, params);
                    actl.setHolder(new RequestHolder(HTTPMethod.GET, params, finalURL, true, act.getName(), ((ProxyRequest) request).getQueryStringParams()));
                    request.setAttribute(ProxyConstants.AUTOIDM_CFG, holder);
                    String authChain = holder.getUrl().getAuthChain();
                    holder.getConfig().getAuthManager().loadAmtParams(request.getSession(), act.getAuthMech().get(0));
                } catch (Exception e) {
                    throw new ServletException("Could not run authentication", e);
                }
            }
        } else {
            throw new ServletException("Unknown URI : " + request.getRequestURI());
        }
    }
    if (actl != null && actl.getHolder() != null) {
        actName = actl.getHolder().getAuthChainName();
    } else {
        if (holder != null) {
            actName = holder.getUrl().getAuthChain();
        } else {
            actName = null;
        }
    }
    AuthChainType act = actName != null ? cfgMgr.getAuthChains().get(actName) : null;
    AuthMechanism mech = cfgMgr.getAuthMech(uri);
    if (mech == null || act == null) {
        nextSys.nextSys(request, response);
        return;
    }
    act = AuthManagerImpl.buildACT(act, cfgMgr);
    int step = 0;
    if (as != null) {
        AuthMechType amt = act.getAuthMech().get(as.getId());
        String amtName = amt.getName();
        MechanismType mech2 = cfgMgr.getAuthMechs().get(amtName);
        if (!request.getRequestURI().endsWith(mech2.getUri())) {
            logger.warn("Attempted double post");
            StringBuilder sb = new StringBuilder().append(cfgMgr.getAuthFormsPath()).append("/resetChain.jsp");
            response.sendRedirect(sb.toString());
            return;
        }
        step = as.getId();
    }
    String authMechName = act.getAuthMech().get(step).getName();
    MechanismType mt = cfgMgr.getAuthMechs().get(authMechName);
    String ruri = request.getRequestURI();
    String forwardedURI = (String) request.getAttribute("javax.servlet.forward.request_uri");
    if (forwardedURI != null) {
        ruri = forwardedURI;
    }
    if (request.getMethod().equalsIgnoreCase("get")) {
        mech.doGet(request, response, as);
    } else if (request.getMethod().equalsIgnoreCase("post")) {
        mech.doPost(request, response, as);
    } else if (request.getMethod().equalsIgnoreCase("put") || request.getMethod().equalsIgnoreCase("patch")) {
        mech.doPut(request, response, as);
    } else if (request.getMethod().equalsIgnoreCase("delete")) {
        mech.doDelete(request, response, as);
    } else if (request.getMethod().equalsIgnoreCase("head")) {
        mech.doHead(request, response, as);
    } else if (request.getMethod().equalsIgnoreCase("options")) {
        mech.doOptions(request, response, as);
    } else {
        mech.doGet(request, response, as);
    }
// check for a failed authenction
// Boolean bool = (Boolean) request.getAttribute(AuthMgrSys.AU_RES);
// HttpSession session = ((HttpServletRequest) request).getSession(true);
// session = SharedSession.getSharedSession().getSession(session.getId());
// AuthInfo authData = (AuthInfo) session.getAttribute(AuthSys.AUTH_DATA);
// String urlChain = holder.getUrl().getAuthChain();
// AuthChainType act = holder.getConfig().getAuthChains().get(urlChain);
/*if (urlChain != null && bool != null) {
			processAuthResp(request, response, holder, bool);
		}*/
}

Example 29 with AuthChainType

use of com.tremolosecurity.config.xml.AuthChainType in project OpenUnison by TremoloSecurity.

the class BasicAuth method checkBasicAuth.

public static boolean checkBasicAuth(HttpServletRequest request, HttpServletResponse response, ConfigManager cfgMgr, BasicAuthImpl authImpl, AuthStep as) throws IOException, ServletException {
    String basicHdr = request.getHeader("Authorization");
    HttpSession session = ((HttpServletRequest) request).getSession();
    HashMap<String, Attribute> authParams = (HashMap<String, Attribute>) session.getAttribute(ProxyConstants.AUTH_MECH_PARAMS);
    String realmName = authParams.get("realmName").getValues().get(0);
    String uidAttr = "uid";
    if (authParams.get("uidAttr") != null) {
        uidAttr = authParams.get("uidAttr").getValues().get(0);
    }
    if (basicHdr == null) {
        as.setExecuted(false);
        sendFail(response, realmName);
        return false;
    }
    basicHdr = basicHdr.substring(basicHdr.indexOf(' ') + 1);
    String headerVal = new String(Base64.decode(basicHdr));
    String userName = headerVal.substring(0, headerVal.indexOf(':'));
    String password = headerVal.substring(headerVal.indexOf(':') + 1);
    MyVDConnection myvd = cfgMgr.getMyVD();
    UrlHolder holder = (UrlHolder) request.getAttribute(ProxyConstants.AUTOIDM_CFG);
    String urlChain = holder.getUrl().getAuthChain();
    AuthChainType act = holder.getConfig().getAuthChains().get(urlChain);
    AuthMechType amt = act.getAuthMech().get(as.getId());
    try {
        authImpl.doAuth(request, session, uidAttr, userName, password, myvd, act, amt, as, cfgMgr);
    } catch (LDAPException e) {
        if (e.getResultCode() != LDAPException.INVALID_CREDENTIALS) {
            logger.error("Could not authenticate user", e);
        }
        as.setExecuted(true);
        as.setSuccess(false);
        sendFail(response, realmName);
        return false;
    /*if (amt.getRequired().equals("required")) {
				session.setAttribute(AuthSys.AUTH_RES, false);
			}*/
    }
    return true;
}

Example 30 with AuthChainType

use of com.tremolosecurity.config.xml.AuthChainType in project OpenUnison by TremoloSecurity.

the class SendMessageThread method doPost.

@Override
public void doPost(HttpServletRequest request, HttpServletResponse response, AuthStep as) throws IOException, ServletException {
    // SharedSession.getSharedSession().getSession(req.getSession().getId());
    HttpSession session = ((HttpServletRequest) request).getSession();
    UrlHolder holder = (UrlHolder) request.getAttribute(ProxyConstants.AUTOIDM_CFG);
    RequestHolder reqHolder = ((AuthController) session.getAttribute(ProxyConstants.AUTH_CTL)).getHolder();
    HashMap<String, Attribute> authParams = (HashMap<String, Attribute>) session.getAttribute(ProxyConstants.AUTH_MECH_PARAMS);
    String urlChain = holder.getUrl().getAuthChain();
    AuthChainType act = holder.getConfig().getAuthChains().get(reqHolder.getAuthChainName());
    AuthMechType amt = act.getAuthMech().get(as.getId());
    String splashRedirect = authParams.get("splashRedirect").getValues().get(0);
    String noUserSplash = authParams.get("noUserSplash").getValues().get(0);
    if (request.getParameter("email") != null) {
        generateResetKey(request, response, splashRedirect, noUserSplash, as, act, this.lookupAttributeName);
        return;
    } else if (request.getParameter("key") != null) {
        String key = request.getParameter("key");
        org.hibernate.Session con = null;
        try {
            con = this.sessionFactory.openSession();
            finishLogin(request, response, session, act, as.getId(), amt, minValidKey, key, con, reqHolder, as);
        } catch (SQLException e) {
            throw new ServletException("Could not complete login", e);
        } finally {
            if (con != null) {
                con.close();
            }
        }
    }
}