Examples with AuthController com.tremolosecurity.proxy.auth.AuthController used on opensource projects

Example 41 with AuthController

use of com.tremolosecurity.proxy.auth.AuthController in project OpenUnison by TremoloSecurity.

the class PersistentCookie method doWork.

private void doWork(HttpServletRequest request, HttpServletResponse response, AuthStep as) throws IOException, ServletException {
    as.setExecuted(true);
    MyVDConnection myvd = cfgMgr.getMyVD();
    // HttpSession session = (HttpSession) req.getAttribute(ConfigFilter.AUTOIDM_SESSION);//((HttpServletRequest) req).getSession(); //SharedSession.getSharedSession().getSession(req.getSession().getId());
    // SharedSession.getSharedSession().getSession(req.getSession().getId());
    HttpSession session = ((HttpServletRequest) request).getSession();
    UrlHolder holder = (UrlHolder) request.getAttribute(ProxyConstants.AUTOIDM_CFG);
    if (holder == null) {
        throw new ServletException("Holder is null");
    }
    RequestHolder reqHolder = ((AuthController) session.getAttribute(ProxyConstants.AUTH_CTL)).getHolder();
    String urlChain = holder.getUrl().getAuthChain();
    AuthChainType act = holder.getConfig().getAuthChains().get(reqHolder.getAuthChainName());
    HashMap<String, Attribute> authParams = (HashMap<String, Attribute>) session.getAttribute(ProxyConstants.AUTH_MECH_PARAMS);
    Attribute attr = authParams.get("cookieName");
    if (attr == null) {
        throw new ServletException("No cookie name specified");
    }
    String cookieName = attr.getValues().get(0);
    boolean useSSLSessionID;
    attr = authParams.get("useSSLSessionID");
    if (attr == null) {
        useSSLSessionID = false;
    } else {
        useSSLSessionID = attr.getValues().get(0).equalsIgnoreCase("true");
    }
    attr = authParams.get("millisToLive");
    if (attr == null) {
        throw new ServletException("No milliseconds to live specified");
    }
    long millisToLive = Long.parseLong(attr.getValues().get(0));
    attr = authParams.get("keyAlias");
    if (attr == null) {
        throw new ServletException("No key name specified");
    }
    String keyAlias = attr.getValues().get(0);
    Cookie authCookie = null;
    if (request.getCookies() == null) {
        as.setSuccess(false);
        holder.getConfig().getAuthManager().nextAuth(request, response, session, false);
        return;
    }
    for (Cookie cookie : request.getCookies()) {
        if (cookie.getName().equalsIgnoreCase(cookieName)) {
            authCookie = cookie;
            break;
        }
    }
    if (authCookie == null) {
        as.setSuccess(false);
        holder.getConfig().getAuthManager().nextAuth(request, response, session, false);
        return;
    }
    com.tremolosecurity.lastmile.LastMile lastmile = new com.tremolosecurity.lastmile.LastMile();
    SecretKey key = this.cfgMgr.getSecretKey(keyAlias);
    if (key == null) {
        throw new ServletException("Secret key '" + keyAlias + "' does not exist");
    }
    try {
        String cookieVal = authCookie.getValue();
        if (cookieVal.startsWith("\"")) {
            cookieVal = cookieVal.substring(1, cookieVal.length() - 1);
        }
        lastmile.loadLastMielToken(cookieVal, key);
    } catch (Exception e) {
        logger.warn("Could not decrypt cookie", e);
        as.setSuccess(false);
        holder.getConfig().getAuthManager().nextAuth(request, response, session, false);
        return;
    }
    if (!lastmile.isValid()) {
        logger.warn("Cookie no longer valid");
        as.setSuccess(false);
        holder.getConfig().getAuthManager().nextAuth(request, response, session, false);
        return;
    }
    boolean found = false;
    boolean validip = false;
    boolean validSslSessionId = !useSSLSessionID;
    String dn = null;
    for (Attribute attrib : lastmile.getAttributes()) {
        if (attrib.getName().equalsIgnoreCase("CLIENT_IP")) {
            validip = attrib.getValues().get(0).equals(request.getRemoteAddr());
        } else if (attrib.getName().equalsIgnoreCase("DN")) {
            dn = attrib.getValues().get(0);
        } else if (attrib.getName().equalsIgnoreCase("SSL_SESSION_ID")) {
            Object sessionID = request.getAttribute("javax.servlet.request.ssl_session_id");
            if (sessionID instanceof byte[]) {
                sessionID = new String(Base64.encodeBase64((byte[]) sessionID));
            }
            validSslSessionId = attrib.getValues().get(0).equals(sessionID);
        }
    }
    if (dn != null && validip && validSslSessionId) {
        try {
            LDAPSearchResults res = myvd.search(dn, 0, "(objectClass=*)", new ArrayList<String>());
            if (res.hasMore()) {
                LDAPEntry entry = res.next();
                Iterator<LDAPAttribute> it = entry.getAttributeSet().iterator();
                AuthInfo authInfo = new AuthInfo(entry.getDN(), (String) session.getAttribute(ProxyConstants.AUTH_MECH_NAME), act.getName(), act.getLevel());
                ((AuthController) session.getAttribute(ProxyConstants.AUTH_CTL)).setAuthInfo(authInfo);
                while (it.hasNext()) {
                    LDAPAttribute ldapattr = it.next();
                    attr = new Attribute(ldapattr.getName());
                    String[] vals = ldapattr.getStringValueArray();
                    for (int i = 0; i < vals.length; i++) {
                        attr.getValues().add(vals[i]);
                    }
                    authInfo.getAttribs().put(attr.getName(), attr);
                }
                as.setSuccess(true);
            } else {
                as.setSuccess(false);
            }
        } catch (LDAPException e) {
            if (e.getResultCode() != LDAPException.INVALID_CREDENTIALS) {
                logger.error("Could not authenticate user", e);
            }
            as.setSuccess(false);
        }
    } else {
        as.setSuccess(false);
    }
    holder.getConfig().getAuthManager().nextAuth(request, response, session, false);
}

Example 42 with AuthController

use of com.tremolosecurity.proxy.auth.AuthController in project OpenUnison by TremoloSecurity.

the class SecretQuestionAuth method doPost.

@Override
public void doPost(HttpServletRequest request, HttpServletResponse response, AuthStep as) throws IOException, ServletException {
    MyVDConnection myvd = cfgMgr.getMyVD();
    // HttpSession session = (HttpSession) req.getAttribute(ConfigFilter.AUTOIDM_SESSION);//((HttpServletRequest) req).getSession(); //SharedSession.getSharedSession().getSession(req.getSession().getId());
    // SharedSession.getSharedSession().getSession(req.getSession().getId());
    HttpSession session = ((HttpServletRequest) request).getSession();
    UrlHolder holder = (UrlHolder) request.getAttribute(ProxyConstants.AUTOIDM_CFG);
    RequestHolder reqHolder = ((AuthController) session.getAttribute(ProxyConstants.AUTH_CTL)).getHolder();
    HashMap<String, Attribute> authParams = (HashMap<String, Attribute>) session.getAttribute(ProxyConstants.AUTH_MECH_PARAMS);
    String alg = authParams.get("alg").getValues().get(0);
    String salt = authParams.get("salt").getValues().get(0);
    String urlChain = holder.getUrl().getAuthChain();
    AuthChainType act = holder.getConfig().getAuthChains().get(reqHolder.getAuthChainName());
    AuthMechType amt = act.getAuthMech().get(as.getId());
    ArrayList<SecretQuestion> questions = (ArrayList<SecretQuestion>) request.getSession(true).getAttribute("TREMOLO_SECRET_ANSWERS");
    if (questions == null) {
        this.doGet(request, response, as);
        return;
    }
    int i = 0;
    StringBuffer b = new StringBuffer();
    for (SecretQuestion sq : questions) {
        b.setLength(0);
        b.append("answer").append(i);
        String answer = request.getParameter(b.toString());
        if (!sq.checkAnswer(alg, answer, salt)) {
            if (amt.getRequired().equals("required")) {
                as.setSuccess(false);
                holder.getConfig().getAuthManager().nextAuth(request, response, session, false);
                return;
            }
        }
        i++;
    }
    as.setSuccess(true);
    holder.getConfig().getAuthManager().nextAuth(request, response, session, false);
}

Example 43 with AuthController

use of com.tremolosecurity.proxy.auth.AuthController in project OpenUnison by TremoloSecurity.

the class ScaleMain method executeWorkflows.

private void executeWorkflows(HttpFilterRequest request, HttpFilterResponse response, Gson gson) throws Exception {
    Type listType = new TypeToken<ArrayList<WorkflowRequest>>() {
    }.getType();
    byte[] requestBytes = (byte[]) request.getAttribute(ProxySys.MSG_BODY);
    String requestString = new String(requestBytes, StandardCharsets.UTF_8);
    List<WorkflowRequest> reqs = gson.fromJson(requestString, listType);
    HashMap<String, String> results = new HashMap<String, String>();
    for (WorkflowRequest req : reqs) {
        if (req.getReason() == null || req.getReason().isEmpty()) {
            results.put(req.getUuid(), "Reason is required");
        } else {
            HashSet<String> allowedOrgs = new HashSet<String>();
            AuthInfo userData = ((AuthController) request.getSession().getAttribute(ProxyConstants.AUTH_CTL)).getAuthInfo();
            OrgType ot = GlobalEntries.getGlobalEntries().getConfigManager().getCfg().getProvisioning().getOrg();
            AzSys az = new AzSys();
            this.checkOrg(allowedOrgs, ot, az, userData, request.getSession());
            String orgid = null;
            List<WorkflowType> wfs = GlobalEntries.getGlobalEntries().getConfigManager().getCfg().getProvisioning().getWorkflows().getWorkflow();
            for (WorkflowType wf : wfs) {
                if (wf.getName().equals(req.getName())) {
                    orgid = wf.getOrgid();
                    break;
                }
            }
            if (orgid == null) {
                results.put(req.getUuid(), "Not Found");
            } else if (!allowedOrgs.contains(orgid)) {
                results.put(req.getUuid(), "Unauthorized");
            } else {
                WFCall wfCall = new WFCall();
                wfCall.setName(req.getName());
                String requestReason = req.getReason().trim();
                if (requestReason.length() > 255) {
                    logger.warn("Reason is oversized : " + requestReason.length());
                    requestReason = requestReason.substring(0, 255);
                }
                wfCall.setReason(requestReason);
                wfCall.setUidAttributeName(this.scaleConfig.getUidAttributeName());
                wfCall.setEncryptedParams(req.getEncryptedParams());
                TremoloUser tu = new TremoloUser();
                if (req.getSubjects() == null || req.getSubjects().isEmpty()) {
                    tu.setUid(userData.getAttribs().get(this.scaleConfig.getUidAttributeName()).getValues().get(0));
                    tu.getAttributes().add(new Attribute(this.scaleConfig.getUidAttributeName(), userData.getAttribs().get(this.scaleConfig.getUidAttributeName()).getValues().get(0)));
                    wfCall.setUser(tu);
                    try {
                        com.tremolosecurity.provisioning.workflow.ExecuteWorkflow exec = new com.tremolosecurity.provisioning.workflow.ExecuteWorkflow();
                        exec.execute(wfCall, GlobalEntries.getGlobalEntries().getConfigManager());
                        results.put(req.getUuid(), "success");
                    } catch (Exception e) {
                        logger.error("Could not update user", e);
                        results.put(req.getUuid(), "Error, please contact your system administrator");
                    }
                } else {
                    PreCheckResponse preCheckResp = new PreCheckResponse();
                    checkPreCheck(request, userData, allowedOrgs, req.getName(), orgid, preCheckResp);
                    StringBuffer errors = new StringBuffer();
                    if (preCheckResp.isCanDelegate()) {
                        for (String subject : req.getSubjects()) {
                            // execute for each subject
                            wfCall = new WFCall();
                            wfCall.setName(req.getName());
                            wfCall.setReason(req.getReason());
                            wfCall.setUidAttributeName(this.scaleConfig.getUidAttributeName());
                            wfCall.setEncryptedParams(req.getEncryptedParams());
                            wfCall.setRequestor(userData.getAttribs().get(this.scaleConfig.getUidAttributeName()).getValues().get(0));
                            tu = new TremoloUser();
                            wfCall.setUser(tu);
                            LDAPSearchResults searchRes = GlobalEntries.getGlobalEntries().getConfigManager().getMyVD().search(GlobalEntries.getGlobalEntries().getConfigManager().getCfg().getLdapRoot(), 2, equal(this.scaleConfig.getUidAttributeName(), subject).toString(), new ArrayList<String>());
                            if (searchRes.hasMore()) {
                                LDAPEntry entry = searchRes.next();
                                if (entry == null) {
                                    errors.append("Error, user " + subject + " does not exist;");
                                } else {
                                    startSubjectWorkflow(errors, req, wfCall, tu, subject, entry, preCheckResp);
                                }
                            } else {
                                errors.append("Error, user " + subject + " does not exist;");
                            }
                            while (searchRes.hasMore()) searchRes.next();
                        }
                        if (errors.length() == 0) {
                            results.put(req.getUuid(), "success");
                        } else {
                            results.put(req.getUuid(), errors.toString().substring(0, errors.toString().length() - 1));
                        }
                    } else {
                        results.put(req.getUuid(), "Unable to submit");
                        logger.warn("User '" + userData.getUserDN() + "' not allowed to request for others for '" + req.getName() + "'");
                    }
                }
            }
        }
    }
    ScaleJSUtils.addCacheHeaders(response);
    response.setContentType("application/json");
    response.getWriter().println(gson.toJson(results).trim());
}

Example 44 with AuthController

use of com.tremolosecurity.proxy.auth.AuthController in project OpenUnison by TremoloSecurity.

the class ScaleMain method loadApproval.

private void loadApproval(HttpFilterRequest request, HttpFilterResponse response, Gson gson) throws ProvisioningException, IOException, LDAPException {
    int approvalID = Integer.parseInt(request.getRequestURI().substring(request.getRequestURI().lastIndexOf('/') + 1));
    AuthInfo userData = ((AuthController) request.getSession().getAttribute(ProxyConstants.AUTH_CTL)).getAuthInfo();
    String uid = userData.getAttribs().get(this.scaleConfig.getUidAttributeName()).getValues().get(0);
    boolean ok = false;
    ApprovalSummaries summaries = ServiceActions.listOpenApprovals(uid, this.scaleConfig.getDisplayNameAttribute(), GlobalEntries.getGlobalEntries().getConfigManager());
    for (ApprovalSummary as : summaries.getApprovals()) {
        if (as.getApproval() == approvalID) {
            ok = true;
        }
    }
    if (!ok) {
        response.setStatus(401);
        response.setContentType("application/json");
        ScaleError error = new ScaleError();
        error.getErrors().add("Unauthorized");
        ScaleJSUtils.addCacheHeaders(response);
        response.getWriter().print(gson.toJson(error).trim());
        response.getWriter().flush();
    } else {
        response.setContentType("application/json");
        ApprovalDetails details = ServiceActions.loadApprovalDetails(uid, approvalID);
        String filter = equal(this.scaleConfig.getUidAttributeName(), details.getUserObj().getUserID()).toString();
        ArrayList<String> attrs = new ArrayList<String>();
        /*for (String attrName : this.scaleConfig.getApprovalAttributes().keySet()) {
				attrs.add(attrName);
			}
			
			if (this.scaleConfig.getRoleAttribute() != null && ! this.scaleConfig.getRoleAttribute().isEmpty()) {
				attrs.add(this.scaleConfig.getRoleAttribute());
			}*/
        LDAPSearchResults res = GlobalEntries.getGlobalEntries().getConfigManager().getMyVD().search(GlobalEntries.getGlobalEntries().getConfigManager().getCfg().getLdapRoot(), 2, filter, attrs);
        if (res.hasMore()) {
            LDAPEntry entry = res.next();
            details.getUserObj().getAttribs().clear();
            for (String attrName : this.scaleConfig.getApprovalAttributes().keySet()) {
                LDAPAttribute attr = entry.getAttribute(attrName);
                if (attr != null) {
                    details.getUserObj().getAttribs().put(scaleConfig.getApprovalAttributes().get(attrName).getDisplayName(), new Attribute(scaleConfig.getApprovalAttributes().get(attrName).getDisplayName(), attr.getStringValue()));
                }
            }
            if (this.scaleConfig.getRoleAttribute() != null && !this.scaleConfig.getRoleAttribute().isEmpty()) {
                LDAPAttribute attr = entry.getAttribute(this.scaleConfig.getRoleAttribute());
                if (attr != null) {
                    details.getUserObj().getGroups().clear();
                    for (String val : attr.getStringValueArray()) {
                        details.getUserObj().getGroups().add(val);
                    }
                }
            } else {
                details.getUserObj().getGroups().clear();
                ArrayList<String> attrNames = new ArrayList<String>();
                attrNames.add("cn");
                LDAPSearchResults res2 = GlobalEntries.getGlobalEntries().getConfigManager().getMyVD().search(GlobalEntries.getGlobalEntries().getConfigManager().getCfg().getLdapRoot(), 2, equal(GlobalEntries.getGlobalEntries().getConfigManager().getCfg().getGroupMemberAttribute(), entry.getDN()).toString(), attrNames);
                while (res2.hasMore()) {
                    LDAPEntry entry2 = res2.next();
                    LDAPAttribute la = entry2.getAttribute("cn");
                    if (la != null) {
                        details.getUserObj().getGroups().add(la.getStringValue());
                    }
                }
            }
        }
        while (res.hasMore()) res.next();
        ScaleJSUtils.addCacheHeaders(response);
        response.getWriter().println(gson.toJson(details).trim());
        response.getWriter().flush();
    }
}

Example 45 with AuthController

use of com.tremolosecurity.proxy.auth.AuthController in project OpenUnison by TremoloSecurity.

the class ScaleMain method lookupUser.

private void lookupUser(HttpFilterRequest request, HttpFilterResponse response, Gson gson) throws LDAPException, IOException {
    response.setContentType("application/json");
    AuthInfo userData = ((AuthController) request.getSession().getAttribute(ProxyConstants.AUTH_CTL)).getAuthInfo();
    Set<String> allowedAttrs = null;
    if (scaleConfig.getUiDecisions() != null) {
        allowedAttrs = this.scaleConfig.getUiDecisions().availableAttributes(userData, request.getServletRequest());
    }
    UserData userToSend = new UserData();
    userToSend.setDn(userData.getUserDN());
    for (String attrName : this.scaleConfig.getUserAttributeList()) {
        if (allowedAttrs == null || allowedAttrs.contains(attrName)) {
            Attribute attr = new Attribute(attrName);
            Attribute fromUser = userData.getAttribs().get(attrName);
            if (fromUser != null) {
                attr.getValues().addAll(fromUser.getValues());
                if (attrName.equalsIgnoreCase(this.scaleConfig.getUidAttributeName())) {
                    userToSend.setUid(fromUser.getValues().get(0));
                }
            }
            userToSend.getAttributes().add(attr);
        }
    }
    if (this.scaleConfig.getRoleAttribute() != null && !this.scaleConfig.getRoleAttribute().isEmpty()) {
        Attribute fromUser = userData.getAttribs().get(this.scaleConfig.getRoleAttribute());
        Attribute attr = new Attribute(this.scaleConfig.getRoleAttribute());
        if (fromUser != null) {
            attr.getValues().addAll(fromUser.getValues());
        }
        userToSend.getAttributes().add(attr);
    }
    ArrayList<String> attrNames = new ArrayList<String>();
    attrNames.add("cn");
    LDAPSearchResults res = GlobalEntries.getGlobalEntries().getConfigManager().getMyVD().search(GlobalEntries.getGlobalEntries().getConfigManager().getCfg().getLdapRoot(), 2, equal(GlobalEntries.getGlobalEntries().getConfigManager().getCfg().getGroupMemberAttribute(), userData.getUserDN()).toString(), attrNames);
    while (res.hasMore()) {
        LDAPEntry entry = res.next();
        LDAPAttribute la = entry.getAttribute("cn");
        if (la != null) {
            userToSend.getGroups().add(la.getStringValue());
        }
    }
    ScaleJSUtils.addCacheHeaders(response);
    response.getWriter().println(gson.toJson(userToSend).trim());
}