Examples with SecurityAssertion ddf.security.assertion.SecurityAssertion used on opensource projects

Example 21 with SecurityAssertion

use of ddf.security.assertion.SecurityAssertion in project ddf by codice.

the class LoginFilter method renewSecurityToken.

private SAMLAuthenticationToken renewSecurityToken(HttpSession session, SAMLAuthenticationToken savedToken) throws ServletException, WSSecurityException {
    if (session != null) {
        SecurityAssertion savedAssertion = new SecurityAssertionImpl(((SecurityToken) savedToken.getCredentials()));
        if (savedAssertion.getIssuer() != null && !savedAssertion.getIssuer().equals(SystemBaseUrl.getHost())) {
            return null;
        }
        if (savedAssertion.getNotOnOrAfter() == null) {
            return null;
        }
        long afterMil = savedAssertion.getNotOnOrAfter().getTime();
        long timeoutMillis = (afterMil - System.currentTimeMillis());
        if (timeoutMillis <= 0) {
            throw new InvalidSAMLReceivedException("SAML assertion has expired.");
        }
        if (timeoutMillis <= 60000) {
            // within 60 seconds
            try {
                LOGGER.debug("Attempting to refresh user's SAML assertion.");
                Subject subject = securityManager.getSubject(savedToken);
                LOGGER.debug("Refresh of user assertion successful");
                for (Object principal : subject.getPrincipals()) {
                    if (principal instanceof SecurityAssertion) {
                        SecurityToken token = ((SecurityAssertion) principal).getSecurityToken();
                        SAMLAuthenticationToken samlAuthenticationToken = new SAMLAuthenticationToken((java.security.Principal) savedToken.getPrincipal(), token, savedToken.getRealm());
                        if (LOGGER.isTraceEnabled()) {
                            LOGGER.trace("Setting session token - class: {}  classloader: {}", token.getClass().getName(), token.getClass().getClassLoader());
                        }
                        ((SecurityTokenHolder) session.getAttribute(SecurityConstants.SAML_ASSERTION)).addSecurityToken(savedToken.getRealm(), token);
                        LOGGER.debug("Saved new user assertion to session.");
                        return samlAuthenticationToken;
                    }
                }
            } catch (SecurityServiceException e) {
                LOGGER.debug("Unable to refresh user's SAML assertion. User will log out prematurely.", e);
                session.invalidate();
            } catch (Exception e) {
                LOGGER.info("Unhandled exception occurred.", e);
                session.invalidate();
            }
        }
    }
    return null;
}

Example 22 with SecurityAssertion

use of ddf.security.assertion.SecurityAssertion in project ddf by codice.

the class LoginFilter method handleAuthenticationToken.

private Subject handleAuthenticationToken(HttpServletRequest httpRequest, BaseAuthenticationToken token) throws ServletException {
    Subject subject;
    HttpSession session = sessionFactory.getOrCreateSession(httpRequest);
    //if we already have an assertion inside the session and it has not expired, then use that instead
    SecurityToken sessionToken = getSecurityToken(session, token.getRealm());
    if (sessionToken == null) {
        /*
             * The user didn't have a SAML token from a previous authentication, but they do have the
             * credentials to log in - perform that action here.
             */
        try {
            // login with the specified authentication credentials (AuthenticationToken)
            subject = securityManager.getSubject(token);
            for (Object principal : subject.getPrincipals().asList()) {
                if (principal instanceof SecurityAssertion) {
                    if (LOGGER.isTraceEnabled()) {
                        Element samlToken = ((SecurityAssertion) principal).getSecurityToken().getToken();
                        LOGGER.trace("SAML Assertion returned: {}", XMLUtils.prettyFormat(samlToken));
                    }
                    SecurityToken securityToken = ((SecurityAssertion) principal).getSecurityToken();
                    addSamlToSession(httpRequest, token.getRealm(), securityToken);
                }
            }
        } catch (SecurityServiceException e) {
            LOGGER.debug("Unable to get subject from auth request.", e);
            throw new ServletException(e);
        }
    } else {
        LOGGER.trace("Creating SAML authentication token with session.");
        SAMLAuthenticationToken samlToken = new SAMLAuthenticationToken(null, session.getId(), token.getRealm());
        return handleAuthenticationToken(httpRequest, samlToken);
    }
    return subject;
}

Example 23 with SecurityAssertion

use of ddf.security.assertion.SecurityAssertion in project ddf by codice.

the class LoginFilterTest method testValidUsernameToken.

@Test
public void testValidUsernameToken() throws IOException, XMLStreamException, ServletException, ParserConfigurationException, SAXException, SecurityServiceException {
    FilterConfig filterConfig = mock(FilterConfig.class);
    LoginFilter loginFilter = new LoginFilter();
    loginFilter.setSessionFactory(sessionFactory);
    ddf.security.service.SecurityManager securityManager = mock(ddf.security.service.SecurityManager.class);
    loginFilter.setSecurityManager(securityManager);
    loginFilter.init(filterConfig);
    HttpServletRequest servletRequest = mock(HttpServletRequest.class);
    HttpServletResponse servletResponse = mock(HttpServletResponse.class);
    FilterChain filterChain = mock(FilterChain.class);
    UPAuthenticationToken token = new UPAuthenticationToken("foo", "bar");
    HandlerResult result = new HandlerResult(HandlerResult.Status.COMPLETED, token);
    when(servletRequest.getAttribute("ddf.security.token")).thenReturn(result);
    HttpSession session = mock(HttpSession.class);
    when(servletRequest.getSession(true)).thenReturn(session);
    when(session.getAttribute(SecurityConstants.SAML_ASSERTION)).thenReturn(new SecurityTokenHolder());
    when(sessionFactory.getOrCreateSession(servletRequest)).thenReturn(session);
    Subject subject = mock(Subject.class, RETURNS_DEEP_STUBS);
    when(securityManager.getSubject(token)).thenReturn(subject);
    SecurityAssertion assertion = mock(SecurityAssertion.class);
    SecurityToken securityToken = mock(SecurityToken.class);
    when(assertion.getSecurityToken()).thenReturn(securityToken);
    when(subject.getPrincipals().asList()).thenReturn(Arrays.asList(assertion));
    when(securityToken.getToken()).thenReturn(readDocument("/good_saml.xml").getDocumentElement());
    loginFilter.doFilter(servletRequest, servletResponse, filterChain);
}

Example 24 with SecurityAssertion

use of ddf.security.assertion.SecurityAssertion in project ddf by codice.

the class SecurityManagerImpl method createPrincipalFromToken.

/**
     * Creates a new principal object from an incoming security token.
     *
     * @param token SecurityToken that contains the principals.
     * @return new SimplePrincipalCollection
     */
private SimplePrincipalCollection createPrincipalFromToken(SecurityToken token) {
    SimplePrincipalCollection principals = new SimplePrincipalCollection();
    for (Realm curRealm : realms) {
        LOGGER.debug("Configuring settings for realm name: {} type: {}", curRealm.getName(), curRealm.getClass().toString());
        LOGGER.debug("Is authorizer: {}, is AuthorizingRealm: {}", curRealm instanceof Authorizer, curRealm instanceof AuthorizingRealm);
        SecurityAssertion securityAssertion = null;
        try {
            securityAssertion = new SecurityAssertionImpl(token, usernameAttributeList);
            Principal principal = securityAssertion.getPrincipal();
            if (principal != null) {
                principals.add(principal.getName(), curRealm.getName());
            }
        } catch (Exception e) {
            LOGGER.warn("Encountered error while trying to get the Principal for the SecurityToken. Security functions may not work properly.", e);
        }
        if (securityAssertion != null) {
            principals.add(securityAssertion, curRealm.getName());
        }
    }
    return principals;
}

Example 25 with SecurityAssertion

use of ddf.security.assertion.SecurityAssertion in project ddf by codice.

the class SubjectUtils method getName.

/**
     * Retrieves the user name from a given subject.
     *
     * @param subject           Subject to get the user name from.
     * @param defaultName       Name to send back if no user name was found.
     * @param returnDisplayName return formatted user name for displaying
     * @return String representation of the user name if available or
     * defaultName if no user name could be found or incoming subject
     * was null.
     */
public static String getName(Subject subject, String defaultName, boolean returnDisplayName) {
    String name = defaultName;
    if (subject != null) {
        PrincipalCollection principals = subject.getPrincipals();
        if (principals != null) {
            SecurityAssertion assertion = principals.oneByType(SecurityAssertion.class);
            if (assertion != null) {
                Principal principal = assertion.getPrincipal();
                if (principal instanceof KerberosPrincipal) {
                    StringTokenizer st = new StringTokenizer(principal.getName(), "@");
                    st = new StringTokenizer(st.nextToken(), "/");
                    name = st.nextToken();
                } else {
                    name = principal.getName();
                }
                if (returnDisplayName) {
                    name = getDisplayName(principal, name);
                }
            } else {
                // send back the primary principal as a string
                name = principals.getPrimaryPrincipal().toString();
            }
        } else {
            LOGGER.debug("No principals located in the incoming subject, cannot look up user name. Using default name of {}.", defaultName);
        }
    } else {
        LOGGER.debug("Incoming subject was null, cannot look up user name. Using default name of {}.", defaultName);
    }
    LOGGER.debug("Sending back name {}.", name);
    return name;
}