Examples with SecurityTokenHolder ddf.security.common.SecurityTokenHolder used on opensource projects

Example 1 with SecurityTokenHolder

use of ddf.security.common.SecurityTokenHolder in project ddf by codice.

the class SAMLAssertionHandlerTest method testGetNormalizedTokenFromSession.

@Test
public void testGetNormalizedTokenFromSession() throws Exception {
    SAMLAssertionHandler handler = new SAMLAssertionHandler();
    HttpServletRequest request = mock(HttpServletRequest.class);
    HttpServletResponse response = mock(HttpServletResponse.class);
    FilterChain chain = mock(FilterChain.class);
    when(request.getCookies()).thenReturn(null);
    HttpSession session = mock(HttpSession.class);
    when(request.getSession(false)).thenReturn(session);
    when(request.getAttribute(ContextPolicy.ACTIVE_REALM)).thenReturn("foo");
    SecurityTokenHolder tokenHolder = mock(SecurityTokenHolder.class);
    when(session.getAttribute(SecurityConstants.SAML_ASSERTION)).thenReturn(tokenHolder);
    SecurityToken securityToken = mock(SecurityToken.class);
    when(tokenHolder.getSecurityToken("foo")).thenReturn(securityToken);
    when(securityToken.getToken()).thenReturn(readDocument("/saml.xml").getDocumentElement());
    HandlerResult result = handler.getNormalizedToken(request, response, chain, true);
    assertNotNull(result);
    assertEquals(HandlerResult.Status.COMPLETED, result.getStatus());
}

Example 2 with SecurityTokenHolder

use of ddf.security.common.SecurityTokenHolder in project ddf by codice.

the class LogoutRequestService method logout.

private void logout() {
    HttpSession session = sessionFactory.getOrCreateSession(request);
    SecurityTokenHolder tokenHolder = ((SecurityTokenHolder) session.getAttribute(SecurityConstants.SAML_ASSERTION));
    SecurityAssertion securityAssertion = new SecurityAssertionImpl(tokenHolder.getSecurityToken("idp"));
    boolean hasSecurityAuditRole = Arrays.stream(System.getProperty("security.audit.roles").split(",")).filter(role -> securityAssertion.getPrincipals().contains(new RolePrincipal(role))).findFirst().isPresent();
    if (hasSecurityAuditRole) {
        SecurityLogger.audit("Subject with admin privileges has logged out: {}", securityAssertion.getPrincipal().getName());
    }
    tokenHolder.remove("idp");
}

Example 3 with SecurityTokenHolder

use of ddf.security.common.SecurityTokenHolder in project ddf by codice.

the class LoginFilter method addSecurityToken.

private void addSecurityToken(HttpSession session, String realm, SecurityToken token) {
    SecurityTokenHolder holder = (SecurityTokenHolder) session.getAttribute(SecurityConstants.SAML_ASSERTION);
    holder.addSecurityToken(realm, token);
}

Example 4 with SecurityTokenHolder

use of ddf.security.common.SecurityTokenHolder in project ddf by codice.

the class HttpSessionFactory method getOrCreateSession.

/**
     * Synchronized method because of jettys getSession method is not thread safe. Additionally,
     * assures a SAML {@link SecurityTokenHolder} has been set on the {@link SecurityConstants#SAML_ASSERTION} attribute
     *
     * @param httpRequest
     * @return
     */
@Override
public synchronized HttpSession getOrCreateSession(HttpServletRequest httpRequest) {
    HttpSession session = httpRequest.getSession(true);
    if (session.getAttribute(SecurityConstants.SAML_ASSERTION) == null) {
        session.setAttribute(SecurityConstants.SAML_ASSERTION, new SecurityTokenHolder());
        SecurityLogger.audit("Creating a new session with id {} for client {}.", session.getId(), httpRequest.getRemoteAddr());
    }
    return session;
}

Example 5 with SecurityTokenHolder

use of ddf.security.common.SecurityTokenHolder in project ddf by codice.

the class LocalLogoutServlet method doGet.

@Override
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    response.setHeader("Cache-Control", "no-cache, no-store");
    response.setHeader("Pragma", "no-cache");
    response.setContentType("text/html");
    URIBuilder redirectUrlBuilder = null;
    List<NameValuePair> params = new ArrayList<>();
    try {
        redirectUrlBuilder = new URIBuilder("/logout/logout-response.html");
        HttpSession session = request.getSession();
        if (session != null) {
            SecurityTokenHolder savedToken = (SecurityTokenHolder) session.getAttribute(SecurityConstants.SAML_ASSERTION);
            if (savedToken != null) {
                Subject subject = ThreadContext.getSubject();
                boolean hasSecurityAuditRole = Arrays.stream(System.getProperty("security.audit.roles").split(",")).anyMatch(subject::hasRole);
                if (hasSecurityAuditRole) {
                    SecurityLogger.audit("Subject with admin privileges has logged out", subject);
                }
                savedToken.removeAll();
            }
            session.invalidate();
            deleteJSessionId(response);
        }
        //Check for pki
        if (request.getAttribute("javax.servlet.request.X509Certificate") != null && ((X509Certificate[]) request.getAttribute("javax.servlet.request.X509Certificate")).length > 0) {
            params.add(new BasicNameValuePair("msg", "Please close your browser to finish logging out"));
        }
        //Check for basic
        Enumeration authHeaders = request.getHeaders(javax.ws.rs.core.HttpHeaders.AUTHORIZATION);
        while (authHeaders.hasMoreElements()) {
            if (((String) authHeaders.nextElement()).contains("Basic")) {
                params.add(new BasicNameValuePair("msg", "Please close your browser to finish logging out"));
                break;
            }
        }
        redirectUrlBuilder.addParameters(params);
        response.sendRedirect(redirectUrlBuilder.build().toString());
    } catch (URISyntaxException e) {
        LOGGER.debug("Invalid URI", e);
    }
}