Examples with AuthorizationData de.ids_mannheim.korap.authentication.http.AuthorizationData used on opensource projects

Example 1 with AuthorizationData

use of de.ids_mannheim.korap.authentication.http.AuthorizationData in project Kustvakt by KorAP.

the class AuthenticationController method requestAPIToken.

// EM: testing using spring security authentication manager
// @Deprecated
// @GET
// @Path("ldap/token")
// public Response requestToken (@Context HttpHeaders headers,
// @Context Locale locale,
// @HeaderParam(ContainerRequest.USER_AGENT) String agent,
// @HeaderParam(ContainerRequest.HOST) String host,
// @HeaderParam("referer-url") String referer,
// @QueryParam("scope") String scopes,
// //   @Context WebServiceContext wsContext, // FB
// @Context SecurityContext securityContext) {
// 
// Map<String, Object> attr = new HashMap<>();
// if (scopes != null && !scopes.isEmpty())
// attr.put(Attributes.SCOPES, scopes);
// attr.put(Attributes.HOST, host);
// attr.put(Attributes.USER_AGENT, agent);
// 
// User user = new KorAPUser();
// user.setUsername(securityContext.getUserPrincipal().getName());
// controller.setAccessAndLocation(user, headers);
// if (DEBUG_LOG == true) System.out.printf(
// "Debug: /token/: location=%s, access='%s'.\n",
// user.locationtoString(), user.accesstoString());
// attr.put(Attributes.LOCATION, user.getLocation());
// attr.put(Attributes.CORPUS_ACCESS, user.getCorpusAccess());
// 
// try {
// TokenContext context = controller.createTokenContext(user, attr,
// TokenType.API);
// return Response.ok(context.toJson()).build();
// }
// catch (KustvaktException e) {
// throw kustvaktResponseHandler.throwit(e);
// }
// }
@GET
@Path("apiToken")
public // @ResourceFilters({HeaderFilter.class})
Response requestAPIToken(@Context HttpHeaders headers, @Context Locale locale, @HeaderParam(ContainerRequest.USER_AGENT) String agent, @HeaderParam(ContainerRequest.HOST) String host, @HeaderParam("referer-url") String referer, @QueryParam("scope") String scopes, // @Context WebServiceContext wsContext, // FB
@Context SecurityContext secCtx) {
    List<String> auth = headers.getRequestHeader(ContainerRequest.AUTHORIZATION);
    if (auth == null || auth.isEmpty()) {
        throw kustvaktResponseHandler.throwit(new KustvaktException(StatusCodes.MISSING_PARAMETER, "Authorization header is missing.", "Authorization header"));
    }
    AuthorizationData authorizationData;
    try {
        authorizationData = authorizationHandler.parseAuthorizationHeaderValue(auth.get(0));
        if (authorizationData.getAuthenticationScheme().equals(AuthenticationScheme.BASIC)) {
            authorizationData = authorizationHandler.parseBasicToken(authorizationData);
        } else {
        // EM: throw exception that auth scheme is not supported?
        }
    } catch (KustvaktException e) {
        throw kustvaktResponseHandler.throwit(e);
    }
    if (DEBUG_LOG == true) {
        System.out.printf("Debug: AuthService.requestAPIToken...:\n");
        System.out.printf("Debug: auth.size=%d\n", auth.size());
        System.out.printf("auth.get(0)='%s'\n", auth.get(0));
        /* hide password etc. - FB
             if( auth.size() > 0 )
            	{
            	Iterator it = auth.iterator();
            	while( it.hasNext() )
            		System.out.printf(" header '%s'\n",  it.next());
            	}
            if( values.length > 0 )
            	{
            	for(int i=0; i< values.length; i++)
            		{
            		System.out.printf(" values[%d]='%s'\n",  i, values[i]);
            		}
            	}
             */
        MultivaluedMap<String, String> headerMap = headers.getRequestHeaders();
        if (headerMap != null && headerMap.size() > 0) {
            Iterator<String> it = headerMap.keySet().iterator();
            while (it.hasNext()) {
                String key = (String) it.next();
                List<String> vals = headerMap.get(key);
            // System.out.printf("Debug: requestAPIToken: '%s' = '%s'\n",
            // key, vals);
            }
        }
    // System.out.printf("Debug: requestAPIToken: isSecure = %s.\n",
    // secCtx.isSecure() ? "yes" : "no");
    }
    if (authorizationData.getUsername() == null || authorizationData.getUsername().isEmpty() || authorizationData.getPassword() == null || authorizationData.getPassword().isEmpty())
        // is actual an invalid request
        throw kustvaktResponseHandler.throwit(StatusCodes.REQUEST_INVALID);
    Map<String, Object> attr = new HashMap<>();
    if (scopes != null && !scopes.isEmpty())
        attr.put(Attributes.SCOPE, scopes);
    attr.put(Attributes.HOST, host);
    attr.put(Attributes.USER_AGENT, agent);
    TokenContext context;
    try {
        // User user = controller.authenticate(0, values[0], values[1], attr); Implementation by Hanl
        User user = controller.authenticate(AuthenticationMethod.LDAP, authorizationData.getUsername(), authorizationData.getPassword(), // Implementation with IdM/LDAP
        attr);
        // Userdata data = this.controller.getUserData(user, UserDetails.class); // Implem. by Hanl
        // todo: is this necessary?
        // attr.putAll(data.fields());
        // EM: add authentication time
        Date authenticationTime = TimeUtils.getNow().toDate();
        attr.put(Attributes.AUTHENTICATION_TIME, authenticationTime);
        // -- EM
        controller.setAccessAndLocation(user, headers);
        if (DEBUG_LOG == true)
            System.out.printf("Debug: /apiToken/: location=%s, access='%s'.\n", user.locationtoString(), user.accesstoString());
        attr.put(Attributes.LOCATION, user.getLocation());
        attr.put(Attributes.CORPUS_ACCESS, user.getCorpusAccess());
        context = controller.createTokenContext(user, attr, TokenType.API);
    // context = controller.createTokenContext(user, attr,
    // Attributes.API_AUTHENTICATION);
    } catch (KustvaktException e) {
        throw kustvaktResponseHandler.throwit(e);
    }
    try {
        return Response.ok(context.toJson()).build();
    } catch (KustvaktException e) {
        throw kustvaktResponseHandler.throwit(e);
    }
}

Example 2 with AuthorizationData

use of de.ids_mannheim.korap.authentication.http.AuthorizationData in project Kustvakt by KorAP.

the class StringUtilsTest method testBasicHttpSplit.

@Test
public void testBasicHttpSplit() throws KustvaktException {
    String s2 = new String(Base64.encodeBase64("test:testPass".getBytes()));
    String[] f2 = TransferEncoding.decodeBase64(s2);
    assertEquals("test", f2[0]);
    assertEquals("testPass", f2[1]);
    HttpAuthorizationHandler handler = new HttpAuthorizationHandler();
    String s1 = "basic " + new String(Base64.encodeBase64("test:testPass".getBytes()));
    AuthorizationData f1 = handler.parseAuthorizationHeaderValue(s1);
    assertEquals(s2, f1.getToken());
}

Example 3 with AuthorizationData

use of de.ids_mannheim.korap.authentication.http.AuthorizationData in project Kustvakt by KorAP.

the class AuthenticationController method requestSession.

@GET
@Path("sessionToken")
public // @ResourceFilters({HeaderFilter.class})
Response requestSession(@Context HttpHeaders headers, @Context Locale locale, @HeaderParam(ContainerRequest.USER_AGENT) String agent, @HeaderParam(ContainerRequest.HOST) String host) {
    List<String> auth = headers.getRequestHeader(ContainerRequest.AUTHORIZATION);
    AuthorizationData authorizationData;
    try {
        authorizationData = authorizationHandler.parseAuthorizationHeaderValue(auth.get(0));
        authorizationData = authorizationHandler.parseBasicToken(authorizationData);
    } catch (KustvaktException e) {
        throw kustvaktResponseHandler.throwit(e);
    }
    // | values[1].equalsIgnoreCase("null"))
    if (authorizationData.getUsername() == null || authorizationData.getUsername().isEmpty() || authorizationData.getPassword() == null || authorizationData.getPassword().isEmpty())
        // is actual an invalid request
        throw kustvaktResponseHandler.throwit(StatusCodes.REQUEST_INVALID);
    Map<String, Object> attr = new HashMap<>();
    attr.put(Attributes.HOST, host);
    attr.put(Attributes.USER_AGENT, agent);
    TokenContext context;
    String contextJson;
    try {
        // EM: authentication scheme default
        User user = controller.authenticate(AuthenticationMethod.DATABASE, authorizationData.getUsername(), authorizationData.getPassword(), attr);
        context = controller.createTokenContext(user, attr, TokenType.SESSION);
        // context = controller.createTokenContext(user, attr,
        // Attributes.SESSION_AUTHENTICATION);
        contextJson = context.toJson();
        jlog.debug(contextJson);
    } catch (KustvaktException e) {
        throw kustvaktResponseHandler.throwit(e);
    }
    return Response.ok().entity(contextJson).build();
}

Example 4 with AuthorizationData

use of de.ids_mannheim.korap.authentication.http.AuthorizationData in project Kustvakt by KorAP.

the class AuthenticationFilter method filter.

@Override
public ContainerRequest filter(ContainerRequest request) {
    String host = request.getHeaderValue(ContainerRequest.HOST);
    String ua = request.getHeaderValue(ContainerRequest.USER_AGENT);
    String authorization = request.getHeaderValue(ContainerRequest.AUTHORIZATION);
    if (authorization != null && !authorization.isEmpty()) {
        TokenContext context = null;
        AuthorizationData authData;
        try {
            authData = authorizationHandler.parseAuthorizationHeaderValue(authorization);
            switch(authData.getAuthenticationScheme()) {
                // production
                case BASIC:
                    context = authenticationManager.getTokenContext(TokenType.BASIC, authData.getToken(), host, ua);
                    break;
                // OAuth2 authentication scheme
                case BEARER:
                    context = authenticationManager.getTokenContext(TokenType.BEARER, authData.getToken(), host, ua);
                    break;
                // EM: JWT token-based authentication scheme
                case API:
                    context = authenticationManager.getTokenContext(TokenType.API, authData.getToken(), host, ua);
                    break;
                default:
                    throw new KustvaktException(StatusCodes.AUTHENTICATION_FAILED, "Authentication scheme is not supported.");
            }
            checkContext(context, request);
            request.setSecurityContext(new KustvaktContext(context));
        } catch (KustvaktException e) {
            throw kustvaktResponseHandler.throwit(e);
        }
    }
    return request;
}