Examples with PowerAuthSignatureHttpHeader io.getlime.security.powerauth.http.PowerAuthSignatureHttpHeader used on opensource projects

Example 1 with PowerAuthSignatureHttpHeader

use of io.getlime.security.powerauth.http.PowerAuthSignatureHttpHeader in project powerauth-restful-integration by lime-company.

the class SecureVaultController method unlockVault.

/**
 * Request the vault unlock key.
 * @param signatureHeader PowerAuth signature HTTP header.
 * @return PowerAuth RESTful response with {@link VaultUnlockResponse} payload.
 * @throws PowerAuthAuthenticationException In case authentication fails.
 */
@POST
@Consumes({ MediaType.APPLICATION_JSON })
@Produces({ MediaType.APPLICATION_JSON })
@Path("unlock")
public ObjectResponse<VaultUnlockResponse> unlockVault(@HeaderParam(PowerAuthSignatureHttpHeader.HEADER_NAME) String signatureHeader, ObjectRequest<VaultUnlockRequest> request, @Context HttpServletRequest httpServletRequest) throws PowerAuthAuthenticationException, PowerAuthSecureVaultException {
    try {
        PowerAuthSignatureHttpHeader header = new PowerAuthSignatureHttpHeader().fromValue(signatureHeader);
        try {
            PowerAuthSignatureHttpHeaderValidator.validate(header);
        } catch (InvalidPowerAuthHttpHeaderException e) {
            throw new PowerAuthAuthenticationException(e.getMessage());
        }
        SignatureTypeConverter converter = new SignatureTypeConverter();
        String activationId = header.getActivationId();
        String applicationId = header.getApplicationKey();
        String signature = header.getSignature();
        PowerAuthPortServiceStub.SignatureType signatureType = converter.convertFrom(header.getSignatureType());
        String nonce = header.getNonce();
        String reason = null;
        if (request != null) {
            VaultUnlockRequest vaultUnlockRequest = request.getRequestObject();
            if (vaultUnlockRequest != null && vaultUnlockRequest.getReason() != null) {
                reason = vaultUnlockRequest.getReason();
            }
        }
        String requestBodyString = ((String) httpServletRequest.getAttribute(PowerAuthRequestFilterBase.POWERAUTH_SIGNATURE_BASE_STRING));
        byte[] requestBodyBytes = requestBodyString == null ? null : BaseEncoding.base64().decode(requestBodyString);
        String data = PowerAuthHttpBody.getSignatureBaseString("POST", "/pa/vault/unlock", BaseEncoding.base64().decode(nonce), requestBodyBytes);
        PowerAuthPortServiceStub.VaultUnlockResponse soapResponse = powerAuthClient.unlockVault(activationId, applicationId, data, signature, signatureType, reason);
        if (!soapResponse.getSignatureValid()) {
            throw new PowerAuthAuthenticationException();
        }
        VaultUnlockResponse response = new VaultUnlockResponse();
        response.setActivationId(soapResponse.getActivationId());
        response.setEncryptedVaultEncryptionKey(soapResponse.getEncryptedVaultEncryptionKey());
        return new ObjectResponse<>(response);
    } catch (PowerAuthAuthenticationException ex) {
        throw ex;
    } catch (Exception ex) {
        throw new PowerAuthSecureVaultException();
    }
}

Example 2 with PowerAuthSignatureHttpHeader

use of io.getlime.security.powerauth.http.PowerAuthSignatureHttpHeader in project powerauth-restful-integration by lime-company.

the class PowerAuthAuthenticationProvider method validateRequestSignature.

/**
 * Validate the signature from the PowerAuth 2.0 HTTP header against the provided HTTP method, request body and URI identifier.
 * Make sure to accept only allowed signatures.
 * @param httpMethod HTTP method (GET, POST, ...)
 * @param httpBody Body of the HTTP request.
 * @param requestUriIdentifier Request URI identifier.
 * @param httpAuthorizationHeader PowerAuth 2.0 HTTP authorization header.
 * @param allowedSignatureTypes Allowed types of the signature.
 * @return Instance of a PowerAuthApiAuthenticationImpl on successful authorization.
 * @throws PowerAuthAuthenticationException In case authorization fails, exception is raised.
 */
public PowerAuthApiAuthentication validateRequestSignature(String httpMethod, byte[] httpBody, String requestUriIdentifier, String httpAuthorizationHeader, List<PowerAuthSignatureTypes> allowedSignatureTypes) throws PowerAuthAuthenticationException {
    // Check for HTTP PowerAuth signature header
    if (httpAuthorizationHeader == null || httpAuthorizationHeader.equals("undefined")) {
        throw new PowerAuthAuthenticationException("POWER_AUTH_SIGNATURE_INVALID_EMPTY");
    }
    // Parse HTTP header
    PowerAuthSignatureHttpHeader header = new PowerAuthSignatureHttpHeader().fromValue(httpAuthorizationHeader);
    // Validate the header
    try {
        PowerAuthSignatureHttpHeaderValidator.validate(header);
    } catch (InvalidPowerAuthHttpHeaderException e) {
        throw new PowerAuthAuthenticationException(e.getMessage());
    }
    // Check if the signature type is allowed
    PowerAuthSignatureTypes expectedSignatureType = PowerAuthSignatureTypes.getEnumFromString(header.getSignatureType());
    if (!allowedSignatureTypes.contains(expectedSignatureType)) {
        throw new PowerAuthAuthenticationException("POWER_AUTH_SIGNATURE_TYPE_INVALID");
    }
    // Configure PowerAuth authentication object
    PowerAuthSignatureAuthentication powerAuthAuthentication = new PowerAuthSignatureAuthenticationImpl();
    powerAuthAuthentication.setActivationId(header.getActivationId());
    powerAuthAuthentication.setApplicationKey(header.getApplicationKey());
    powerAuthAuthentication.setNonce(BaseEncoding.base64().decode(header.getNonce()));
    powerAuthAuthentication.setSignatureType(header.getSignatureType());
    powerAuthAuthentication.setSignature(header.getSignature());
    powerAuthAuthentication.setHttpMethod(httpMethod);
    powerAuthAuthentication.setRequestUri(requestUriIdentifier);
    powerAuthAuthentication.setData(httpBody);
    // Call the authentication
    PowerAuthApiAuthentication auth;
    try {
        auth = this.authenticate(powerAuthAuthentication);
    } catch (RemoteException e) {
        throw new PowerAuthAuthenticationException("POWER_AUTH_SIGNATURE_SOAP_ERROR");
    }
    // In case authentication is null, throw PowerAuth exception
    if (auth == null) {
        throw new PowerAuthAuthenticationException("POWER_AUTH_SIGNATURE_INVALID_VALUE");
    }
    return auth;
}

Example 3 with PowerAuthSignatureHttpHeader

use of io.getlime.security.powerauth.http.PowerAuthSignatureHttpHeader in project powerauth-restful-integration by lime-company.

the class PowerAuthAuthenticationProvider method validateRequestSignatureWithActivationDetails.

@Override
@Nonnull
public PowerAuthApiAuthentication validateRequestSignatureWithActivationDetails(@Nonnull String httpMethod, @Nullable byte[] httpBody, @Nonnull String requestUriIdentifier, @Nonnull String httpAuthorizationHeader, @Nonnull List<PowerAuthSignatureTypes> allowedSignatureTypes, @Nullable Integer forcedSignatureVersion) throws PowerAuthAuthenticationException {
    // Check for HTTP PowerAuth signature header
    if (httpAuthorizationHeader.equals("undefined")) {
        logger.warn("Signature HTTP header is missing");
        throw new PowerAuthHeaderMissingException();
    }
    // Parse HTTP header
    final PowerAuthSignatureHttpHeader header = new PowerAuthSignatureHttpHeader().fromValue(httpAuthorizationHeader);
    // Validate the header
    try {
        PowerAuthSignatureHttpHeaderValidator.validate(header);
    } catch (InvalidPowerAuthHttpHeaderException ex) {
        logger.warn("Signature HTTP header validation failed, error: {}", ex.getMessage());
        logger.debug(ex.getMessage(), ex);
        throw new PowerAuthSignatureInvalidException();
    }
    // Check if the signature type is allowed
    final PowerAuthSignatureTypes expectedSignatureType = PowerAuthSignatureTypes.getEnumFromString(header.getSignatureType());
    if (expectedSignatureType == null || !allowedSignatureTypes.contains(expectedSignatureType)) {
        logger.warn("Invalid signature type: {}", expectedSignatureType);
        throw new PowerAuthSignatureTypeInvalidException();
    }
    // Configure PowerAuth authentication object
    final PowerAuthSignatureAuthenticationImpl powerAuthAuthentication = new PowerAuthSignatureAuthenticationImpl();
    powerAuthAuthentication.setActivationId(header.getActivationId());
    powerAuthAuthentication.setApplicationKey(header.getApplicationKey());
    powerAuthAuthentication.setNonce(BaseEncoding.base64().decode(header.getNonce()));
    powerAuthAuthentication.setSignatureType(header.getSignatureType());
    powerAuthAuthentication.setSignature(header.getSignature());
    powerAuthAuthentication.setHttpMethod(httpMethod);
    powerAuthAuthentication.setRequestUri(requestUriIdentifier);
    powerAuthAuthentication.setData(httpBody);
    powerAuthAuthentication.setVersion(header.getVersion());
    powerAuthAuthentication.setHttpHeader(header);
    powerAuthAuthentication.setForcedSignatureVersion(forcedSignatureVersion);
    // Call the authentication based on signature authentication object
    final PowerAuthApiAuthentication auth = (PowerAuthApiAuthentication) this.authenticate(powerAuthAuthentication);
    // In case authentication is null, throw PowerAuth exception
    if (auth == null) {
        logger.debug("Signature validation failed");
        throw new PowerAuthSignatureInvalidException();
    }
    return auth;
}

Example 4 with PowerAuthSignatureHttpHeader

use of io.getlime.security.powerauth.http.PowerAuthSignatureHttpHeader in project powerauth-restful-integration by lime-company.

the class PowerAuthEncryptionProviderBase method extractEciesEncryptionContext.

/**
 * Extract context required for ECIES encryption from either encryption or signature HTTP header.
 *
 * @param request HTTP servlet request.
 * @return Context for ECIES encryption.
 * @throws PowerAuthEncryptionException Thrown when HTTP header with ECIES data is invalid.
 */
private EciesEncryptionContext extractEciesEncryptionContext(HttpServletRequest request) throws PowerAuthEncryptionException {
    final String encryptionHttpHeader = request.getHeader(PowerAuthEncryptionHttpHeader.HEADER_NAME);
    final String signatureHttpHeader = request.getHeader(PowerAuthSignatureHttpHeader.HEADER_NAME);
    // Check that at least one PowerAuth HTTP header with parameters for ECIES is present
    if (encryptionHttpHeader == null && signatureHttpHeader == null) {
        logger.warn("Neither signature nor encryption HTTP header is present");
        throw new PowerAuthEncryptionException();
    }
    // In case the PowerAuth signature HTTP header is present, use it for ECIES
    if (signatureHttpHeader != null) {
        // Parse signature HTTP header
        final PowerAuthSignatureHttpHeader header = new PowerAuthSignatureHttpHeader().fromValue(signatureHttpHeader);
        // Validate the signature HTTP header
        try {
            PowerAuthSignatureHttpHeaderValidator.validate(header);
        } catch (InvalidPowerAuthHttpHeaderException ex) {
            logger.warn("Signature HTTP header validation failed, error: {}", ex.getMessage());
            logger.debug(ex.getMessage(), ex);
            throw new PowerAuthEncryptionException();
        }
        // Construct encryption parameters object
        final String applicationKey = header.getApplicationKey();
        final String activationId = header.getActivationId();
        final String version = header.getVersion();
        return new EciesEncryptionContext(applicationKey, activationId, version, header);
    } else {
        // Parse encryption HTTP header
        final PowerAuthEncryptionHttpHeader header = new PowerAuthEncryptionHttpHeader().fromValue(encryptionHttpHeader);
        // Validate the encryption HTTP header
        try {
            PowerAuthEncryptionHttpHeaderValidator.validate(header);
        } catch (InvalidPowerAuthHttpHeaderException ex) {
            logger.warn("Encryption validation failed, error: {}", ex.getMessage());
            logger.debug(ex.getMessage(), ex);
            throw new PowerAuthEncryptionException();
        }
        // Construct encryption parameters object
        final String applicationKey = header.getApplicationKey();
        final String activationId = header.getActivationId();
        final String version = header.getVersion();
        return new EciesEncryptionContext(applicationKey, activationId, version, header);
    }
}

Example 5 with PowerAuthSignatureHttpHeader

use of io.getlime.security.powerauth.http.PowerAuthSignatureHttpHeader in project powerauth-restful-integration by lime-company.

the class UpgradeService method upgradeCommit.

/**
 * Commit upgrade of activation to version 3.
 * @param signatureHeader PowerAuth signature HTTP header.
 * @param httpServletRequest HTTP servlet request.
 * @return Commit upgrade response.
 * @throws PowerAuthAuthenticationException in case authentication fails.
 * @throws PowerAuthUpgradeException In case upgrade commit fails.
 */
public Response upgradeCommit(String signatureHeader, HttpServletRequest httpServletRequest) throws PowerAuthAuthenticationException, PowerAuthUpgradeException {
    try {
        // Extract request body
        final byte[] requestBodyBytes = authenticationProvider.extractRequestBodyBytes(httpServletRequest);
        if (requestBodyBytes == null || requestBodyBytes.length == 0) {
            // Expected request body is {}, do not accept empty body
            logger.warn("Empty request body");
            throw new PowerAuthInvalidRequestException();
        }
        // Verify signature, force signature version during upgrade to version 3
        final List<PowerAuthSignatureTypes> allowedSignatureTypes = Collections.singletonList(PowerAuthSignatureTypes.POSSESSION);
        final PowerAuthApiAuthentication authentication = authenticationProvider.validateRequestSignatureWithActivationDetails("POST", requestBodyBytes, "/pa/upgrade/commit", signatureHeader, allowedSignatureTypes, 3);
        // In case signature verification fails, upgrade fails, too
        if (!authentication.getAuthenticationContext().isValid() || authentication.getActivationContext().getActivationId() == null) {
            logger.debug("Signature validation failed");
            throw new PowerAuthSignatureInvalidException();
        }
        // Get signature HTTP headers
        final String activationId = authentication.getActivationContext().getActivationId();
        final PowerAuthSignatureHttpHeader httpHeader = (PowerAuthSignatureHttpHeader) authentication.getHttpHeader();
        final String applicationKey = httpHeader.getApplicationKey();
        // Commit upgrade on PowerAuth server
        final CommitUpgradeResponse upgradeResponse = powerAuthClient.commitUpgrade(activationId, applicationKey);
        if (upgradeResponse.isCommitted()) {
            return new Response();
        } else {
            logger.debug("Upgrade commit failed");
            throw new PowerAuthUpgradeException();
        }
    } catch (PowerAuthAuthenticationException ex) {
        throw ex;
    } catch (Exception ex) {
        logger.warn("PowerAuth upgrade commit failed, error: {}", ex.getMessage());
        logger.debug(ex.getMessage(), ex);
        throw new PowerAuthUpgradeException();
    }
}