Examples with PowerAuthApiAuthentication io.getlime.security.powerauth.rest.api.base.authentication.PowerAuthApiAuthentication used on opensource projects

Example 6 with PowerAuthApiAuthentication

use of io.getlime.security.powerauth.rest.api.base.authentication.PowerAuthApiAuthentication in project powerauth-restful-integration by lime-company.

the class PowerAuthAnnotationInterceptor method preHandle.

@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
    // requests before the actual requests.
    if (handler instanceof HandlerMethod) {
        HandlerMethod handlerMethod = (HandlerMethod) handler;
        // Obtain annotations
        PowerAuth powerAuthSignatureAnnotation = handlerMethod.getMethodAnnotation(PowerAuth.class);
        PowerAuthToken powerAuthTokenAnnotation = handlerMethod.getMethodAnnotation(PowerAuthToken.class);
        // Check that only one annotation is active
        if (powerAuthSignatureAnnotation != null && powerAuthTokenAnnotation != null) {
            Logger.getLogger(this.getClass().getName()).log(Level.SEVERE, "You cannot use both @PowerAuth and @PowerAuthToken on same handler method. We are removing both.");
            powerAuthSignatureAnnotation = null;
            powerAuthTokenAnnotation = null;
        }
        // Resolve @PowerAuth annotation
        if (powerAuthSignatureAnnotation != null) {
            try {
                PowerAuthApiAuthentication authentication = this.authenticationProvider.validateRequestSignature(request, powerAuthSignatureAnnotation.resourceId(), request.getHeader(PowerAuthSignatureHttpHeader.HEADER_NAME), new ArrayList<>(Arrays.asList(powerAuthSignatureAnnotation.signatureType())));
                request.setAttribute(PowerAuth.AUTHENTICATION_OBJECT, authentication);
            } catch (PowerAuthAuthenticationException ex) {
                // silently ignore here and make sure authentication object is null
                request.setAttribute(PowerAuth.AUTHENTICATION_OBJECT, null);
            }
        }
        // Resolve @PowerAuthToken annotation
        if (powerAuthTokenAnnotation != null) {
            try {
                PowerAuthApiAuthentication authentication = this.authenticationProvider.validateToken(request.getHeader(PowerAuthTokenHttpHeader.HEADER_NAME), new ArrayList<>(Arrays.asList(powerAuthTokenAnnotation.signatureType())));
                request.setAttribute(PowerAuth.AUTHENTICATION_OBJECT, authentication);
            } catch (PowerAuthAuthenticationException ex) {
                // silently ignore here and make sure authentication object is null
                request.setAttribute(PowerAuth.AUTHENTICATION_OBJECT, null);
            }
        }
    }
    return super.preHandle(request, response, handler);
}

Example 7 with PowerAuthApiAuthentication

use of io.getlime.security.powerauth.rest.api.base.authentication.PowerAuthApiAuthentication in project powerauth-restful-integration by lime-company.

the class ActivationController method removeActivation.

/**
 * Get activation status.
 * @param signatureHeader PowerAuth signature HTTP header.
 * @return PowerAuth RESTful response with {@link ActivationRemoveResponse} payload.
 * @throws PowerAuthActivationException In case activation access fails.
 * @throws PowerAuthAuthenticationException In case the signature validation fails.
 */
@RequestMapping(value = "remove", method = RequestMethod.POST)
@ResponseBody
public ObjectResponse<ActivationRemoveResponse> removeActivation(@RequestHeader(value = PowerAuthSignatureHttpHeader.HEADER_NAME) String signatureHeader) throws PowerAuthActivationException, PowerAuthAuthenticationException {
    try {
        PowerAuthApiAuthentication apiAuthentication = authenticationProvider.validateRequestSignature("POST", null, "/pa/activation/remove", signatureHeader);
        if (apiAuthentication != null && apiAuthentication.getActivationId() != null) {
            RemoveActivationResponse soapResponse = powerAuthClient.removeActivation(apiAuthentication.getActivationId());
            ActivationRemoveResponse response = new ActivationRemoveResponse();
            response.setActivationId(soapResponse.getActivationId());
            return new ObjectResponse<>(response);
        } else {
            throw new PowerAuthAuthenticationException("USER_NOT_AUTHENTICATED");
        }
    } catch (PowerAuthAuthenticationException ex) {
        throw ex;
    } catch (Exception ex) {
        throw new PowerAuthActivationException();
    }
}

Example 8 with PowerAuthApiAuthentication

use of io.getlime.security.powerauth.rest.api.base.authentication.PowerAuthApiAuthentication in project powerauth-restful-integration by lime-company.

the class PowerAuthAuthenticationProvider method validateToken.

public PowerAuthApiAuthentication validateToken(String tokenHeader, List<PowerAuthSignatureTypes> allowedSignatureTypes) throws PowerAuthAuthenticationException {
    // Check for HTTP PowerAuth signature header
    if (tokenHeader == null || tokenHeader.equals("undefined")) {
        throw new PowerAuthAuthenticationException("POWER_AUTH_TOKEN_INVALID_EMPTY");
    }
    // Parse HTTP header
    PowerAuthTokenHttpHeader header = new PowerAuthTokenHttpHeader().fromValue(tokenHeader);
    // Validate the header
    try {
        PowerAuthTokenHttpHeaderValidator.validate(header);
    } catch (InvalidPowerAuthHttpHeaderException e) {
        Logger.getLogger(this.getClass().getName()).log(Level.SEVERE, e.getMessage(), e);
        throw new PowerAuthAuthenticationException(e.getMessage());
    }
    // Prepare authentication object
    PowerAuthTokenAuthenticationImpl powerAuthTokenAuthentication = new PowerAuthTokenAuthenticationImpl();
    powerAuthTokenAuthentication.setTokenId(header.getTokenId());
    powerAuthTokenAuthentication.setTokenDigest(header.getTokenDigest());
    powerAuthTokenAuthentication.setNonce(header.getNonce());
    powerAuthTokenAuthentication.setTimestamp(header.getTimestamp());
    // Call the authentication based on token authentication object
    final PowerAuthApiAuthentication auth = (PowerAuthApiAuthentication) this.authenticate(powerAuthTokenAuthentication);
    // In case authentication is null, throw PowerAuth exception
    if (auth == null) {
        throw new PowerAuthAuthenticationException("POWER_AUTH_TOKEN_INVALID_VALUE");
    }
    // Check if the signature type is allowed
    PowerAuthSignatureTypes expectedSignatureType = auth.getSignatureFactors();
    if (!allowedSignatureTypes.contains(expectedSignatureType)) {
        throw new PowerAuthAuthenticationException("POWER_AUTH_TOKEN_SIGNATURE_TYPE_INVALID");
    }
    return auth;
}

Example 9 with PowerAuthApiAuthentication

use of io.getlime.security.powerauth.rest.api.base.authentication.PowerAuthApiAuthentication in project powerauth-restful-integration by lime-company.

the class PowerAuthAuthenticationProvider method validateRequestSignature.

/**
 * Validate the signature from the PowerAuth 2.0 HTTP header against the provided HTTP method, request body and URI identifier.
 * Make sure to accept only allowed signatures.
 * @param httpMethod HTTP method (GET, POST, ...)
 * @param httpBody Body of the HTTP request.
 * @param requestUriIdentifier Request URI identifier.
 * @param httpAuthorizationHeader PowerAuth 2.0 HTTP authorization header.
 * @param allowedSignatureTypes Allowed types of the signature.
 * @return Instance of a PowerAuthApiAuthenticationImpl on successful authorization.
 * @throws PowerAuthAuthenticationException In case authorization fails, exception is raised.
 */
public PowerAuthApiAuthentication validateRequestSignature(String httpMethod, byte[] httpBody, String requestUriIdentifier, String httpAuthorizationHeader, List<PowerAuthSignatureTypes> allowedSignatureTypes) throws PowerAuthAuthenticationException {
    // Check for HTTP PowerAuth signature header
    if (httpAuthorizationHeader == null || httpAuthorizationHeader.equals("undefined")) {
        throw new PowerAuthAuthenticationException("POWER_AUTH_SIGNATURE_INVALID_EMPTY");
    }
    // Parse HTTP header
    PowerAuthSignatureHttpHeader header = new PowerAuthSignatureHttpHeader().fromValue(httpAuthorizationHeader);
    // Validate the header
    try {
        PowerAuthSignatureHttpHeaderValidator.validate(header);
    } catch (InvalidPowerAuthHttpHeaderException e) {
        Logger.getLogger(this.getClass().getName()).log(Level.SEVERE, e.getMessage(), e);
        throw new PowerAuthAuthenticationException(e.getMessage());
    }
    // Check if the application is allowed, "true" is the default behavior
    if (applicationConfiguration != null) {
        boolean isApplicationAllowed = applicationConfiguration.isAllowedApplicationKey(header.getApplicationKey());
        if (!isApplicationAllowed) {
            throw new PowerAuthAuthenticationException("POWER_AUTH_SIGNATURE_INVALID_APPLICATION_ID");
        }
    }
    // Check if the signature type is allowed
    PowerAuthSignatureTypes expectedSignatureType = PowerAuthSignatureTypes.getEnumFromString(header.getSignatureType());
    if (!allowedSignatureTypes.contains(expectedSignatureType)) {
        throw new PowerAuthAuthenticationException("POWER_AUTH_SIGNATURE_TYPE_INVALID");
    }
    // Configure PowerAuth authentication object
    PowerAuthSignatureAuthenticationImpl powerAuthAuthentication = new PowerAuthSignatureAuthenticationImpl();
    powerAuthAuthentication.setActivationId(header.getActivationId());
    powerAuthAuthentication.setApplicationKey(header.getApplicationKey());
    powerAuthAuthentication.setNonce(BaseEncoding.base64().decode(header.getNonce()));
    powerAuthAuthentication.setSignatureType(header.getSignatureType());
    powerAuthAuthentication.setSignature(header.getSignature());
    powerAuthAuthentication.setHttpMethod(httpMethod);
    powerAuthAuthentication.setRequestUri(requestUriIdentifier);
    powerAuthAuthentication.setData(httpBody);
    // Call the authentication based on signature authentication object
    PowerAuthApiAuthentication auth = (PowerAuthApiAuthentication) this.authenticate(powerAuthAuthentication);
    // In case authentication is null, throw PowerAuth exception
    if (auth == null) {
        throw new PowerAuthAuthenticationException("POWER_AUTH_SIGNATURE_INVALID_VALUE");
    }
    return auth;
}

Example 10 with PowerAuthApiAuthentication

use of io.getlime.security.powerauth.rest.api.base.authentication.PowerAuthApiAuthentication in project powerauth-restful-integration by lime-company.

the class ActivationController method removeActivation.

/**
 * Get activation status.
 * @param signatureHeader PowerAuth signature HTTP header.
 * @return PowerAuth RESTful response with {@link ActivationRemoveResponse} payload.
 * @throws PowerAuthAuthenticationException In case the signature validation fails.
 * @throws RemoteException In case SOAP communication fails
 */
@POST
@Consumes({ MediaType.APPLICATION_JSON })
@Produces({ MediaType.APPLICATION_JSON })
@Path("remove")
public ObjectResponse<ActivationRemoveResponse> removeActivation(@HeaderParam(PowerAuthSignatureHttpHeader.HEADER_NAME) String signatureHeader) throws PowerAuthAuthenticationException, PowerAuthActivationException {
    try {
        PowerAuthApiAuthentication apiAuthentication = authenticationProvider.validateRequestSignature("POST", null, "/pa/activation/remove", signatureHeader);
        if (apiAuthentication != null && apiAuthentication.getActivationId() != null) {
            PowerAuthPortServiceStub.RemoveActivationResponse soapResponse = powerAuthClient.removeActivation(apiAuthentication.getActivationId());
            ActivationRemoveResponse response = new ActivationRemoveResponse();
            response.setActivationId(soapResponse.getActivationId());
            return new ObjectResponse<>(response);
        } else {
            throw new PowerAuthAuthenticationException("USER_NOT_AUTHENTICATED");
        }
    } catch (PowerAuthAuthenticationException ex) {
        throw ex;
    } catch (Exception ex) {
        throw new PowerAuthActivationException();
    }
}