Examples with SignatureTypeConverter io.getlime.security.powerauth.rest.api.spring.converter.v3.SignatureTypeConverter used on opensource projects

Example 1 with SignatureTypeConverter

use of io.getlime.security.powerauth.rest.api.spring.converter.v3.SignatureTypeConverter in project powerauth-restful-integration by lime-company.

the class TokenService method createToken.

/**
 * Create token.
 * @param request Create token request.
 * @param authentication PowerAuth API authentication.
 * @return Create token response.
 * @throws PowerAuthAuthenticationException In case token could not be created.
 */
public TokenCreateResponse createToken(TokenCreateRequest request, PowerAuthApiAuthentication authentication) throws PowerAuthAuthenticationException {
    try {
        // Fetch activation ID and signature type
        final String activationId = authentication.getActivationContext().getActivationId();
        final PowerAuthSignatureTypes signatureFactors = authentication.getAuthenticationContext().getSignatureType();
        // Fetch data from the request
        final String ephemeralPublicKey = request.getEphemeralPublicKey();
        // Prepare a signature type converter
        SignatureTypeConverter converter = new SignatureTypeConverter();
        // Create a token
        final CreateTokenResponse token = powerAuthClient.v2().createToken(activationId, ephemeralPublicKey, converter.convertFrom(signatureFactors));
        // Prepare a response
        final TokenCreateResponse response = new TokenCreateResponse();
        response.setMac(token.getMac());
        response.setEncryptedData(token.getEncryptedData());
        return response;
    } catch (Exception ex) {
        logger.warn("Creating PowerAuth token failed, error: {}", ex.getMessage());
        logger.debug(ex.getMessage(), ex);
        throw new PowerAuthTokenErrorException();
    }
}

Example 2 with SignatureTypeConverter

use of io.getlime.security.powerauth.rest.api.spring.converter.v3.SignatureTypeConverter in project powerauth-restful-integration by lime-company.

the class PowerAuthAuthenticationProvider method validateSignatureAuthentication.

/**
 * Validate signature based authentication.
 *
 * @param authentication Signature based authentication object.
 * @return API authentication object in case of successful authentication, null otherwise.
 */
private PowerAuthApiAuthenticationImpl validateSignatureAuthentication(PowerAuthSignatureAuthenticationImpl authentication) {
    if (authentication.getSignatureType() != null) {
        final SignatureTypeConverter converter = new SignatureTypeConverter();
        final SignatureType signatureType = converter.convertFrom(authentication.getSignatureType());
        if (signatureType == null) {
            return null;
        }
        final VerifySignatureRequest request = new VerifySignatureRequest();
        request.setActivationId(authentication.getActivationId());
        request.setApplicationKey(authentication.getApplicationKey());
        request.setSignature(authentication.getSignature());
        request.setSignatureType(signatureType);
        request.setSignatureVersion(authentication.getVersion());
        request.setData(PowerAuthHttpBody.getSignatureBaseString(authentication.getHttpMethod(), authentication.getRequestUri(), authentication.getNonce(), authentication.getData()));
        // This occurs when verifying signature during upgrade before upgrade is committed.
        if (authentication.getForcedSignatureVersion() != null) {
            request.setForcedSignatureVersion(authentication.getForcedSignatureVersion().longValue());
        }
        final VerifySignatureResponse response;
        try {
            response = powerAuthClient.verifySignature(request);
        } catch (PowerAuthClientException ex) {
            logger.warn("Signature validation failed, error: {}", ex.getMessage());
            logger.debug("Error details", ex);
            return null;
        }
        final AuthenticationContext authenticationContext = new AuthenticationContext();
        authenticationContext.setValid(response.isSignatureValid());
        authenticationContext.setRemainingAttempts(response.getRemainingAttempts() != null ? response.getRemainingAttempts().intValue() : null);
        authenticationContext.setSignatureType(response.getSignatureType() != null ? PowerAuthSignatureTypes.getEnumFromString(response.getSignatureType().value()) : null);
        final PowerAuthActivation activationContext = copyActivationAttributes(response.getActivationId(), response.getUserId(), activationStatusConverter.convertFrom(response.getActivationStatus()), response.getBlockedReason(), response.getActivationFlags(), authenticationContext, authentication.getVersion());
        return copyAuthenticationAttributes(response.getActivationId(), response.getUserId(), response.getApplicationId(), response.getApplicationRoles(), response.getActivationFlags(), authenticationContext, authentication.getVersion(), authentication.getHttpHeader(), activationContext);
    } else {
        return null;
    }
}

Example 3 with SignatureTypeConverter

use of io.getlime.security.powerauth.rest.api.spring.converter.v3.SignatureTypeConverter in project powerauth-restful-integration by lime-company.

the class SecureVaultService method vaultUnlock.

/**
 * Unlock secure vault.
 * @param signatureHeader PowerAuth signature HTTP header.
 * @param request Vault unlock request.
 * @param httpServletRequest HTTP servlet request.
 * @return Vault unlock response.
 * @throws PowerAuthSecureVaultException In case vault unlock fails.
 * @throws PowerAuthAuthenticationException In case authentication fails.
 */
public VaultUnlockResponse vaultUnlock(String signatureHeader, VaultUnlockRequest request, HttpServletRequest httpServletRequest) throws PowerAuthSecureVaultException, PowerAuthAuthenticationException {
    try {
        // Parse the header
        final PowerAuthSignatureHttpHeader header = new PowerAuthSignatureHttpHeader().fromValue(signatureHeader);
        // Validate the header
        try {
            PowerAuthSignatureHttpHeaderValidator.validate(header);
        } catch (InvalidPowerAuthHttpHeaderException ex) {
            logger.warn("Signature HTTP header validation failed, error: {}", ex.getMessage());
            logger.debug(ex.getMessage(), ex);
            throw new PowerAuthSignatureTypeInvalidException();
        }
        final SignatureTypeConverter converter = new SignatureTypeConverter();
        final String activationId = header.getActivationId();
        final String applicationId = header.getApplicationKey();
        final String signature = header.getSignature();
        final SignatureType signatureType = converter.convertFrom(header.getSignatureType());
        if (signatureType == null) {
            logger.warn("Invalid signature type: {}", header.getSignatureType());
            throw new PowerAuthSignatureTypeInvalidException();
        }
        final String nonce = header.getNonce();
        String reason = null;
        byte[] requestBodyBytes;
        if ("2.0".equals(header.getVersion())) {
            // Version 2.0 requires null data in signature for vault unlock.
            requestBodyBytes = null;
        } else if ("2.1".equals(header.getVersion())) {
            // Version 2.1 or higher requires request data in signature (POST request body) for vault unlock.
            if (request != null) {
                // Send vault unlock reason, in case it is available.
                if (request.getReason() != null) {
                    reason = request.getReason();
                }
            }
            // Use POST request body as data for signature.
            requestBodyBytes = authenticationProvider.extractRequestBodyBytes(httpServletRequest);
        } else {
            logger.warn("Invalid protocol version in secure vault: {}", header.getVersion());
            throw new PowerAuthSecureVaultException();
        }
        final String data = PowerAuthHttpBody.getSignatureBaseString("POST", "/pa/vault/unlock", BaseEncoding.base64().decode(nonce), requestBodyBytes);
        final com.wultra.security.powerauth.client.v2.VaultUnlockResponse paResponse = powerAuthClient.v2().unlockVault(activationId, applicationId, data, signature, signatureType, reason);
        if (!paResponse.isSignatureValid()) {
            logger.debug("Signature validation failed");
            throw new PowerAuthSignatureInvalidException();
        }
        final VaultUnlockResponse response = new VaultUnlockResponse();
        response.setActivationId(paResponse.getActivationId());
        response.setEncryptedVaultEncryptionKey(paResponse.getEncryptedVaultEncryptionKey());
        return response;
    } catch (PowerAuthAuthenticationException ex) {
        throw ex;
    } catch (Exception ex) {
        logger.warn("PowerAuth vault unlock failed, error: {}", ex.getMessage());
        logger.debug(ex.getMessage(), ex);
        throw new PowerAuthSecureVaultException();
    }
}

Example 4 with SignatureTypeConverter

use of io.getlime.security.powerauth.rest.api.spring.converter.v3.SignatureTypeConverter in project powerauth-restful-integration by lime-company.

the class SecureVaultService method vaultUnlock.

/**
 * Unlock secure vault.
 * @param header PowerAuth signature HTTP header.
 * @param request ECIES encrypted vault unlock request.
 * @param httpServletRequest HTTP servlet request.
 * @return ECIES encrypted vault unlock response.
 * @throws PowerAuthSecureVaultException In case vault unlock request fails.
 * @throws PowerAuthAuthenticationException In case authentication fails.
 */
public EciesEncryptedResponse vaultUnlock(PowerAuthSignatureHttpHeader header, EciesEncryptedRequest request, HttpServletRequest httpServletRequest) throws PowerAuthSecureVaultException, PowerAuthAuthenticationException {
    try {
        final SignatureTypeConverter converter = new SignatureTypeConverter();
        final String activationId = header.getActivationId();
        final String applicationKey = header.getApplicationKey();
        final String signature = header.getSignature();
        final SignatureType signatureType = converter.convertFrom(header.getSignatureType());
        if (signatureType == null) {
            logger.warn("Invalid signature type: {}", header.getSignatureType());
            throw new PowerAuthSignatureTypeInvalidException();
        }
        final String signatureVersion = header.getVersion();
        final String nonce = header.getNonce();
        // Fetch data from the request
        final String ephemeralPublicKey = request.getEphemeralPublicKey();
        final String encryptedData = request.getEncryptedData();
        final String mac = request.getMac();
        final String eciesNonce = request.getNonce();
        // Prepare data for signature to allow signature verification on PowerAuth server
        final byte[] requestBodyBytes = authenticationProvider.extractRequestBodyBytes(httpServletRequest);
        final String data = PowerAuthHttpBody.getSignatureBaseString("POST", "/pa/vault/unlock", BaseEncoding.base64().decode(nonce), requestBodyBytes);
        // Verify signature and get encrypted vault encryption key from PowerAuth server
        final VaultUnlockResponse paResponse = powerAuthClient.unlockVault(activationId, applicationKey, signature, signatureType, signatureVersion, data, ephemeralPublicKey, encryptedData, mac, eciesNonce);
        if (!paResponse.isSignatureValid()) {
            logger.debug("Signature validation failed");
            throw new PowerAuthSignatureInvalidException();
        }
        return new EciesEncryptedResponse(paResponse.getEncryptedData(), paResponse.getMac());
    } catch (PowerAuthAuthenticationException ex) {
        throw ex;
    } catch (Exception ex) {
        logger.warn("PowerAuth vault unlock failed, error: {}", ex.getMessage());
        logger.debug(ex.getMessage(), ex);
        throw new PowerAuthSecureVaultException();
    }
}

Example 5 with SignatureTypeConverter

use of io.getlime.security.powerauth.rest.api.spring.converter.v3.SignatureTypeConverter in project powerauth-restful-integration by lime-company.

the class TokenService method createToken.

/**
 * Create token.
 *
 * @param request        ECIES encrypted create token request.
 * @param authentication PowerAuth API authentication object.
 * @return ECIES encrypted create token response.
 * @throws PowerAuthAuthenticationException In case token could not be created.
 */
public EciesEncryptedResponse createToken(EciesEncryptedRequest request, PowerAuthApiAuthentication authentication) throws PowerAuthAuthenticationException {
    try {
        // Fetch activation ID and signature type
        final PowerAuthSignatureTypes signatureFactors = authentication.getAuthenticationContext().getSignatureType();
        // Fetch data from the request
        final String ephemeralPublicKey = request.getEphemeralPublicKey();
        final String encryptedData = request.getEncryptedData();
        final String mac = request.getMac();
        final String nonce = request.getNonce();
        // Prepare a signature type converter
        final SignatureTypeConverter converter = new SignatureTypeConverter();
        final SignatureType signatureType = converter.convertFrom(signatureFactors);
        if (signatureType == null) {
            logger.warn("Invalid signature type: {}", signatureFactors);
            throw new PowerAuthSignatureTypeInvalidException();
        }
        // Get ECIES headers
        final String activationId = authentication.getActivationContext().getActivationId();
        final PowerAuthSignatureHttpHeader httpHeader = (PowerAuthSignatureHttpHeader) authentication.getHttpHeader();
        final String applicationKey = httpHeader.getApplicationKey();
        // Create a token
        final CreateTokenResponse token = powerAuthClient.createToken(activationId, applicationKey, ephemeralPublicKey, encryptedData, mac, nonce, signatureType);
        // Prepare a response
        final EciesEncryptedResponse response = new EciesEncryptedResponse();
        response.setMac(token.getMac());
        response.setEncryptedData(token.getEncryptedData());
        return response;
    } catch (Exception ex) {
        logger.warn("Creating PowerAuth token failed, error: {}", ex.getMessage());
        logger.debug(ex.getMessage(), ex);
        throw new PowerAuthTokenErrorException();
    }
}