Examples with Security io.helidon.security.Security used on opensource projects

Example 46 with Security

use of io.helidon.security.Security in project helidon by oracle.

the class SecurityFilterTest method testAtzAbortWith.

@Test
void testAtzAbortWith() {
    SecurityFeature feature = SecurityFeature.builder(security).build();
    SecurityContext securityContext = security.createContext("testAbortWith");
    SecurityFilter sf = new SecurityFilter(feature.featureConfig(), security, serverConfig, securityContext);
    ContainerRequest request = mock(ContainerRequest.class);
    SecurityFilter.FilterContext filterContext = new SecurityFilter.FilterContext();
    filterContext.setJerseyRequest(request);
    SecurityClientBuilder<AuthorizationResponse> clientBuilder = mock(SecurityClientBuilder.class);
    when(clientBuilder.buildAndGet()).thenReturn(AuthorizationResponse.builder().description("Unit-test").status(SecurityResponse.SecurityStatus.FAILURE).build());
    sf.processAuthorization(filterContext, clientBuilder);
    assertThat(filterContext.isShouldFinish(), is(true));
    verify(request).abortWith(argThat(response -> response.getStatus() == 403));
}

Example 47 with Security

use of io.helidon.security.Security in project helidon by oracle.

the class SecurityCdiExtension method registerSecurity.

// security must have priority higher than metrics, openapi and healt
// so we can protect these endpoints
private void registerSecurity(@Observes @Priority(LIBRARY_BEFORE) @Initialized(ApplicationScoped.class) Object adv, BeanManager bm) {
    if (securityBuilder.noProvider(AuthenticationProvider.class)) {
        LOGGER.info("Authentication provider is missing from security configuration, but security extension for microprofile " + "is enabled (requires providers configuration at key security.providers). " + "Security will not have any valid authentication provider");
        securityBuilder.addAuthenticationProvider(this::failingAtnProvider);
    }
    if (securityBuilder.noProvider(AuthorizationProvider.class)) {
        LOGGER.info("Authorization provider is missing from security configuration, but security extension for microprofile " + "is enabled (requires providers configuration at key security.providers). " + "ABAC provider is configured for authorization.");
        securityBuilder.addAuthorizationProvider(AbacProvider.create());
    }
    Security tmpSecurity = securityBuilder.build();
    // free it and make sure we fail if somebody wants to update security afterwards
    securityBuilder = null;
    if (!tmpSecurity.enabled()) {
        // security is disabled, we need to set up some basic stuff - injection, security context etc.
        LOGGER.info("Security is disabled.");
        tmpSecurity = Security.builder().enabled(false).build();
    }
    // we need an effectively final instance to use in lambda
    Security security = tmpSecurity;
    // security is available in global
    Contexts.globalContext().register(security);
    JaxRsCdiExtension jaxrs = bm.getExtension(JaxRsCdiExtension.class);
    ServerCdiExtension server = bm.getExtension(ServerCdiExtension.class);
    Contexts.context().ifPresent(ctx -> ctx.register(security));
    Config jerseyConfig = config.get("security.jersey");
    if (jerseyConfig.get("enabled").asBoolean().orElse(true)) {
        SecurityFeature feature = SecurityFeature.builder(security).config(jerseyConfig).build();
        jaxrs.applicationsToRun().forEach(app -> app.resourceConfig().register(feature));
    }
    Config webServerConfig = config.get("security.web-server");
    if (webServerConfig.exists() && webServerConfig.get("enabled").asBoolean().orElse(true)) {
        server.serverRoutingBuilder().register(WebSecurity.create(security, config.get("security")));
    }
    this.security.set(security);
}

Example 48 with Security

use of io.helidon.security.Security in project helidon by oracle.

the class TestProviderOverrides method testOverride.

@Test
void testOverride() {
    Map<String, String> map = Map.of("security.providers.1.type", "header-atn", "security.providers.1.header-atn.authenticate", "false");
    Config config = Config.builder().addSource(ConfigSources.create(map)).addSource(ConfigSources.classpath("application.yaml")).disableEnvironmentVariablesSource().disableSystemPropertiesSource().build();
    Security security = Security.create(config.get("security"));
}