Examples with Subject io.helidon.security.Subject used on opensource projects

Example 11 with Subject

use of io.helidon.security.Subject in project helidon by oracle.

the class JakartaElPolicyExecutorTest method testSimpleExpression.

@Test
public void testSimpleExpression() {
    JavaxElPolicyExecutor ex = JavaxElPolicyExecutor.create();
    SecurityEnvironment env = SecurityEnvironment.create();
    Subject user = Subject.builder().principal(Principal.create("unit-test-user")).addGrant(Role.create("unit-test-user-role")).build();
    Subject service = Subject.builder().principal(Principal.create("unit-test-service")).addGrant(Role.create("unit-test-service-role")).build();
    MyResource object = new MyResource("unit-test-user");
    ProviderRequest request = mock(ProviderRequest.class);
    when(request.service()).thenReturn(Optional.of(service));
    when(request.subject()).thenReturn(Optional.of(user));
    when(request.env()).thenReturn(env);
    when(request.getObject()).thenReturn(Optional.of(object));
    Errors.Collector collector = Errors.collector();
    ex.executePolicy("${user.principal.id == object.owner}", collector, request);
    collector.collect().checkValid();
    collector = Errors.collector();
    ex.executePolicy("${user.principal.id == object.owner}", collector, request);
    collector.collect().checkValid();
    collector = Errors.collector();
    ex.executePolicy("${inRole(user, 'unit-test-user-role') && inRole(service, 'unit-test-service-role')}", collector, request);
    collector.collect().checkValid();
    collector = Errors.collector();
    ex.executePolicy("${service.principal.id == object.owner}", collector, request);
    if (collector.collect().isValid()) {
        fail("Should have failed, as service is not the owner of the object");
    }
    collector = Errors.collector();
    ex.executePolicy("${env.time.year >= 2017}", collector, request);
    collector.collect().checkValid();
}

Example 12 with Subject

use of io.helidon.security.Subject in project helidon by oracle.

the class JavaxElPolicyExecutor method executePolicy.

@Override
public void executePolicy(String policyStatement, Errors.Collector collector, ProviderRequest request) {
    StandardELContext context = new StandardELContext(ef);
    context.addELResolver(ATTRIBUTE_RESOLVER);
    FunctionMapper functions = context.getFunctionMapper();
    VariableMapper variables = context.getVariableMapper();
    customMethods.forEach(customFunction -> functions.mapFunction(customFunction.prefix, customFunction.localName, customFunction.method));
    Subject userSubject = request.subject().orElse(SecurityContext.ANONYMOUS);
    variable(variables, "user", userSubject, Subject.class);
    variable(variables, "subject", userSubject, Subject.class);
    variable(variables, "service", request.service().orElse(SecurityContext.ANONYMOUS), Subject.class);
    variable(variables, "env", request.env(), SecurityEnvironment.class);
    variable(variables, "object", request.getObject().orElse(null), Object.class);
    variable(variables, "request", request, ProviderRequest.class);
    try {
        ValueExpression expression = ef.createValueExpression(context, policyStatement, boolean.class);
        boolean value = (boolean) expression.getValue(context);
        if (!value) {
            collector.fatal(this, "Policy statement \"" + policyStatement + "\" evaluated to false");
        }
    } catch (Exception e) {
        LOGGER.log(Level.FINEST, e, () -> "Statement " + policyStatement + " evaluation failed");
        throw new SecurityException("Policy statement \"" + policyStatement + "\" evaluated to an exception", e);
    }
}

Example 13 with Subject

use of io.helidon.security.Subject in project helidon by oracle.

the class HeaderAtnProviderConfigTest method testProviderService.

@Test
public void testProviderService() {
    String username = "username";
    Security security = Security.create(config.get("security"));
    SecurityContext context = security.contextBuilder("unit-test").env(SecurityEnvironment.builder().header("Authorization", "bearer " + username).build()).build();
    AuthenticationResponse response = context.atnClientBuilder().buildAndGet();
    assertThat(response.status(), is(SecurityResponse.SecurityStatus.SUCCESS));
    assertThat(response.user(), is(not(Optional.empty())));
    response.user().map(Subject::principal).map(Principal::getName).ifPresent(user -> {
        assertThat(user, is(username));
    });
    assertThat(response.service(), is(Optional.empty()));
}

Example 14 with Subject

use of io.helidon.security.Subject in project helidon by oracle.

the class HeaderAtnProviderTest method testExtraction.

@Test
public void testExtraction() {
    String username = "username";
    HeaderAtnProvider provider = getFullProvider();
    SecurityEnvironment env = SecurityEnvironment.builder().header("Authorization", "bearer " + username).build();
    ProviderRequest request = mock(ProviderRequest.class);
    when(request.env()).thenReturn(env);
    AuthenticationResponse response = provider.syncAuthenticate(request);
    assertThat(response.status(), is(SecurityResponse.SecurityStatus.SUCCESS));
    assertThat(response.user(), is(not(Optional.empty())));
    assertThat(response.service(), is(Optional.empty()));
    response.user().map(Subject::principal).map(Principal::getName).ifPresent(name -> assertThat(name, is(username)));
}

Example 15 with Subject

use of io.helidon.security.Subject in project helidon by oracle.

the class JwtProvider method buildSubject.

Subject buildSubject(Jwt jwt, SignedJwt signedJwt) {
    Principal principal = buildPrincipal(jwt);
    TokenCredential.Builder builder = TokenCredential.builder();
    jwt.issueTime().ifPresent(builder::issueTime);
    jwt.expirationTime().ifPresent(builder::expTime);
    jwt.issuer().ifPresent(builder::issuer);
    builder.token(signedJwt.tokenContent());
    builder.addToken(Jwt.class, jwt);
    builder.addToken(SignedJwt.class, signedJwt);
    Subject.Builder subjectBuilder = Subject.builder().principal(principal).addPublicCredential(TokenCredential.class, builder.build());
    if (useJwtGroups) {
        Optional<List<String>> userGroups = jwt.userGroups();
        userGroups.ifPresent(groups -> groups.forEach(group -> subjectBuilder.addGrant(Role.create(group))));
    }
    Optional<List<String>> scopes = jwt.scopes();
    scopes.ifPresent(scopeList -> {
        scopeList.forEach(scope -> subjectBuilder.addGrant(Grant.builder().name(scope).type("scope").build()));
    });
    return subjectBuilder.build();
}