Examples with AuthorizationManager io.undertow.servlet.api.AuthorizationManager used on opensource projects

Example 1 with AuthorizationManager

use of io.undertow.servlet.api.AuthorizationManager in project undertow by undertow-io.

the class HttpServletRequestImpl method isUserInRole.

@Override
public boolean isUserInRole(final String role) {
    if (role == null) {
        return false;
    }
    // according to the servlet spec this aways returns false
    if (role.equals("*")) {
        return false;
    }
    SecurityContext sc = exchange.getSecurityContext();
    Account account = sc != null ? sc.getAuthenticatedAccount() : null;
    if (account == null) {
        return false;
    }
    ServletRequestContext servletRequestContext = exchange.getAttachment(ServletRequestContext.ATTACHMENT_KEY);
    if (role.equals("**")) {
        Set<String> roles = servletRequestContext.getDeployment().getDeploymentInfo().getSecurityRoles();
        if (!roles.contains("**")) {
            return true;
        }
    }
    final ServletChain servlet = servletRequestContext.getCurrentServlet();
    final Deployment deployment = servletContext.getDeployment();
    final AuthorizationManager authorizationManager = deployment.getDeploymentInfo().getAuthorizationManager();
    return authorizationManager.isUserInRole(role, account, servlet.getManagedServlet().getServletInfo(), this, deployment);
}

Example 2 with AuthorizationManager

use of io.undertow.servlet.api.AuthorizationManager in project undertow by undertow-io.

the class ServletConfidentialityConstraintHandler method handleRequest.

@Override
public void handleRequest(HttpServerExchange exchange) throws Exception {
    final ServletRequestContext servletRequestContext = exchange.getAttachment(ServletRequestContext.ATTACHMENT_KEY);
    final AuthorizationManager authorizationManager = servletRequestContext.getDeployment().getDeploymentInfo().getAuthorizationManager();
    TransportGuaranteeType connectionGuarantee = servletRequestContext.getOriginalRequest().isSecure() ? TransportGuaranteeType.CONFIDENTIAL : TransportGuaranteeType.NONE;
    TransportGuaranteeType transportGuarantee = authorizationManager.transportGuarantee(connectionGuarantee, servletRequestContext.getTransportGuarenteeType(), servletRequestContext.getOriginalRequest());
    servletRequestContext.setTransportGuarenteeType(transportGuarantee);
    if (TransportGuaranteeType.REJECTED == transportGuarantee) {
        HttpServletResponse response = (HttpServletResponse) servletRequestContext.getServletResponse();
        response.sendError(StatusCodes.FORBIDDEN);
        return;
    }
    super.handleRequest(exchange);
}