Examples with WebResourceCollection io.undertow.servlet.api.WebResourceCollection used on opensource projects

Example 6 with WebResourceCollection

use of io.undertow.servlet.api.WebResourceCollection in project undertow by undertow-io.

the class SecurityConstraintUrlMappingTestCase method setup.

@BeforeClass
public static void setup() throws ServletException {
    final PathHandler root = new PathHandler();
    final ServletContainer container = ServletContainer.Factory.newInstance();
    ServletInfo s = new ServletInfo("servlet", AuthenticationMessageServlet.class).addInitParam(MessageServlet.MESSAGE, HELLO_WORLD).addMapping("/role1").addMapping("/role2").addMapping("/starstar").addMapping("/secured/role2/*").addMapping("/secured/1/2/*").addMapping("/public/*").addMapping("/extension/*");
    ServletIdentityManager identityManager = new ServletIdentityManager();
    identityManager.addUser("user1", "password1", "role1");
    identityManager.addUser("user2", "password2", "role2", "**");
    identityManager.addUser("user3", "password3", "role1", "role2");
    identityManager.addUser("user4", "password4", "badRole");
    DeploymentInfo builder = new DeploymentInfo().setClassLoader(SimpleServletTestCase.class.getClassLoader()).setContextPath("/servletContext").setClassIntrospecter(TestClassIntrospector.INSTANCE).setDeploymentName("servletContext.war").setIdentityManager(identityManager).setLoginConfig(new LoginConfig("BASIC", "Test Realm")).addServlet(s);
    builder.addSecurityConstraint(new SecurityConstraint().addWebResourceCollection(new WebResourceCollection().addUrlPattern("/role1")).addRoleAllowed("role1"));
    builder.addSecurityConstraint(new SecurityConstraint().addWebResourceCollection(new WebResourceCollection().addUrlPattern("/starstar")).addRoleAllowed("**"));
    builder.addSecurityConstraint(new SecurityConstraint().addWebResourceCollection(new WebResourceCollection().addUrlPattern("/secured/*")).addRoleAllowed("role2"));
    builder.addSecurityConstraint(new SecurityConstraint().addWebResourceCollection(new WebResourceCollection().addUrlPattern("/secured/*")).addRoleAllowed("role2"));
    builder.addSecurityConstraint(new SecurityConstraint().addWebResourceCollection(new WebResourceCollection().addUrlPattern("/secured/1/*")).addRoleAllowed("role1"));
    builder.addSecurityConstraint(new SecurityConstraint().addWebResourceCollection(new WebResourceCollection().addUrlPattern("/secured/1/2/*")).addRoleAllowed("role2"));
    builder.addSecurityConstraint(new SecurityConstraint().addWebResourceCollection(new WebResourceCollection().addUrlPattern("*.html")).addRoleAllowed("role2"));
    builder.addSecurityConstraint(new SecurityConstraint().addWebResourceCollection(new WebResourceCollection().addUrlPattern("/public/*")).setEmptyRoleSemantic(SecurityInfo.EmptyRoleSemantic.PERMIT));
    builder.addSecurityConstraint(new SecurityConstraint().addWebResourceCollection(new WebResourceCollection().addUrlPattern("/public/postSecured/*").addHttpMethod("POST")).addRoleAllowed("role1"));
    DeploymentManager manager = container.addDeployment(builder);
    manager.deploy();
    root.addPrefixPath(builder.getContextPath(), manager.start());
    builder = new DeploymentInfo().setClassLoader(SimpleServletTestCase.class.getClassLoader()).setContextPath("/star").setClassIntrospecter(TestClassIntrospector.INSTANCE).setDeploymentName("servletContext.war").setIdentityManager(identityManager).setLoginConfig(new LoginConfig("BASIC", "Test Realm")).addSecurityRole("**").addServlet(s);
    builder.addSecurityConstraint(new SecurityConstraint().addWebResourceCollection(new WebResourceCollection().addUrlPattern("/starstar")).addRoleAllowed("**"));
    manager = container.addDeployment(builder);
    manager.deploy();
    root.addPrefixPath(builder.getContextPath(), manager.start());
    DefaultServer.setRootHandler(root);
}

Example 7 with WebResourceCollection

use of io.undertow.servlet.api.WebResourceCollection in project undertow by undertow-io.

the class DigestAuthTestCase method setup.

@BeforeClass
public static void setup() throws ServletException {
    final PathHandler path = new PathHandler();
    final ServletContainer container = ServletContainer.Factory.newInstance();
    ServletInfo usernameServlet = new ServletInfo("Username Servlet", SendUsernameServlet.class).addMapping("/secured/username");
    ServletInfo authTypeServlet = new ServletInfo("Auth Type Servlet", SendAuthTypeServlet.class).addMapping("/secured/authType");
    ServletIdentityManager identityManager = new ServletIdentityManager();
    identityManager.addUser("user1", "password1", "role1");
    DeploymentInfo builder = new DeploymentInfo().setClassLoader(SimpleServletTestCase.class.getClassLoader()).setContextPath("/servletContext").setClassIntrospecter(TestClassIntrospector.INSTANCE).setDeploymentName("servletContext.war").setIdentityManager(identityManager).setLoginConfig(new LoginConfig("DIGEST", REALM_NAME)).addServlets(usernameServlet, authTypeServlet);
    builder.addSecurityConstraint(new SecurityConstraint().addWebResourceCollection(new WebResourceCollection().addUrlPattern("/secured/*")).addRoleAllowed("role1").setEmptyRoleSemantic(EmptyRoleSemantic.DENY));
    DeploymentManager manager = container.addDeployment(builder);
    manager.deploy();
    path.addPrefixPath(builder.getContextPath(), manager.start());
    DefaultServer.setRootHandler(path);
}

Example 8 with WebResourceCollection

use of io.undertow.servlet.api.WebResourceCollection in project undertow by undertow-io.

the class ServletBasicAuthTestCase method setup.

@BeforeClass
public static void setup() throws ServletException {
    final PathHandler path = new PathHandler();
    final ServletContainer container = ServletContainer.Factory.newInstance();
    ServletInfo usernameServlet = new ServletInfo("Username Servlet", SendUsernameServlet.class).addMapping("/secured/username");
    ServletInfo authTypeServlet = new ServletInfo("Auth Type Servlet", SendAuthTypeServlet.class).addMapping("/secured/authType");
    ServletIdentityManager identityManager = new ServletIdentityManager();
    identityManager.addUser("user1", "password1", "role1");
    identityManager.addUser("charsetUser", "password-ü", "role1");
    LoginConfig loginConfig = new LoginConfig(REALM_NAME);
    Map<String, String> props = new HashMap<>();
    props.put("charset", "ISO_8859_1");
    props.put("user-agent-charsets", "Chrome,UTF-8,OPR,UTF-8");
    loginConfig.addFirstAuthMethod(new AuthMethodConfig("BASIC", props));
    DeploymentInfo builder = new DeploymentInfo().setClassLoader(SimpleServletTestCase.class.getClassLoader()).setContextPath("/servletContext").setClassIntrospecter(TestClassIntrospector.INSTANCE).setDeploymentName("servletContext.war").setIdentityManager(identityManager).setLoginConfig(loginConfig).addServlets(usernameServlet, authTypeServlet);
    builder.addSecurityConstraint(new SecurityConstraint().addWebResourceCollection(new WebResourceCollection().addUrlPattern("/secured/*")).addRoleAllowed("role1").setEmptyRoleSemantic(SecurityInfo.EmptyRoleSemantic.DENY));
    DeploymentManager manager = container.addDeployment(builder);
    manager.deploy();
    path.addPrefixPath(builder.getContextPath(), manager.start());
    DefaultServer.setRootHandler(path);
}

Example 9 with WebResourceCollection

use of io.undertow.servlet.api.WebResourceCollection in project undertow by undertow-io.

the class DeploymentManagerImpl method buildSecurityConstraints.

private SecurityPathMatches buildSecurityConstraints() {
    SecurityPathMatches.Builder builder = SecurityPathMatches.builder(deployment.getDeploymentInfo());
    final Set<String> urlPatterns = new HashSet<>();
    for (SecurityConstraint constraint : deployment.getDeploymentInfo().getSecurityConstraints()) {
        builder.addSecurityConstraint(constraint);
        for (WebResourceCollection webResources : constraint.getWebResourceCollections()) {
            urlPatterns.addAll(webResources.getUrlPatterns());
        }
    }
    for (final ServletInfo servlet : deployment.getDeploymentInfo().getServlets().values()) {
        final ServletSecurityInfo securityInfo = servlet.getServletSecurityInfo();
        if (securityInfo != null) {
            final Set<String> mappings = new HashSet<>(servlet.getMappings());
            mappings.removeAll(urlPatterns);
            if (!mappings.isEmpty()) {
                final Set<String> methods = new HashSet<>();
                for (HttpMethodSecurityInfo method : securityInfo.getHttpMethodSecurityInfo()) {
                    methods.add(method.getMethod());
                    if (method.getRolesAllowed().isEmpty() && method.getEmptyRoleSemantic() == EmptyRoleSemantic.PERMIT) {
                        //this is an implict allow
                        continue;
                    }
                    SecurityConstraint newConstraint = new SecurityConstraint().addRolesAllowed(method.getRolesAllowed()).setTransportGuaranteeType(method.getTransportGuaranteeType()).addWebResourceCollection(new WebResourceCollection().addUrlPatterns(mappings).addHttpMethod(method.getMethod()));
                    builder.addSecurityConstraint(newConstraint);
                }
                //now add the constraint, unless it has all default values and method constrains where specified
                if (!securityInfo.getRolesAllowed().isEmpty() || securityInfo.getEmptyRoleSemantic() != EmptyRoleSemantic.PERMIT || methods.isEmpty()) {
                    SecurityConstraint newConstraint = new SecurityConstraint().setEmptyRoleSemantic(securityInfo.getEmptyRoleSemantic()).addRolesAllowed(securityInfo.getRolesAllowed()).setTransportGuaranteeType(securityInfo.getTransportGuaranteeType()).addWebResourceCollection(new WebResourceCollection().addUrlPatterns(mappings).addHttpMethodOmissions(methods));
                    builder.addSecurityConstraint(newConstraint);
                }
            }
        }
    }
    return builder.build();
}

Example 10 with WebResourceCollection

use of io.undertow.servlet.api.WebResourceCollection in project undertow by undertow-io.

the class ServletRegistrationImpl method setServletSecurity.

@Override
public Set<String> setServletSecurity(final ServletSecurityElement constraint) {
    if (constraint == null) {
        throw UndertowMessages.MESSAGES.argumentCannotBeNull("constraint");
    }
    DeploymentInfo deploymentInfo = deployment.getDeploymentInfo();
    //this is not super efficient, but it does not really matter
    final Set<String> urlPatterns = new HashSet<>();
    for (SecurityConstraint sc : deploymentInfo.getSecurityConstraints()) {
        for (WebResourceCollection webResources : sc.getWebResourceCollections()) {
            urlPatterns.addAll(webResources.getUrlPatterns());
        }
    }
    final Set<String> ret = new HashSet<>();
    for (String url : servletInfo.getMappings()) {
        if (urlPatterns.contains(url)) {
            ret.add(url);
        }
    }
    ServletSecurityInfo info = new ServletSecurityInfo();
    servletInfo.setServletSecurityInfo(info);
    info.setTransportGuaranteeType(constraint.getTransportGuarantee() == CONFIDENTIAL ? TransportGuaranteeType.CONFIDENTIAL : TransportGuaranteeType.NONE).setEmptyRoleSemantic(emptyRoleSemantic(constraint.getEmptyRoleSemantic())).addRolesAllowed(constraint.getRolesAllowed());
    for (final HttpMethodConstraintElement methodConstraint : constraint.getHttpMethodConstraints()) {
        info.addHttpMethodSecurityInfo(new HttpMethodSecurityInfo().setTransportGuaranteeType(methodConstraint.getTransportGuarantee() == CONFIDENTIAL ? TransportGuaranteeType.CONFIDENTIAL : TransportGuaranteeType.NONE).setMethod(methodConstraint.getMethodName()).setEmptyRoleSemantic(emptyRoleSemantic(methodConstraint.getEmptyRoleSemantic())).addRolesAllowed(methodConstraint.getRolesAllowed()));
    }
    return ret;
}