Examples with RolesAllowed jakarta.annotation.security.RolesAllowed used on opensource projects

Example 6 with RolesAllowed

use of jakarta.annotation.security.RolesAllowed in project spring-security by spring-projects.

the class Jsr250MethodSecurityMetadataSource method processAnnotations.

private List<ConfigAttribute> processAnnotations(Annotation[] annotations) {
    if (annotations == null || annotations.length == 0) {
        return null;
    }
    List<ConfigAttribute> attributes = new ArrayList<>();
    for (Annotation annotation : annotations) {
        if (annotation instanceof DenyAll) {
            attributes.add(Jsr250SecurityConfig.DENY_ALL_ATTRIBUTE);
            return attributes;
        }
        if (annotation instanceof PermitAll) {
            attributes.add(Jsr250SecurityConfig.PERMIT_ALL_ATTRIBUTE);
            return attributes;
        }
        if (annotation instanceof RolesAllowed) {
            RolesAllowed ra = (RolesAllowed) annotation;
            for (String allowed : ra.value()) {
                String defaultedAllowed = getRoleWithDefaultPrefix(allowed);
                attributes.add(new Jsr250SecurityConfig(defaultedAllowed));
            }
            return attributes;
        }
    }
    return null;
}

Example 7 with RolesAllowed

use of jakarta.annotation.security.RolesAllowed in project org.openntf.xsp.jakartaee by OpenNTF.

the class RolesAllowedFilter method isAllowed.

private boolean isAllowed(ContainerRequestContext requestContext) {
    Method method = resourceInfo.getResourceMethod();
    Class<?> clazz = resourceInfo.getResourceClass();
    if (method.isAnnotationPresent(PermitAll.class)) {
        return true;
    }
    if (method.isAnnotationPresent(DenyAll.class)) {
        return false;
    }
    RolesAllowed roles = method.getAnnotation(RolesAllowed.class);
    if (roles == null) {
        roles = clazz.getAnnotation(RolesAllowed.class);
    }
    if (roles != null) {
        SecurityContext sec = requestContext.getSecurityContext();
        for (String role : roles.value()) {
            if (sec.isUserInRole(role)) {
                return true;
            }
        }
        return false;
    }
    return true;
}

Example 8 with RolesAllowed

use of jakarta.annotation.security.RolesAllowed in project resteasy by resteasy.

the class RoleBasedSecurityFeature method configure.

@SuppressWarnings(value = "unchecked")
@Override
public void configure(ResourceInfo resourceInfo, FeatureContext configurable) {
    @SuppressWarnings("rawtypes") final Class declaring = resourceInfo.getResourceClass();
    final Method method = resourceInfo.getResourceMethod();
    if (declaring == null || method == null)
        return;
    String[] rolesAllowed = null;
    boolean denyAll;
    boolean permitAll;
    RolesAllowed allowed = (RolesAllowed) declaring.getAnnotation(RolesAllowed.class);
    RolesAllowed methodAllowed = method.getAnnotation(RolesAllowed.class);
    if (methodAllowed != null)
        allowed = methodAllowed;
    if (allowed != null) {
        rolesAllowed = allowed.value();
    }
    denyAll = (declaring.isAnnotationPresent(DenyAll.class) && method.isAnnotationPresent(RolesAllowed.class) == false && method.isAnnotationPresent(PermitAll.class) == false) || method.isAnnotationPresent(DenyAll.class);
    permitAll = (declaring.isAnnotationPresent(PermitAll.class) == true && method.isAnnotationPresent(RolesAllowed.class) == false && method.isAnnotationPresent(DenyAll.class) == false) || method.isAnnotationPresent(PermitAll.class);
    if (rolesAllowed != null || denyAll || permitAll) {
        RoleBasedSecurityFilter filter = new RoleBasedSecurityFilter(rolesAllowed, denyAll, permitAll);
        configurable.register(filter);
    }
}

Example 9 with RolesAllowed

use of jakarta.annotation.security.RolesAllowed in project helidon by oracle.

the class AbacProviderTest method testMissingRoleValidator.

@Test
public void testMissingRoleValidator() {
    AbacProvider provider = AbacProvider.create();
    // this must be implicitly considered an attribute annotation
    RolesAllowed attrib = Mockito.mock(RolesAllowed.class);
    doReturn(RolesAllowed.class).when(attrib).annotationType();
    SecurityLevel level = SecurityLevel.create("mock").withClassAnnotations(Map.of(RolesAllowed.class, List.of(attrib))).build();
    EndpointConfig ec = EndpointConfig.builder().securityLevels(List.of(level)).build();
    ProviderRequest request = Mockito.mock(ProviderRequest.class);
    when(request.endpointConfig()).thenReturn(ec);
    AuthorizationResponse response = provider.syncAuthorize(request);
    assertThat(response.status(), is(SecurityResponse.SecurityStatus.FAILURE));
    assertThat(response.description(), not(Optional.empty()));
    response.description().ifPresent(desc -> assertThat(desc, containsString("RolesAllowed attribute annotation is not supported")));
}

Example 10 with RolesAllowed

use of jakarta.annotation.security.RolesAllowed in project helidon by oracle.

the class RoleValidatorTest method testRolesAllowedDeny.

@Test
void testRolesAllowedDeny() {
    RoleValidator validator = RoleValidator.create();
    RolesAllowed annot = mock(RolesAllowed.class);
    String[] roleArray = new String[] { "admin" };
    when(annot.value()).thenReturn(roleArray);
    SecurityLevel appSecurityLevel = mock(SecurityLevel.class);
    SecurityLevel classSecurityLevel = mock(SecurityLevel.class);
    List<SecurityLevel> securityLevels = new ArrayList<>();
    securityLevels.add(appSecurityLevel);
    securityLevels.add(classSecurityLevel);
    EndpointConfig ep = mock(EndpointConfig.class);
    when(ep.securityLevels()).thenReturn(securityLevels);
    when(classSecurityLevel.filterAnnotations(RolesAllowed.class, EndpointConfig.AnnotationScope.METHOD)).thenReturn(List.of(annot));
    RoleValidator.RoleConfig rConfig = validator.fromAnnotations(ep);
    Errors.Collector collector = Errors.collector();
    ProviderRequest request = mock(ProviderRequest.class);
    when(request.subject()).thenReturn(Optional.of(Subject.builder().principal(Principal.create("myAdmin")).addGrant(Role.create("user")).build()));
    when(request.service()).thenReturn(Optional.empty());
    validator.validate(rConfig, collector, request);
    if (collector.collect().isValid()) {
        fail("User is not in admin role, should have failed");
    }
}