Examples with AuthStatus javax.security.auth.message.AuthStatus used on opensource projects

Example 1 with AuthStatus

use of javax.security.auth.message.AuthStatus in project tomcat by apache.

the class AuthenticatorBase method authenticateJaspic.

private boolean authenticateJaspic(Request request, Response response, JaspicState state, boolean requirePrincipal) {
    boolean cachedAuth = checkForCachedAuthentication(request, response, false);
    Subject client = new Subject();
    AuthStatus authStatus;
    try {
        authStatus = state.serverAuthContext.validateRequest(state.messageInfo, client, null);
    } catch (AuthException e) {
        log.debug(sm.getString("authenticator.loginFail"), e);
        return false;
    }
    request.setRequest((HttpServletRequest) state.messageInfo.getRequestMessage());
    response.setResponse((HttpServletResponse) state.messageInfo.getResponseMessage());
    if (authStatus == AuthStatus.SUCCESS) {
        GenericPrincipal principal = getPrincipal(client);
        if (log.isDebugEnabled()) {
            log.debug("Authenticated user: " + principal);
        }
        if (principal == null) {
            request.setUserPrincipal(null);
            request.setAuthType(null);
            if (requirePrincipal) {
                return false;
            }
        } else if (cachedAuth == false || !principal.getUserPrincipal().equals(request.getUserPrincipal())) {
            // Skip registration if authentication credentials were
            // cached and the Principal did not change.
            request.setNote(Constants.REQ_JASPIC_SUBJECT_NOTE, client);
            // JASPIC API uses raw types
            @SuppressWarnings("rawtypes") Map map = state.messageInfo.getMap();
            if (map != null && map.containsKey("javax.servlet.http.registerSession")) {
                register(request, response, principal, "JASPIC", null, null, true, true);
            } else {
                register(request, response, principal, "JASPIC", null, null);
            }
        }
        return true;
    }
    return false;
}

Example 2 with AuthStatus

use of javax.security.auth.message.AuthStatus in project jetty.project by eclipse.

the class JaspiAuthenticator method secureResponse.

public boolean secureResponse(JaspiMessageInfo messageInfo, Authentication validatedUser) throws ServerAuthException {
    try {
        String authContextId = _authConfig.getAuthContextID(messageInfo);
        ServerAuthContext authContext = _authConfig.getAuthContext(authContextId, _serviceSubject, _authProperties);
        // TODO
        // authContext.cleanSubject(messageInfo,validatedUser.getUserIdentity().getSubject());
        AuthStatus status = authContext.secureResponse(messageInfo, _serviceSubject);
        return (AuthStatus.SEND_SUCCESS.equals(status));
    } catch (AuthException e) {
        throw new ServerAuthException(e);
    }
}

Example 3 with AuthStatus

use of javax.security.auth.message.AuthStatus in project jetty.project by eclipse.

the class JaspiAuthenticator method validateRequest.

public Authentication validateRequest(JaspiMessageInfo messageInfo) throws ServerAuthException {
    try {
        String authContextId = _authConfig.getAuthContextID(messageInfo);
        ServerAuthContext authContext = _authConfig.getAuthContext(authContextId, _serviceSubject, _authProperties);
        Subject clientSubject = new Subject();
        AuthStatus authStatus = authContext.validateRequest(messageInfo, clientSubject, _serviceSubject);
        if (authStatus == AuthStatus.SEND_CONTINUE)
            return Authentication.SEND_CONTINUE;
        if (authStatus == AuthStatus.SEND_FAILURE)
            return Authentication.SEND_FAILURE;
        if (authStatus == AuthStatus.SUCCESS) {
            Set<UserIdentity> ids = clientSubject.getPrivateCredentials(UserIdentity.class);
            UserIdentity userIdentity;
            if (ids.size() > 0) {
                userIdentity = ids.iterator().next();
            } else {
                CallerPrincipalCallback principalCallback = _callbackHandler.getThreadCallerPrincipalCallback();
                if (principalCallback == null) {
                    return Authentication.UNAUTHENTICATED;
                }
                Principal principal = principalCallback.getPrincipal();
                if (principal == null) {
                    String principalName = principalCallback.getName();
                    Set<Principal> principals = principalCallback.getSubject().getPrincipals();
                    for (Principal p : principals) {
                        if (p.getName().equals(principalName)) {
                            principal = p;
                            break;
                        }
                    }
                    if (principal == null) {
                        return Authentication.UNAUTHENTICATED;
                    }
                }
                GroupPrincipalCallback groupPrincipalCallback = _callbackHandler.getThreadGroupPrincipalCallback();
                String[] groups = groupPrincipalCallback == null ? null : groupPrincipalCallback.getGroups();
                userIdentity = _identityService.newUserIdentity(clientSubject, principal, groups);
            }
            HttpSession session = ((HttpServletRequest) messageInfo.getRequestMessage()).getSession(false);
            Authentication cached = (session == null ? null : (SessionAuthentication) session.getAttribute(SessionAuthentication.__J_AUTHENTICATED));
            if (cached != null)
                return cached;
            return new UserAuthentication(getAuthMethod(), userIdentity);
        }
        if (authStatus == AuthStatus.SEND_SUCCESS) {
            // we are processing a message in a secureResponse dialog.
            return Authentication.SEND_SUCCESS;
        }
        if (authStatus == AuthStatus.FAILURE) {
            HttpServletResponse response = (HttpServletResponse) messageInfo.getResponseMessage();
            response.sendError(HttpServletResponse.SC_FORBIDDEN);
            return Authentication.SEND_FAILURE;
        }
        // should not happen
        throw new IllegalStateException("No AuthStatus returned");
    } catch (IOException | AuthException e) {
        throw new ServerAuthException(e);
    }
}

Example 4 with AuthStatus

use of javax.security.auth.message.AuthStatus in project OpenAM by OpenRock.

the class JaspiAuthModuleWrapper method onLoginSuccess.

/**
     * Post processing of successful authentication, which initialises the underlying JASPI ServerAuthModule, as a new
     * instance of this class is created for the Post Authentication Process, and then calls the subtypes
     * onLoginSuccess method, and then finally calls the JASPI ServerAuthModule's secureResponse method.
     *
     * @param requestParamsMap {@inheritDoc}
     * @param request {@inheritDoc}
     * @param response {@inheritDoc}
     * @param ssoToken {@inheritDoc}
     * @throws AuthenticationException {@inheritDoc}
     */
public void onLoginSuccess(Map requestParamsMap, HttpServletRequest request, HttpServletResponse response, SSOToken ssoToken) throws AuthenticationException {
    try {
        Map<String, Object> config = initialize(requestParamsMap, request, response, ssoToken);
        serverAuthModule.initialize(createRequestMessagePolicy(), null, null, config);
        MessageInfo messageInfo = prepareMessageInfo(request, response);
        onLoginSuccess(messageInfo, requestParamsMap, request, response, ssoToken);
        AuthStatus authStatus = serverAuthModule.secureResponse(messageInfo, null);
        if (AuthStatus.SEND_SUCCESS.equals(authStatus)) {
            // nothing to do here just carry on
            debug.message("Successfully secured response.");
        } else if (AuthStatus.SEND_FAILURE.equals(authStatus)) {
            // Send HttpServletResponse to client and exit.
            debug.message("Failed to secured response, included response message");
            throw new AuthenticationException(resourceBundleName, "authFailed", null);
        } else if (AuthStatus.SEND_CONTINUE.equals(authStatus)) {
            // Send HttpServletResponse to client and exit.
            debug.message("Has not finished securing response. Requires more information from client.");
            throw new AuthenticationException(resourceBundleName, "authFailed", null);
        } else {
            debug.error("Invalid AuthStatus, " + authStatus.toString());
            throw new AuthenticationException(resourceBundleName, "authFailed", null);
        }
    } catch (AuthException e) {
        debug.error("Authentication Failed", e);
        throw new AuthenticationException(resourceBundleName, "authFailed", null);
    }
}

Example 5 with AuthStatus

use of javax.security.auth.message.AuthStatus in project tomcat by apache.

the class SimpleServerAuthContext method validateRequest.

// JASPIC API uses raw types
@SuppressWarnings("unchecked")
@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject) throws AuthException {
    for (int moduleIndex = 0; moduleIndex < modules.size(); moduleIndex++) {
        ServerAuthModule module = modules.get(moduleIndex);
        AuthStatus result = module.validateRequest(messageInfo, clientSubject, serviceSubject);
        if (result != AuthStatus.SEND_FAILURE) {
            messageInfo.getMap().put("moduleIndex", Integer.valueOf(moduleIndex));
            return result;
        }
    }
    return AuthStatus.SEND_FAILURE;
}