use of javax.security.auth.message.callback.CallerPrincipalCallback in project jetty.project by eclipse.
the class JaspiAuthenticator method validateRequest.
public Authentication validateRequest(JaspiMessageInfo messageInfo) throws ServerAuthException {
try {
String authContextId = _authConfig.getAuthContextID(messageInfo);
ServerAuthContext authContext = _authConfig.getAuthContext(authContextId, _serviceSubject, _authProperties);
Subject clientSubject = new Subject();
AuthStatus authStatus = authContext.validateRequest(messageInfo, clientSubject, _serviceSubject);
if (authStatus == AuthStatus.SEND_CONTINUE)
return Authentication.SEND_CONTINUE;
if (authStatus == AuthStatus.SEND_FAILURE)
return Authentication.SEND_FAILURE;
if (authStatus == AuthStatus.SUCCESS) {
Set<UserIdentity> ids = clientSubject.getPrivateCredentials(UserIdentity.class);
UserIdentity userIdentity;
if (ids.size() > 0) {
userIdentity = ids.iterator().next();
} else {
CallerPrincipalCallback principalCallback = _callbackHandler.getThreadCallerPrincipalCallback();
if (principalCallback == null) {
return Authentication.UNAUTHENTICATED;
}
Principal principal = principalCallback.getPrincipal();
if (principal == null) {
String principalName = principalCallback.getName();
Set<Principal> principals = principalCallback.getSubject().getPrincipals();
for (Principal p : principals) {
if (p.getName().equals(principalName)) {
principal = p;
break;
}
}
if (principal == null) {
return Authentication.UNAUTHENTICATED;
}
}
GroupPrincipalCallback groupPrincipalCallback = _callbackHandler.getThreadGroupPrincipalCallback();
String[] groups = groupPrincipalCallback == null ? null : groupPrincipalCallback.getGroups();
userIdentity = _identityService.newUserIdentity(clientSubject, principal, groups);
}
HttpSession session = ((HttpServletRequest) messageInfo.getRequestMessage()).getSession(false);
Authentication cached = (session == null ? null : (SessionAuthentication) session.getAttribute(SessionAuthentication.__J_AUTHENTICATED));
if (cached != null)
return cached;
return new UserAuthentication(getAuthMethod(), userIdentity);
}
if (authStatus == AuthStatus.SEND_SUCCESS) {
// we are processing a message in a secureResponse dialog.
return Authentication.SEND_SUCCESS;
}
if (authStatus == AuthStatus.FAILURE) {
HttpServletResponse response = (HttpServletResponse) messageInfo.getResponseMessage();
response.sendError(HttpServletResponse.SC_FORBIDDEN);
return Authentication.SEND_FAILURE;
}
// should not happen
throw new IllegalStateException("No AuthStatus returned");
} catch (IOException | AuthException e) {
throw new ServerAuthException(e);
}
}
use of javax.security.auth.message.callback.CallerPrincipalCallback in project jetty.project by eclipse.
the class ServletCallbackHandler method handle.
public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
for (Callback callback : callbacks) {
// jaspi to server communication
if (callback instanceof CallerPrincipalCallback) {
_callerPrincipals.set((CallerPrincipalCallback) callback);
} else if (callback instanceof GroupPrincipalCallback) {
_groupPrincipals.set((GroupPrincipalCallback) callback);
} else if (callback instanceof PasswordValidationCallback) {
PasswordValidationCallback passwordValidationCallback = (PasswordValidationCallback) callback;
Subject subject = passwordValidationCallback.getSubject();
UserIdentity user = _loginService.login(passwordValidationCallback.getUsername(), passwordValidationCallback.getPassword(), null);
if (user != null) {
passwordValidationCallback.setResult(true);
passwordValidationCallback.getSubject().getPrincipals().addAll(user.getSubject().getPrincipals());
passwordValidationCallback.getSubject().getPrivateCredentials().add(user);
}
} else if (callback instanceof CredentialValidationCallback) {
CredentialValidationCallback credentialValidationCallback = (CredentialValidationCallback) callback;
Subject subject = credentialValidationCallback.getSubject();
LoginCallback loginCallback = new LoginCallbackImpl(subject, credentialValidationCallback.getUsername(), credentialValidationCallback.getCredential());
UserIdentity user = _loginService.login(credentialValidationCallback.getUsername(), credentialValidationCallback.getCredential(), null);
if (user != null) {
loginCallback.setUserPrincipal(user.getUserPrincipal());
credentialValidationCallback.getSubject().getPrivateCredentials().add(loginCallback);
credentialValidationCallback.setResult(true);
credentialValidationCallback.getSubject().getPrincipals().addAll(user.getSubject().getPrincipals());
credentialValidationCallback.getSubject().getPrivateCredentials().add(user);
}
} else // TODO implement these
if (callback instanceof CertStoreCallback) {
} else if (callback instanceof PrivateKeyCallback) {
} else if (callback instanceof SecretKeyCallback) {
} else if (callback instanceof TrustStoreCallback) {
} else {
throw new UnsupportedCallbackException(callback);
}
}
}
use of javax.security.auth.message.callback.CallerPrincipalCallback in project jetty.project by eclipse.
the class ServletCallbackHandler method getThreadCallerPrincipalCallback.
public CallerPrincipalCallback getThreadCallerPrincipalCallback() {
CallerPrincipalCallback callerPrincipalCallback = _callerPrincipals.get();
_callerPrincipals.set(null);
return callerPrincipalCallback;
}
use of javax.security.auth.message.callback.CallerPrincipalCallback in project jetty.project by eclipse.
the class HttpHeaderAuthModule method validateRequest.
/**
* Validation occurs here.
*/
@Override
public AuthStatus validateRequest(final MessageInfo messageInfo, final Subject client, final Subject serviceSubject) throws AuthException {
// Take the request from the messageInfo structure.
final HttpServletRequest req = (HttpServletRequest) messageInfo.getRequestMessage();
try {
// Get the user name from the header. If not there then fail authentication.
final String userName = req.getHeader("X-Forwarded-User");
if (userName == null) {
return AuthStatus.FAILURE;
}
// Store the user name that was in the header and also set a group.
handler.handle(new Callback[] { new CallerPrincipalCallback(client, userName), new GroupPrincipalCallback(client, new String[] { "users" }) });
return AuthStatus.SUCCESS;
} catch (final Exception e) {
throw new AuthException(e.getMessage());
}
}
use of javax.security.auth.message.callback.CallerPrincipalCallback in project OpenAM by OpenRock.
the class LocalSSOTokenSessionModule method validate.
/**
* Validates the request by attempting to retrieve the SSOToken ID from the cookies on the request.
* If the SSOToken ID cookie is not present then the method returns AuthStatus.SEND_FAILURE, otherwise if it is
* present it is then used to retrieve the actual SSOToken from the SSOTokenManager, if valid then
* AuthStatus.SUCCESS will be returned, otherwise AuthStatus.SEND_FAILURE will be returned.
*
* @param request The HttpServletRequest.
* @param messageInfo A contextual object that encapsulates the client request and server response objects, and
* that may be used to save state across a sequence of calls made to the methods of this
* interface for the purpose of completing a secure message exchange.
* @param clientSubject A Subject that represents the source of the service request. It is used by the method
* implementation to store Principals and credentials validated in the request.
* @return AuthStatus.SUCCESS if the SSOToken ID is valid, otherwise AuthStatus.SEND_FAILURE.
* @throws AuthException If there is a problem validating the request.
*/
private Promise<AuthStatus, AuthenticationException> validate(HttpServletRequest request, MessageInfoContext messageInfo, Subject clientSubject) {
String tokenId = getRequestUtils().getTokenId(request);
if (StringUtils.isEmpty(tokenId)) {
tokenId = request.getHeader(getCookieHeaderName());
}
if (!StringUtils.isEmpty(tokenId)) {
SSOToken ssoToken = getFactory().getTokenFromId(tokenId);
if (ssoToken != null) {
int authLevel;
try {
authLevel = ssoToken.getAuthLevel();
String name = ssoToken.getPrincipal().getName();
handler.handle(new Callback[] { new CallerPrincipalCallback(clientSubject, name) });
clientSubject.getPrincipals().add(ssoToken.getPrincipal());
} catch (SSOException e) {
return newExceptionPromise(new AuthenticationException(e.getMessage()));
} catch (UnsupportedCallbackException e) {
return newExceptionPromise(new AuthenticationException(e.getMessage()));
} catch (IOException e) {
return newExceptionPromise(new AuthenticationException(e.getMessage()));
}
Map<String, Object> context = (Map<String, Object>) messageInfo.getRequestContextMap().get("org.forgerock.authentication.context");
context.put("authLevel", authLevel);
context.put("tokenId", ssoToken.getTokenID().toString());
return newResultPromise(SUCCESS);
}
}
return newResultPromise(getInvalidSSOTokenAuthStatus());
}
Aggregations