Examples with AuthenticationStatus javax.security.enterprise.AuthenticationStatus used on opensource projects

Example 1 with AuthenticationStatus

use of javax.security.enterprise.AuthenticationStatus in project tomee by apache.

the class RememberMeInterceptor method validateRequest.

private AuthenticationStatus validateRequest(final InvocationContext invocationContext) throws Exception {
    final HttpMessageContext httpMessageContext = (HttpMessageContext) invocationContext.getParameters()[2];
    final RememberMe rememberMe = TomEEELInvocationHandler.of(RememberMe.class, getRememberMe(), getElProcessor(invocationContext, httpMessageContext));
    final Optional<Cookie> cookie = getCookie(httpMessageContext.getRequest(), rememberMe.cookieName());
    if (cookie.isPresent() && !isEmpty(cookie.get().getValue())) {
        final RememberMeCredential rememberMeCredential = new RememberMeCredential(cookie.get().getValue());
        final CredentialValidationResult validate = rememberMeIdentityStore.get().validate(rememberMeCredential);
        if (VALID.equals(validate.getStatus())) {
            return httpMessageContext.notifyContainerAboutLogin(validate);
        } else {
            cookie.get().setMaxAge(0);
            httpMessageContext.getResponse().addCookie(cookie.get());
        }
    }
    final AuthenticationStatus status = (AuthenticationStatus) invocationContext.proceed();
    if (SUCCESS.equals(status) && httpMessageContext.getCallerPrincipal() != null) {
        if (rememberMe.isRememberMe()) {
            final CallerPrincipal principal = new CallerPrincipal(httpMessageContext.getCallerPrincipal().getName());
            final Set<String> groups = httpMessageContext.getGroups();
            final String loginToken = rememberMeIdentityStore.get().generateLoginToken(principal, groups);
            final Cookie rememberMeCookie = new Cookie(rememberMe.cookieName(), loginToken);
            rememberMeCookie.setPath(isEmpty(httpMessageContext.getRequest().getContextPath()) ? "/" : httpMessageContext.getRequest().getContextPath());
            rememberMeCookie.setMaxAge(rememberMe.cookieMaxAgeSeconds());
            rememberMeCookie.setHttpOnly(rememberMe.cookieHttpOnly());
            rememberMeCookie.setSecure(rememberMe.cookieSecureOnly());
            httpMessageContext.getResponse().addCookie(rememberMeCookie);
        }
    }
    return status;
}

Example 2 with AuthenticationStatus

use of javax.security.enterprise.AuthenticationStatus in project tomee by apache.

the class LoginToContinueInterceptor method processContainerInitiatedAuthentication.

private AuthenticationStatus processContainerInitiatedAuthentication(final InvocationContext invocationContext, final HttpMessageContext httpMessageContext) throws Exception {
    if (isOnInitialProtectedURL(httpMessageContext)) {
        saveRequest(httpMessageContext.getRequest());
        final LoginToContinue loginToContinue = getLoginToContinue(invocationContext);
        if (loginToContinue.useForwardToLogin()) {
            return httpMessageContext.forward(loginToContinue.loginPage());
        } else {
            return httpMessageContext.redirect(toAbsoluteUrl(httpMessageContext.getRequest(), loginToContinue.loginPage()));
        }
    }
    if (isOnLoginPostback(httpMessageContext)) {
        final AuthenticationStatus authenticationStatus = (AuthenticationStatus) invocationContext.proceed();
        if (authenticationStatus.equals(SUCCESS)) {
            if (httpMessageContext.getCallerPrincipal() == null) {
                return SUCCESS;
            }
            if (matchRequest(httpMessageContext.getRequest())) {
                return SUCCESS;
            }
            saveAuthentication(httpMessageContext.getRequest(), httpMessageContext.getCallerPrincipal(), httpMessageContext.getGroups());
            final SavedRequest savedRequest = getRequest(httpMessageContext.getRequest());
            return httpMessageContext.redirect(savedRequest.getRequestURLWithQueryString());
        } else if (authenticationStatus.equals(SEND_FAILURE)) {
            final LoginToContinue loginToContinue = getLoginToContinue(invocationContext);
            if (!loginToContinue.errorPage().isEmpty()) {
                return httpMessageContext.redirect(toAbsoluteUrl(httpMessageContext.getRequest(), loginToContinue.errorPage()));
            }
            return authenticationStatus;
        } else {
            // SEND_CONTINUE
            return authenticationStatus;
        }
    }
    if (isOnOriginalURLAfterAuthenticate(httpMessageContext)) {
        final SavedRequest savedRequest = getRequest(httpMessageContext.getRequest());
        final SavedAuthentication savedAuthentication = getAuthentication(httpMessageContext.getRequest());
        clearRequestAndAuthentication(httpMessageContext.getRequest());
        final SavedHttpServletRequest savedHttpServletRequest = new SavedHttpServletRequest(httpMessageContext.getRequest(), savedRequest);
        return httpMessageContext.withRequest(savedHttpServletRequest).notifyContainerAboutLogin(savedAuthentication.getPrincipal(), savedAuthentication.getGroups());
    }
    return (AuthenticationStatus) invocationContext.proceed();
}

Example 3 with AuthenticationStatus

use of javax.security.enterprise.AuthenticationStatus in project tomee by apache.

the class TomEESecurityServerAuthModule method validateRequest.

@Override
public AuthStatus validateRequest(final MessageInfo messageInfo, final Subject clientSubject, final Subject serviceSubject) throws AuthException {
    final HttpMessageContext httpMessageContext = httpMessageContext(handler, messageInfo, clientSubject, serviceSubject);
    final HttpAuthenticationMechanism authenticationMechanism = CDI.current().select(TomEESecurityServletAuthenticationMechanismMapper.class).get().getCurrentAuthenticationMechanism(httpMessageContext);
    final AuthenticationStatus authenticationStatus;
    try {
        authenticationStatus = authenticationMechanism.validateRequest(httpMessageContext.getRequest(), httpMessageContext.getResponse(), httpMessageContext);
    } catch (final AuthenticationException e) {
        final AuthException authException = new AuthException(e.getMessage());
        authException.initCause(e);
        throw authException;
    }
    return mapToAuthStatus(authenticationStatus);
}

Example 4 with AuthenticationStatus

use of javax.security.enterprise.AuthenticationStatus in project tomee by apache.

the class AutoApplySessionInterceptor method validateRequest.

private AuthenticationStatus validateRequest(final InvocationContext invocationContext) throws Exception {
    final HttpMessageContext httpMessageContext = (HttpMessageContext) invocationContext.getParameters()[2];
    final Principal principal = httpMessageContext.getRequest().getUserPrincipal();
    if (principal == null) {
        final Object authenticationStatus = invocationContext.proceed();
        if (AuthenticationStatus.SUCCESS.equals(authenticationStatus)) {
            httpMessageContext.getMessageInfo().getMap().put("javax.servlet.http.registerSession", "true");
        }
        return (AuthenticationStatus) authenticationStatus;
    } else {
        final CallerPrincipalCallback callerPrincipalCallback = new CallerPrincipalCallback(httpMessageContext.getClientSubject(), principal);
        httpMessageContext.getHandler().handle(new Callback[] { callerPrincipalCallback });
        return AuthenticationStatus.SUCCESS;
    }
}

Example 5 with AuthenticationStatus

use of javax.security.enterprise.AuthenticationStatus in project tomee by apache.

the class TomEESecurityServerAuthModule method secureResponse.

@Override
public AuthStatus secureResponse(final MessageInfo messageInfo, final Subject subject) throws AuthException {
    final HttpMessageContext httpMessageContext = httpMessageContext(handler, messageInfo, subject, null);
    final HttpAuthenticationMechanism authenticationMechanism = CDI.current().select(TomEESecurityServletAuthenticationMechanismMapper.class).get().getCurrentAuthenticationMechanism(httpMessageContext);
    final AuthenticationStatus authenticationStatus;
    try {
        authenticationStatus = authenticationMechanism.secureResponse(httpMessageContext.getRequest(), httpMessageContext.getResponse(), httpMessageContext);
    } catch (final AuthenticationException e) {
        final AuthException authException = new AuthException(e.getMessage());
        authException.initCause(e);
        throw authException;
    }
    return mapToAuthStatus(authenticationStatus);
}