Examples with HttpMessageContext javax.security.enterprise.authentication.mechanism.http.HttpMessageContext used on opensource projects

Example 1 with HttpMessageContext

use of javax.security.enterprise.authentication.mechanism.http.HttpMessageContext in project tomee by apache.

the class RememberMeInterceptor method validateRequest.

private AuthenticationStatus validateRequest(final InvocationContext invocationContext) throws Exception {
    final HttpMessageContext httpMessageContext = (HttpMessageContext) invocationContext.getParameters()[2];
    final RememberMe rememberMe = TomEEELInvocationHandler.of(RememberMe.class, getRememberMe(), getElProcessor(invocationContext, httpMessageContext));
    final Optional<Cookie> cookie = getCookie(httpMessageContext.getRequest(), rememberMe.cookieName());
    if (cookie.isPresent() && !isEmpty(cookie.get().getValue())) {
        final RememberMeCredential rememberMeCredential = new RememberMeCredential(cookie.get().getValue());
        final CredentialValidationResult validate = rememberMeIdentityStore.get().validate(rememberMeCredential);
        if (VALID.equals(validate.getStatus())) {
            return httpMessageContext.notifyContainerAboutLogin(validate);
        } else {
            cookie.get().setMaxAge(0);
            httpMessageContext.getResponse().addCookie(cookie.get());
        }
    }
    final AuthenticationStatus status = (AuthenticationStatus) invocationContext.proceed();
    if (SUCCESS.equals(status) && httpMessageContext.getCallerPrincipal() != null) {
        if (rememberMe.isRememberMe()) {
            final CallerPrincipal principal = new CallerPrincipal(httpMessageContext.getCallerPrincipal().getName());
            final Set<String> groups = httpMessageContext.getGroups();
            final String loginToken = rememberMeIdentityStore.get().generateLoginToken(principal, groups);
            final Cookie rememberMeCookie = new Cookie(rememberMe.cookieName(), loginToken);
            rememberMeCookie.setPath(isEmpty(httpMessageContext.getRequest().getContextPath()) ? "/" : httpMessageContext.getRequest().getContextPath());
            rememberMeCookie.setMaxAge(rememberMe.cookieMaxAgeSeconds());
            rememberMeCookie.setHttpOnly(rememberMe.cookieHttpOnly());
            rememberMeCookie.setSecure(rememberMe.cookieSecureOnly());
            httpMessageContext.getResponse().addCookie(rememberMeCookie);
        }
    }
    return status;
}

Example 2 with HttpMessageContext

use of javax.security.enterprise.authentication.mechanism.http.HttpMessageContext in project tomee by apache.

the class LoginToContinueInterceptor method validateRequest.

private AuthenticationStatus validateRequest(final InvocationContext invocationContext) throws Exception {
    final HttpMessageContext httpMessageContext = (HttpMessageContext) invocationContext.getParameters()[2];
    clearStaleState(httpMessageContext);
    if (httpMessageContext.getAuthParameters().isNewAuthentication()) {
        return processCallerInitiatedAuthentication(invocationContext, httpMessageContext);
    } else {
        return processContainerInitiatedAuthentication(invocationContext, httpMessageContext);
    }
}

Example 3 with HttpMessageContext

use of javax.security.enterprise.authentication.mechanism.http.HttpMessageContext in project tomee by apache.

the class TomEESecurityServerAuthModule method cleanSubject.

@Override
public void cleanSubject(final MessageInfo messageInfo, final Subject subject) throws AuthException {
    final HttpMessageContext httpMessageContext = httpMessageContext(handler, messageInfo, subject, null);
    CDI.current().select(TomEESecurityServletAuthenticationMechanismMapper.class).get().getCurrentAuthenticationMechanism(httpMessageContext).cleanSubject(httpMessageContext.getRequest(), httpMessageContext.getResponse(), httpMessageContext);
}

Example 4 with HttpMessageContext

use of javax.security.enterprise.authentication.mechanism.http.HttpMessageContext in project tomee by apache.

the class TomEESecurityServerAuthModule method validateRequest.

@Override
public AuthStatus validateRequest(final MessageInfo messageInfo, final Subject clientSubject, final Subject serviceSubject) throws AuthException {
    final HttpMessageContext httpMessageContext = httpMessageContext(handler, messageInfo, clientSubject, serviceSubject);
    final HttpAuthenticationMechanism authenticationMechanism = CDI.current().select(TomEESecurityServletAuthenticationMechanismMapper.class).get().getCurrentAuthenticationMechanism(httpMessageContext);
    final AuthenticationStatus authenticationStatus;
    try {
        authenticationStatus = authenticationMechanism.validateRequest(httpMessageContext.getRequest(), httpMessageContext.getResponse(), httpMessageContext);
    } catch (final AuthenticationException e) {
        final AuthException authException = new AuthException(e.getMessage());
        authException.initCause(e);
        throw authException;
    }
    return mapToAuthStatus(authenticationStatus);
}

Example 5 with HttpMessageContext

use of javax.security.enterprise.authentication.mechanism.http.HttpMessageContext in project tomee by apache.

the class AutoApplySessionInterceptor method validateRequest.

private AuthenticationStatus validateRequest(final InvocationContext invocationContext) throws Exception {
    final HttpMessageContext httpMessageContext = (HttpMessageContext) invocationContext.getParameters()[2];
    final Principal principal = httpMessageContext.getRequest().getUserPrincipal();
    if (principal == null) {
        final Object authenticationStatus = invocationContext.proceed();
        if (AuthenticationStatus.SUCCESS.equals(authenticationStatus)) {
            httpMessageContext.getMessageInfo().getMap().put("javax.servlet.http.registerSession", "true");
        }
        return (AuthenticationStatus) authenticationStatus;
    } else {
        final CallerPrincipalCallback callerPrincipalCallback = new CallerPrincipalCallback(httpMessageContext.getClientSubject(), principal);
        httpMessageContext.getHandler().handle(new Callback[] { callerPrincipalCallback });
        return AuthenticationStatus.SUCCESS;
    }
}