Examples with UNAUTHORIZED javax.ws.rs.core.Response.Status.UNAUTHORIZED used on opensource projects

Example 1 with UNAUTHORIZED

use of javax.ws.rs.core.Response.Status.UNAUTHORIZED in project codex by apycazo.

the class SecurityFilter method filter.

@Override
public void filter(ContainerRequestContext requestContext) {
    if (securityManagers.stream().noneMatch(manager -> manager.authenticate(requestContext))) {
        if (requestContext.getHeaderString(HttpHeaders.AUTHORIZATION) != null) {
            // the request tried to be authorized, but no manager could authenticate
            requestContext.abortWith(Response.status(FORBIDDEN).build());
        } else {
            // the request tried to be authorized, and no credentials where found
            requestContext.abortWith(Response.status(UNAUTHORIZED).build());
        }
    } else {
        // check role requirements (if any)
        SecurityContext securityContext = requestContext.getSecurityContext();
        Set<SecurityRole> roleSet = new HashSet<>();
        // adds class-level annotation roles
        Optional.ofNullable(resourceInfo.getResourceClass().getAnnotation(Authenticated.class)).ifPresent(annotation -> roleSet.addAll(Arrays.asList(annotation.rolesAllowed())));
        // adds method-level annotation roles
        Optional.ofNullable(resourceInfo.getResourceMethod().getAnnotation(Authenticated.class)).ifPresent(annotation -> roleSet.addAll(Arrays.asList(annotation.rolesAllowed())));
        if (!roleSet.isEmpty() && roleSet.stream().noneMatch(role -> securityContext.isUserInRole(role.name()))) {
            requestContext.abortWith(Response.status(FORBIDDEN).build());
        }
    }
}

Example 2 with UNAUTHORIZED

use of javax.ws.rs.core.Response.Status.UNAUTHORIZED in project pay-adminusers by alphagov.

the class UserResource method activateSecondFactorOtpKey.

@Path("/{userExternalId}/second-factor/activate")
@POST
@Produces(APPLICATION_JSON)
@Consumes(APPLICATION_JSON)
public Response activateSecondFactorOtpKey(@PathParam("userExternalId") String externalId, JsonNode payload) {
    LOGGER.info("User 2FA activate new OTP key request");
    return validator.validate2faActivateRequest(payload).map(errors -> Response.status(BAD_REQUEST).entity(errors).build()).orElseGet(() -> {
        int code = payload.get("code").asInt();
        SecondFactorMethod secondFactor = SecondFactorMethod.valueOf(payload.get("second_factor").asText());
        return userServices.activateNewOtpKey(externalId, secondFactor, code).map(user -> Response.status(OK).type(APPLICATION_JSON).entity(user).build()).orElseGet(() -> Response.status(UNAUTHORIZED).build());
    });
}

Example 3 with UNAUTHORIZED

use of javax.ws.rs.core.Response.Status.UNAUTHORIZED in project trino by trinodb.

the class OAuth2WebUiAuthenticationFilter method filter.

@Override
public void filter(ContainerRequestContext request) {
    String path = request.getUriInfo().getRequestUri().getPath();
    if (path.equals(DISABLED_LOCATION)) {
        return;
    }
    // doesn't seem very useful if you have OAuth, and would be very complex.
    if (!request.getSecurityContext().isSecure()) {
        // send 401 to REST api calls and redirect to others
        if (path.startsWith("/ui/api/")) {
            sendWwwAuthenticate(request, "Unauthorized", ImmutableSet.of(TRINO_FORM_LOGIN));
            return;
        }
        request.abortWith(Response.seeOther(DISABLED_LOCATION_URI).build());
        return;
    }
    Optional<Map<String, Object>> claims;
    try {
        claims = getAccessToken(request);
        if (claims.isEmpty()) {
            needAuthentication(request);
            return;
        }
    } catch (ChallengeFailedException e) {
        LOG.debug(e, "Invalid token: %s", e.getMessage());
        sendErrorMessage(request, UNAUTHORIZED, "Unauthorized");
        return;
    }
    try {
        Object principal = claims.get().get(principalField);
        if (!isValidPrincipal(principal)) {
            LOG.debug("Invalid principal field: %s. Expected principal to be non-empty", principalField);
            sendErrorMessage(request, UNAUTHORIZED, "Unauthorized");
            return;
        }
        String principalName = (String) principal;
        Identity.Builder builder = Identity.forUser(userMapping.mapUser(principalName));
        builder.withPrincipal(new BasicPrincipal(principalName));
        groupsField.flatMap(field -> Optional.ofNullable((List<String>) claims.get().get(field))).ifPresent(groups -> builder.withGroups(ImmutableSet.copyOf(groups)));
        setAuthenticatedIdentity(request, builder.build());
    } catch (UserMappingException e) {
        sendErrorMessage(request, UNAUTHORIZED, firstNonNull(e.getMessage(), "Unauthorized"));
    }
}