Examples with SecuritySession org.apache.archiva.redback.system.SecuritySession used on opensource projects

Example 11 with SecuritySession

use of org.apache.archiva.redback.system.SecuritySession in project archiva by apache.

the class SecuritySystemStub method authenticate.

@Override
public SecuritySession authenticate(AuthenticationDataSource source) throws AuthenticationException, UserNotFoundException, AccountLockedException {
    AuthenticationResult result = null;
    SecuritySession session = null;
    if (users.get(source.getUsername()) != null) {
        result = new AuthenticationResult(true, source.getUsername(), null);
        User user = new JpaUser();
        user.setUsername(source.getUsername());
        user.setPassword(users.get(source.getUsername()));
        session = new DefaultSecuritySession(result, user);
    } else {
        result = new AuthenticationResult(false, source.getUsername(), null);
        session = new DefaultSecuritySession(result);
    }
    return session;
}

Example 12 with SecuritySession

use of org.apache.archiva.redback.system.SecuritySession in project archiva by apache.

the class ArchivaDavResourceFactory method isAuthorized.

protected boolean isAuthorized(DavServletRequest request, String repositoryId) throws DavException {
    try {
        AuthenticationResult result = httpAuth.getAuthenticationResult(request, null);
        SecuritySession securitySession = httpAuth.getSecuritySession(request.getSession(true));
        return // 
        servletAuth.isAuthenticated(request, result) && // 
        servletAuth.isAuthorized(// 
        request, // 
        securitySession, // 
        repositoryId, WebdavMethodUtil.getMethodPermission(request.getMethod()));
    } catch (AuthenticationException e) {
        // safety check for MRM-911
        String guest = UserManager.GUEST_USERNAME;
        try {
            if (servletAuth.isAuthorized(guest, ((ArchivaDavResourceLocator) request.getRequestLocator()).getRepositoryId(), WebdavMethodUtil.getMethodPermission(request.getMethod()))) {
                return true;
            }
        } catch (UnauthorizedException ae) {
            throw new UnauthorizedDavException(repositoryId, "You are not authenticated and authorized to access any repository.");
        }
        throw new UnauthorizedDavException(repositoryId, "You are not authenticated");
    } catch (MustChangePasswordException e) {
        throw new UnauthorizedDavException(repositoryId, "You must change your password.");
    } catch (AccountLockedException e) {
        throw new UnauthorizedDavException(repositoryId, "User account is locked.");
    } catch (AuthorizationException e) {
        throw new DavException(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "Fatal Authorization Subsystem Error.");
    } catch (UnauthorizedException e) {
        throw new UnauthorizedDavException(repositoryId, e.getMessage());
    }
}

Example 13 with SecuritySession

use of org.apache.archiva.redback.system.SecuritySession in project archiva by apache.

the class RssFeedServlet method isAllowed.

/**
 * Basic authentication.
 *
 * @param req
 * @param repositoryId TODO
 * @param groupId      TODO
 * @param artifactId   TODO
 * @return
 */
private boolean isAllowed(HttpServletRequest req, String repositoryId, String groupId, String artifactId) throws UserNotFoundException, AccountLockedException, AuthenticationException, MustChangePasswordException, UnauthorizedException {
    String auth = req.getHeader("Authorization");
    List<String> repoIds = new ArrayList<>();
    if (repositoryId != null) {
        repoIds.add(repositoryId);
    } else if (artifactId != null && groupId != null) {
        if (auth != null) {
            if (!auth.toUpperCase().startsWith("BASIC ")) {
                return false;
            }
            Decoder dec = new Base64();
            String usernamePassword = "";
            try {
                usernamePassword = new String((byte[]) dec.decode(auth.substring(6).getBytes()));
            } catch (DecoderException ie) {
                log.warn("Error decoding username and password: {}", ie.getMessage());
            }
            if (usernamePassword == null || usernamePassword.trim().equals("")) {
                repoIds = getObservableRepos(UserManager.GUEST_USERNAME);
            } else {
                String[] userCredentials = usernamePassword.split(":");
                repoIds = getObservableRepos(userCredentials[0]);
            }
        } else {
            repoIds = getObservableRepos(UserManager.GUEST_USERNAME);
        }
    } else {
        return false;
    }
    for (String repoId : repoIds) {
        try {
            AuthenticationResult result = httpAuth.getAuthenticationResult(req, null);
            SecuritySession securitySession = httpAuth.getSecuritySession(req.getSession(true));
            if (// 
            servletAuth.isAuthenticated(req, result) && // 
            servletAuth.isAuthorized(// 
            req, // 
            securitySession, // 
            repoId, ArchivaRoleConstants.OPERATION_REPOSITORY_ACCESS)) {
                return true;
            }
        } catch (AuthorizationException e) {
            log.debug("AuthorizationException for repoId: {}", repoId);
        } catch (UnauthorizedException e) {
            log.debug("UnauthorizedException for repoId: {}", repoId);
        }
    }
    throw new UnauthorizedException("Access denied.");
}

Example 14 with SecuritySession

use of org.apache.archiva.redback.system.SecuritySession in project archiva by apache.

the class DefaultUserRepositories method getAccessibleRepositories.

private List<ManagedRepository> getAccessibleRepositories(String principal, String operation) throws ArchivaSecurityException, AccessDeniedException, PrincipalNotFoundException {
    SecuritySession securitySession = createSession(principal);
    List<ManagedRepository> managedRepositories = new ArrayList<>();
    try {
        List<ManagedRepository> repos = managedRepositoryAdmin.getManagedRepositories();
        for (ManagedRepository repo : repos) {
            try {
                String repoId = repo.getId();
                if (securitySystem.isAuthorized(securitySession, operation, repoId)) {
                    managedRepositories.add(repo);
                }
            } catch (AuthorizationException e) {
                // swallow.
                log.debug("Not authorizing '{}' for repository '{}': {}", principal, repo.getId(), e.getMessage());
            }
        }
        return managedRepositories;
    } catch (RepositoryAdminException e) {
        throw new ArchivaSecurityException(e.getMessage(), e);
    }
}

Example 15 with SecuritySession

use of org.apache.archiva.redback.system.SecuritySession in project archiva by apache.

the class ArchivaServletAuthenticatorTest method testIsAuthorizedUserHasWriteAccess.

@Test
public void testIsAuthorizedUserHasWriteAccess() throws Exception {
    createUser(USER_ALPACA, "Al 'Archiva' Paca");
    assignRepositoryManagerRole(USER_ALPACA, "corporate");
    UserManager userManager = securitySystem.getUserManager();
    User user = userManager.findUser(USER_ALPACA);
    AuthenticationResult result = new AuthenticationResult(true, USER_ALPACA, null);
    SecuritySession session = new DefaultSecuritySession(result, user);
    boolean isAuthorized = servletAuth.isAuthorized(request, session, "corporate", ArchivaRoleConstants.OPERATION_REPOSITORY_UPLOAD);
    assertTrue(isAuthorized);
    restoreGuestInitialValues(USER_ALPACA);
}