use of org.apache.cxf.common.security.SecurityToken in project jbossws-cxf by jbossws.
the class AuthenticationMgrSubjectCreatingInterceptor method handleMessage.
@Override
public void handleMessage(Message message) throws Fault {
JBossAuthenticationManager authenticationManger = message.get(JBossAuthenticationManager.class);
if (authenticationManger == null) {
return;
}
SecurityContext context = message.get(SecurityContext.class);
if (context == null || context.getUserPrincipal() == null) {
Loggers.SECURITY_LOGGER.userPrincipalNotAvailableOnCurrentMessage();
return;
}
SecurityToken token = message.get(SecurityToken.class);
Subject subject = null;
if (token != null) {
// Try authenticating using SecurityToken info
if (token.getTokenType() != TokenType.UsernameToken) {
throw Messages.MESSAGES.unsupportedTokenType(token.getTokenType());
}
UsernameToken ut = (UsernameToken) token;
subject = helper.createSubject(authenticationManger, ut.getName(), ut.getPassword(), ut.isHashed(), ut.getNonce(), ut.getCreatedTime());
} else {
// Try authenticating using WSS4J internal info (previously set into SecurityContext by WSS4JInInterceptor)
Principal p = context.getUserPrincipal();
if (!(p instanceof UsernameTokenPrincipal)) {
throw Messages.MESSAGES.couldNotGetSubjectInfo();
}
UsernameTokenPrincipal up = (UsernameTokenPrincipal) p;
subject = helper.createSubject(authenticationManger, up.getName(), up.getPassword(), up.isPasswordDigest(), up.getNonce(), up.getCreatedTime());
}
Principal principal = getPrincipal(context.getUserPrincipal(), subject);
message.put(SecurityContext.class, createSecurityContext(principal, subject));
}
use of org.apache.cxf.common.security.SecurityToken in project cxf by apache.
the class AbstractSecurityContextInInterceptor method handleMessage.
public void handleMessage(Message message) {
SecurityToken token = message.get(SecurityToken.class);
if (token == null) {
reportSecurityException("Security Token is not available on the current message");
}
SecurityContext context = message.get(SecurityContext.class);
if (context == null || context.getUserPrincipal() == null) {
reportSecurityException("User Principal is not available on the current message");
}
Subject subject = null;
try {
subject = createSubject(token);
} catch (Exception ex) {
reportSecurityException("Failed Authentication : Subject has not been created, " + ex.getMessage());
}
if (subject == null || subject.getPrincipals().isEmpty()) {
reportSecurityException("Failed Authentication : Invalid Subject");
}
Principal principal = getPrincipal(context.getUserPrincipal(), subject);
SecurityContext sc = createSecurityContext(principal, subject);
message.put(SecurityContext.class, sc);
}
use of org.apache.cxf.common.security.SecurityToken in project jbossws-cxf by jbossws.
the class SubjectCreatingInterceptor method handleMessage.
@Override
public void handleMessage(SoapMessage msg) throws Fault {
Endpoint ep = msg.getExchange().get(Endpoint.class);
sdc.set(ep.getSecurityDomainContext());
try {
SecurityToken token = msg.get(SecurityToken.class);
SecurityContext context = msg.get(SecurityContext.class);
if (token == null || context == null || context.getUserPrincipal() == null) {
super.handleMessage(msg);
return;
}
UsernameToken ut = (UsernameToken) token;
Subject subject = createSubject(ut.getName(), ut.getPassword(), ut.isHashed(), ut.getNonce(), ut.getCreatedTime());
SecurityContext sc = doCreateSecurityContext(context.getUserPrincipal(), subject);
msg.put(SecurityContext.class, sc);
} finally {
if (sdc != null) {
sdc.remove();
}
}
}
use of org.apache.cxf.common.security.SecurityToken in project jbossws-cxf by jbossws.
the class SubjectCreatingPolicyInterceptor method handleMessage.
@Override
public void handleMessage(Message message) throws Fault {
Endpoint ep = message.getExchange().get(Endpoint.class);
SecurityDomainContext sdc = ep.getSecurityDomainContext();
SecurityContext context = message.get(SecurityContext.class);
if (context == null || context.getUserPrincipal() == null) {
Loggers.SECURITY_LOGGER.userPrincipalNotAvailableOnCurrentMessage();
return;
}
SecurityToken token = message.get(SecurityToken.class);
Subject subject = null;
if (token != null) {
// Try authenticating using SecurityToken info
if (token.getTokenType() != TokenType.UsernameToken) {
throw Messages.MESSAGES.unsupportedTokenType(token.getTokenType());
}
UsernameToken ut = (UsernameToken) token;
subject = createSubject(sdc, ut.getName(), ut.getPassword(), ut.isHashed(), ut.getNonce(), ut.getCreatedTime());
} else {
// Try authenticating using WSS4J internal info (previously set into SecurityContext by WSS4JInInterceptor)
Principal p = context.getUserPrincipal();
if (!(p instanceof UsernameTokenPrincipal)) {
throw Messages.MESSAGES.couldNotGetSubjectInfo();
}
UsernameTokenPrincipal up = (UsernameTokenPrincipal) p;
subject = createSubject(sdc, up.getName(), up.getPassword(), up.isPasswordDigest(), up.getNonce(), up.getCreatedTime());
}
Principal principal = getPrincipal(context.getUserPrincipal(), subject);
message.put(SecurityContext.class, createSecurityContext(principal, subject));
}
use of org.apache.cxf.common.security.SecurityToken in project cxf by apache.
the class CallbackHandlerProviderUsernameToken method create.
@Override
public CallbackHandler create(Message message) {
SecurityToken token = message.get(SecurityToken.class);
if (!(token instanceof UsernameToken)) {
return null;
}
UsernameToken ut = (UsernameToken) token;
if (ut.getPasswordType().endsWith("PasswordDigest")) {
return new NameDigestPasswordCallbackHandler(ut.getName(), ut.getPassword(), ut.getNonce(), ut.getCreatedTime());
}
return new NamePasswordCallbackHandler(ut.getName(), ut.getPassword());
}
Aggregations