Search in sources :

Example 1 with SecurityToken

use of org.apache.cxf.common.security.SecurityToken in project jbossws-cxf by jbossws.

the class AuthenticationMgrSubjectCreatingInterceptor method handleMessage.

@Override
public void handleMessage(Message message) throws Fault {
    JBossAuthenticationManager authenticationManger = message.get(JBossAuthenticationManager.class);
    if (authenticationManger == null) {
        return;
    }
    SecurityContext context = message.get(SecurityContext.class);
    if (context == null || context.getUserPrincipal() == null) {
        Loggers.SECURITY_LOGGER.userPrincipalNotAvailableOnCurrentMessage();
        return;
    }
    SecurityToken token = message.get(SecurityToken.class);
    Subject subject = null;
    if (token != null) {
        // Try authenticating using SecurityToken info
        if (token.getTokenType() != TokenType.UsernameToken) {
            throw Messages.MESSAGES.unsupportedTokenType(token.getTokenType());
        }
        UsernameToken ut = (UsernameToken) token;
        subject = helper.createSubject(authenticationManger, ut.getName(), ut.getPassword(), ut.isHashed(), ut.getNonce(), ut.getCreatedTime());
    } else {
        // Try authenticating using WSS4J internal info (previously set into SecurityContext by WSS4JInInterceptor)
        Principal p = context.getUserPrincipal();
        if (!(p instanceof UsernameTokenPrincipal)) {
            throw Messages.MESSAGES.couldNotGetSubjectInfo();
        }
        UsernameTokenPrincipal up = (UsernameTokenPrincipal) p;
        subject = helper.createSubject(authenticationManger, up.getName(), up.getPassword(), up.isPasswordDigest(), up.getNonce(), up.getCreatedTime());
    }
    Principal principal = getPrincipal(context.getUserPrincipal(), subject);
    message.put(SecurityContext.class, createSecurityContext(principal, subject));
}
Also used : SecurityToken(org.apache.cxf.common.security.SecurityToken) UsernameTokenPrincipal(org.apache.wss4j.common.principal.UsernameTokenPrincipal) SecurityContext(org.apache.cxf.security.SecurityContext) UsernameToken(org.apache.cxf.common.security.UsernameToken) JBossAuthenticationManager(org.jboss.security.plugins.JBossAuthenticationManager) Subject(javax.security.auth.Subject) Principal(java.security.Principal) UsernameTokenPrincipal(org.apache.wss4j.common.principal.UsernameTokenPrincipal)

Example 2 with SecurityToken

use of org.apache.cxf.common.security.SecurityToken in project cxf by apache.

the class AbstractSecurityContextInInterceptor method handleMessage.

public void handleMessage(Message message) {
    SecurityToken token = message.get(SecurityToken.class);
    if (token == null) {
        reportSecurityException("Security Token is not available on the current message");
    }
    SecurityContext context = message.get(SecurityContext.class);
    if (context == null || context.getUserPrincipal() == null) {
        reportSecurityException("User Principal is not available on the current message");
    }
    Subject subject = null;
    try {
        subject = createSubject(token);
    } catch (Exception ex) {
        reportSecurityException("Failed Authentication : Subject has not been created, " + ex.getMessage());
    }
    if (subject == null || subject.getPrincipals().isEmpty()) {
        reportSecurityException("Failed Authentication : Invalid Subject");
    }
    Principal principal = getPrincipal(context.getUserPrincipal(), subject);
    SecurityContext sc = createSecurityContext(principal, subject);
    message.put(SecurityContext.class, sc);
}
Also used : SecurityToken(org.apache.cxf.common.security.SecurityToken) SecurityContext(org.apache.cxf.security.SecurityContext) Subject(javax.security.auth.Subject) Principal(java.security.Principal)

Example 3 with SecurityToken

use of org.apache.cxf.common.security.SecurityToken in project jbossws-cxf by jbossws.

the class SubjectCreatingInterceptor method handleMessage.

@Override
public void handleMessage(SoapMessage msg) throws Fault {
    Endpoint ep = msg.getExchange().get(Endpoint.class);
    sdc.set(ep.getSecurityDomainContext());
    try {
        SecurityToken token = msg.get(SecurityToken.class);
        SecurityContext context = msg.get(SecurityContext.class);
        if (token == null || context == null || context.getUserPrincipal() == null) {
            super.handleMessage(msg);
            return;
        }
        UsernameToken ut = (UsernameToken) token;
        Subject subject = createSubject(ut.getName(), ut.getPassword(), ut.isHashed(), ut.getNonce(), ut.getCreatedTime());
        SecurityContext sc = doCreateSecurityContext(context.getUserPrincipal(), subject);
        msg.put(SecurityContext.class, sc);
    } finally {
        if (sdc != null) {
            sdc.remove();
        }
    }
}
Also used : SecurityToken(org.apache.cxf.common.security.SecurityToken) Endpoint(org.jboss.wsf.spi.deployment.Endpoint) DefaultSecurityContext(org.apache.cxf.interceptor.security.DefaultSecurityContext) SecurityContext(org.apache.cxf.security.SecurityContext) UsernameToken(org.apache.cxf.common.security.UsernameToken) Subject(javax.security.auth.Subject)

Example 4 with SecurityToken

use of org.apache.cxf.common.security.SecurityToken in project jbossws-cxf by jbossws.

the class SubjectCreatingPolicyInterceptor method handleMessage.

@Override
public void handleMessage(Message message) throws Fault {
    Endpoint ep = message.getExchange().get(Endpoint.class);
    SecurityDomainContext sdc = ep.getSecurityDomainContext();
    SecurityContext context = message.get(SecurityContext.class);
    if (context == null || context.getUserPrincipal() == null) {
        Loggers.SECURITY_LOGGER.userPrincipalNotAvailableOnCurrentMessage();
        return;
    }
    SecurityToken token = message.get(SecurityToken.class);
    Subject subject = null;
    if (token != null) {
        // Try authenticating using SecurityToken info
        if (token.getTokenType() != TokenType.UsernameToken) {
            throw Messages.MESSAGES.unsupportedTokenType(token.getTokenType());
        }
        UsernameToken ut = (UsernameToken) token;
        subject = createSubject(sdc, ut.getName(), ut.getPassword(), ut.isHashed(), ut.getNonce(), ut.getCreatedTime());
    } else {
        // Try authenticating using WSS4J internal info (previously set into SecurityContext by WSS4JInInterceptor)
        Principal p = context.getUserPrincipal();
        if (!(p instanceof UsernameTokenPrincipal)) {
            throw Messages.MESSAGES.couldNotGetSubjectInfo();
        }
        UsernameTokenPrincipal up = (UsernameTokenPrincipal) p;
        subject = createSubject(sdc, up.getName(), up.getPassword(), up.isPasswordDigest(), up.getNonce(), up.getCreatedTime());
    }
    Principal principal = getPrincipal(context.getUserPrincipal(), subject);
    message.put(SecurityContext.class, createSecurityContext(principal, subject));
}
Also used : SecurityToken(org.apache.cxf.common.security.SecurityToken) Endpoint(org.jboss.wsf.spi.deployment.Endpoint) UsernameTokenPrincipal(org.apache.wss4j.common.principal.UsernameTokenPrincipal) SecurityContext(org.apache.cxf.security.SecurityContext) DefaultSecurityContext(org.apache.cxf.interceptor.security.DefaultSecurityContext) UsernameToken(org.apache.cxf.common.security.UsernameToken) SecurityDomainContext(org.jboss.wsf.spi.security.SecurityDomainContext) Subject(javax.security.auth.Subject) Principal(java.security.Principal) UsernameTokenPrincipal(org.apache.wss4j.common.principal.UsernameTokenPrincipal)

Example 5 with SecurityToken

use of org.apache.cxf.common.security.SecurityToken in project cxf by apache.

the class CallbackHandlerProviderUsernameToken method create.

@Override
public CallbackHandler create(Message message) {
    SecurityToken token = message.get(SecurityToken.class);
    if (!(token instanceof UsernameToken)) {
        return null;
    }
    UsernameToken ut = (UsernameToken) token;
    if (ut.getPasswordType().endsWith("PasswordDigest")) {
        return new NameDigestPasswordCallbackHandler(ut.getName(), ut.getPassword(), ut.getNonce(), ut.getCreatedTime());
    }
    return new NamePasswordCallbackHandler(ut.getName(), ut.getPassword());
}
Also used : SecurityToken(org.apache.cxf.common.security.SecurityToken) NameDigestPasswordCallbackHandler(org.apache.cxf.interceptor.security.NameDigestPasswordCallbackHandler) NamePasswordCallbackHandler(org.apache.cxf.interceptor.security.NamePasswordCallbackHandler) UsernameToken(org.apache.cxf.common.security.UsernameToken)

Aggregations

SecurityToken (org.apache.cxf.common.security.SecurityToken)6 Subject (javax.security.auth.Subject)5 UsernameToken (org.apache.cxf.common.security.UsernameToken)5 SecurityContext (org.apache.cxf.security.SecurityContext)5 Principal (java.security.Principal)3 DefaultSecurityContext (org.apache.cxf.interceptor.security.DefaultSecurityContext)3 UsernameTokenPrincipal (org.apache.wss4j.common.principal.UsernameTokenPrincipal)2 Endpoint (org.jboss.wsf.spi.deployment.Endpoint)2 NameDigestPasswordCallbackHandler (org.apache.cxf.interceptor.security.NameDigestPasswordCallbackHandler)1 NamePasswordCallbackHandler (org.apache.cxf.interceptor.security.NamePasswordCallbackHandler)1 JBossAuthenticationManager (org.jboss.security.plugins.JBossAuthenticationManager)1 SecurityDomainContext (org.jboss.wsf.spi.security.SecurityDomainContext)1