Examples with AuthorizationPolicy org.apache.cxf.configuration.security.AuthorizationPolicy used on opensource projects

Example 6 with AuthorizationPolicy

use of org.apache.cxf.configuration.security.AuthorizationPolicy in project carbon-apimgt by wso2.

the class XACMLAuthenticationInterceptor method handleRequest.

/**
 * isUserPermitted requests received at the ml endpoint, using HTTP basic-auth headers as the authentication
 * mechanism. This method returns a null value which indicates that the request to be processed.
 */
public boolean handleRequest(Message message, ClassResourceInfo resourceInfo) {
    if (logger.isDebugEnabled()) {
        logger.debug(String.format("Authenticating request: " + message.getId()));
    }
    AuthorizationPolicy policy = message.get(AuthorizationPolicy.class);
    if (policy == null) {
        logger.error("Authentication failed: Basic authentication header is missing");
        return false;
    }
    Object certObject = null;
    String username = StringUtils.trim(policy.getUserName());
    if (StringUtils.isEmpty(username)) {
        logger.error("Username cannot be null/empty.");
        return false;
    }
    return isUserPermitted(username, (String) message.get(Message.REQUEST_URI), (String) message.get(Message.HTTP_REQUEST_METHOD), null);
}

Example 7 with AuthorizationPolicy

use of org.apache.cxf.configuration.security.AuthorizationPolicy in project cxf by apache.

the class WrappedMessageContext method put.

public final Object put(String key, Object value, Scope scope) {
    String mappedKey = mapKey(key);
    if (!MessageContext.MESSAGE_OUTBOUND_PROPERTY.equals(mappedKey)) {
        scopes.put(mappedKey, scope);
    }
    Object ret = null;
    if ((MessageContext.HTTP_RESPONSE_HEADERS.equals(key) || MessageContext.HTTP_RESPONSE_CODE.equals(key)) && !isResponse() && !isRequestor()) {
        Message tmp = createResponseMessage();
        if (tmp != null) {
            if (MessageContext.HTTP_RESPONSE_HEADERS.equals(key)) {
                return tmp.put(Message.PROTOCOL_HEADERS, value);
            }
            return tmp.put(mappedKey, value);
        }
    } else if (BindingProvider.USERNAME_PROPERTY.equals(key)) {
        AuthorizationPolicy authPolicy = (AuthorizationPolicy) message.get(AuthorizationPolicy.class.getName());
        if (authPolicy == null) {
            authPolicy = new AuthorizationPolicy();
            message.put(AuthorizationPolicy.class.getName(), authPolicy);
        }
        ret = authPolicy.getUserName();
        authPolicy.setUserName((String) value);
    } else if (BindingProvider.PASSWORD_PROPERTY.equals(key)) {
        AuthorizationPolicy authPolicy = (AuthorizationPolicy) message.get(AuthorizationPolicy.class.getName());
        if (authPolicy == null) {
            authPolicy = new AuthorizationPolicy();
            message.put(AuthorizationPolicy.class.getName(), authPolicy);
        }
        ret = authPolicy.getPassword();
        authPolicy.setPassword((String) value);
    } else if (MessageContext.HTTP_REQUEST_HEADERS.equals(key)) {
        ret = message.put(Message.PROTOCOL_HEADERS, value);
    } else if (MessageContext.OUTBOUND_MESSAGE_ATTACHMENTS.equals(key)) {
        Map<String, DataHandler> attachments = CastUtils.cast((Map<?, ?>) value);
        ret = message.put(Message.ATTACHMENTS, new WrappedAttachments(attachments));
    } else if (SoapBindingConstants.SOAP_ACTION.equals(mappedKey) && !isRequestor() && exchange != null) {
        Message tmp = createResponseMessage();
        if (tmp != null) {
            tmp.put(mappedKey, value);
        }
    } else {
        ret = message.put(mappedKey, value);
    }
    return ret;
}

Example 8 with AuthorizationPolicy

use of org.apache.cxf.configuration.security.AuthorizationPolicy in project cxf by apache.

the class JAASLoginInterceptorTest method addAuthPolicy.

private void addAuthPolicy(Message message, String username, String password) {
    AuthorizationPolicy authPol = new AuthorizationPolicy();
    authPol.setUserName(username);
    authPol.setPassword(password);
    message.put(AuthorizationPolicy.class, authPol);
}

Example 9 with AuthorizationPolicy

use of org.apache.cxf.configuration.security.AuthorizationPolicy in project cxf by apache.

the class JAXRSSamlTest method testSAMLTokenHeaderUsingAuthorizationPolicy.

@Test
public void testSAMLTokenHeaderUsingAuthorizationPolicy() throws Exception {
    String address = "https://localhost:" + PORT + "/samlheader/bookstore/books/123";
    JAXRSClientFactoryBean bean = new JAXRSClientFactoryBean();
    bean.setAddress(address);
    SpringBusFactory bf = new SpringBusFactory();
    URL busFile = JAXRSSamlTest.class.getResource("client.xml");
    Bus springBus = bf.createBus(busFile.toString());
    bean.setBus(springBus);
    // Create SAML Token
    SAMLCallback samlCallback = new SAMLCallback();
    SAMLUtil.doSAMLCallback(new SamlCallbackHandler(), samlCallback);
    SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlCallback);
    Document doc = DOMUtils.createDocument();
    Element token = assertion.toDOM(doc);
    WebClient wc = bean.createWebClient();
    HTTPConduit http = (HTTPConduit) WebClient.getConfig(wc).getConduit();
    AuthorizationPolicy authorizationPolicy = new AuthorizationPolicy();
    String encodedToken = encodeToken(DOM2Writer.nodeToString(token));
    authorizationPolicy.setAuthorization(encodedToken);
    authorizationPolicy.setAuthorizationType("SAML");
    http.setAuthorization(authorizationPolicy);
    try {
        Book book = wc.get(Book.class);
        assertEquals(123L, book.getId());
    } catch (WebApplicationException ex) {
        fail(ex.getMessage());
    } catch (ProcessingException ex) {
        if (ex.getCause() != null && ex.getCause().getMessage() != null) {
            fail(ex.getCause().getMessage());
        } else {
            fail(ex.getMessage());
        }
    }
}

Example 10 with AuthorizationPolicy

use of org.apache.cxf.configuration.security.AuthorizationPolicy in project cxf by apache.

the class AuthPolicyValidatingInterceptor method handleMessage.

public void handleMessage(Message message) throws Fault {
    AuthorizationPolicy policy = message.get(AuthorizationPolicy.class);
    if (policy == null || policy.getUserName() == null || policy.getPassword() == null) {
        String name = null;
        if (policy != null) {
            name = policy.getUserName();
        }
        org.apache.cxf.common.i18n.Message errorMsg = new org.apache.cxf.common.i18n.Message("NO_USER_PASSWORD", BUNDLE, name);
        LOG.warning(errorMsg.toString());
        throw new SecurityException(errorMsg.toString());
    }
    try {
        super.validate(message);
    } catch (Exception ex) {
        throw new Fault(ex);
    }
}