Examples with AccessDeniedException org.apache.cxf.interceptor.security.AccessDeniedException used on opensource projects

Example 6 with AccessDeniedException

use of org.apache.cxf.interceptor.security.AccessDeniedException in project cxf by apache.

the class SecurityOutFaultInterceptor method handleMessage.

public void handleMessage(Message message) throws Fault {
    Fault fault = (Fault) message.getContent(Exception.class);
    Throwable ex = fault.getCause();
    if (!(ex instanceof SecurityException)) {
        throw new RuntimeException("Security Exception is expected");
    }
    HttpServletResponse response = (HttpServletResponse) message.getExchange().getInMessage().get(AbstractHTTPDestination.HTTP_RESPONSE);
    int status = ex instanceof AccessDeniedException ? 403 : 401;
    response.setStatus(status);
    try {
        response.getOutputStream().write(ex.getMessage().getBytes());
        response.getOutputStream().flush();
    } catch (IOException iex) {
    // ignore
    }
    message.getInterceptorChain().abort();
}

Example 7 with AccessDeniedException

use of org.apache.cxf.interceptor.security.AccessDeniedException in project ddf by codice.

the class CrlInterceptor method handleMessage.

@Override
public void handleMessage(Message message) throws Fault {
    HttpServletRequest request = (HttpServletRequest) message.get(AbstractHTTPDestination.HTTP_REQUEST);
    X509Certificate[] certs = (X509Certificate[]) request.getAttribute("javax.servlet.request.X509Certificate");
    if (!crlChecker.passesCrlCheck(certs)) {
        throw new AccessDeniedException("Cannot complete request, certificate was revoked by CRL.");
    }
}

Example 8 with AccessDeniedException

use of org.apache.cxf.interceptor.security.AccessDeniedException in project cxf by apache.

the class ClaimsAuthorizingInterceptorTest method testUserInRoleAndClaims.

@Test
public void testUserInRoleAndClaims() throws Exception {
    SecureAnnotationsInterceptor in = new SecureAnnotationsInterceptor();
    in.setAnnotationClassName(SecureRole.class.getName());
    in.setSecuredObject(new TestService2());
    Message m = prepareMessage(TestService2.class, "test", createDefaultClaim("admin"), createClaim("a", "b", "c"));
    in.handleMessage(m);
    ClaimsAuthorizingInterceptor in2 = new ClaimsAuthorizingInterceptor();
    org.apache.cxf.rt.security.saml.claims.SAMLClaim claim = new org.apache.cxf.rt.security.saml.claims.SAMLClaim();
    claim.setNameFormat("a");
    claim.setName("b");
    claim.addValue("c");
    in2.setClaims(Collections.singletonMap("test", Collections.singletonList(new ClaimBean(claim))));
    in2.handleMessage(m);
    try {
        in.handleMessage(prepareMessage(TestService2.class, "test", createDefaultClaim("user")));
        fail("AccessDeniedException expected");
    } catch (AccessDeniedException ex) {
    // expected
    }
}

Example 9 with AccessDeniedException

use of org.apache.cxf.interceptor.security.AccessDeniedException in project cxf by apache.

the class ClaimsAuthorizingInterceptor method handleMessage.

public void handleMessage(Message message) throws Fault {
    SecurityContext sc = message.get(SecurityContext.class);
    if (!(sc instanceof ClaimsSecurityContext)) {
        throw new AccessDeniedException("Security Context is unavailable or unrecognized");
    }
    Method method = MessageUtils.getTargetMethod(message).orElseThrow(() -> new AccessDeniedException("Method is not available : Unauthorized"));
    if (authorize((ClaimsSecurityContext) sc, method)) {
        return;
    }
    throw new AccessDeniedException("Unauthorized");
}

Example 10 with AccessDeniedException

use of org.apache.cxf.interceptor.security.AccessDeniedException in project cxf by apache.

the class ClaimsAuthorizingInterceptorTest method testNonSAMLClaimDefaultNameAndFormat.

@Test
public void testNonSAMLClaimDefaultNameAndFormat() throws Exception {
    org.apache.cxf.rt.security.claims.Claim claim1 = new org.apache.cxf.rt.security.claims.Claim();
    claim1.setClaimType("role");
    claim1.setValues(Arrays.asList("admin", "user"));
    org.apache.cxf.rt.security.claims.Claim claim2 = new org.apache.cxf.rt.security.claims.Claim();
    claim2.setClaimType("http://authentication");
    claim2.setValues(Arrays.asList("password"));
    Message m = prepareMessage(TestService.class, "claimWithSpecificName", "role", claim1, claim2);
    interceptor.handleMessage(m);
    try {
        claim1.setValues(Arrays.asList("user"));
        m = prepareMessage(TestService.class, "claimWithSpecificName", "role", claim1, claim2);
        interceptor.handleMessage(m);
        fail("AccessDeniedException expected");
    } catch (AccessDeniedException ex) {
    // expected
    }
}