Examples with RolePrefixSecurityContextImpl org.apache.cxf.interceptor.security.RolePrefixSecurityContextImpl used on opensource projects

Example 1 with RolePrefixSecurityContextImpl

use of org.apache.cxf.interceptor.security.RolePrefixSecurityContextImpl in project cxf by apache.

the class StaxSecurityContextInInterceptor method doResults.

private void doResults(SoapMessage msg, List<SecurityEvent> incomingSecurityEventList) throws WSSecurityException {
    // Now go through the results in a certain order to set up a security context. Highest priority is first.
    List<Event> desiredSecurityEvents = new ArrayList<>();
    desiredSecurityEvents.add(WSSecurityEventConstants.SAML_TOKEN);
    desiredSecurityEvents.add(WSSecurityEventConstants.USERNAME_TOKEN);
    desiredSecurityEvents.add(WSSecurityEventConstants.KERBEROS_TOKEN);
    desiredSecurityEvents.add(WSSecurityEventConstants.X509Token);
    desiredSecurityEvents.add(WSSecurityEventConstants.KeyValueToken);
    for (Event desiredEvent : desiredSecurityEvents) {
        SubjectAndPrincipalSecurityToken token = null;
        try {
            token = getSubjectPrincipalToken(incomingSecurityEventList, desiredEvent, msg);
        } catch (XMLSecurityException ex) {
        // proceed
        }
        if (token != null) {
            Principal p = token.getPrincipal();
            Subject subject = token.getSubject();
            if (subject != null) {
                String roleClassifier = (String) msg.getContextualProperty(SecurityConstants.SUBJECT_ROLE_CLASSIFIER);
                if (roleClassifier != null && !"".equals(roleClassifier)) {
                    String roleClassifierType = (String) msg.getContextualProperty(SecurityConstants.SUBJECT_ROLE_CLASSIFIER_TYPE);
                    if (roleClassifierType == null || "".equals(roleClassifierType)) {
                        roleClassifierType = "prefix";
                    }
                    msg.put(SecurityContext.class, new RolePrefixSecurityContextImpl(subject, roleClassifier, roleClassifierType));
                } else {
                    msg.put(SecurityContext.class, new DefaultSecurityContext(subject));
                }
                break;
            } else if (p != null) {
                Object receivedAssertion = null;
                if (desiredEvent == WSSecurityEventConstants.SAML_TOKEN) {
                    String roleAttributeName = (String) SecurityUtils.getSecurityPropertyValue(SecurityConstants.SAML_ROLE_ATTRIBUTENAME, msg);
                    if (roleAttributeName == null || roleAttributeName.length() == 0) {
                        roleAttributeName = SAML_ROLE_ATTRIBUTENAME_DEFAULT;
                    }
                    receivedAssertion = ((SAMLTokenPrincipal) token.getPrincipal()).getToken();
                    if (receivedAssertion != null) {
                        ClaimCollection claims = SAMLUtils.getClaims((SamlAssertionWrapper) receivedAssertion);
                        Set<Principal> roles = SAMLUtils.parseRolesFromClaims(claims, roleAttributeName, null);
                        SAMLSecurityContext context = new SAMLSecurityContext(p, roles, claims);
                        msg.put(SecurityContext.class, context);
                    }
                } else {
                    msg.put(SecurityContext.class, createSecurityContext(p));
                }
                break;
            }
        }
    }
}

Example 2 with RolePrefixSecurityContextImpl

use of org.apache.cxf.interceptor.security.RolePrefixSecurityContextImpl in project cxf by apache.

the class DefaultWSS4JSecurityContextCreator method createSecurityContext.

protected SecurityContext createSecurityContext(SoapMessage msg, boolean useJAASSubject, WSSecurityEngineResult wsResult) {
    final Principal p = (Principal) wsResult.get(WSSecurityEngineResult.TAG_PRINCIPAL);
    final Subject subject = (Subject) wsResult.get(WSSecurityEngineResult.TAG_SUBJECT);
    if (subject != null && !(p instanceof KerberosPrincipal) && useJAASSubject) {
        String roleClassifier = (String) msg.getContextualProperty(SecurityConstants.SUBJECT_ROLE_CLASSIFIER);
        if (roleClassifier != null && !"".equals(roleClassifier)) {
            String roleClassifierType = (String) msg.getContextualProperty(SecurityConstants.SUBJECT_ROLE_CLASSIFIER_TYPE);
            if (roleClassifierType == null || "".equals(roleClassifierType)) {
                roleClassifierType = "prefix";
            }
            return new RolePrefixSecurityContextImpl(subject, roleClassifier, roleClassifierType);
        }
        return new DefaultSecurityContext(p, subject);
    } else if (p != null) {
        boolean utWithCallbacks = MessageUtils.getContextualBoolean(msg, SecurityConstants.VALIDATE_TOKEN, true);
        if (!utWithCallbacks) {
            WSS4JTokenConverter.convertToken(msg, p);
        }
        Object receivedAssertion = wsResult.get(WSSecurityEngineResult.TAG_TRANSFORMED_TOKEN);
        if (receivedAssertion == null) {
            receivedAssertion = wsResult.get(WSSecurityEngineResult.TAG_SAML_ASSERTION);
        }
        if (wsResult.get(WSSecurityEngineResult.TAG_DELEGATION_CREDENTIAL) != null) {
            msg.put(SecurityConstants.DELEGATED_CREDENTIAL, wsResult.get(WSSecurityEngineResult.TAG_DELEGATION_CREDENTIAL));
        }
        if (receivedAssertion instanceof SamlAssertionWrapper) {
            String roleAttributeName = (String) SecurityUtils.getSecurityPropertyValue(SecurityConstants.SAML_ROLE_ATTRIBUTENAME, msg);
            if (roleAttributeName == null || roleAttributeName.length() == 0) {
                roleAttributeName = WSS4JInInterceptor.SAML_ROLE_ATTRIBUTENAME_DEFAULT;
            }
            ClaimCollection claims = SAMLUtils.getClaims((SamlAssertionWrapper) receivedAssertion);
            Set<Principal> roles = SAMLUtils.parseRolesFromClaims(claims, roleAttributeName, null);
            SAMLSecurityContext context = new SAMLSecurityContext(p, roles, claims);
            context.setIssuer(SAMLUtils.getIssuer(receivedAssertion));
            context.setAssertionElement(SAMLUtils.getAssertionElement(receivedAssertion));
            return context;
        }
        return createSecurityContext(p);
    }
    return null;
}