Examples with ClaimCollection org.apache.cxf.rt.security.claims.ClaimCollection used on opensource projects

Example 86 with ClaimCollection

use of org.apache.cxf.rt.security.claims.ClaimCollection in project cxf by apache.

the class CustomWSS4JSecurityContextCreator method createSecurityContext.

/**
 * Create a SecurityContext and store it on the SoapMessage parameter
 */
public void createSecurityContext(SoapMessage msg, WSHandlerResult handlerResult) {
    Map<Integer, List<WSSecurityEngineResult>> actionResults = handlerResult.getActionResults();
    Principal asymmetricPrincipal = null;
    // Get Asymmetric Signature action
    List<WSSecurityEngineResult> foundResults = actionResults.get(WSConstants.SIGN);
    if (foundResults != null && !foundResults.isEmpty()) {
        for (WSSecurityEngineResult result : foundResults) {
            PublicKey publickey = (PublicKey) result.get(WSSecurityEngineResult.TAG_PUBLIC_KEY);
            X509Certificate cert = (X509Certificate) result.get(WSSecurityEngineResult.TAG_X509_CERTIFICATE);
            if (publickey == null && cert == null) {
                continue;
            }
            SecurityContext context = createSecurityContext(msg, true, result);
            if (context != null && context.getUserPrincipal() != null) {
                asymmetricPrincipal = context.getUserPrincipal();
                break;
            }
        }
    }
    // We must have an asymmetric principal
    if (asymmetricPrincipal == null) {
        return;
    }
    // Get signed SAML action
    SAMLSecurityContext context = null;
    foundResults = actionResults.get(WSConstants.ST_SIGNED);
    if (foundResults != null && !foundResults.isEmpty()) {
        for (WSSecurityEngineResult result : foundResults) {
            Object receivedAssertion = result.get(WSSecurityEngineResult.TAG_TRANSFORMED_TOKEN);
            if (receivedAssertion == null) {
                receivedAssertion = result.get(WSSecurityEngineResult.TAG_SAML_ASSERTION);
            }
            if (receivedAssertion instanceof SamlAssertionWrapper) {
                String roleAttributeName = (String) SecurityUtils.getSecurityPropertyValue(SecurityConstants.SAML_ROLE_ATTRIBUTENAME, msg);
                if (roleAttributeName == null || roleAttributeName.length() == 0) {
                    roleAttributeName = WSS4JInInterceptor.SAML_ROLE_ATTRIBUTENAME_DEFAULT;
                }
                ClaimCollection claims = SAMLUtils.getClaims((SamlAssertionWrapper) receivedAssertion);
                Set<Principal> roles = SAMLUtils.parseRolesFromClaims(claims, roleAttributeName, null);
                context = new SAMLSecurityContext(asymmetricPrincipal, roles, claims);
                context.setIssuer(SAMLUtils.getIssuer(receivedAssertion));
                context.setAssertionElement(SAMLUtils.getAssertionElement(receivedAssertion));
                break;
            }
        }
    }
    if (context != null) {
        msg.put(SecurityContext.class, context);
    }
}

Example 87 with ClaimCollection

use of org.apache.cxf.rt.security.claims.ClaimCollection in project cxf by apache.

the class LDAPClaimsTest method testRetrieveRolesForAlice.

@org.junit.Test
public void testRetrieveRolesForAlice() throws Exception {
    LdapGroupClaimsHandler claimsHandler = (LdapGroupClaimsHandler) appContext.getBean("testGroupClaimsHandler");
    ClaimsManager claimsManager = new ClaimsManager();
    claimsManager.setClaimHandlers(Collections.singletonList(claimsHandler));
    String user = props.getProperty("claimUser");
    Assert.assertNotNull(user, "Property 'claimUser' not configured");
    ClaimCollection requestedClaims = new ClaimCollection();
    Claim claim = new Claim();
    String roleURI = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role";
    claim.setClaimType(roleURI);
    requestedClaims.add(claim);
    ClaimsParameters params = new ClaimsParameters();
    params.setPrincipal(new CustomTokenPrincipal(user));
    ProcessedClaimCollection retrievedClaims = claimsManager.retrieveClaimValues(requestedClaims, params);
    Assert.assertTrue(retrievedClaims.size() == 1);
    Assert.assertEquals(retrievedClaims.get(0).getClaimType(), roleURI);
    Assert.assertTrue(retrievedClaims.get(0).getValues().size() == 2);
}

Example 88 with ClaimCollection

use of org.apache.cxf.rt.security.claims.ClaimCollection in project cxf by apache.

the class LDAPClaimsTest method testRetrieveRolesForBobInBusinessCategoryWidgets.

@org.junit.Test
public void testRetrieveRolesForBobInBusinessCategoryWidgets() throws Exception {
    LdapGroupClaimsHandler claimsHandler = (LdapGroupClaimsHandler) appContext.getBean("testGroupClaimsHandlerFilter");
    ClaimsManager claimsManager = new ClaimsManager();
    claimsManager.setClaimHandlers(Collections.singletonList(claimsHandler));
    String user = props.getProperty("otherClaimUser");
    Assert.assertNotNull(user, "Property 'claimUser' not configured");
    ClaimCollection requestedClaims = new ClaimCollection();
    Claim claim = new Claim();
    String roleURI = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role";
    claim.setClaimType(roleURI);
    requestedClaims.add(claim);
    ClaimsParameters params = new ClaimsParameters();
    params.setPrincipal(new CustomTokenPrincipal(user));
    ProcessedClaimCollection retrievedClaims = claimsManager.retrieveClaimValues(requestedClaims, params);
    Assert.assertTrue(retrievedClaims.size() == 1);
    Assert.assertEquals(retrievedClaims.get(0).getClaimType(), roleURI);
    Assert.assertTrue(retrievedClaims.get(0).getValues().size() == 1);
}

Example 89 with ClaimCollection

use of org.apache.cxf.rt.security.claims.ClaimCollection in project cxf by apache.

the class LDAPClaimsTest method testRetrieveClaimsWithUnsupportedMandatoryClaimType.

@org.junit.Test(expected = STSException.class)
public void testRetrieveClaimsWithUnsupportedMandatoryClaimType() throws Exception {
    LdapClaimsHandler claimsHandler = (LdapClaimsHandler) appContext.getBean("testClaimsHandler");
    ClaimsManager claimsManager = new ClaimsManager();
    claimsManager.setClaimHandlers(Collections.singletonList(claimsHandler));
    String user = props.getProperty("claimUser");
    Assert.assertNotNull(user, "Property 'claimUser' not configured");
    ClaimCollection requestedClaims = createRequestClaimCollection();
    // add unsupported but mandatory claim
    Claim claim = new Claim();
    claim.setClaimType(ClaimTypes.GENDER);
    claim.setOptional(false);
    requestedClaims.add(claim);
    ClaimsParameters params = new ClaimsParameters();
    params.setPrincipal(new CustomTokenPrincipal(user));
    claimsManager.retrieveClaimValues(requestedClaims, params);
}

Example 90 with ClaimCollection

use of org.apache.cxf.rt.security.claims.ClaimCollection in project cxf by apache.

the class LDAPClaimsTest method testRetrieveClaimsWithUnsupportedOptionalClaimType.

@org.junit.Test
public void testRetrieveClaimsWithUnsupportedOptionalClaimType() throws Exception {
    LdapClaimsHandler claimsHandler = (LdapClaimsHandler) appContext.getBean("testClaimsHandler");
    ClaimsManager claimsManager = new ClaimsManager();
    claimsManager.setClaimHandlers(Collections.singletonList(claimsHandler));
    String user = props.getProperty("claimUser");
    Assert.assertNotNull(user, "Property 'claimUser' not configured");
    ClaimCollection requestedClaims = createRequestClaimCollection();
    // add unsupported but optional unsupported claim
    Claim claim = new Claim();
    claim.setClaimType(ClaimTypes.GENDER);
    claim.setOptional(true);
    requestedClaims.add(claim);
    // Gender is not expected to be returned because not supported
    List<String> expectedClaims = new ArrayList<>();
    expectedClaims.add(ClaimTypes.FIRSTNAME.toString());
    expectedClaims.add(ClaimTypes.LASTNAME.toString());
    expectedClaims.add(ClaimTypes.EMAILADDRESS.toString());
    ClaimsParameters params = new ClaimsParameters();
    params.setPrincipal(new CustomTokenPrincipal(user));
    ProcessedClaimCollection retrievedClaims = claimsManager.retrieveClaimValues(requestedClaims, params);
    Assert.assertTrue("Retrieved number of claims [" + retrievedClaims.size() + "] doesn't match with expected [" + expectedClaims.size() + "]", retrievedClaims.size() == expectedClaims.size());
    for (ProcessedClaim c : retrievedClaims) {
        if (expectedClaims.contains(c.getClaimType())) {
            expectedClaims.remove(c.getClaimType());
        } else {
            Assert.assertTrue("Claim '" + c.getClaimType() + "' not requested", false);
        }
    }
}