Examples with SecurityContext org.apache.cxf.security.SecurityContext used on opensource projects

Example 1 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project ddf by codice.

the class SecurityAssertionStore method getSecurityAssertion.

/**
     * Return the SecurityAssertion wrapper associated with the provided message
     *
     * @param message Message
     * @return SecurityAssertion
     */
public static SecurityAssertion getSecurityAssertion(Message message) {
    if (message != null) {
        TokenStore tokenStore = getTokenStore(message);
        Principal principal = null;
        SecurityContext context = message.get(SecurityContext.class);
        if (context != null) {
            principal = context.getUserPrincipal();
        }
        if (!(principal instanceof SAMLTokenPrincipal)) {
            // Try to find the SAMLTokenPrincipal if it exists
            List<?> wsResults = List.class.cast(message.get(WSHandlerConstants.RECV_RESULTS));
            if (wsResults != null) {
                for (Object wsResult : wsResults) {
                    if (wsResult instanceof WSHandlerResult) {
                        List<WSSecurityEngineResult> wsseResults = ((WSHandlerResult) wsResult).getResults();
                        for (WSSecurityEngineResult wsseResult : wsseResults) {
                            Object principalResult = wsseResult.get(WSSecurityEngineResult.TAG_PRINCIPAL);
                            if (principalResult instanceof SAMLTokenPrincipal) {
                                principal = (SAMLTokenPrincipal) principalResult;
                                break;
                            }
                        }
                    }
                }
            }
        }
        if (tokenStore != null && principal != null && principal instanceof SAMLTokenPrincipal) {
            String id = ((SAMLTokenPrincipal) principal).getId();
            SamlAssertionWrapper samlAssertionWrapper = ((SAMLTokenPrincipal) principal).getToken();
            SecurityToken token = tokenStore.getToken(id);
            if (token == null) {
                if (samlAssertionWrapper.getSaml2().getIssueInstant() != null && samlAssertionWrapper.getSaml2().getConditions() != null && samlAssertionWrapper.getSaml2().getConditions().getNotOnOrAfter() != null) {
                    token = new SecurityToken(id, samlAssertionWrapper.getElement(), samlAssertionWrapper.getSaml2().getIssueInstant().toDate(), samlAssertionWrapper.getSaml2().getConditions().getNotOnOrAfter().toDate());
                } else {
                    // we don't know how long this should last or when it was created, so just
                    // set it to 1 minute
                    // This shouldn't happen unless someone sets up a third party STS with weird
                    // settings.
                    Date date = new Date();
                    token = new SecurityToken(id, samlAssertionWrapper.getElement(), date, new Date(date.getTime() + TimeUnit.MINUTES.toMillis(1)));
                }
                tokenStore.add(token);
            }
            return new SecurityAssertionImpl(token);
        }
    }
    return new SecurityAssertionImpl();
}

Example 2 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class ClaimsAuthorizingInterceptor method handleMessage.

public void handleMessage(Message message) throws Fault {
    SecurityContext sc = message.get(SecurityContext.class);
    if (!(sc instanceof SAMLSecurityContext)) {
        throw new AccessDeniedException("Security Context is unavailable or unrecognized");
    }
    Method method = getTargetMethod(message);
    if (authorize((SAMLSecurityContext) sc, method)) {
        return;
    }
    throw new AccessDeniedException("Unauthorized");
}

Example 3 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class AbstractAuthFilter method createSecurityContext.

protected SecurityContext createSecurityContext(HttpServletRequest request, final OAuthInfo info) {
    // TODO:
    // This custom parameter is only needed by the "oauth"
    // demo shipped in the distribution; needs to be removed.
    request.setAttribute("oauth_authorities", info.getRoles());
    UserSubject subject = info.getToken().getSubject();
    final UserSubject theSubject = subject;
    return new SecurityContext() {

        public Principal getUserPrincipal() {
            String login = AbstractAuthFilter.this.useUserSubject ? (theSubject != null ? theSubject.getLogin() : null) : info.getToken().getClient().getLoginName();
            return new SimplePrincipal(login);
        }

        public boolean isUserInRole(String role) {
            List<String> roles = null;
            if (AbstractAuthFilter.this.useUserSubject && theSubject != null) {
                roles = theSubject.getRoles();
            } else {
                roles = info.getRoles();
            }
            return roles.contains(role);
        }
    };
}

Example 4 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class OAuthRequestFilter method setSecurityContext.

private void setSecurityContext(MessageContext mc, Message m, OAuthInfo info) {
    SecurityContext sc = createSecurityContext(mc.getHttpServletRequest(), info);
    m.setContent(SecurityContext.class, sc);
    m.setContent(OAuthContext.class, createOAuthContext(info));
}

Example 5 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class ClaimsAuthorizingInterceptorTest method prepareMessage.

private Message prepareMessage(Class<?> cls, String methodName, org.apache.cxf.rt.security.claims.Claim... claim) throws Exception {
    ClaimCollection claims = new ClaimCollection();
    claims.addAll(Arrays.asList(claim));
    Set<Principal> roles = SAMLUtils.parseRolesFromClaims(claims, SAMLClaim.SAML_ROLE_ATTRIBUTENAME_DEFAULT, SAML2Constants.ATTRNAME_FORMAT_UNSPECIFIED);
    SecurityContext sc = new SAMLSecurityContext(new SimplePrincipal("user"), roles, claims);
    Message m = new MessageImpl();
    m.setExchange(new ExchangeImpl());
    m.put(SecurityContext.class, sc);
    m.put("org.apache.cxf.resource.method", cls.getMethod(methodName, new Class[] {}));
    return m;
}