Examples with SecurityContext org.apache.cxf.security.SecurityContext used on opensource projects

Example 51 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class Saml2BearerGrantHandler method getGrantSubject.

protected UserSubject getGrantSubject(Message message, SamlAssertionWrapper wrapper) {
    SecurityContext sc = scProvider.getSecurityContext(message, wrapper);
    if (sc instanceof SAMLSecurityContext) {
        SAMLSecurityContext jaxrsSc = (SAMLSecurityContext) sc;
        Set<Principal> rolesP = jaxrsSc.getUserRoles();
        List<String> roles = new ArrayList<>();
        if (rolesP != null) {
            for (Principal p : rolesP) {
                roles.add(p.getName());
            }
        }
        return new SamlUserSubject(jaxrsSc.getUserPrincipal().getName(), roles, jaxrsSc.getClaims());
    }
    return new UserSubject(sc.getUserPrincipal().getName());
}

Example 52 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class AbstractUsernameTokenAuthenticatingInterceptor method handleMessage.

@Override
public void handleMessage(SoapMessage msg) throws Fault {
    SecurityToken token = msg.get(SecurityToken.class);
    SecurityContext context = msg.get(SecurityContext.class);
    if (token == null || context == null || context.getUserPrincipal() == null) {
        super.handleMessage(msg);
        return;
    }
    UsernameToken ut = (UsernameToken) token;
    Subject subject = createSubject(ut.getName(), ut.getPassword(), ut.isHashed(), ut.getNonce(), ut.getCreatedTime());
    SecurityContext sc = doCreateSecurityContext(context.getUserPrincipal(), subject);
    msg.put(SecurityContext.class, sc);
}

Example 53 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class DefaultWSS4JSecurityContextCreator method createSecurityContext.

/**
 * Create a SecurityContext and store it on the SoapMessage parameter
 */
public void createSecurityContext(SoapMessage msg, WSHandlerResult handlerResult) {
    boolean allowUnsignedSamlPrincipals = SecurityUtils.getSecurityPropertyBoolean(SecurityConstants.ENABLE_UNSIGNED_SAML_ASSERTION_PRINCIPAL, msg, false);
    boolean allowUTNoPassword = SecurityUtils.getSecurityPropertyBoolean(SecurityConstants.ENABLE_UT_NOPASSWORD_PRINCIPAL, msg, false);
    boolean useJAASSubject = true;
    String useJAASSubjectStr = (String) SecurityUtils.getSecurityPropertyValue(SecurityConstants.SC_FROM_JAAS_SUBJECT, msg);
    if (useJAASSubjectStr != null) {
        useJAASSubject = Boolean.parseBoolean(useJAASSubjectStr);
    }
    // Now go through the results in a certain order to set up a security context. Highest priority is first.
    Map<Integer, List<WSSecurityEngineResult>> actionResults = handlerResult.getActionResults();
    for (Integer resultPriority : securityPriorities) {
        if ((resultPriority == WSConstants.ST_UNSIGNED && !allowUnsignedSamlPrincipals) || (resultPriority == WSConstants.UT_NOPASSWORD && !allowUTNoPassword)) {
            continue;
        }
        List<WSSecurityEngineResult> foundResults = actionResults.get(resultPriority);
        if (foundResults != null && !foundResults.isEmpty()) {
            for (WSSecurityEngineResult result : foundResults) {
                if (!skipResult(resultPriority, result)) {
                    SecurityContext context = createSecurityContext(msg, useJAASSubject, result);
                    if (context != null) {
                        msg.put(SecurityContext.class, context);
                        return;
                    }
                }
            }
        }
    }
}

Example 54 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class BinarySecurityTokenInterceptor method processToken.

protected void processToken(SoapMessage message) {
    Header h = findSecurityHeader(message, false);
    if (h == null) {
        return;
    }
    Element el = (Element) h.getObject();
    Element child = DOMUtils.getFirstElement(el);
    while (child != null) {
        if (WSS4JConstants.BINARY_TOKEN_LN.equals(child.getLocalName()) && WSS4JConstants.WSSE_NS.equals(child.getNamespaceURI())) {
            try {
                List<WSSecurityEngineResult> bstResults = processToken(child, message);
                if (bstResults != null) {
                    List<WSHandlerResult> results = CastUtils.cast((List<?>) message.get(WSHandlerConstants.RECV_RESULTS));
                    if (results == null) {
                        results = new ArrayList<>();
                        message.put(WSHandlerConstants.RECV_RESULTS, results);
                    }
                    WSHandlerResult rResult = new WSHandlerResult(null, bstResults, Collections.singletonMap(WSConstants.BST, bstResults));
                    results.add(0, rResult);
                    assertTokens(message);
                    Principal principal = (Principal) bstResults.get(0).get(WSSecurityEngineResult.TAG_PRINCIPAL);
                    SecurityContext sc = message.get(SecurityContext.class);
                    if (sc == null || sc.getUserPrincipal() == null) {
                        message.put(SecurityContext.class, new DefaultSecurityContext(principal, null));
                    }
                }
            } catch (WSSecurityException ex) {
                throw WSS4JUtils.createSoapFault(message, message.getVersion(), ex);
            }
        }
        child = DOMUtils.getNextElement(child);
    }
}

Example 55 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class JwsContainerRequestFilter method filter.

@Override
public void filter(ContainerRequestContext context) throws IOException {
    if (isMethodWithNoContent(context.getMethod()) || isCheckEmptyStream() && !context.hasEntity()) {
        return;
    }
    final String content = IOUtils.readStringFromStream(context.getEntityStream());
    if (StringUtils.isEmpty(content)) {
        return;
    }
    JwsCompactConsumer p = new JwsCompactConsumer(content);
    JwsSignatureVerifier theSigVerifier = getInitializedSigVerifier(p.getJwsHeaders());
    if (!p.verifySignatureWith(theSigVerifier)) {
        context.abortWith(JAXRSUtils.toResponse(400));
        return;
    }
    JoseUtils.validateRequestContextProperty(p.getJwsHeaders());
    byte[] bytes = p.getDecodedJwsPayloadBytes();
    context.setEntityStream(new ByteArrayInputStream(bytes));
    context.getHeaders().putSingle("Content-Length", Integer.toString(bytes.length));
    String ct = JoseUtils.checkContentType(p.getJwsHeaders().getContentType(), getDefaultMediaType());
    if (ct != null) {
        context.getHeaders().putSingle("Content-Type", ct);
    }
    if (super.isValidateHttpHeaders()) {
        super.validateHttpHeadersIfNeeded(context.getHeaders(), p.getJwsHeaders());
    }
    Principal currentPrincipal = context.getSecurityContext().getUserPrincipal();
    if (currentPrincipal == null || currentPrincipal.getName() == null) {
        SecurityContext securityContext = configureSecurityContext(theSigVerifier);
        if (securityContext != null) {
            JAXRSUtils.getCurrentMessage().put(SecurityContext.class, securityContext);
        }
    }
}