Examples with SecurityContext org.apache.cxf.security.SecurityContext used on opensource projects

Example 56 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class DirectAuthorizationService method authorize.

@POST
@Consumes("application/x-www-form-urlencoded")
@Produces("text/html")
public Response authorize(MultivaluedMap<String, String> params) {
    SecurityContext sc = getAndValidateSecurityContext(params);
    Client client = getClient(params);
    // Create a UserSubject representing the end user
    UserSubject userSubject = createUserSubject(sc, params);
    AccessTokenRegistration reg = new AccessTokenRegistration();
    reg.setClient(client);
    reg.setGrantType(OAuthConstants.DIRECT_TOKEN_GRANT);
    reg.setSubject(userSubject);
    String providedScope = params.getFirst(OAuthConstants.SCOPE);
    List<String> requestedScope = OAuthUtils.getRequestedScopes(client, providedScope, useAllClientScopes, partialMatchScopeValidation);
    reg.setRequestedScope(requestedScope);
    reg.setApprovedScope(requestedScope);
    ServerAccessToken token = getDataProvider().createAccessToken(reg);
    ClientAccessToken clientToken = OAuthUtils.toClientAccessToken(token, isWriteOptionalParameters());
    return Response.ok(clientToken).build();
}

Example 57 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class JwtBearerAuthHandler method filter.

@Override
public void filter(ContainerRequestContext context) {
    Message message = JAXRSUtils.getCurrentMessage();
    Form form = readFormData(message);
    MultivaluedMap<String, String> formData = form.asMap();
    String assertionType = formData.getFirst(Constants.CLIENT_AUTH_ASSERTION_TYPE);
    String decodedAssertionType = assertionType != null ? HttpUtils.urlDecode(assertionType) : null;
    if (decodedAssertionType == null || !Constants.CLIENT_AUTH_JWT_BEARER.equals(decodedAssertionType)) {
        throw ExceptionUtils.toNotAuthorizedException(null, null);
    }
    String assertion = formData.getFirst(Constants.CLIENT_AUTH_ASSERTION_PARAM);
    if (assertion == null) {
        throw ExceptionUtils.toNotAuthorizedException(null, null);
    }
    String clientId = formData.getFirst(OAuthConstants.CLIENT_ID);
    Client client = null;
    if (clientId != null && clientProvider != null) {
        client = clientProvider.getClient(clientId);
        if (client == null) {
            throw ExceptionUtils.toNotAuthorizedException(null, null);
        }
        message.put(Client.class, client);
    }
    JwtToken token = super.getJwtToken(assertion, client);
    String subjectName = (String) token.getClaim(JwtConstants.CLAIM_SUBJECT);
    if (clientId != null && !clientId.equals(subjectName)) {
        throw ExceptionUtils.toNotAuthorizedException(null, null);
    }
    message.put(OAuthConstants.CLIENT_ID, subjectName);
    formData.remove(OAuthConstants.CLIENT_ID);
    formData.remove(Constants.CLIENT_AUTH_ASSERTION_PARAM);
    formData.remove(Constants.CLIENT_AUTH_ASSERTION_TYPE);
    SecurityContext securityContext = configureSecurityContext(token);
    if (securityContext != null) {
        JAXRSUtils.getCurrentMessage().put(SecurityContext.class, securityContext);
    }
    // restore input stream
    try {
        FormUtils.restoreForm(provider, form, message);
    } catch (Exception ex) {
        throw ExceptionUtils.toNotAuthorizedException(null, null);
    }
}

Example 58 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class ClaimsAuthorizingInterceptor method handleMessage.

public void handleMessage(Message message) throws Fault {
    SecurityContext sc = message.get(SecurityContext.class);
    if (!(sc instanceof ClaimsSecurityContext)) {
        throw new AccessDeniedException("Security Context is unavailable or unrecognized");
    }
    Method method = MessageUtils.getTargetMethod(message).orElseThrow(() -> new AccessDeniedException("Method is not available : Unauthorized"));
    if (authorize((ClaimsSecurityContext) sc, method)) {
        return;
    }
    throw new AccessDeniedException("Unauthorized");
}

Example 59 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class WSS4JBasicAuthValidator method validate.

protected void validate(Message message) throws WSSecurityException {
    AuthorizationPolicy policy = message.get(AuthorizationPolicy.class);
    if (policy == null || policy.getUserName() == null || policy.getPassword() == null) {
        String name = null;
        if (policy != null) {
            name = policy.getUserName();
        }
        String errorMsg = "No user name and/or password is available, name: " + name;
        LOG.warning(errorMsg);
        throw new SecurityException(errorMsg);
    }
    UsernameToken token = convertPolicyToToken(policy);
    Credential credential = new Credential();
    credential.setUsernametoken(token);
    RequestData data = new RequestData();
    data.setMsgContext(message);
    data.setCallbackHandler(callbackHandler);
    credential = getValidator().validate(credential, data);
    // Create a Principal/SecurityContext
    final SecurityContext sc;
    if (credential != null && credential.getPrincipal() != null) {
        sc = createSecurityContext(message, credential);
    } else {
        Principal p = new WSUsernameTokenPrincipalImpl(policy.getUserName(), false);
        ((WSUsernameTokenPrincipalImpl) p).setPassword(policy.getPassword());
        sc = createSecurityContext(p);
    }
    message.put(SecurityContext.class, sc);
}

Example 60 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class XACMLAuthorizingInterceptorTest method testDeny.

@org.junit.Test
public void testDeny() throws Exception {
    // Mock up a Security Context
    SecurityContext sc = createSecurityContext("alice", "boss");
    String operation = "{http://www.example.org/contract/DoubleIt}DoubleIt";
    MessageImpl msg = new MessageImpl();
    msg.put(Message.WSDL_OPERATION, QName.valueOf(operation));
    String service = "{http://www.example.org/contract/DoubleIt}DoubleItService";
    msg.put(Message.WSDL_SERVICE, QName.valueOf(service));
    String resourceURI = "https://localhost:8080/doubleit";
    msg.put(Message.REQUEST_URI, resourceURI);
    msg.put(SecurityContext.class, sc);
    PolicyDecisionPoint pdp = new DummyPDP();
    XACMLAuthorizingInterceptor authorizingInterceptor = new XACMLAuthorizingInterceptor(pdp);
    try {
        authorizingInterceptor.handleMessage(msg);
        fail("Failure expected on deny");
    } catch (Exception ex) {
    // Failure expected
    }
}