Examples with SecurityContext org.apache.cxf.security.SecurityContext used on opensource projects

Example 6 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class ClaimsAuthorizingInterceptor method handleMessage.

public void handleMessage(Message message) throws Fault {
    SecurityContext sc = message.get(SecurityContext.class);
    if (!(sc instanceof SAMLSecurityContext)) {
        throw new AccessDeniedException("Security Context is unavailable or unrecognized");
    }
    Method method = getTargetMethod(message);
    if (authorize((SAMLSecurityContext) sc, method)) {
        return;
    }
    throw new AccessDeniedException("Unauthorized");
}

Example 7 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class AbstractXACMLAuthorizingInterceptor method handleMessage.

public void handleMessage(Message message) throws Fault {
    SecurityContext sc = message.get(SecurityContext.class);
    if (sc instanceof LoginSecurityContext) {
        Principal principal = sc.getUserPrincipal();
        String principalName = null;
        if (principal != null) {
            principalName = principal.getName();
        }
        LoginSecurityContext loginSecurityContext = (LoginSecurityContext) sc;
        Set<Principal> principalRoles = loginSecurityContext.getUserRoles();
        List<String> roles = new ArrayList<>();
        if (principalRoles != null) {
            for (Principal p : principalRoles) {
                if (p != null && p.getName() != null && !p.getName().equals(principalName)) {
                    roles.add(p.getName());
                }
            }
        }
        try {
            if (authorize(principal, roles, message)) {
                return;
            }
        } catch (Exception e) {
            LOG.log(Level.FINE, "Unauthorized: " + e.getMessage(), e);
            throw new AccessDeniedException("Unauthorized");
        }
    } else {
        LOG.log(Level.FINE, "The SecurityContext was not an instance of LoginSecurityContext. No authorization " + "is possible as a result");
    }
    throw new AccessDeniedException("Unauthorized");
}

Example 8 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class AbstractAuthFilter method createSecurityContext.

protected SecurityContext createSecurityContext(HttpServletRequest request, final OAuthInfo info) {
    // TODO:
    // This custom parameter is only needed by the "oauth"
    // demo shipped in the distribution; needs to be removed.
    request.setAttribute("oauth_authorities", info.getRoles());
    UserSubject subject = info.getToken().getSubject();
    final UserSubject theSubject = subject;
    return new SecurityContext() {

        public Principal getUserPrincipal() {
            String login = AbstractAuthFilter.this.useUserSubject ? (theSubject != null ? theSubject.getLogin() : null) : info.getToken().getClient().getLoginName();
            return new SimplePrincipal(login);
        }

        public boolean isUserInRole(String role) {
            List<String> roles = null;
            if (AbstractAuthFilter.this.useUserSubject && theSubject != null) {
                roles = theSubject.getRoles();
            } else {
                roles = info.getRoles();
            }
            return roles.contains(role);
        }
    };
}

Example 9 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class OAuthRequestFilter method setSecurityContext.

private void setSecurityContext(MessageContext mc, Message m, OAuthInfo info) {
    SecurityContext sc = createSecurityContext(mc.getHttpServletRequest(), info);
    m.setContent(SecurityContext.class, sc);
    m.setContent(OAuthContext.class, createOAuthContext(info));
}

Example 10 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class OAuthRequestFilter method createSecurityContext.

protected SecurityContext createSecurityContext(HttpServletRequest request, AccessTokenValidation accessTokenV) {
    UserSubject resourceOwnerSubject = accessTokenV.getTokenSubject();
    UserSubject clientSubject = accessTokenV.getClientSubject();
    final UserSubject theSubject = OAuthRequestFilter.this.useUserSubject ? resourceOwnerSubject : clientSubject;
    return new SecurityContext() {

        public Principal getUserPrincipal() {
            return theSubject != null ? new SimplePrincipal(theSubject.getLogin()) : null;
        }

        public boolean isUserInRole(String role) {
            if (theSubject == null) {
                return false;
            }
            return theSubject.getRoles().contains(role);
        }
    };
}