Examples with SecurityContext org.apache.cxf.security.SecurityContext used on opensource projects

Example 11 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class DirectAuthorizationService method getAndValidateSecurityContext.

protected SecurityContext getAndValidateSecurityContext(MultivaluedMap<String, String> params) {
    SecurityContext securityContext = (SecurityContext) getMessageContext().get(SecurityContext.class.getName());
    if (securityContext == null || securityContext.getUserPrincipal() == null) {
        throw ExceptionUtils.toNotAuthorizedException(null, null);
    }
    checkTransportSecurity();
    return securityContext;
}

Example 12 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class RedirectionBasedGrantService method getAndValidateSecurityContext.

protected SecurityContext getAndValidateSecurityContext(MultivaluedMap<String, String> params) {
    SecurityContext securityContext = (SecurityContext) getMessageContext().get(SecurityContext.class.getName());
    if (securityContext == null || securityContext.getUserPrincipal() == null) {
        throw ExceptionUtils.toNotAuthorizedException(null, null);
    }
    checkTransportSecurity();
    return securityContext;
}

Example 13 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class RedirectionBasedGrantService method startAuthorization.

/**
 * Starts the authorization process
 */
protected Response startAuthorization(MultivaluedMap<String, String> params) {
    // Make sure the end user has authenticated, check if HTTPS is used
    SecurityContext sc = getAndValidateSecurityContext(params);
    Client client = getClient(params.getFirst(OAuthConstants.CLIENT_ID), params);
    // Create a UserSubject representing the end user
    UserSubject userSubject = createUserSubject(sc, params);
    if (authorizationFilter != null) {
        params = authorizationFilter.process(params, userSubject, client);
    }
    // Validate the provided request URI, if any, against the ones Client provided
    // during the registration
    String redirectUri = validateRedirectUri(client, params.getFirst(OAuthConstants.REDIRECT_URI));
    return startAuthorization(params, userSubject, client, redirectUri);
}

Example 14 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class RedirectionBasedGrantService method completeAuthorization.

/**
 * Completes the authorization process
 */
protected Response completeAuthorization(MultivaluedMap<String, String> params) {
    // Make sure the end user has authenticated, check if HTTPS is used
    SecurityContext securityContext = getAndValidateSecurityContext(params);
    UserSubject userSubject = createUserSubject(securityContext, params);
    // Make sure the session is valid
    String sessionTokenParamName = params.getFirst(OAuthConstants.SESSION_AUTHENTICITY_TOKEN_PARAM_NAME);
    if (sessionTokenParamName == null) {
        sessionTokenParamName = OAuthConstants.SESSION_AUTHENTICITY_TOKEN;
    }
    String sessionToken = params.getFirst(sessionTokenParamName);
    if (sessionToken == null || !compareRequestAndSessionTokens(sessionToken, params, userSubject)) {
        throw ExceptionUtils.toBadRequestException(null, null);
    }
    OAuthRedirectionState state = recreateRedirectionStateFromSession(userSubject, sessionToken);
    if (state == null) {
        state = recreateRedirectionStateFromParams(params);
    }
    Client client = getClient(state.getClientId(), params);
    String redirectUri = validateRedirectUri(client, state.getRedirectUri());
    // Get the end user decision value
    String decision = params.getFirst(OAuthConstants.AUTHORIZATION_DECISION_KEY);
    boolean allow = OAuthConstants.AUTHORIZATION_DECISION_ALLOW.equals(decision);
    // Return the error if denied
    if (!allow) {
        return createErrorResponse(params, redirectUri, OAuthConstants.ACCESS_DENIED);
    }
    // Check if the end user may have had a chance to down-scope the requested scopes
    List<String> requestedScope = OAuthUtils.parseScope(state.getProposedScope());
    List<String> approvedScope = new LinkedList<String>();
    for (String rScope : requestedScope) {
        String param = params.getFirst(rScope + "_status");
        if (param != null && OAuthConstants.AUTHORIZATION_DECISION_ALLOW.equals(param)) {
            approvedScope.add(rScope);
        }
    }
    if (!requestedScope.containsAll(approvedScope) || !OAuthUtils.validateScopes(requestedScope, client.getRegisteredScopes(), partialMatchScopeValidation)) {
        return createErrorResponse(params, redirectUri, OAuthConstants.INVALID_SCOPE);
    }
    getMessageContext().put(AUTHORIZATION_REQUEST_PARAMETERS, params);
    String preAuthorizedTokenKey = params.getFirst(PREAUTHORIZED_TOKEN_KEY);
    if (preAuthorizedTokenKey != null && isRevokePreauthorizedTokenOnApproval()) {
        getDataProvider().revokeToken(client, preAuthorizedTokenKey, OAuthConstants.ACCESS_TOKEN);
    }
    // Request a new grant
    return createGrant(state, client, requestedScope, approvedScope, userSubject, null);
}

Example 15 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class ClaimsAuthorizingInterceptorTest method prepareMessage.

private Message prepareMessage(Class<?> cls, String methodName, org.apache.cxf.rt.security.claims.Claim... claim) throws Exception {
    ClaimCollection claims = new ClaimCollection();
    claims.addAll(Arrays.asList(claim));
    Set<Principal> roles = SAMLUtils.parseRolesFromClaims(claims, SAMLClaim.SAML_ROLE_ATTRIBUTENAME_DEFAULT, SAML2Constants.ATTRNAME_FORMAT_UNSPECIFIED);
    SecurityContext sc = new SAMLSecurityContext(new SimplePrincipal("user"), roles, claims);
    Message m = new MessageImpl();
    m.setExchange(new ExchangeImpl());
    m.put(SecurityContext.class, sc);
    m.put("org.apache.cxf.resource.method", cls.getMethod(methodName, new Class[] {}));
    return m;
}