Examples with SecurityContext org.apache.cxf.security.SecurityContext used on opensource projects

Example 26 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project tesb-rt-se by Talend.

the class SecurityContextFilter method filter.

@Override
public void filter(ContainerRequestContext requestContext) throws IOException {
    Message message = JAXRSUtils.getCurrentMessage();
    SecurityContext sc = message.get(SecurityContext.class);
    if (sc != null) {
        Principal principal = sc.getUserPrincipal();
        if (principal != null) {
            String accountName = principal.getName();
            UserAccount account = accounts.getAccount(accountName);
            if (account == null) {
                account = accounts.getAccountWithAlias(accountName);
            }
            if (account == null) {
                requestContext.abortWith(createFaultResponse());
            } else {
                setNewSecurityContext(message, account.getName());
            }
            return;
        }
    }
    List<String> authValues = headers.getRequestHeader("Authorization");
    if (authValues == null || authValues.size() != 1) {
        requestContext.abortWith(createFaultResponse());
        return;
    }
    String[] values = authValues.get(0).split(" ");
    if (values.length != 2 || !"Basic".equals(values[0])) {
        requestContext.abortWith(createFaultResponse());
        return;
    }
    String decodedValue = null;
    try {
        decodedValue = new String(Base64Utility.decode(values[1]));
    } catch (Base64Exception ex) {
        requestContext.abortWith(createFaultResponse());
        return;
    }
    String[] namePassword = decodedValue.split(":");
    if (namePassword.length != 2) {
        requestContext.abortWith(createFaultResponse());
        return;
    }
    final UserAccount account = accounts.getAccount(namePassword[0]);
    if (account == null || !account.getPassword().equals(namePassword[1])) {
        requestContext.abortWith(createFaultResponse());
        return;
    }
    setNewSecurityContext(message, account.getName());
}

Example 27 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project tesb-rt-se by Talend.

the class SecurityContextFilter method filter.

@Override
public void filter(ContainerRequestContext requestContext) throws IOException {
    Message message = JAXRSUtils.getCurrentMessage();
    if (ui.getAbsolutePath().toString().endsWith(userRegistrationPath)) {
        return;
    }
    List<String> authValues = headers.getRequestHeader("Authorization");
    if (authValues.size() != 1) {
        requestContext.abortWith(createFaultResponse());
        return;
    }
    String[] values = authValues.get(0).split(" ");
    if (values.length != 2 || !"Basic".equals(values[0])) {
        requestContext.abortWith(createFaultResponse());
        return;
    }
    String decodedValue = null;
    try {
        decodedValue = new String(Base64Utility.decode(values[1]));
    } catch (Base64Exception ex) {
        requestContext.abortWith(createFaultResponse());
        return;
    }
    String[] namePassword = decodedValue.split(":");
    if (namePassword.length != 2) {
        requestContext.abortWith(createFaultResponse());
        return;
    }
    final UserAccount account = accounts.getAccount(namePassword[0]);
    if (account == null || !account.getPassword().equals(namePassword[1])) {
        requestContext.abortWith(createFaultResponse());
        return;
    }
    final SecurityContext sc = new SecurityContext() {

        public Principal getUserPrincipal() {
            return new SimplePrincipal(account.getName());
        }

        public boolean isUserInRole(String arg0) {
            return false;
        }
    };
    message.put(SecurityContext.class, sc);
}

Example 28 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project tesb-rt-se by Talend.

the class SecurityContextFilter method filter.

@Override
public void filter(ContainerRequestContext requestContext) throws IOException {
    List<String> authValues = headers.getRequestHeader("Authorization");
    if (authValues.size() != 1) {
        requestContext.abortWith(createFaultResponse());
        return;
    }
    String[] values = authValues.get(0).split(" ");
    if (values.length != 2 || !"Basic".equals(values[0])) {
        requestContext.abortWith(createFaultResponse());
        return;
    }
    String decodedValue = null;
    try {
        decodedValue = new String(Base64Utility.decode(values[1]));
    } catch (Base64Exception ex) {
        requestContext.abortWith(createFaultResponse());
        return;
    }
    final String[] namePassword = decodedValue.split(":");
    if (namePassword.length != 2) {
        requestContext.abortWith(createFaultResponse());
        return;
    }
    String password = users.get(namePassword[0]);
    if (password == null || !password.equals(namePassword[1])) {
        requestContext.abortWith(createFaultResponse());
        return;
    }
    final SecurityContext sc = new SecurityContext() {

        public Principal getUserPrincipal() {
            return new SimplePrincipal(namePassword[0]);
        }

        public boolean isUserInRole(String arg0) {
            return false;
        }
    };
    JAXRSUtils.getCurrentMessage().put(SecurityContext.class, sc);
}

Example 29 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project jbossws-cxf by jbossws.

the class AuthenticationMgrSubjectCreatingInterceptor method handleMessage.

@Override
public void handleMessage(Message message) throws Fault {
    JBossAuthenticationManager authenticationManger = message.get(JBossAuthenticationManager.class);
    if (authenticationManger == null) {
        return;
    }
    SecurityContext context = message.get(SecurityContext.class);
    if (context == null || context.getUserPrincipal() == null) {
        Loggers.SECURITY_LOGGER.userPrincipalNotAvailableOnCurrentMessage();
        return;
    }
    SecurityToken token = message.get(SecurityToken.class);
    Subject subject = null;
    if (token != null) {
        // Try authenticating using SecurityToken info
        if (token.getTokenType() != TokenType.UsernameToken) {
            throw Messages.MESSAGES.unsupportedTokenType(token.getTokenType());
        }
        UsernameToken ut = (UsernameToken) token;
        subject = helper.createSubject(authenticationManger, ut.getName(), ut.getPassword(), ut.isHashed(), ut.getNonce(), ut.getCreatedTime());
    } else {
        // Try authenticating using WSS4J internal info (previously set into SecurityContext by WSS4JInInterceptor)
        Principal p = context.getUserPrincipal();
        if (!(p instanceof UsernameTokenPrincipal)) {
            throw Messages.MESSAGES.couldNotGetSubjectInfo();
        }
        UsernameTokenPrincipal up = (UsernameTokenPrincipal) p;
        subject = helper.createSubject(authenticationManger, up.getName(), up.getPassword(), up.isPasswordDigest(), up.getNonce(), up.getCreatedTime());
    }
    Principal principal = getPrincipal(context.getUserPrincipal(), subject);
    message.put(SecurityContext.class, createSecurityContext(principal, subject));
}

Example 30 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project testcases by coheigea.

the class XACML3AuthorizingInterceptor method handleMessage.

public void handleMessage(Message message) throws Fault {
    SecurityContext sc = message.get(SecurityContext.class);
    if (sc instanceof LoginSecurityContext) {
        Principal principal = sc.getUserPrincipal();
        LoginSecurityContext loginSecurityContext = (LoginSecurityContext) sc;
        Set<Principal> principalRoles = loginSecurityContext.getUserRoles();
        List<String> roles = new ArrayList<String>();
        if (principalRoles != null) {
            for (Principal p : principalRoles) {
                if (p != principal) {
                    roles.add(p.getName());
                }
            }
        }
        try {
            if (authorize(principal, roles, message)) {
                return;
            }
        } catch (Exception e) {
            LOG.log(Level.FINE, "Unauthorized: " + e.getMessage(), e);
            throw new AccessDeniedException("Unauthorized");
        }
    } else {
        LOG.log(Level.FINE, "The SecurityContext was not an instance of LoginSecurityContext. No authorization " + "is possible as a result");
    }
    throw new AccessDeniedException("Unauthorized");
}