Examples with SecurityContext org.apache.cxf.security.SecurityContext used on opensource projects

Example 36 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project camel by apache.

the class DefaultCxfMessageMapperTest method testSecurityContext.

@Test
public void testSecurityContext() {
    DefaultCxfMessageMapper mapper = new DefaultCxfMessageMapper();
    HttpServletRequest request = EasyMock.createMock(HttpServletRequest.class);
    request.getUserPrincipal();
    EasyMock.expectLastCall().andReturn(new SimplePrincipal("barry"));
    request.isUserInRole("role1");
    EasyMock.expectLastCall().andReturn(true);
    request.isUserInRole("role2");
    EasyMock.expectLastCall().andReturn(false);
    EasyMock.replay(request);
    Exchange camelExchange = setupCamelExchange("/", "/", request);
    Message cxfMessage = mapper.createCxfMessageFromCamelExchange(camelExchange, EasyMock.createMock(HeaderFilterStrategy.class));
    SecurityContext sc = cxfMessage.get(SecurityContext.class);
    assertNotNull(sc);
    assertEquals("barry", sc.getUserPrincipal().getName());
    assertTrue(sc.isUserInRole("role1"));
    assertFalse(sc.isUserInRole("role2"));
}

Example 37 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class UsernameTokenInterceptor method processToken.

protected void processToken(SoapMessage message) {
    Header h = findSecurityHeader(message, false);
    if (h == null) {
        return;
    }
    boolean utWithCallbacks = MessageUtils.getContextualBoolean(message, SecurityConstants.VALIDATE_TOKEN, true);
    Element el = (Element) h.getObject();
    Element child = DOMUtils.getFirstElement(el);
    while (child != null) {
        if (SPConstants.USERNAME_TOKEN.equals(child.getLocalName()) && WSS4JConstants.WSSE_NS.equals(child.getNamespaceURI())) {
            try {
                boolean bspCompliant = isWsiBSPCompliant(message);
                Principal principal = null;
                Subject subject = null;
                Object transformedToken = null;
                if (utWithCallbacks) {
                    final WSSecurityEngineResult result = validateToken(child, message);
                    subject = (Subject) result.get(WSSecurityEngineResult.TAG_SUBJECT);
                    transformedToken = result.get(WSSecurityEngineResult.TAG_TRANSFORMED_TOKEN);
                    principal = (Principal) result.get(WSSecurityEngineResult.TAG_PRINCIPAL);
                    if (principal == null) {
                        principal = parseTokenAndCreatePrincipal(child, bspCompliant);
                    }
                } else {
                    principal = parseTokenAndCreatePrincipal(child, bspCompliant);
                    WSS4JTokenConverter.convertToken(message, principal);
                }
                SecurityContext sc = message.get(SecurityContext.class);
                if (sc == null || sc.getUserPrincipal() == null) {
                    if (transformedToken instanceof SamlAssertionWrapper) {
                        message.put(SecurityContext.class, createSecurityContext(message, (SamlAssertionWrapper) transformedToken));
                    } else if (subject != null && principal != null) {
                        message.put(SecurityContext.class, createSecurityContext(principal, subject));
                    } else {
                        UsernameTokenPrincipal utPrincipal = (UsernameTokenPrincipal) principal;
                        String nonce = null;
                        if (utPrincipal.getNonce() != null) {
                            nonce = Base64.getMimeEncoder().encodeToString(utPrincipal.getNonce());
                        }
                        subject = createSubject(utPrincipal.getName(), utPrincipal.getPassword(), utPrincipal.isPasswordDigest(), nonce, utPrincipal.getCreatedTime());
                        message.put(SecurityContext.class, createSecurityContext(utPrincipal, subject));
                    }
                }
                if (principal instanceof UsernameTokenPrincipal) {
                    storeResults((UsernameTokenPrincipal) principal, subject, message);
                }
            } catch (WSSecurityException ex) {
                throw new Fault(ex);
            } catch (Base64DecodingException ex) {
                throw new Fault(ex);
            }
        }
        child = DOMUtils.getNextElement(child);
    }
}

Example 38 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class AbstractUsernameTokenAuthenticatingInterceptor method handleMessage.

@Override
public void handleMessage(SoapMessage msg) throws Fault {
    SecurityToken token = msg.get(SecurityToken.class);
    SecurityContext context = msg.get(SecurityContext.class);
    if (token == null || context == null || context.getUserPrincipal() == null) {
        super.handleMessage(msg);
        return;
    }
    UsernameToken ut = (UsernameToken) token;
    Subject subject = createSubject(ut.getName(), ut.getPassword(), ut.isHashed(), ut.getNonce(), ut.getCreatedTime());
    SecurityContext sc = doCreateSecurityContext(context.getUserPrincipal(), subject);
    msg.put(SecurityContext.class, sc);
}

Example 39 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class BinarySecurityTokenInterceptor method processToken.

protected void processToken(SoapMessage message) {
    Header h = findSecurityHeader(message, false);
    if (h == null) {
        return;
    }
    Element el = (Element) h.getObject();
    Element child = DOMUtils.getFirstElement(el);
    while (child != null) {
        if (WSS4JConstants.BINARY_TOKEN_LN.equals(child.getLocalName()) && WSS4JConstants.WSSE_NS.equals(child.getNamespaceURI())) {
            try {
                List<WSSecurityEngineResult> bstResults = processToken(child, message);
                if (bstResults != null) {
                    List<WSHandlerResult> results = CastUtils.cast((List<?>) message.get(WSHandlerConstants.RECV_RESULTS));
                    if (results == null) {
                        results = new ArrayList<>();
                        message.put(WSHandlerConstants.RECV_RESULTS, results);
                    }
                    WSHandlerResult rResult = new WSHandlerResult(null, bstResults, Collections.singletonMap(WSConstants.BST, bstResults));
                    results.add(0, rResult);
                    assertTokens(message);
                    Principal principal = (Principal) bstResults.get(0).get(WSSecurityEngineResult.TAG_PRINCIPAL);
                    SecurityContext sc = message.get(SecurityContext.class);
                    if (sc == null || sc.getUserPrincipal() == null) {
                        message.put(SecurityContext.class, new DefaultSecurityContext(principal, null));
                    }
                }
            } catch (WSSecurityException ex) {
                throw WSS4JUtils.createSoapFault(message, message.getVersion(), ex);
            }
        }
        child = DOMUtils.getNextElement(child);
    }
}

Example 40 with SecurityContext

use of org.apache.cxf.security.SecurityContext in project cxf by apache.

the class DefaultWSS4JSecurityContextCreator method createSecurityContext.

/**
 * Create a SecurityContext and store it on the SoapMessage parameter
 */
public void createSecurityContext(SoapMessage msg, WSHandlerResult handlerResult) {
    boolean allowUnsignedSamlPrincipals = SecurityUtils.getSecurityPropertyBoolean(SecurityConstants.ENABLE_UNSIGNED_SAML_ASSERTION_PRINCIPAL, msg, false);
    boolean allowUTNoPassword = SecurityUtils.getSecurityPropertyBoolean(SecurityConstants.ENABLE_UT_NOPASSWORD_PRINCIPAL, msg, false);
    boolean useJAASSubject = true;
    String useJAASSubjectStr = (String) SecurityUtils.getSecurityPropertyValue(SecurityConstants.SC_FROM_JAAS_SUBJECT, msg);
    if (useJAASSubjectStr != null) {
        useJAASSubject = Boolean.parseBoolean(useJAASSubjectStr);
    }
    // Now go through the results in a certain order to set up a security context. Highest priority is first.
    Map<Integer, List<WSSecurityEngineResult>> actionResults = handlerResult.getActionResults();
    for (Integer resultPriority : securityPriorities) {
        if ((resultPriority == WSConstants.ST_UNSIGNED && !allowUnsignedSamlPrincipals) || (resultPriority == WSConstants.UT_NOPASSWORD && !allowUTNoPassword)) {
            continue;
        }
        List<WSSecurityEngineResult> foundResults = actionResults.get(resultPriority);
        if (foundResults != null && !foundResults.isEmpty()) {
            for (WSSecurityEngineResult result : foundResults) {
                if (!skipResult(resultPriority, result)) {
                    SecurityContext context = createSecurityContext(msg, useJAASSubject, result);
                    if (context != null) {
                        msg.put(SecurityContext.class, context);
                        return;
                    }
                }
            }
        }
    }
}