Examples with TLSSessionInfo org.apache.cxf.security.transport.TLSSessionInfo used on opensource projects

Example 11 with TLSSessionInfo

use of org.apache.cxf.security.transport.TLSSessionInfo in project cxf by apache.

the class JAASLoginInterceptorTest method testLoginWithTlsHandler.

@Test
public void testLoginWithTlsHandler() {
    JAASLoginInterceptor jaasInt = createTestJaasLoginInterceptor();
    CallbackHandlerTlsCert tlsHandler = new CallbackHandlerTlsCert();
    tlsHandler.setFixedPassword(TestUserPasswordLoginModule.TESTPASS);
    CertKeyToUserNameMapper certMapper = new CertKeyToUserNameMapper();
    certMapper.setKey("CN");
    tlsHandler.setCertMapper(certMapper);
    jaasInt.setCallbackHandlerProviders(Collections.singletonList((CallbackHandlerProvider) tlsHandler));
    Message message = new MessageImpl();
    TLSSessionInfo sessionInfo = new TLSSessionInfo("", null, new Certificate[] { createTestCert(TEST_SUBJECT_DN) });
    message.put(TLSSessionInfo.class, sessionInfo);
    jaasInt.handleMessage(message);
}

Example 12 with TLSSessionInfo

use of org.apache.cxf.security.transport.TLSSessionInfo in project cxf by apache.

the class OAuthRequestFilter method validateRequest.

protected void validateRequest(Message m) {
    if (isCorsRequest(m)) {
        return;
    }
    // Get the scheme and its data, Bearer only is supported by default
    // WWW-Authenticate with the list of supported schemes will be sent back
    // if the scheme is not accepted
    String[] authParts = getAuthorizationParts(m);
    if (authParts.length < 2) {
        throw ExceptionUtils.toForbiddenException(null, null);
    }
    String authScheme = authParts[0];
    String authSchemeData = authParts[1];
    // Get the access token
    AccessTokenValidation accessTokenV = getAccessTokenValidation(authScheme, authSchemeData, null);
    if (!accessTokenV.isInitialValidationSuccessful()) {
        AuthorizationUtils.throwAuthorizationFailure(supportedSchemes, realm);
    }
    // Check audiences
    String validAudience = validateAudiences(accessTokenV.getAudiences());
    // Check if token was issued by the supported issuer
    if (issuer != null && !issuer.equals(accessTokenV.getTokenIssuer())) {
        AuthorizationUtils.throwAuthorizationFailure(supportedSchemes, realm);
    }
    // Find the scopes which match the current request
    List<OAuthPermission> permissions = accessTokenV.getTokenScopes();
    List<OAuthPermission> matchingPermissions = new ArrayList<>();
    HttpServletRequest req = getMessageContext().getHttpServletRequest();
    for (OAuthPermission perm : permissions) {
        boolean uriOK = checkRequestURI(req, perm.getUris());
        boolean verbOK = checkHttpVerb(req, perm.getHttpVerbs());
        boolean scopeOk = checkScopeProperty(perm.getPermission());
        if (uriOK && verbOK && scopeOk) {
            matchingPermissions.add(perm);
        }
    }
    if (!permissions.isEmpty() && matchingPermissions.isEmpty() || allPermissionsMatch && (matchingPermissions.size() != permissions.size()) || !requiredScopes.isEmpty() && requiredScopes.size() != matchingPermissions.size()) {
        String message = "Client has no valid permissions";
        LOG.warning(message);
        throw ExceptionUtils.toForbiddenException(null, null);
    }
    if (accessTokenV.getClientIpAddress() != null) {
        String remoteAddress = getMessageContext().getHttpServletRequest().getRemoteAddr();
        if (remoteAddress == null || accessTokenV.getClientIpAddress().equals(remoteAddress)) {
            String message = "Client IP Address is invalid";
            LOG.warning(message);
            throw ExceptionUtils.toForbiddenException(null, null);
        }
    }
    if (blockPublicClients && !accessTokenV.isClientConfidential()) {
        String message = "Only Confidential Clients are supported";
        LOG.warning(message);
        throw ExceptionUtils.toForbiddenException(null, null);
    }
    if (am != null && !am.equals(accessTokenV.getTokenSubject().getAuthenticationMethod())) {
        String message = "The token has been authorized by the resource owner " + "using an unsupported authentication method";
        LOG.warning(message);
        throw ExceptionUtils.toNotAuthorizedException(null, null);
    }
    // Check Client Certificate Binding if any
    String certThumbprint = accessTokenV.getExtraProps().get(JoseConstants.HEADER_X509_THUMBPRINT_SHA256);
    if (certThumbprint != null) {
        TLSSessionInfo tlsInfo = getTlsSessionInfo();
        X509Certificate cert = tlsInfo == null ? null : OAuthUtils.getRootTLSCertificate(tlsInfo);
        if (cert == null || !OAuthUtils.compareCertificateThumbprints(cert, certThumbprint)) {
            throw ExceptionUtils.toNotAuthorizedException(null, null);
        }
    }
    // Create the security context and make it available on the message
    SecurityContext sc = createSecurityContext(req, accessTokenV);
    m.put(SecurityContext.class, sc);
    // Also set the OAuthContext
    OAuthContext oauthContext = new OAuthContext(accessTokenV.getTokenSubject(), accessTokenV.getClientSubject(), matchingPermissions, accessTokenV.getTokenGrantType());
    oauthContext.setClientId(accessTokenV.getClientId());
    oauthContext.setClientConfidential(accessTokenV.isClientConfidential());
    oauthContext.setTokenKey(accessTokenV.getTokenKey());
    oauthContext.setTokenAudience(validAudience);
    oauthContext.setTokenIssuer(accessTokenV.getTokenIssuer());
    oauthContext.setTokenRequestParts(authParts);
    oauthContext.setTokenExtraProperties(accessTokenV.getExtraProps());
    m.setContent(OAuthContext.class, oauthContext);
}

Example 13 with TLSSessionInfo

use of org.apache.cxf.security.transport.TLSSessionInfo in project cxf by apache.

the class CallbackHandlerTlsCert method getCertificate.

/**
 * Extracts certificate from message, expecting to find TLSSessionInfo inside.
 *
 * @param message
 */
private Certificate getCertificate(Message message) {
    TLSSessionInfo tlsSessionInfo = message.get(TLSSessionInfo.class);
    if (tlsSessionInfo == null) {
        throw new SecurityException("Not TLS connection");
    }
    Certificate[] certificates = tlsSessionInfo.getPeerCertificates();
    if (certificates == null || certificates.length == 0) {
        throw new SecurityException("No certificate found");
    }
    // Due to RFC5246, senders certificates always comes 1st
    return certificates[0];
}