Examples with UserPrincipal org.apache.karaf.jaas.boot.principal.UserPrincipal used on opensource projects

Example 1 with UserPrincipal

use of org.apache.karaf.jaas.boot.principal.UserPrincipal in project fabric8 by jboss-fuse.

the class ZookeeperBackingEngine method listUsers.

/**
 * List Users
 */
public List<UserPrincipal> listUsers() {
    List<UserPrincipal> result = new ArrayList<UserPrincipal>();
    for (String userName : users.keySet()) {
        if (userName.startsWith(GROUP_PREFIX)) {
            continue;
        }
        UserPrincipal userPrincipal = new UserPrincipal(userName);
        result.add(userPrincipal);
    }
    return result;
}

Example 2 with UserPrincipal

use of org.apache.karaf.jaas.boot.principal.UserPrincipal in project fabric8 by jboss-fuse.

the class ZookeeperLoginModule method login.

@Override
public boolean login() throws LoginException {
    boolean result;
    String user = null;
    try {
        Callback[] callbacks = new Callback[2];
        callbacks[0] = new NameCallback("Username: ");
        callbacks[1] = new PasswordCallback("Password: ", false);
        try {
            callbackHandler.handle(callbacks);
        } catch (IOException ioe) {
            throw new LoginException(ioe.getMessage());
        } catch (UnsupportedCallbackException uce) {
            throw new LoginException(uce.getMessage() + " not available to obtain information from user");
        }
        user = ((NameCallback) callbacks[0]).getName();
        if (user == null)
            throw new FailedLoginException("user name is null");
        if (user.startsWith(BackingEngine.GROUP_PREFIX)) {
            throw new IllegalArgumentException("Prefix not permitted in user names: " + BackingEngine.GROUP_PREFIX);
        }
        char[] tmpPassword = ((PasswordCallback) callbacks[1]).getPassword();
        if (tmpPassword == null) {
            tmpPassword = new char[0];
        }
        if (debug)
            LOG.debug("Login [" + this + "] - user=" + user + ",users=" + users);
        if (isContainerLogin(user)) {
            String token = containers.getProperty(user);
            if (token == null) {
                // force reload cache of container tokens
                CuratorFramework curator = CuratorFrameworkLocator.getCuratorFramework();
                if (curator != null) {
                    try {
                        getCachedContainerTokens(curator, true);
                        token = containers.getProperty(user);
                    } catch (Exception e) {
                        LOG.warn(e.getMessage());
                    }
                }
                // didn't help
                if (token == null) {
                    throw new FailedLoginException("Container doesn't exist");
                }
            }
            // the password is in the first position
            if (!new String(tmpPassword).equals(token)) {
                // force reload cache of container tokens
                CuratorFramework curator = CuratorFrameworkLocator.getCuratorFramework();
                if (curator != null) {
                    try {
                        getCachedContainerTokens(curator, true);
                        token = containers.getProperty(user);
                    } catch (Exception e) {
                        LOG.warn(e.getMessage());
                    }
                }
                // didn't help
                if (!new String(tmpPassword).equals(token)) {
                    throw new FailedLoginException("Tokens do not match");
                }
            }
            principals = new HashSet<Principal>();
            principals.add(new UserPrincipal(user));
            principals.add(new RolePrincipal("container"));
            principals.add(new RolePrincipal("admin"));
            subject.getPrivateCredentials().add(new String(tmpPassword));
            result = true;
        } else {
            String userInfos = users.getProperty(user);
            if (userInfos == null) {
                // force reload cache of user tokens
                CuratorFramework curator = CuratorFrameworkLocator.getCuratorFramework();
                if (curator != null) {
                    try {
                        getCachedUsers(curator, path, true);
                        userInfos = users.getProperty(user);
                    } catch (Exception e) {
                        LOG.warn(e.getMessage());
                    }
                }
                // didn't help
                if (userInfos == null) {
                    throw new FailedLoginException("User doesn't exist");
                }
            }
            // the password is in the first position
            String[] infos = userInfos.split(",");
            String password = infos[0];
            if (!checkPassword(new String(tmpPassword), password)) {
                // force reload cache of user tokens
                CuratorFramework curator = CuratorFrameworkLocator.getCuratorFramework();
                if (curator != null) {
                    try {
                        getCachedUsers(curator, path, true);
                        userInfos = users.getProperty(user);
                    } catch (Exception e) {
                        LOG.warn(e.getMessage());
                    }
                }
                // didn't help
                if (userInfos == null) {
                    throw new FailedLoginException("User doesn't exist");
                }
                infos = userInfos.split(",");
                password = infos[0];
                if (!checkPassword(new String(tmpPassword), password)) {
                    throw new FailedLoginException("Password does not match");
                }
            }
            principals = new HashSet<Principal>();
            principals.add(new UserPrincipal(user));
            for (int i = 1; i < infos.length; i++) {
                if (infos[i].trim().startsWith(BackingEngine.GROUP_PREFIX)) {
                    // it's a group reference
                    principals.add(new GroupPrincipal(infos[i].trim().substring(BackingEngine.GROUP_PREFIX.length())));
                    String groupInfo = (String) users.get(infos[i].trim());
                    if (groupInfo != null) {
                        String[] roles = groupInfo.split(",");
                        for (int j = 1; j < roles.length; j++) {
                            principals.add(new RolePrincipal(roles[j].trim()));
                        }
                    }
                } else {
                    // it's an user reference
                    principals.add(new RolePrincipal(infos[i].trim()));
                }
            }
            subject.getPrivateCredentials().add(new String(tmpPassword));
            result = true;
        }
    } catch (LoginException ex) {
        if (debug) {
            LOG.debug("Login failed {}", user, ex);
        }
        throw ex;
    }
    if (debug) {
        LOG.debug("Successfully logged in {}", user);
    }
    return result;
}

Example 3 with UserPrincipal

use of org.apache.karaf.jaas.boot.principal.UserPrincipal in project fabric8 by jboss-fuse.

the class FabricKarafTestSupport method executeCommands.

/**
 * Executes a shell command and returns output as a String.
 * Commands have a default timeout of 10 seconds.
 * @param timeout The amount of time in millis to wait for the command to execute.
 * @param silent  Specifies if the command should be displayed in the screen.
 * @param commands The command to execute.
 */
public static String executeCommands(final long timeout, final boolean silent, final Set<RolePrincipal> roles, final String... commands) {
    String response = null;
    final ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
    final PrintStream printStream = new PrintStream(byteArrayOutputStream);
    final CommandProcessor commandProcessor = ServiceLocator.awaitService(FrameworkUtil.getBundle(FabricKarafTestSupport.class).getBundleContext(), CommandProcessor.class);
    final CommandSession commandSession = commandProcessor.createSession(System.in, printStream, printStream);
    commandSession.put("APPLICATION", System.getProperty("runtime.id", "root"));
    commandSession.put("USER", "karaf");
    FutureTask<String> commandFuture = new FutureTask<String>(new Callable<String>() {

        public String call() throws Exception {
            Subject subject = new Subject();
            subject.getPrincipals().add(new UserPrincipal("admin"));
            subject.getPrincipals().add(new RolePrincipal("admin"));
            subject.getPrincipals().add(new RolePrincipal("manager"));
            subject.getPrincipals().add(new RolePrincipal("viewer"));
            if (roles != null) {
                for (RolePrincipal role : roles) {
                    subject.getPrincipals().add(role);
                }
            }
            return Subject.doAs(subject, new PrivilegedAction<String>() {

                @Override
                public String run() {
                    for (String command : commands) {
                        boolean keepRunning = true;
                        if (!silent) {
                            System.out.println(command);
                            System.out.flush();
                        }
                        LOGGER.info("Executing command: " + command);
                        while (!Thread.currentThread().isInterrupted() && keepRunning) {
                            try {
                                commandSession.execute(command);
                                keepRunning = false;
                            } catch (Exception e) {
                                if (retryException(e)) {
                                    keepRunning = true;
                                    sleep(1000);
                                } else {
                                    throw new CommandExecutionException(e);
                                }
                            }
                        }
                    }
                    printStream.flush();
                    return byteArrayOutputStream.toString();
                }
            });
        }
    });
    try {
        executor.submit(commandFuture);
        response = commandFuture.get(timeout, TimeUnit.MILLISECONDS);
    } catch (ExecutionException e) {
        throw CommandExecutionException.launderThrowable(e.getCause());
    } catch (Exception e) {
        throw CommandExecutionException.launderThrowable(e);
    }
    return response;
}

Example 4 with UserPrincipal

use of org.apache.karaf.jaas.boot.principal.UserPrincipal in project ddf by codice.

the class RoleClaimsHandlerTest method testRetrieveClaimsValuesIgnoredReferences.

@Test
public void testRetrieveClaimsValuesIgnoredReferences() throws LdapException, SearchResultReferenceIOException {
    BindResult bindResult = mock(BindResult.class);
    ClaimsParameters claimsParameters;
    Connection connection = mock(Connection.class);
    ConnectionEntryReader membershipReader = mock(ConnectionEntryReader.class);
    ConnectionEntryReader groupNameReader = mock(ConnectionEntryReader.class);
    LinkedAttribute membershipAttribute = new LinkedAttribute("uid");
    LinkedAttribute groupNameAttribute = new LinkedAttribute("cn");
    ClaimsCollection processedClaims;
    RoleClaimsHandler claimsHandler;
    SearchResultEntry membershipSearchResult = mock(SearchResultEntry.class);
    DN resultDN = DN.valueOf("uid=tstark,");
    SearchResultEntry groupNameSearchResult = mock(SearchResultEntry.class);
    String groupName = "avengers";
    when(bindResult.isSuccess()).thenReturn(true);
    membershipAttribute.add("tstark");
    when(membershipSearchResult.getAttribute(anyString())).thenReturn(membershipAttribute);
    // simulate two items in the list (a reference and an entry)
    when(membershipReader.hasNext()).thenReturn(true, true, false);
    // test a reference followed by entries thereafter
    when(membershipReader.isEntry()).thenReturn(false, true);
    when(membershipReader.readEntry()).thenReturn(membershipSearchResult);
    when(membershipSearchResult.getName()).thenReturn(resultDN);
    groupNameAttribute.add(groupName);
    when(groupNameSearchResult.getAttribute(anyString())).thenReturn(groupNameAttribute);
    when(groupNameReader.hasNext()).thenReturn(true, true, false);
    when(groupNameReader.isEntry()).thenReturn(false, true);
    when(groupNameReader.readEntry()).thenReturn(groupNameSearchResult);
    when(connection.bind(any())).thenReturn(bindResult);
    when(connection.search(any(), any(), eq("(&(objectClass=groupOfNames)(|(member=uid=tstark,)(member=uid=tstark,)))"), any())).thenReturn(groupNameReader);
    when(connection.search(anyString(), any(), anyString(), matches("uid"))).thenReturn(membershipReader);
    claimsHandler = new RoleClaimsHandler(new AttributeMapLoader(new SubjectUtils()));
    ConnectionFactory mockConnectionFactory = mock(ConnectionFactory.class);
    when(mockConnectionFactory.getConnection()).thenReturn(connection);
    claimsHandler.setLdapConnectionFactory(mockConnectionFactory);
    claimsHandler.setBindMethod("Simple");
    claimsHandler.setBindUserCredentials("foo");
    claimsHandler.setBindUserDN("bar");
    claimsParameters = new ClaimsParametersImpl(new UserPrincipal(USER_CN), new HashSet<>(), new HashMap<>());
    processedClaims = claimsHandler.retrieveClaims(claimsParameters);
    assertThat(processedClaims, hasSize(1));
    Claim claim = processedClaims.get(0);
    assertThat(claim.getValues(), hasSize(1));
    assertThat(claim.getValues().get(0), equalTo(groupName));
}

Example 5 with UserPrincipal

use of org.apache.karaf.jaas.boot.principal.UserPrincipal in project ddf by codice.

the class SslLdapLoginModule method doLogin.

protected boolean doLogin() throws LoginException {
    // --------- EXTRACT USERNAME AND PASSWORD FOR LDAP LOOKUP -------------
    Callback[] callbacks = new Callback[2];
    callbacks[0] = new NameCallback("Username: ");
    callbacks[1] = new PasswordCallback("Password: ", false);
    try {
        callbackHandler.handle(callbacks);
    } catch (IOException ioException) {
        LOGGER.debug("Exception while handling login.", ioException);
        throw new LoginException(ioException.getMessage());
    } catch (UnsupportedCallbackException unsupportedCallbackException) {
        LOGGER.debug("Exception while handling login.", unsupportedCallbackException);
        throw new LoginException(unsupportedCallbackException.getMessage() + " not available to obtain information from user.");
    }
    user = ((NameCallback) callbacks[0]).getName();
    if (user == null) {
        return false;
    }
    user = user.trim();
    validateUsername(user);
    char[] tmpPassword = ((PasswordCallback) callbacks[1]).getPassword();
    // this method.
    if ("none".equalsIgnoreCase(getBindMethod()) && (tmpPassword != null)) {
        LOGGER.debug("Changing from authentication = none to simple since user or password was specified.");
        // default to simple so that the provided user/password will get checked
        setBindMethod(DEFAULT_AUTHENTICATION);
    }
    if (tmpPassword == null) {
        tmpPassword = new char[0];
    }
    // ---------------------------------------------------------------------
    // RESET OBJECT STATE AND DECLARE LOCAL VARS
    principals = new HashSet<>();
    Connection connection;
    String userDn;
    // ------------- CREATE CONNECTION #1 ----------------------------------
    try {
        connection = ldapConnectionPool.borrowObject();
    } catch (Exception e) {
        LOGGER.info("Unable to obtain ldap connection from pool", e);
        return false;
    }
    try {
        if (connection != null) {
            // ------------- BIND #1 (CONNECTION USERNAME & PASSWORD) --------------
            try {
                BindRequest request;
                switch(bindMethod) {
                    case "Simple":
                        request = Requests.newSimpleBindRequest(connectionUsername, connectionPassword);
                        break;
                    case "SASL":
                        request = Requests.newPlainSASLBindRequest(connectionUsername, connectionPassword);
                        break;
                    case "GSSAPI SASL":
                        request = Requests.newGSSAPISASLBindRequest(connectionUsername, connectionPassword);
                        ((GSSAPISASLBindRequest) request).setRealm(realm);
                        ((GSSAPISASLBindRequest) request).setKDCAddress(kdcAddress);
                        break;
                    case "Digest MD5 SASL":
                        request = Requests.newDigestMD5SASLBindRequest(connectionUsername, connectionPassword);
                        ((DigestMD5SASLBindRequest) request).setCipher(DigestMD5SASLBindRequest.CIPHER_HIGH);
                        ((DigestMD5SASLBindRequest) request).getQOPs().clear();
                        ((DigestMD5SASLBindRequest) request).getQOPs().add(DigestMD5SASLBindRequest.QOP_AUTH_CONF);
                        ((DigestMD5SASLBindRequest) request).getQOPs().add(DigestMD5SASLBindRequest.QOP_AUTH_INT);
                        ((DigestMD5SASLBindRequest) request).getQOPs().add(DigestMD5SASLBindRequest.QOP_AUTH);
                        if (StringUtils.isNotEmpty(realm)) {
                            ((DigestMD5SASLBindRequest) request).setRealm(realm);
                        }
                        break;
                    default:
                        request = Requests.newSimpleBindRequest(connectionUsername, connectionPassword);
                        break;
                }
                LOGGER.trace("Attempting LDAP bind for administrator: {}", connectionUsername);
                BindResult bindResult = connection.bind(request);
                if (!bindResult.isSuccess()) {
                    LOGGER.debug(BIND_FAILURE_MSG);
                    return false;
                }
            } catch (LdapException e) {
                LOGGER.debug("Unable to bind to LDAP server.", e);
                return false;
            }
            LOGGER.trace("LDAP bind successful for administrator: {}", connectionUsername);
            // --------- SEARCH #1, FIND USER DISTINGUISHED NAME -----------
            SearchScope scope;
            scope = userSearchSubtree ? SearchScope.WHOLE_SUBTREE : SearchScope.SINGLE_LEVEL;
            userFilter = userFilter.replaceAll(Pattern.quote("%u"), Matcher.quoteReplacement(user));
            userFilter = userFilter.replace("\\", "\\\\");
            LOGGER.trace("Performing LDAP query for user: {} at {} with filter {}", user, userBaseDN, userFilter);
            try (ConnectionEntryReader entryReader = connection.search(userBaseDN, scope, userFilter)) {
                while (entryReader.hasNext() && entryReader.isReference()) {
                    LOGGER.debug("Referral ignored while searching for user {}", user);
                    entryReader.readReference();
                }
                if (!entryReader.hasNext()) {
                    LOGGER.info("User {} not found in LDAP.", user);
                    return false;
                }
                SearchResultEntry searchResultEntry = entryReader.readEntry();
                userDn = searchResultEntry.getName().toString();
            } catch (LdapException | SearchResultReferenceIOException e) {
                LOGGER.info("Unable to read contents of LDAP user search.", e);
                return false;
            }
            // Validate user's credentials.
            try {
                LOGGER.trace("Attempting LDAP bind for user: {}", userDn);
                BindResult bindResult = connection.bind(userDn, tmpPassword);
                if (!bindResult.isSuccess()) {
                    LOGGER.info(BIND_FAILURE_MSG);
                    return false;
                }
            } catch (Exception e) {
                LOGGER.info("Unable to bind user: {} to LDAP server.", userDn, e);
                return false;
            }
            LOGGER.trace("LDAP bind successful for user: {}", userDn);
            // ---------- ADD USER AS PRINCIPAL --------------------------------
            principals.add(new UserPrincipal(user));
            // ----- BIND #3 (CONNECTION USERNAME & PASSWORD) --------------
            try {
                LOGGER.trace("Attempting LDAP bind for administrator: {}", connectionUsername);
                BindResult bindResult = connection.bind(connectionUsername, connectionPassword);
                if (!bindResult.isSuccess()) {
                    LOGGER.info(BIND_FAILURE_MSG);
                    return false;
                }
            } catch (LdapException e) {
                LOGGER.info("Unable to bind to LDAP server.", e);
                return false;
            }
            LOGGER.trace("LDAP bind successful for administrator: {}", connectionUsername);
            // --------- SEARCH #3, GET ROLES ------------------------------
            scope = roleSearchSubtree ? SearchScope.WHOLE_SUBTREE : SearchScope.SINGLE_LEVEL;
            roleFilter = roleFilter.replaceAll(Pattern.quote("%u"), Matcher.quoteReplacement(user));
            roleFilter = roleFilter.replaceAll(Pattern.quote("%dn"), Matcher.quoteReplacement(userBaseDN));
            roleFilter = roleFilter.replaceAll(Pattern.quote("%fqdn"), Matcher.quoteReplacement(userDn));
            roleFilter = roleFilter.replace("\\", "\\\\");
            LOGGER.trace("Performing LDAP query for roles for user: {} at {} with filter {} for role attribute {}", user, roleBaseDN, roleFilter, roleNameAttribute);
            // ------------- ADD ROLES AS NEW PRINCIPALS -------------------
            try (ConnectionEntryReader entryReader = connection.search(roleBaseDN, scope, roleFilter, roleNameAttribute)) {
                SearchResultEntry entry;
                while (entryReader.hasNext()) {
                    if (entryReader.isEntry()) {
                        entry = entryReader.readEntry();
                        Attribute attr = entry.getAttribute(roleNameAttribute);
                        if (attr == null) {
                            throw new LoginException("No attributes returned for [" + roleNameAttribute + " : " + roleBaseDN + "]");
                        }
                        for (ByteString role : attr) {
                            principals.add(new RolePrincipal(role.toString()));
                        }
                    } else {
                        // Got a continuation reference.
                        final SearchResultReference ref = entryReader.readReference();
                        LOGGER.debug("Skipping result reference: {}", ref.getURIs());
                    }
                }
            } catch (Exception e) {
                LOGGER.debug("Exception while getting roles for [" + user + "].", e);
                throw new LoginException("Can't get roles for [" + user + "]: " + e.getMessage());
            }
        } else {
            LOGGER.trace("LDAP Connection was null could not authenticate user.");
            return false;
        }
        succeeded = true;
        commitSucceeded = true;
        return true;
    } finally {
        ldapConnectionPool.returnObject(connection);
    }
}