Examples with UsernamePrincipal org.apache.qpid.server.security.auth.UsernamePrincipal used on opensource projects

Example 26 with UsernamePrincipal

use of org.apache.qpid.server.security.auth.UsernamePrincipal in project qpid-broker-j by apache.

the class GoogleOAuth2IdentityResolverService method getUserPrincipal.

@Override
public Principal getUserPrincipal(final OAuth2AuthenticationProvider<?> authenticationProvider, String accessToken, final NamedAddressSpace addressSpace) throws IOException, IdentityResolverException {
    URL userInfoEndpoint = authenticationProvider.getIdentityResolverEndpointURI(addressSpace).toURL();
    TrustStore trustStore = authenticationProvider.getTrustStore();
    ConnectionBuilder connectionBuilder = new ConnectionBuilder(userInfoEndpoint);
    connectionBuilder.setConnectTimeout(authenticationProvider.getConnectTimeout()).setReadTimeout(authenticationProvider.getReadTimeout());
    if (trustStore != null) {
        try {
            connectionBuilder.setTrustMangers(trustStore.getTrustManagers());
        } catch (GeneralSecurityException e) {
            throw new ServerScopedRuntimeException("Cannot initialise TLS", e);
        }
    }
    connectionBuilder.setTlsProtocolWhiteList(authenticationProvider.getTlsProtocolWhiteList()).setTlsProtocolBlackList(authenticationProvider.getTlsProtocolBlackList()).setTlsCipherSuiteWhiteList(authenticationProvider.getTlsCipherSuiteWhiteList()).setTlsCipherSuiteBlackList(authenticationProvider.getTlsCipherSuiteBlackList());
    LOGGER.debug("About to call identity service '{}'", userInfoEndpoint);
    HttpURLConnection connection = connectionBuilder.build();
    connection.setRequestProperty("Accept-Charset", UTF8);
    connection.setRequestProperty("Accept", "application/json");
    connection.setRequestProperty("Authorization", "Bearer " + accessToken);
    connection.connect();
    try (InputStream input = OAuth2Utils.getResponseStream(connection)) {
        int responseCode = connection.getResponseCode();
        LOGGER.debug("Call to identity service '{}' complete, response code : {}", userInfoEndpoint, responseCode);
        Map<String, String> responseMap;
        try {
            responseMap = _objectMapper.readValue(input, Map.class);
        } catch (JsonProcessingException e) {
            throw new IOException(String.format("Identity resolver '%s' did not return json", userInfoEndpoint), e);
        }
        if (responseCode != 200) {
            throw new IdentityResolverException(String.format("Identity resolver '%s' failed, response code %d", userInfoEndpoint, responseCode));
        }
        final String googleId = responseMap.get("sub");
        if (googleId == null) {
            throw new IdentityResolverException(String.format("Identity resolver '%s' failed, response did not include 'sub'", userInfoEndpoint));
        }
        return new UsernamePrincipal(googleId, authenticationProvider);
    }
}

Example 27 with UsernamePrincipal

use of org.apache.qpid.server.security.auth.UsernamePrincipal in project qpid-broker-j by apache.

the class KeycloakOAuth2IdentityResolverService method getUserPrincipal.

@Override
public Principal getUserPrincipal(final OAuth2AuthenticationProvider<?> authenticationProvider, String accessToken, final NamedAddressSpace addressSpace) throws IOException, IdentityResolverException {
    URL userInfoEndpoint = authenticationProvider.getIdentityResolverEndpointURI(addressSpace).toURL();
    TrustStore trustStore = authenticationProvider.getTrustStore();
    ConnectionBuilder connectionBuilder = new ConnectionBuilder(userInfoEndpoint);
    connectionBuilder.setConnectTimeout(authenticationProvider.getConnectTimeout()).setReadTimeout(authenticationProvider.getReadTimeout());
    if (trustStore != null) {
        try {
            connectionBuilder.setTrustMangers(trustStore.getTrustManagers());
        } catch (GeneralSecurityException e) {
            throw new ServerScopedRuntimeException("Cannot initialise TLS", e);
        }
    }
    connectionBuilder.setTlsProtocolWhiteList(authenticationProvider.getTlsProtocolWhiteList()).setTlsProtocolBlackList(authenticationProvider.getTlsProtocolBlackList()).setTlsCipherSuiteWhiteList(authenticationProvider.getTlsCipherSuiteWhiteList()).setTlsCipherSuiteBlackList(authenticationProvider.getTlsCipherSuiteBlackList());
    LOGGER.debug("About to call identity service '{}'", userInfoEndpoint);
    HttpURLConnection connection = connectionBuilder.build();
    connection.setRequestProperty("Accept-Charset", UTF8);
    connection.setRequestProperty("Accept", "application/json");
    connection.setRequestProperty("Authorization", "Bearer " + accessToken);
    connection.connect();
    try (InputStream input = OAuth2Utils.getResponseStream(connection)) {
        int responseCode = connection.getResponseCode();
        LOGGER.debug("Call to identity service '{}' complete, response code : {}", userInfoEndpoint, responseCode);
        Map<String, String> responseMap;
        try {
            responseMap = _objectMapper.readValue(input, Map.class);
        } catch (JsonProcessingException e) {
            throw new IOException(String.format("Identity resolver '%s' did not return json", userInfoEndpoint), e);
        }
        if (responseCode != 200) {
            throw new IdentityResolverException(String.format("Identity resolver '%s' failed, response code %d", userInfoEndpoint, responseCode));
        }
        String username = responseMap.get("preferred_username");
        if (username == null) {
            username = responseMap.get("sub");
            if (username == null) {
                throw new IdentityResolverException(String.format("Identity resolver '%s' failed, response did not include 'sub'", userInfoEndpoint));
            }
        }
        return new UsernamePrincipal(username, authenticationProvider);
    }
}

Example 28 with UsernamePrincipal

use of org.apache.qpid.server.security.auth.UsernamePrincipal in project qpid-broker-j by apache.

the class AbstractPasswordFilePrincipalDatabaseTest method testRejectUsernameWithColon.

public void testRejectUsernameWithColon() throws Exception {
    String usernameWithColon = "user:name";
    Principal principal = new UsernamePrincipal(usernameWithColon, null);
    File testFile = createPasswordFile(0, 0);
    loadPasswordFile(testFile);
    try {
        getDatabase().createPrincipal(principal, TEST_PASSWORD_CHARS);
        fail("Username with colon should be rejected");
    } catch (IllegalArgumentException e) {
    // pass
    }
}

Example 29 with UsernamePrincipal

use of org.apache.qpid.server.security.auth.UsernamePrincipal in project qpid-broker-j by apache.

the class AbstractPasswordFilePrincipalDatabaseTest method testRejectPasswordWithColon.

public void testRejectPasswordWithColon() throws Exception {
    String username = "username";
    String passwordWithColon = "pass:word";
    Principal principal = new UsernamePrincipal(username, null);
    File testFile = createPasswordFile(0, 0);
    loadPasswordFile(testFile);
    try {
        getDatabase().createPrincipal(principal, passwordWithColon.toCharArray());
        fail("Password with colon should be rejected");
    } catch (IllegalArgumentException e) {
    // pass
    }
    getDatabase().createPrincipal(_principal, TEST_PASSWORD_CHARS);
    try {
        getDatabase().updatePassword(_principal, passwordWithColon.toCharArray());
        fail("Password with colon should be rejected");
    } catch (IllegalArgumentException e) {
    // pass
    }
}

Example 30 with UsernamePrincipal

use of org.apache.qpid.server.security.auth.UsernamePrincipal in project qpid-broker-j by apache.

the class ExternalAuthenticationManagerTest method testAuthenticatePrincipalCnAndDc.

public void testAuthenticatePrincipalCnAndDc() throws Exception {
    X500Principal principal = new X500Principal("CN=person, DC=example, DC=com");
    UsernamePrincipal expectedPrincipal = new UsernamePrincipal("person@example.com", _manager);
    when(_saslSettings.getExternalPrincipal()).thenReturn(principal);
    SaslNegotiator negotiator = _manager.createSaslNegotiator("EXTERNAL", _saslSettings, null);
    AuthenticationResult result = negotiator.handleResponse(new byte[0]);
    assertNotNull(result);
    assertEquals("Expected authentication to be successful", AuthenticationResult.AuthenticationStatus.SUCCESS, result.getStatus());
    assertOnlyContainsWrapped(expectedPrincipal, result.getPrincipals());
    assertEquals("person@example.com", result.getMainPrincipal().getName());
}