Examples with AuthorizationException org.apache.shiro.authz.AuthorizationException used on opensource projects

Example 16 with AuthorizationException

use of org.apache.shiro.authz.AuthorizationException in project graylog2-server by Graylog2.

the class ShiroAuthorizationFilter method filter.

@Override
public void filter(ContainerRequestContext requestContext) throws IOException {
    final SecurityContext securityContext = requestContext.getSecurityContext();
    if (securityContext instanceof ShiroSecurityContext) {
        final ShiroSecurityContext context = (ShiroSecurityContext) securityContext;
        final String userId = RestTools.getUserIdFromRequest(requestContext);
        final ContextAwarePermissionAnnotationHandler annotationHandler = new ContextAwarePermissionAnnotationHandler(context);
        final String[] requiredPermissions = annotation.value();
        try {
            LOG.debug("Checking authorization for user [{}], needs permissions: {}", userId, requiredPermissions);
            annotationHandler.assertAuthorized(annotation);
        } catch (AuthorizationException e) {
            LOG.info("Not authorized. User <{}> is missing permissions {} to perform <{} {}>", userId, Arrays.toString(requiredPermissions), requestContext.getMethod(), requestContext.getUriInfo().getPath());
            throw new ForbiddenException("Not authorized");
        }
    } else {
        throw new ForbiddenException();
    }
}

Example 17 with AuthorizationException

use of org.apache.shiro.authz.AuthorizationException in project ddf by codice.

the class AbstractAuthorizingRealm method doGetAuthorizationInfo.

/**
 * Takes the security attributes about the subject of the incoming security token and builds sets
 * of permissions and roles for use in further checking.
 *
 * @param principalCollection holds the security assertions for the primary principal of this
 *     request
 * @return a new collection of permissions and roles corresponding to the security assertions
 * @throws AuthorizationException if there are no security assertions associated with this
 *     principal collection or if the token cannot be processed successfully.
 */
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
    SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
    LOGGER.debug("Retrieving authorization info for {}", principalCollection.getPrimaryPrincipal());
    Collection<SecurityAssertion> assertions = principalCollection.byType(SecurityAssertion.class);
    if (assertions.isEmpty()) {
        String msg = "No assertion found, cannot retrieve authorization info.";
        throw new AuthorizationException(msg);
    }
    List<AttributeStatement> attributeStatements = assertions.stream().map(SecurityAssertion::getAttributeStatements).flatMap(List::stream).collect(Collectors.toList());
    Set<Permission> permissions = new HashSet<>();
    Set<String> roles = new HashSet<>();
    Map<String, Set<String>> permissionsMap = new HashMap<>();
    Collection<Expansion> expansionServices = getUserExpansionServices();
    for (AttributeStatement curStatement : attributeStatements) {
        addAttributesToMap(curStatement.getAttributes(), permissionsMap, expansionServices);
    }
    for (Map.Entry<String, Set<String>> entry : permissionsMap.entrySet()) {
        permissions.add(new KeyValuePermissionImpl(entry.getKey(), entry.getValue()));
        if (LOGGER.isDebugEnabled()) {
            LOGGER.debug("Adding permission: {} : {}", entry.getKey(), StringUtils.join(entry.getValue(), ","));
        }
    }
    if (permissionsMap.containsKey(SAML_ROLE)) {
        roles.addAll(permissionsMap.get(SAML_ROLE));
        if (LOGGER.isDebugEnabled()) {
            LOGGER.debug("Adding roles to authorization info: {}", StringUtils.join(roles, ","));
        }
    }
    info.setObjectPermissions(permissions);
    info.setRoles(roles);
    return info;
}

Example 18 with AuthorizationException

use of org.apache.shiro.authz.AuthorizationException in project mica2 by obiba.

the class DataAccessRequestResource method archive.

@PUT
@Path("/_archive")
public Response archive(@PathParam("id") String id) {
    if (!SecurityUtils.getSubject().hasRole(Roles.MICA_DAO) && !SecurityUtils.getSubject().hasRole(Roles.MICA_ADMIN)) {
        throw new AuthorizationException();
    }
    DataAccessRequest request = dataAccessRequestService.findById(id);
    if (DataAccessEntityStatus.APPROVED.equals(request.getStatus())) {
        DataAccessRequestTimeline timeline = reportNotificationService.getReportsTimeline(request);
        if (!timeline.hasEndDate())
            throw new BadRequestException("Cannot archive: no data access request end date is defined");
        if (new Date().before(timeline.getEndDate()))
            throw new BadRequestException("Cannot archive: data access request end date not reached");
        request.setArchived(true);
        dataAccessRequestService.archive(request, true);
    } else {
        throw new BadRequestException("Cannot archive: data access request must have been approved before being archived");
    }
    return Response.noContent().build();
}

Example 19 with AuthorizationException

use of org.apache.shiro.authz.AuthorizationException in project mica2 by obiba.

the class DataAccessRequestResource method changeApplicant.

@PUT
@Path("/_applicant")
public Response changeApplicant(@PathParam("id") String id, @QueryParam("username") String applicant) {
    if (!SecurityUtils.getSubject().hasRole(Roles.MICA_DAO) && !SecurityUtils.getSubject().hasRole(Roles.MICA_ADMIN)) {
        throw new AuthorizationException();
    }
    if (Strings.isNullOrEmpty(applicant))
        throw new IllegalArgumentException("An applicant name is required");
    DataAccessRequest request = dataAccessRequestService.findById(id);
    String originalApplicant = request.getApplicant();
    dataAccessRequestService.changeApplicantAndSave(request, applicant);
    commentsService.findPublicComments("/data-access-request", id).stream().filter(comment -> comment.getCreatedBy().equals(originalApplicant)).map(comment -> Comment.newBuilder(comment).createdBy(applicant).build()).forEach(comment -> commentsService.save(comment, null));
    return Response.noContent().build();
}

Example 20 with AuthorizationException

use of org.apache.shiro.authz.AuthorizationException in project mica2 by obiba.

the class DataAccessRequestResource method unarchive.

@DELETE
@Path("/_archive")
public Response unarchive(@PathParam("id") String id) {
    if (!SecurityUtils.getSubject().hasRole(Roles.MICA_ADMIN)) {
        throw new AuthorizationException();
    }
    DataAccessRequest request = dataAccessRequestService.findById(id);
    dataAccessRequestService.archive(request, false);
    return Response.noContent().build();
}