Examples with SecurityManager org.apache.shiro.mgt.SecurityManager used on opensource projects

Example 21 with SecurityManager

use of org.apache.shiro.mgt.SecurityManager in project neo4j by neo4j.

the class ShiroSubjectFactory method createSubject.

@Override
public Subject createSubject(SubjectContext context) {
    SecurityManager securityManager = context.resolveSecurityManager();
    Session session = context.resolveSession();
    boolean sessionCreationEnabled = context.isSessionCreationEnabled();
    PrincipalCollection principals = context.resolvePrincipals();
    boolean authenticated = context.resolveAuthenticated();
    String host = context.resolveHost();
    ShiroAuthenticationInfo authcInfo = (ShiroAuthenticationInfo) context.getAuthenticationInfo();
    return new ShiroSubject(principals, authenticated, host, session, sessionCreationEnabled, securityManager, authcInfo.getAuthenticationResult());
}

Example 22 with SecurityManager

use of org.apache.shiro.mgt.SecurityManager in project perry by ca-cwds.

the class AbstractApiSecurityTest method tearDownShiro.

@AfterClass
public static void tearDownShiro() {
    doClearSubject();
    try {
        SecurityManager securityManager = getSecurityManager();
        LifecycleUtils.destroy(securityManager);
    } catch (UnavailableSecurityManagerException e) {
    // we don't care about this when cleaning up the test environment
    // (for example, maybe the subclass is a unit test and it didn't
    // need a SecurityManager instance because it was using only
    // mock Subject instances)
    }
    setSecurityManager(null);
}

Example 23 with SecurityManager

use of org.apache.shiro.mgt.SecurityManager in project tutorials by eugenp.

the class Main method main.

public static void main(String[] args) {
    Realm realm = new MyCustomRealm();
    SecurityManager securityManager = new DefaultSecurityManager(realm);
    SecurityUtils.setSecurityManager(securityManager);
    Subject currentUser = SecurityUtils.getSubject();
    if (!currentUser.isAuthenticated()) {
        UsernamePasswordToken token = new UsernamePasswordToken("user", "password");
        token.setRememberMe(true);
        try {
            currentUser.login(token);
        } catch (UnknownAccountException uae) {
            log.error("Username Not Found!", uae);
        } catch (IncorrectCredentialsException ice) {
            log.error("Invalid Credentials!", ice);
        } catch (LockedAccountException lae) {
            log.error("Your Account is Locked!", lae);
        } catch (AuthenticationException ae) {
            log.error("Unexpected Error!", ae);
        }
    }
    log.info("User [" + currentUser.getPrincipal() + "] logged in successfully.");
    if (currentUser.hasRole("admin")) {
        log.info("Welcome Admin");
    } else if (currentUser.hasRole("editor")) {
        log.info("Welcome, Editor!");
    } else if (currentUser.hasRole("author")) {
        log.info("Welcome, Author");
    } else {
        log.info("Welcome, Guest");
    }
    if (currentUser.isPermitted("articles:compose")) {
        log.info("You can compose an article");
    } else {
        log.info("You are not permitted to compose an article!");
    }
    if (currentUser.isPermitted("articles:save")) {
        log.info("You can save articles");
    } else {
        log.info("You can not save articles");
    }
    if (currentUser.isPermitted("articles:publish")) {
        log.info("You can publish articles");
    } else {
        log.info("You can not publish articles");
    }
    Session session = currentUser.getSession();
    session.setAttribute("key", "value");
    String value = (String) session.getAttribute("key");
    if (value.equals("value")) {
        log.info("Retrieved the correct value! [" + value + "]");
    }
    currentUser.logout();
    System.exit(0);
}

Example 24 with SecurityManager

use of org.apache.shiro.mgt.SecurityManager in project shiro by apache.

the class IniSecurityManagerFactory method createSecurityManager.

@SuppressWarnings({ "unchecked" })
private SecurityManager createSecurityManager(Ini ini, Ini.Section mainSection) {
    getReflectionBuilder().setObjects(createDefaults(ini, mainSection));
    Map<String, ?> objects = buildInstances(mainSection);
    SecurityManager securityManager = getSecurityManagerBean();
    boolean autoApplyRealms = isAutoApplyRealms(securityManager);
    if (autoApplyRealms) {
        // realms and realm factory might have been created - pull them out first so we can
        // initialize the securityManager:
        Collection<Realm> realms = getRealms(objects);
        // set them on the SecurityManager
        if (!CollectionUtils.isEmpty(realms)) {
            applyRealmsToSecurityManager(realms, securityManager);
        }
    }
    return securityManager;
}

Example 25 with SecurityManager

use of org.apache.shiro.mgt.SecurityManager in project shiro by apache.

the class DelegatingSubjectTest method testRunAs.

@Test
public void testRunAs() {
    Ini ini = new Ini();
    Ini.Section users = ini.addSection("users");
    users.put("user1", "user1,role1");
    users.put("user2", "user2,role2");
    users.put("user3", "user3,role3");
    IniSecurityManagerFactory factory = new IniSecurityManagerFactory(ini);
    SecurityManager sm = factory.getInstance();
    // login as user1
    Subject subject = new Subject.Builder(sm).buildSubject();
    subject.login(new UsernamePasswordToken("user1", "user1"));
    assertFalse(subject.isRunAs());
    assertEquals("user1", subject.getPrincipal());
    assertTrue(subject.hasRole("role1"));
    assertFalse(subject.hasRole("role2"));
    assertFalse(subject.hasRole("role3"));
    // no previous principals since we haven't called runAs yet
    assertNull(subject.getPreviousPrincipals());
    // runAs user2:
    subject.runAs(new SimplePrincipalCollection("user2", IniSecurityManagerFactory.INI_REALM_NAME));
    assertTrue(subject.isRunAs());
    assertEquals("user2", subject.getPrincipal());
    assertTrue(subject.hasRole("role2"));
    assertFalse(subject.hasRole("role1"));
    assertFalse(subject.hasRole("role3"));
    // assert we still have the previous (user1) principals:
    PrincipalCollection previous = subject.getPreviousPrincipals();
    assertFalse(previous == null || previous.isEmpty());
    assertTrue(previous.getPrimaryPrincipal().equals("user1"));
    // test the stack functionality:  While as user2, run as user3:
    subject.runAs(new SimplePrincipalCollection("user3", IniSecurityManagerFactory.INI_REALM_NAME));
    assertTrue(subject.isRunAs());
    assertEquals("user3", subject.getPrincipal());
    assertTrue(subject.hasRole("role3"));
    assertFalse(subject.hasRole("role1"));
    assertFalse(subject.hasRole("role2"));
    // assert we still have the previous (user2) principals in the stack:
    previous = subject.getPreviousPrincipals();
    assertFalse(previous == null || previous.isEmpty());
    assertTrue(previous.getPrimaryPrincipal().equals("user2"));
    // drop down to user2:
    subject.releaseRunAs();
    // assert still run as:
    assertTrue(subject.isRunAs());
    assertEquals("user2", subject.getPrincipal());
    assertTrue(subject.hasRole("role2"));
    assertFalse(subject.hasRole("role1"));
    assertFalse(subject.hasRole("role3"));
    // assert we still have the previous (user1) principals:
    previous = subject.getPreviousPrincipals();
    assertFalse(previous == null || previous.isEmpty());
    assertTrue(previous.getPrimaryPrincipal().equals("user1"));
    // drop down to original user1:
    subject.releaseRunAs();
    // assert we're no longer runAs:
    assertFalse(subject.isRunAs());
    assertEquals("user1", subject.getPrincipal());
    assertTrue(subject.hasRole("role1"));
    assertFalse(subject.hasRole("role2"));
    assertFalse(subject.hasRole("role3"));
    // no previous principals in orig state
    assertNull(subject.getPreviousPrincipals());
    subject.logout();
    LifecycleUtils.destroy(sm);
}