Examples with UnauthorizedSsoServiceException org.apereo.cas.services.UnauthorizedSsoServiceException used on opensource projects

Example 1 with UnauthorizedSsoServiceException

use of org.apereo.cas.services.UnauthorizedSsoServiceException in project cas by apereo.

the class SecurityTokenServiceAuthenticationMetaDataPopulator method populateAttributes.

@Override
public void populateAttributes(final AuthenticationBuilder builder, final AuthenticationTransaction transaction) {
    if (!this.selectionStrategy.supports(transaction.getService())) {
        return;
    }
    final Service service = this.selectionStrategy.resolveServiceFrom(transaction.getService());
    if (service != null) {
        final WSFederationRegisteredService rp = this.servicesManager.findServiceBy(service, WSFederationRegisteredService.class);
        if (rp == null || !rp.getAccessStrategy().isServiceAccessAllowed()) {
            LOGGER.warn("Service [{}] is not allowed to use SSO.", rp);
            throw new UnauthorizedSsoServiceException();
        }
        final SecurityTokenServiceClient sts = clientBuilder.buildClientForSecurityTokenRequests(rp);
        invokeSecurityTokenServiceForToken(transaction, builder, rp, sts);
    }
}

Example 2 with UnauthorizedSsoServiceException

use of org.apereo.cas.services.UnauthorizedSsoServiceException in project cas by apereo.

the class DefaultCentralAuthenticationService method grantProxyTicket.

@Audit(action = AuditableActions.PROXY_TICKET, actionResolverName = AuditActionResolvers.GRANT_PROXY_TICKET_RESOLVER, resourceResolverName = AuditResourceResolvers.GRANT_PROXY_TICKET_RESOURCE_RESOLVER)
@Override
public ProxyTicket grantProxyTicket(final String proxyGrantingTicket, final Service service) throws AbstractTicketException {
    val proxyGrantingTicketObject = getTicket(proxyGrantingTicket, ProxyGrantingTicket.class);
    val registeredService = configurationContext.getServicesManager().findServiceBy(service);
    try {
        enforceRegisteredServiceAccess(service, proxyGrantingTicketObject, registeredService);
        RegisteredServiceAccessStrategyUtils.ensureServiceSsoAccessIsAllowed(registeredService, service, proxyGrantingTicketObject);
    } catch (final Exception e) {
        LoggingUtils.warn(LOGGER, e);
        throw new UnauthorizedSsoServiceException();
    }
    evaluateProxiedServiceIfNeeded(service, proxyGrantingTicketObject, registeredService);
    getAuthenticationSatisfiedByPolicy(proxyGrantingTicketObject.getRoot().getAuthentication(), new ServiceContext(service, registeredService));
    val authentication = proxyGrantingTicketObject.getRoot().getAuthentication();
    AuthenticationCredentialsThreadLocalBinder.bindCurrent(authentication);
    return configurationContext.getLockRepository().execute(proxyGrantingTicketObject.getId(), Unchecked.supplier(new CheckedSupplier<ProxyTicket>() {

        @Override
        public ProxyTicket get() throws Throwable {
            val principal = authentication.getPrincipal();
            val factory = (ProxyTicketFactory) configurationContext.getTicketFactory().get(ProxyTicket.class);
            val proxyTicket = factory.create(proxyGrantingTicketObject, service, ProxyTicket.class);
            configurationContext.getTicketRegistry().updateTicket(proxyGrantingTicketObject);
            configurationContext.getTicketRegistry().addTicket(proxyTicket);
            LOGGER.info("Granted proxy ticket [{}] for service [{}] for user [{}]", proxyTicket.getId(), service.getId(), principal.getId());
            doPublishEvent(new CasProxyTicketGrantedEvent(this, proxyGrantingTicketObject, proxyTicket));
            return proxyTicket;
        }
    })).orElseThrow(UnauthorizedProxyingException::new);
}

Example 3 with UnauthorizedSsoServiceException

use of org.apereo.cas.services.UnauthorizedSsoServiceException in project cas by apereo.

the class RegisteredServiceAuthenticationHandlerResolver method supports.

@Override
public boolean supports(final Set<AuthenticationHandler> handlers, final AuthenticationTransaction transaction) {
    val service = authenticationServiceSelectionPlan.resolveService(transaction.getService());
    if (service != null) {
        val registeredService = this.servicesManager.findServiceBy(service);
        LOGGER.trace("Located registered service definition [{}] for this authentication transaction", registeredService);
        if (registeredService == null || !registeredService.getAccessStrategy().isServiceAccessAllowed()) {
            LOGGER.warn("Service [{}] is not allowed to use SSO.", service);
            throw new UnauthorizedSsoServiceException();
        }
        val authenticationPolicy = registeredService.getAuthenticationPolicy();
        return !authenticationPolicy.getRequiredAuthenticationHandlers().isEmpty() || !authenticationPolicy.getExcludedAuthenticationHandlers().isEmpty();
    }
    return false;
}

Example 4 with UnauthorizedSsoServiceException

use of org.apereo.cas.services.UnauthorizedSsoServiceException in project cas by apereo.

the class SecurityTokenServiceAuthenticationPostProcessor method process.

@Override
public void process(final AuthenticationTransaction transaction, final AuthenticationBuilder builder) {
    if (!this.selectionStrategy.supports(transaction.getService())) {
        return;
    }
    final Service service = this.selectionStrategy.resolveServiceFrom(transaction.getService());
    if (service != null) {
        final WSFederationRegisteredService rp = this.servicesManager.findServiceBy(service, WSFederationRegisteredService.class);
        if (rp == null || !rp.getAccessStrategy().isServiceAccessAllowed()) {
            LOGGER.warn("Service [{}] is not allowed to use SSO.", rp);
            throw new UnauthorizedSsoServiceException();
        }
        final SecurityTokenServiceClient sts = clientBuilder.buildClientForSecurityTokenRequests(rp);
        invokeSecurityTokenServiceForToken(transaction, builder, rp, sts);
    }
}

Example 5 with UnauthorizedSsoServiceException

use of org.apereo.cas.services.UnauthorizedSsoServiceException in project cas by apereo.

the class RegisteredServiceAuthenticationHandlerResolver method supports.

@Override
public boolean supports(final Set<AuthenticationHandler> handlers, final AuthenticationTransaction transaction) {
    final Service service = transaction.getService();
    if (service != null) {
        final RegisteredService registeredService = this.servicesManager.findServiceBy(service);
        LOGGER.debug("Located registered service definition [{}] for this authentication transaction", registeredService);
        if (registeredService == null || !registeredService.getAccessStrategy().isServiceAccessAllowed()) {
            LOGGER.warn("Service [{}] is not allowed to use SSO.", registeredService);
            throw new UnauthorizedSsoServiceException();
        }
        return !registeredService.getRequiredHandlers().isEmpty();
    }
    return false;
}