use of org.candlepin.auth.NoAuthPrincipal in project candlepin by candlepin.
the class AuthenticationFilter method filter.
@Override
public void filter(ContainerRequestContext requestContext) throws IOException {
log.debug("Authentication check for {}", requestContext.getUriInfo().getPath());
HttpRequest httpRequest = ResteasyProviderFactory.getContextData(HttpRequest.class);
ResourceInfo resourceInfo = ResteasyProviderFactory.getContextData(ResourceInfo.class);
Method method = resourceInfo.getResourceMethod();
SecurityHole hole = method.getAnnotation(SecurityHole.class);
Principal principal = null;
if (hole != null && hole.anon()) {
principal = new NoAuthPrincipal();
} else if (resourceInfo.getResourceClass().equals(ApiListingResource.class)) {
log.debug("Swagger API request made; no principal required.");
principal = new NoAuthPrincipal();
} else {
for (AuthProvider provider : providers) {
principal = provider.getPrincipal(httpRequest);
if (principal != null) {
log.debug("Establishing principal with {}", provider.getClass().getName());
break;
}
}
}
/* At this point, there is no provider that has given a valid principal,
* so we use the NoAuthPrincipal here if it is allowed. */
if (principal == null) {
if (hole != null && hole.noAuth()) {
log.debug("No auth allowed for resource; setting NoAuth principal");
principal = new NoAuthPrincipal();
} else if (!config.getBoolean(ConfigProperties.AUTH_OVER_HTTP) && !request.isSecure()) {
throw new BadRequestException("Please use SSL when accessing protected resources");
} else {
throw new NotAuthorizedException("Invalid credentials.");
}
}
SecurityContext securityContext = new CandlepinSecurityContext(principal);
requestContext.setSecurityContext(securityContext);
// Push the principal into the context for the PrincipalProvider to access directly
ResteasyProviderFactory.pushContext(Principal.class, principal);
}
use of org.candlepin.auth.NoAuthPrincipal in project candlepin by candlepin.
the class AuthenticationFilterTest method securityHoleWithNoAuth.
@Test
public void securityHoleWithNoAuth() throws Exception {
Method method = FakeResource.class.getMethod("noAuthMethod", String.class);
mockResourceMethod(method);
interceptor.filter(getContext());
Principal p = ResteasyProviderFactory.getContextData(Principal.class);
assertTrue(p instanceof NoAuthPrincipal);
}
use of org.candlepin.auth.NoAuthPrincipal in project candlepin by candlepin.
the class PoolCuratorTest method testAvailablePoolsDoesNotIncludeUeberPool.
@Test
public void testAvailablePoolsDoesNotIncludeUeberPool() throws Exception {
Owner owner = this.createOwner();
Product product = this.createProduct(owner);
Consumer consumer = this.createMockConsumer(owner, false);
consumer.setFact("cpu_cores", "4");
consumer = consumerCurator.merge(consumer);
Pool pool = createPool(owner, product, 100L, TestUtil.createDate(2000, 3, 2), TestUtil.createDate(2005, 3, 2));
poolCurator.create(pool);
ueberCertGenerator.generate(owner.getKey(), new NoAuthPrincipal());
List<Pool> results = poolCurator.listAvailableEntitlementPools(consumer, consumer.getOwnerId(), (Collection<String>) null, null);
assertEquals(1, results.size());
}
use of org.candlepin.auth.NoAuthPrincipal in project candlepin by candlepin.
the class ConsumerResourceCreationTest method orgRequiredWithActivationKeys.
@Test(expected = BadRequestException.class)
public void orgRequiredWithActivationKeys() {
Principal p = new NoAuthPrincipal();
List<String> keys = mockActivationKeys();
ConsumerDTO consumer = TestUtil.createConsumerDTO("sys.example.com", null, null, systemDto);
resource.create(consumer, p, null, null, createKeysString(keys), true);
}
use of org.candlepin.auth.NoAuthPrincipal in project candlepin by candlepin.
the class ConsumerResourceCreationTest method registerWithKeys.
@Test
public void registerWithKeys() {
// No auth should be required for registering with keys:
Principal p = new NoAuthPrincipal();
List<String> keys = mockActivationKeys();
ConsumerDTO consumer = TestUtil.createConsumerDTO("sys.example.com", null, null, systemDto);
resource.create(consumer, p, null, owner.getKey(), createKeysString(keys), true);
for (String keyName : keys) {
verify(activationKeyCurator).lookupForOwner(keyName, owner);
}
}
Aggregations