Examples with BaseAuthenticationToken org.codice.ddf.security.handler.BaseAuthenticationToken used on opensource projects

Example 11 with BaseAuthenticationToken

use of org.codice.ddf.security.handler.BaseAuthenticationToken in project ddf by codice.

the class Security method getSystemSubject.

/**
 * Gets the {@link Subject} associated with this system. Uses a cached subject since the subject
 * will not change between calls.
 *
 * @return system's {@link Subject} or {@code null} if unable to get the system's {@link Subject}
 * @throws SecurityException if a security manager exists and the {@link
 *     javax.security.auth.AuthPermission AuthPermission("getSystemSubject")} or {@link
 *     javax.security.auth.AuthPermission AuthPermission("getSubject")} permissions are not
 *     authorized
 */
@Override
@Nullable
public final synchronized Subject getSystemSubject() {
    auditSystemSubjectAccess();
    final java.lang.SecurityManager security = System.getSecurityManager();
    if (security != null) {
        security.checkPermission(Security.GET_SYSTEM_SUBJECT_PERMISSION);
    }
    if (!javaSubjectHasAdminRole()) {
        securityLogger.audit("Unable to retrieve system subject.");
        return null;
    }
    if (cachedSystemSubject != null) {
        return cachedSystemSubject;
    }
    KeyStore keyStore = AccessController.doPrivileged((PrivilegedAction<KeyStore>) this::getSystemKeyStore);
    String alias = null;
    Certificate cert = null;
    try {
        if (keyStore != null) {
            if (keyStore.size() == 1) {
                alias = keyStore.aliases().nextElement();
            } else if (keyStore.size() > 1) {
                alias = getCertificateAlias();
            }
            cert = keyStore.getCertificate(alias);
        }
    } catch (KeyStoreException e) {
        LOGGER.warn("Unable to get certificate for alias [{}]", alias, e);
        return null;
    }
    if (cert == null) {
        LOGGER.warn("Unable to get certificate for alias [{}]", alias);
        return null;
    }
    AuthenticationTokenFactory tokenFactory = createBasicTokenFactory();
    AuthenticationToken token = tokenFactory.fromCertificates(new X509Certificate[] { (X509Certificate) cert }, "127.0.0.1");
    if (token != null) {
        if (token instanceof BaseAuthenticationToken) {
            ((BaseAuthenticationToken) token).setAllowGuest(true);
        }
        SecurityManager securityManager = getSecurityManager();
        if (securityManager != null) {
            try {
                cachedSystemSubject = securityManager.getSubject(token);
            } catch (SecurityServiceException sse) {
                LOGGER.warn("Unable to request subject for system user.", sse);
            }
        }
    }
    return cachedSystemSubject;
}

Example 12 with BaseAuthenticationToken

use of org.codice.ddf.security.handler.BaseAuthenticationToken in project ddf by codice.

the class GuestRealm method doGetAuthenticationInfo.

@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
    BaseAuthenticationToken baseAuthenticationToken = (BaseAuthenticationToken) authenticationToken;
    SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo();
    SimplePrincipalCollection principals = createPrincipalFromToken(baseAuthenticationToken);
    simpleAuthenticationInfo.setPrincipals(principals);
    simpleAuthenticationInfo.setCredentials(authenticationToken.getCredentials());
    securityLogger.audit("Guest assertion generated for IP address: " + baseAuthenticationToken.getIpAddress());
    return simpleAuthenticationInfo;
}

Example 13 with BaseAuthenticationToken

use of org.codice.ddf.security.handler.BaseAuthenticationToken in project ddf by codice.

the class GuestRealmTest method testSupportsBaseGuestAllowed.

@Test
public void testSupportsBaseGuestAllowed() {
    BaseAuthenticationToken baseAuthenticationToken = new MockBaseAuthenticationToken("principal", "credentials", "0.0.0.0");
    baseAuthenticationToken.setAllowGuest(true);
    boolean supports = guestRealm.supports(baseAuthenticationToken);
    assertTrue(supports);
}

Example 14 with BaseAuthenticationToken

use of org.codice.ddf.security.handler.BaseAuthenticationToken in project ddf by codice.

the class GuestRealmTest method testDoGetAuthenticationInfo.

@Test
public void testDoGetAuthenticationInfo() {
    BaseAuthenticationToken baseAuthenticationToken = new MockBaseAuthenticationToken("principal", "credentials", "0.0.0.0");
    baseAuthenticationToken.setAllowGuest(true);
    AuthenticationInfo authenticationInfo = guestRealm.doGetAuthenticationInfo(baseAuthenticationToken);
    assertEquals(baseAuthenticationToken.getCredentials(), authenticationInfo.getCredentials());
    PrincipalCollection principals = authenticationInfo.getPrincipals();
    assertEquals(2, principals.asList().size());
    Iterator iterator = principals.iterator();
    assertEquals("Guest@0.0.0.0", iterator.next());
    Object next = iterator.next();
    assertTrue(next instanceof SecurityAssertion);
    SecurityAssertion securityAssertion = (SecurityAssertion) next;
    assertEquals(2, securityAssertion.getAttributeStatements().get(0).getAttributes().size());
    boolean claim1 = false;
    boolean claim2 = false;
    boolean claim3 = false;
    boolean claim4 = false;
    for (Attribute attribute : securityAssertion.getAttributeStatements().get(0).getAttributes()) {
        if (attribute.getName().equals("claim1")) {
            claim1 = true;
            assertEquals("value1", attribute.getValues().get(0));
        }
        if (attribute.getName().equals("claim2")) {
            claim2 = true;
            assertTrue(attribute.getValues().stream().anyMatch(v -> v.equals("value2")));
            assertTrue(attribute.getValues().stream().anyMatch(v -> v.equals("value3")));
        }
        if (attribute.getName().equals(":")) {
            claim3 = true;
        }
        if (attribute.getName().equals("bad")) {
            claim4 = true;
        }
    }
    assertTrue(claim1);
    assertTrue(claim2);
    assertFalse(claim3);
    assertFalse(claim4);
    AuthenticationInfo newAuthenticationInfo = guestRealm.doGetAuthenticationInfo(baseAuthenticationToken);
    assertNotSame(authenticationInfo, newAuthenticationInfo);
}

Example 15 with BaseAuthenticationToken

use of org.codice.ddf.security.handler.BaseAuthenticationToken in project ddf by codice.

the class PKIRealmTest method testSupportsGood.

@Test
public void testSupportsGood() {
    BaseAuthenticationToken authenticationToken = mock(BaseAuthenticationToken.class);
    when(authenticationToken.getCredentials()).thenReturn(new X509Certificate[1]);
    when(authenticationToken.getPrincipal()).thenReturn(new X500Principal("cn=test"));
    when(authenticationToken.getType()).thenReturn(AuthenticationTokenType.PKI);
    boolean supports = pkiRealm.supports(authenticationToken);
    assertTrue(supports);
}