Examples with PKIAuthenticationToken org.codice.ddf.security.handler.api.PKIAuthenticationToken used on opensource projects

Example 6 with PKIAuthenticationToken

use of org.codice.ddf.security.handler.api.PKIAuthenticationToken in project ddf by codice.

the class TestPKITokenValidator method testCanHandleAnyRealmToken.

@Test
public void testCanHandleAnyRealmToken() {
    BinarySecurityTokenType binarySecurityTokenType = new BinarySecurityTokenType();
    binarySecurityTokenType.setEncodingType(WSConstants.SOAPMESSAGE_NS + "#Base64Binary");
    binarySecurityTokenType.setValueType(PKIAuthenticationToken.PKI_TOKEN_VALUE_TYPE);
    PKIAuthenticationTokenFactory pkiAuthenticationTokenFactory = new PKIAuthenticationTokenFactory();
    pkiAuthenticationTokenFactory.setSignaturePropertiesPath(TestPKITokenValidator.class.getResource("/signature.properties").getPath());
    pkiAuthenticationTokenFactory.init();
    PKIAuthenticationToken pkiAuthenticationToken = pkiAuthenticationTokenFactory.getTokenFromCerts(certificates, "*");
    binarySecurityTokenType.setValue(pkiAuthenticationToken.getEncodedCredentials());
    ReceivedToken receivedToken = mock(ReceivedToken.class);
    when(receivedToken.getToken()).thenReturn(binarySecurityTokenType);
    boolean result = pkiTokenValidator.canHandleToken(receivedToken);
    assertEquals(true, result);
}

Example 7 with PKIAuthenticationToken

use of org.codice.ddf.security.handler.api.PKIAuthenticationToken in project ddf by codice.

the class Security method getSystemSubject.

/**
     * Gets the {@link Subject} associated with this system. Uses a cached subject since the subject
     * will not change between calls.
     *
     * @return system's {@link Subject}
     */
public synchronized Subject getSystemSubject() {
    if (!javaSubjectHasAdminRole()) {
        SecurityLogger.audit("Unable to retrieve system subject.");
        return null;
    }
    if (!tokenAboutToExpire(cachedSystemSubject)) {
        return cachedSystemSubject;
    }
    KeyStore keyStore = getSystemKeyStore();
    String alias = null;
    Certificate cert = null;
    try {
        if (keyStore != null) {
            if (keyStore.size() == 1) {
                alias = keyStore.aliases().nextElement();
            } else if (keyStore.size() > 1) {
                alias = getCertificateAlias();
            }
            cert = keyStore.getCertificate(alias);
        }
    } catch (KeyStoreException e) {
        LOGGER.warn("Unable to get certificate for alias [{}]", alias, e);
        return null;
    }
    if (cert == null) {
        LOGGER.warn("Unable to get certificate for alias [{}]", alias);
        return null;
    }
    PKIAuthenticationTokenFactory pkiTokenFactory = createPKITokenFactory();
    PKIAuthenticationToken pkiToken = pkiTokenFactory.getTokenFromCerts(new X509Certificate[] { (X509Certificate) cert }, PKIAuthenticationToken.DEFAULT_REALM);
    if (pkiToken != null) {
        SecurityManager securityManager = getSecurityManager();
        if (securityManager != null) {
            try {
                cachedSystemSubject = securityManager.getSubject(pkiToken);
            } catch (SecurityServiceException sse) {
                LOGGER.warn("Unable to request subject for system user.", sse);
            }
        }
    }
    return cachedSystemSubject;
}

Example 8 with PKIAuthenticationToken

use of org.codice.ddf.security.handler.api.PKIAuthenticationToken in project ddf by codice.

the class PKITokenValidator method getPKITokenFromTarget.

private PKIAuthenticationToken getPKITokenFromTarget(ReceivedToken validateTarget) {
    Object token = validateTarget.getToken();
    if ((token instanceof BinarySecurityTokenType) && PKIAuthenticationToken.PKI_TOKEN_VALUE_TYPE.equals(((BinarySecurityTokenType) token).getValueType())) {
        String encodedCredential = ((BinarySecurityTokenType) token).getValue();
        LOGGER.debug("Encoded username/password credential: {}", encodedCredential);
        BaseAuthenticationToken base = null;
        try {
            base = PKIAuthenticationToken.parse(encodedCredential, true);
            return new PKIAuthenticationToken(base.getPrincipal(), base.getCredentials().toString(), base.getRealm());
        } catch (WSSecurityException e) {
            LOGGER.info("Unable to parse {} from encodedToken.", PKIAuthenticationToken.class.getSimpleName(), e);
            return null;
        }
    }
    return null;
}

Example 9 with PKIAuthenticationToken

use of org.codice.ddf.security.handler.api.PKIAuthenticationToken in project ddf by codice.

the class TestPKITokenValidator method testValidateToken.

@Test
public void testValidateToken() {
    BinarySecurityTokenType binarySecurityTokenType = new BinarySecurityTokenType();
    binarySecurityTokenType.setEncodingType(WSConstants.SOAPMESSAGE_NS + "#Base64Binary");
    binarySecurityTokenType.setValueType(PKIAuthenticationToken.PKI_TOKEN_VALUE_TYPE);
    PKIAuthenticationTokenFactory pkiAuthenticationTokenFactory = new PKIAuthenticationTokenFactory();
    pkiAuthenticationTokenFactory.setSignaturePropertiesPath(TestPKITokenValidator.class.getResource("/signature.properties").getPath());
    pkiAuthenticationTokenFactory.init();
    PKIAuthenticationToken pkiAuthenticationToken = pkiAuthenticationTokenFactory.getTokenFromCerts(certificates, "karaf");
    binarySecurityTokenType.setValue(pkiAuthenticationToken.getEncodedCredentials());
    ReceivedToken receivedToken = mock(ReceivedToken.class);
    when(receivedToken.getToken()).thenReturn(binarySecurityTokenType);
    TokenValidatorParameters tokenValidatorParameters = mock(TokenValidatorParameters.class);
    STSPropertiesMBean stsPropertiesMBean = mock(STSPropertiesMBean.class);
    when(stsPropertiesMBean.getSignatureCrypto()).thenReturn(merlin);
    when(tokenValidatorParameters.getStsProperties()).thenReturn(stsPropertiesMBean);
    when(tokenValidatorParameters.getToken()).thenReturn(receivedToken);
    doCallRealMethod().when(receivedToken).setState(any(ReceivedToken.STATE.class));
    doCallRealMethod().when(receivedToken).getState();
    TokenValidatorResponse tokenValidatorResponse = pkiTokenValidator.validateToken(tokenValidatorParameters);
    assertEquals(ReceivedToken.STATE.VALID, tokenValidatorResponse.getToken().getState());
    assertEquals("US", tokenValidatorResponse.getAdditionalProperties().get(SubjectUtils.COUNTRY_CLAIM_URI));
    assertEquals("localhost@example.org", tokenValidatorResponse.getAdditionalProperties().get(SubjectUtils.EMAIL_ADDRESS_CLAIM_URI));
}

Example 10 with PKIAuthenticationToken

use of org.codice.ddf.security.handler.api.PKIAuthenticationToken in project ddf by codice.

the class TestPKITokenValidator method testCanHandleToken.

@Test
public void testCanHandleToken() {
    BinarySecurityTokenType binarySecurityTokenType = new BinarySecurityTokenType();
    binarySecurityTokenType.setEncodingType(WSConstants.SOAPMESSAGE_NS + "#Base64Binary");
    binarySecurityTokenType.setValueType(PKIAuthenticationToken.PKI_TOKEN_VALUE_TYPE);
    PKIAuthenticationTokenFactory pkiAuthenticationTokenFactory = new PKIAuthenticationTokenFactory();
    pkiAuthenticationTokenFactory.setSignaturePropertiesPath(TestPKITokenValidator.class.getResource("/signature.properties").getPath());
    pkiAuthenticationTokenFactory.init();
    PKIAuthenticationToken pkiAuthenticationToken = pkiAuthenticationTokenFactory.getTokenFromCerts(certificates, "karaf");
    binarySecurityTokenType.setValue(pkiAuthenticationToken.getEncodedCredentials());
    ReceivedToken receivedToken = mock(ReceivedToken.class);
    when(receivedToken.getToken()).thenReturn(binarySecurityTokenType);
    boolean result = pkiTokenValidator.canHandleToken(receivedToken);
    assertEquals(true, result);
}