Examples with JwtSubPrincipal org.dcache.auth.JwtSubPrincipal used on opensource projects

Example 1 with JwtSubPrincipal

use of org.dcache.auth.JwtSubPrincipal in project dcache by dCache.

the class BaseProfile method addSub.

private void addSub(IdentityProvider idp, Map<String, JsonNode> claims, Set<Principal> principals) {
    var node = claims.get("sub");
    if (node != null && node.isTextual()) {
        String claimValue = node.asText();
        principals.add(new OidcSubjectPrincipal(claimValue, idp.getName()));
        // REVISIT: the JwtSubPrincipal is only included for backwards compatibility.  It is
        // not used by dCache and should (very likely) be removed.
        principals.add(new JwtSubPrincipal(idp.getName(), claimValue));
    }
}

Example 2 with JwtSubPrincipal

use of org.dcache.auth.JwtSubPrincipal in project dcache by dCache.

the class SciTokenPlugin method authenticate.

@Override
public void authenticate(Set<Object> publicCredentials, Set<Object> privateCredentials, Set<Principal> identifiedPrincipals, Set<Restriction> restrictions) throws AuthenticationException {
    List<String> tokens = privateCredentials.stream().filter(BearerTokenCredential.class::isInstance).map(BearerTokenCredential.class::cast).map(BearerTokenCredential::getToken).filter(JsonWebToken::isCompatibleFormat).collect(Collectors.toList());
    checkAuthentication(!tokens.isEmpty(), "no JWT bearer token");
    checkAuthentication(tokens.size() == 1, "multiple JWT bearer tokens");
    try {
        JsonWebToken token = checkValid(new JsonWebToken(tokens.get(0)));
        Issuer issuer = issuerOf(token);
        validateWlcgVersionClaim(token);
        Collection<Principal> principals = new ArrayList<>();
        // REVISIT consider introducing an SPI to allow plugable support for handling claims.
        Optional<String> sub = token.getPayloadString("sub");
        sub.map(s -> new JwtSubPrincipal(issuer.getId(), s)).ifPresent(principals::add);
        sub.map(s -> new OidcSubjectPrincipal(s, issuer.getId())).ifPresent(principals::add);
        Optional<String> jti = token.getPayloadString("jti");
        jti.map(s -> new JwtJtiPrincipal(issuer.getId(), s)).ifPresent(principals::add);
        token.getPayloadStringOrArray("wlcg.groups").stream().map(OpenIdGroupPrincipal::new).forEach(principals::add);
        checkAuthentication(sub.isPresent() || jti.isPresent(), "missing sub and jti claims");
        principals.add(issuer.getOpIdentity());
        List<AuthorisationSupplier> scopes = token.getPayloadString("scope").map(SciTokenPlugin::parseScope).orElse(Collections.emptyList());
        if (scopes.isEmpty()) {
            // No scopes defined -> not explicit authorisation; however, perhaps the client
            // is allowed to do something based on asserted group-membership or from their
            // membership of the VO (implied by the OP issuing any token at all).
            // This only makes sense if the token follows the WLCG AuthZ profile.  A SciToken
            // is not valid (or useful) without at least one authorisation statements in the
            // 'scope' claim
            checkAuthentication(token.getPayloadString("wlcg.ver").isPresent(), "not a SciToken or WLCG profile.");
        // allow login to proceed with whatever information we've gained so far.
        } else {
            principals.addAll(issuer.getUserIdentity());
            Restriction r = buildRestriction(issuer.getPrefix(), scopes);
            LOGGER.debug("Authenticated user with restriction: {}", r);
            restrictions.add(r);
            principals.add(new ExemptFromNamespaceChecks());
        }
        identifiedPrincipals.addAll(principals);
    } catch (IOException e) {
        throw new AuthenticationException(e.getMessage());
    }
}

Example 3 with JwtSubPrincipal

use of org.dcache.auth.JwtSubPrincipal in project dcache by dCache.

the class SciTokenPluginTest method shouldAcceptWlcgProfileWithoutScope.

@Test
public void shouldAcceptWlcgProfileWithoutScope() throws Exception {
    given(aSciTokenPlugin().withProperty("gplazma.scitoken.issuer!EXAMPLE", "https://example.org/ /prefix uid:1000 gid:1000"));
    givenThat("OP1", isAnIssuer().withURL("https://example.org/").withKey("key1", rsa256Keys()));
    String sub = UUID.randomUUID().toString();
    String jti = UUID.randomUUID().toString();
    whenAuthenticatingWith(aJwtToken().withClaim("wlcg.ver", "1.0").withClaim("jti", jti).withClaim("sub", sub).issuedBy("OP1").usingKey("key1"));
    assertThat(identifiedPrincipals, hasItems(new JwtSubPrincipal("EXAMPLE", sub), new OidcSubjectPrincipal(sub, "EXAMPLE"), new OAuthProviderPrincipal("EXAMPLE"), new JwtJtiPrincipal("EXAMPLE", jti)));
    assertThat(identifiedPrincipals, not(hasItems(new UidPrincipal(1000), new GidPrincipal(1000, true))));
}