Examples with MacaroonContext org.dcache.macaroons.MacaroonContext used on opensource projects

Example 1 with MacaroonContext

use of org.dcache.macaroons.MacaroonContext in project dcache by dCache.

the class MacaroonRequestHandler method buildMacaroon.

private String buildMacaroon(String target, Request request) throws ErrorResponseException {
    checkValidRequest(request.isSecure(), "Not secure transport");
    if (Subjects.isNobody(getSubject())) {
        throw new ErrorResponseException(SC_UNAUTHORIZED, "Authentication required");
    }
    MacaroonContext context = buildContext(target, request);
    MacaroonRequest macaroonRequest = parseJSON(request);
    try {
        List<Caveat> caveats = new ArrayList<>();
        List<Caveat> beforeCaveats = new ArrayList<>();
        for (String serialisedCaveat : macaroonRequest.getCaveats()) {
            Caveat caveat = new Caveat(serialisedCaveat);
            (caveat.hasType(BEFORE) ? beforeCaveats : caveats).add(caveat);
        }
        macaroonRequest.getValidity().map(Duration::parse).map(Instant.now()::plus).map(i -> new Caveat(BEFORE, i)).ifPresent(beforeCaveats::add);
        Instant expiry = calculateExpiry(context, beforeCaveats);
        MacaroonProcessor.MacaroonBuildResult result = _processor.buildMacaroon(expiry, context, caveats);
        request.setAttribute(MACAROON_ID_ATTRIBUTE, result.getId());
        return result.getMacaroon();
    } catch (DateTimeParseException e) {
        throw new ErrorResponseException(SC_BAD_REQUEST, "Bad validity value: " + e.getMessage());
    } catch (InvalidCaveatException e) {
        throw new ErrorResponseException(SC_BAD_REQUEST, "Bad requested caveat: " + e.getMessage());
    } catch (InternalErrorException e) {
        throw new ErrorResponseException(SC_INTERNAL_SERVER_ERROR, "Internal error: " + e.getMessage());
    }
}

Example 2 with MacaroonContext

use of org.dcache.macaroons.MacaroonContext in project dcache by dCache.

the class MacaroonLoginStrategy method login.

@Override
public LoginReply login(Subject subject) throws CacheException {
    LOGGER.debug("Login attempted: {}", subject);
    Origin origin = extractClientIP(subject);
    String macaroon = extractCredential(subject);
    try {
        MacaroonContext context = processor.expandMacaroon(macaroon, origin.getAddress());
        LoginReply reply = new LoginReply();
        FsPath root = context.getRoot().orElse(FsPath.ROOT);
        Set<LoginAttribute> attributes = reply.getLoginAttributes();
        attributes.add(new HomeDirectory(context.getHome().orElse(FsPath.ROOT)));
        attributes.add(new RootDirectory(root));
        context.getExpiry().map(Expiry::new).ifPresent(attributes::add);
        context.getPath().map(root::chroot).map(PrefixRestriction::new).ifPresent(attributes::add);
        context.getAllowedActivities().map(EnumSet::complementOf).map(DenyActivityRestriction::new).ifPresent(attributes::add);
        context.getMaxUpload().ifPresent(s -> attributes.add(new MaxUploadSize(s)));
        Set<Principal> principals = reply.getSubject().getPrincipals();
        principals.add(new UidPrincipal(context.getUid()));
        principals.addAll(asGidPrincipals(context.getGids()));
        principals.add(new UserNamePrincipal(context.getUsername()));
        principals.add(origin);
        principals.add(new MacaroonPrincipal(context.getId()));
        LOGGER.debug("Login successful: {}", reply);
        return reply;
    } catch (InvalidMacaroonException e) {
        throw new PermissionDeniedCacheException("macaroon login denied: " + e.getMessage());
    }
}

Example 3 with MacaroonContext

use of org.dcache.macaroons.MacaroonContext in project dcache by dCache.

the class MacaroonRequestHandler method buildContext.

private MacaroonContext buildContext(String target, Request request) throws ErrorResponseException {
    MacaroonContext context = new MacaroonContext();
    FsPath desiredPath = _pathMapper.asDcachePath(request, target);
    FsPath userRoot = FsPath.ROOT;
    FsPath prefixRestrictionPath = null;
    for (LoginAttribute attr : AuthenticationHandler.getLoginAttributes(request)) {
        if (attr instanceof HomeDirectory) {
            context.setHome(FsPath.ROOT.resolve(((HomeDirectory) attr).getHome()));
        } else if (attr instanceof RootDirectory) {
            userRoot = FsPath.ROOT.resolve(((RootDirectory) attr).getRoot());
        } else if (attr instanceof Expiry) {
            context.updateExpiry(((Expiry) attr).getExpiry());
        } else if (attr instanceof DenyActivityRestriction) {
            context.removeActivities(((DenyActivityRestriction) attr).getDenied());
        } else if (attr instanceof PrefixRestriction) {
            ImmutableSet<FsPath> paths = ((PrefixRestriction) attr).getPrefixes();
            if (target.equals("/")) {
                checkArgument(paths.size() == 1, "Cannot serialise with multiple path restrictions");
                prefixRestrictionPath = paths.iterator().next();
            } else {
                prefixRestrictionPath = paths.stream().filter(desiredPath::hasPrefix).findFirst().orElseThrow(() -> new ErrorResponseException(SC_BAD_REQUEST, "Bad request path: Desired path not within existing path"));
            }
        } else if (attr instanceof Restriction) {
            throw new ErrorResponseException(SC_BAD_REQUEST, "Cannot serialise restriction " + attr.getClass().getSimpleName());
        } else if (attr instanceof MaxUploadSize) {
            try {
                context.updateMaxUpload(((MaxUploadSize) attr).getMaximumSize());
            } catch (InvalidCaveatException e) {
                throw new ErrorResponseException(SC_BAD_REQUEST, "Cannot add max-upload: " + e.getMessage());
            }
        }
    }
    Subject subject = getSubject();
    context.setUid(Subjects.getUid(subject));
    context.setGids(Subjects.getGids(subject));
    context.setUsername(Subjects.getUserName(subject));
    FsPath effectiveRoot = _pathMapper.effectiveRoot(userRoot, m -> new ErrorResponseException(SC_BAD_REQUEST, m));
    context.setRoot(effectiveRoot);
    FsPath path = prefixRestrictionPath != null ? prefixRestrictionPath : target.equals("/") ? null : desiredPath;
    if (path != null) {
        context.setPath(path.stripPrefix(effectiveRoot));
    }
    return context;
}