Examples with UserIdentity org.eclipse.jetty.server.UserIdentity used on opensource projects

Example 21 with UserIdentity

use of org.eclipse.jetty.server.UserIdentity in project jetty.project by eclipse.

the class ClientCertAuthenticator method validateRequest.

@Override
public Authentication validateRequest(ServletRequest req, ServletResponse res, boolean mandatory) throws ServerAuthException {
    if (!mandatory)
        return new DeferredAuthentication(this);
    HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) res;
    X509Certificate[] certs = (X509Certificate[]) request.getAttribute("javax.servlet.request.X509Certificate");
    try {
        // Need certificates.
        if (certs != null && certs.length > 0) {
            if (_validateCerts) {
                KeyStore trustStore = getKeyStore(_trustStorePath, _trustStoreType, _trustStoreProvider, _trustStorePassword == null ? null : _trustStorePassword.toString());
                Collection<? extends CRL> crls = loadCRL(_crlPath);
                CertificateValidator validator = new CertificateValidator(trustStore, crls);
                validator.validate(certs);
            }
            for (X509Certificate cert : certs) {
                if (cert == null)
                    continue;
                Principal principal = cert.getSubjectDN();
                if (principal == null)
                    principal = cert.getIssuerDN();
                final String username = principal == null ? "clientcert" : principal.getName();
                final char[] credential = B64Code.encode(cert.getSignature());
                UserIdentity user = login(username, credential, req);
                if (user != null) {
                    return new UserAuthentication(getAuthMethod(), user);
                }
            }
        }
        if (!DeferredAuthentication.isDeferred(response)) {
            response.sendError(HttpServletResponse.SC_FORBIDDEN);
            return Authentication.SEND_FAILURE;
        }
        return Authentication.UNAUTHENTICATED;
    } catch (Exception e) {
        throw new ServerAuthException(e.getMessage());
    }
}

Example 22 with UserIdentity

use of org.eclipse.jetty.server.UserIdentity in project jetty.project by eclipse.

the class HashLoginService method loadRoleInfo.

/* ------------------------------------------------------------ */
@Override
protected String[] loadRoleInfo(UserPrincipal user) {
    UserIdentity id = _propertyUserStore.getUserIdentity(user.getName());
    if (id == null)
        return null;
    Set<RolePrincipal> roles = id.getSubject().getPrincipals(RolePrincipal.class);
    if (roles == null)
        return null;
    List<String> list = new ArrayList<>();
    for (RolePrincipal r : roles) list.add(r.getName());
    return list.toArray(new String[roles.size()]);
}

Example 23 with UserIdentity

use of org.eclipse.jetty.server.UserIdentity in project elasticsearch-jetty by sonian.

the class ESLoginService method login.

@Override
public UserIdentity login(String username, Object credentials) {
    if (cacheTime >= 0) {
        long now = System.currentTimeMillis();
        if (now - lastHashPurge > cacheTime || cacheTime == 0) {
            _users.clear();
            lastHashPurge = now;
        }
    }
    UserIdentity u = super.login(username, credentials);
    if (u != null) {
        Log.info("authenticating user [{}]", username);
    } else {
        Log.info("did not find user [{}]", username);
    }
    return u;
}

Example 24 with UserIdentity

use of org.eclipse.jetty.server.UserIdentity in project zm-mailbox by Zimbra.

the class ZimbraAuthenticator method validateRequest.

@Override
public Authentication validateRequest(ServletRequest req, ServletResponse resp, boolean mandatory) throws ServerAuthException {
    if (mandatory && req instanceof HttpServletRequest) {
        HttpServletRequest httpReq = (HttpServletRequest) req;
        //we want to just ignore rather than potentially flooding auth provider (which may be external)
        if (PathMap.match(urlPattern, httpReq.getRequestURI())) {
            Cookie[] cookies = httpReq.getCookies();
            if (cookies != null) {
                for (Cookie cookie : cookies) {
                    if (ZimbraCookie.authTokenCookieName(true).equalsIgnoreCase(cookie.getName()) || ZimbraCookie.authTokenCookieName(false).equalsIgnoreCase(cookie.getName())) {
                        String encoded = cookie.getValue();
                        AuthToken token;
                        try {
                            token = AuthProvider.getAuthToken(encoded);
                            Account authAcct = AuthProvider.validateAuthToken(Provisioning.getInstance(), token, false);
                            if (authAcct != null) {
                                if (_loginService instanceof ZimbraLoginService) {
                                    UserIdentity user = ((ZimbraLoginService) _loginService).makeUserIdentity(authAcct.getMail());
                                    ZimbraLog.security.debug("Auth token validated");
                                    return new UserAuthentication(getAuthMethod(), user);
                                } else {
                                    ZimbraLog.security.warn("Misconfigured? _loginService not ZimbraLoginService");
                                    assert (false);
                                }
                            }
                        } catch (AuthTokenException e) {
                            ZimbraLog.security.error("Unable to authenticate due to AuthTokenException", e);
                        } catch (ServiceException e) {
                            ZimbraLog.security.error("Unable to authenticate due to ServiceException", e);
                        }
                    }
                }
                ZimbraLog.security.debug("no valid auth token, fallback to basic");
            }
        }
    }
    return super.validateRequest(req, resp, mandatory);
}

Example 25 with UserIdentity

use of org.eclipse.jetty.server.UserIdentity in project zm-mailbox by Zimbra.

the class ZimbraLoginService method makeUserIdentity.

UserIdentity makeUserIdentity(String userName) {
    // blank password/credentials. this is just a placeholder; we always
    // check credentials via prov on each login
    Credential credential = Credential.getCredential("");
    // only need 'user' role for current implementation protecting
    // /zimbra/downloads - expand to admin if needed later
    String roleName = "user";
    Principal userPrincipal = new KnownUser(userName, credential);
    Subject subject = new Subject();
    subject.getPrincipals().add(userPrincipal);
    subject.getPrivateCredentials().add(credential);
    subject.getPrincipals().add(new RolePrincipal(roleName));
    subject.setReadOnly();
    UserIdentity identity = identityService.newUserIdentity(subject, userPrincipal, new String[] { roleName });
    return identity;
}