Examples with GlobusPrincipal org.globus.gsi.gssapi.jaas.GlobusPrincipal used on opensource projects

Example 1 with GlobusPrincipal

use of org.globus.gsi.gssapi.jaas.GlobusPrincipal in project dcache by dCache.

the class GplazmaMultiMapFileTest method shouldFailWhenWrongMapFormatDN.

@Test
public void shouldFailWhenWrongMapFormatDN() throws Exception {
    givenConfig("dn:kermit@dcache.org    username:kermit");
    whenMapping(new GlobusPrincipal("\"dn:/C=DE/S=Hamburg/OU=desy.de/CN=Kermit The Frog\""));
    // REVISIT should warn of invalid DN syntax
    assertThat(mappedPrincipals, is(empty()));
}

Example 2 with GlobusPrincipal

use of org.globus.gsi.gssapi.jaas.GlobusPrincipal in project dcache by dCache.

the class Subjects method toString.

/**
 * Provide a one-line description of argument.  This is ostensibly the same job as
 * Subject#toString.  In contrast, this method never includes any line-break characters,
 * provides a better description for X.509 proxy chains, and uses a more terse format.
 * <p>
 * Note: the resulting line may be quite long.
 *
 * @param subject the identity to print
 * @return a single line describing that identity
 */
public static String toString(Subject subject) {
    StringBuilder sb = new StringBuilder();
    for (Object credential : subject.getPublicCredentials()) {
        appendComma(sb);
        if (credential instanceof CertPath) {
            List<X509Certificate> certificates = (List<X509Certificate>) ((CertPath) credential).getCertificates();
            X509Certificate[] chain = certificates.toArray(X509Certificate[]::new);
            appendX509Array(sb, chain);
        } else if (credential instanceof X509Certificate[]) {
            appendX509Array(sb, (X509Certificate[]) credential);
        } else {
            appendOptionallyInQuotes(sb, credential.toString());
        }
    }
    for (Object credential : subject.getPrivateCredentials()) {
        appendComma(sb);
        if (credential instanceof PasswordCredential) {
            String description = ((PasswordCredential) credential).describeCredential();
            sb.append("username-with-password:");
            appendOptionallyInQuotes(sb, description);
        } else if (credential instanceof BearerTokenCredential) {
            String token = ((BearerTokenCredential) credential).describeToken();
            sb.append("bearer-token:");
            appendOptionallyInQuotes(sb, token);
        } else {
            appendOptionallyInQuotes(sb, credential.toString());
        }
    }
    for (Principal principal : subject.getPrincipals()) {
        appendComma(sb);
        if (principal instanceof GlobusPrincipal) {
            sb.append("dn:");
            appendOptionallyInQuotes(sb, principal.getName());
        } else if (principal instanceof KerberosPrincipal) {
            sb.append("kerberos:");
            appendOptionallyInQuotes(sb, principal.getName());
        } else if (principal instanceof FQANPrincipal) {
            sb.append("fqan:");
            String label = ((FQANPrincipal) principal).isPrimaryGroup() ? "!" + principal.getName() : principal.getName();
            appendOptionallyInQuotes(sb, label);
        } else if (principal instanceof LoginNamePrincipal) {
            sb.append("desired-username:");
            appendOptionallyInQuotes(sb, principal.getName());
        } else if (principal instanceof Origin) {
            sb.append("origin:");
            appendOptionallyInQuotes(sb, principal.getName());
        } else if (principal instanceof OidcSubjectPrincipal) {
            sb.append("oidc:");
            appendOptionallyInQuotes(sb, principal.getName());
        } else if (principal instanceof EmailAddressPrincipal) {
            sb.append("email:");
            appendOptionallyInQuotes(sb, principal.getName());
        } else if (principal instanceof UserNamePrincipal) {
            sb.append("user:");
            appendOptionallyInQuotes(sb, principal.getName());
        } else if (principal instanceof GroupNamePrincipal) {
            sb.append("group:");
            String label = ((GroupNamePrincipal) principal).isPrimaryGroup() ? "!" + principal.getName() : principal.getName();
            appendOptionallyInQuotes(sb, label);
        } else if (principal instanceof UidPrincipal) {
            sb.append("uid:").append(((UidPrincipal) principal).getUid());
        } else if (principal instanceof GidPrincipal) {
            sb.append("gid:");
            if (((GidPrincipal) principal).isPrimaryGroup()) {
                sb.append('!');
            }
            sb.append(principal.getName());
        } else if (principal instanceof DesiredRole) {
            sb.append("desired-role:");
            appendOptionallyInQuotes(sb, principal.getName());
        } else if (principal instanceof EntityDefinitionPrincipal) {
            sb.append("entity-defn:").append(principal.getName());
        } else if (principal instanceof FullNamePrincipal) {
            sb.append("full-name:");
            appendOptionallyInQuotes(sb, principal.getName());
        } else if (principal instanceof IGTFPolicyPrincipal) {
            sb.append("IGTF-policy:");
            appendOptionallyInQuotes(sb, principal.getName());
        } else if (principal instanceof IGTFStatusPrincipal) {
            sb.append("IGTF-status:");
            appendOptionallyInQuotes(sb, principal.getName());
        } else if (principal instanceof LoAPrincipal) {
            sb.append("LoA:");
            appendOptionallyInQuotes(sb, principal.getName());
        } else if (principal instanceof LoginGidPrincipal) {
            sb.append("desired-gid:").append(((LoginGidPrincipal) principal).getGid());
        } else if (principal instanceof LoginUidPrincipal) {
            sb.append("desired-uid:").append(((LoginUidPrincipal) principal).getUid());
        } else if (principal instanceof MacaroonPrincipal) {
            sb.append("macaroon:");
            appendOptionallyInQuotes(sb, principal.getName());
        } else if (principal instanceof OpenIdGroupPrincipal) {
            sb.append("oidc-group:");
            appendOptionallyInQuotes(sb, principal.getName());
        } else if (principal instanceof Origin) {
            sb.append("origin:").append(principal.getName());
        } else {
            sb.append(principal.getClass().getSimpleName()).append(':');
            appendOptionallyInQuotes(sb, principal.getName());
        }
    }
    return "{" + sb + "}";
}

Example 3 with GlobusPrincipal

use of org.globus.gsi.gssapi.jaas.GlobusPrincipal in project dcache by dCache.

the class Subjects method principalsFromArgs.

public static Set<Principal> principalsFromArgs(List<String> args) {
    Set<Principal> principals = new HashSet<>();
    boolean isPrimaryFqan = true;
    boolean isPrimaryGid = true;
    for (String arg : args) {
        int idx = arg.indexOf(':');
        if (idx == -1) {
            throw new IllegalArgumentException("format for principals is <type>:<value>");
        }
        String type = arg.substring(0, idx);
        String value = arg.substring(idx + 1);
        Principal principal;
        switch(type) {
            case "dn":
                principal = new GlobusPrincipal(value);
                break;
            case "gid":
                principal = new GidPrincipal(value, isPrimaryGid);
                isPrimaryGid = false;
                break;
            case "kerberos":
                principal = new KerberosPrincipal(value);
                break;
            case "fqan":
                principal = new FQANPrincipal(value, isPrimaryFqan);
                isPrimaryFqan = false;
                break;
            case "name":
                principal = new LoginNamePrincipal(value);
                break;
            case "origin":
                principal = new Origin(InetAddresses.forString(value));
                break;
            case "oidc":
                int atIndex = value.lastIndexOf('@');
                checkArgument(atIndex != -1, "format for 'oidc' principals is <value>@<OP>");
                String oidcClaim = value.substring(0, atIndex);
                String op = value.substring(atIndex + 1);
                principal = new OidcSubjectPrincipal(oidcClaim, op);
                break;
            case "email":
                principal = new EmailAddressPrincipal(value);
                break;
            case "uid":
                principal = new UidPrincipal(value);
                break;
            case "user":
                LOGGER.warn("Please use \"username:{}\" instead of \"{}\"", value, arg);
            // FALL THROUGH
            case "username":
                principal = new UserNamePrincipal(value);
                break;
            case "group":
                boolean isPrimary = value.startsWith("!");
                if (isPrimary) {
                    value = value.substring(1);
                }
                principal = new GroupNamePrincipal(value, isPrimary);
                break;
            default:
                try {
                    Class<? extends Principal> principalClass = Class.forName(type).asSubclass(Principal.class);
                    Constructor<? extends Principal> principalConstructor = principalClass.getConstructor(String.class);
                    principal = principalConstructor.newInstance(value);
                } catch (NoSuchMethodException e) {
                    throw new IllegalArgumentException("No matching constructor found: " + type + "(String)");
                } catch (ClassNotFoundException e) {
                    throw new IllegalArgumentException("No matching class found: " + type);
                } catch (InvocationTargetException e) {
                    throw new IllegalArgumentException("Invocation failed: " + e.toString());
                } catch (InstantiationException e) {
                    throw new IllegalArgumentException("Instantiation failed: " + e.toString());
                } catch (IllegalAccessException e) {
                    throw new IllegalArgumentException("Access Exception: " + e.toString());
                }
        }
        principals.add(principal);
    }
    return principals;
}

Example 4 with GlobusPrincipal

use of org.globus.gsi.gssapi.jaas.GlobusPrincipal in project dcache by dCache.

the class Subjects method getSubject.

/**
 * Maps a UserAuthBase to a Subject.  The Subject will contain the UID (UidPrincipal), GID
 * (GidPrincipal), user name (UserNamePrincipal), DN (GlobusPrincipal), and FQAN (FQANPrincipal)
 * principals.
 *
 * @param user    UserAuthBase to convert
 * @param primary Whether the groups of user are the primary groups
 */
public static final Subject getSubject(UserAuthBase user, boolean primary) {
    Subject subject = new Subject();
    Set<Principal> principals = subject.getPrincipals();
    principals.add(new UidPrincipal(user.UID));
    boolean isPrimary = primary;
    for (int gid : user.GIDs) {
        principals.add(new GidPrincipal(gid, isPrimary));
        isPrimary = false;
    }
    String name = user.Username;
    if (name != null && !name.isEmpty()) {
        principals.add(new UserNamePrincipal(name));
    }
    String dn = user.DN;
    if (dn != null && !dn.isEmpty()) {
        principals.add(new GlobusPrincipal(dn));
    }
    String fqan = user.getFqan().toString();
    if (fqan != null && !fqan.isEmpty()) {
        principals.add(new FQANPrincipal(fqan, primary));
    }
    return subject;
}

Example 5 with GlobusPrincipal

use of org.globus.gsi.gssapi.jaas.GlobusPrincipal in project dcache by dCache.

the class VoRoleMapPlugin method map.

@Override
public void map(Set<Principal> principals) throws AuthenticationException {
    List<FQANPrincipal> fqanPrincipals = Lists.newArrayList(filter(principals, FQANPrincipal.class));
    List<GlobusPrincipal> globusPrincipals = Lists.newArrayList(filter(principals, GlobusPrincipal.class));
    boolean hasPrimary = containsPrimaryGroupName(principals);
    boolean authorized = false;
    for (FQANPrincipal fqanPrincipal : fqanPrincipals) {
        boolean found = false;
        boolean isPrimary = fqanPrincipal.isPrimaryGroup() && !hasPrimary;
        FQAN fqan = fqanPrincipal.getFqan();
        do {
            for (GlobusPrincipal globusPrincipal : globusPrincipals) {
                if (addMappingFor(globusPrincipal, fqanPrincipal, fqan, isPrimary, principals)) {
                    authorized = true;
                    found = true;
                    hasPrimary |= isPrimary;
                }
            }
            fqan = fqan.getParent();
        } while (isPrimary && !found && fqan != null);
    }
    checkAuthentication(authorized, "no record");
}