Search in sources :

Example 1 with AuthMechanism

use of org.jboss.as.domain.management.AuthMechanism in project wildfly-swarm by wildfly-swarm.

the class SecureHttpContexts method secureHandler.

/**
 * Wraps the target handler and makes it inheritSecurity.
 * Includes a predicate for relevant web contexts.
 */
private HttpHandler secureHandler(final HttpHandler toWrap, SecurityRealm securityRealm) {
    HttpHandler handler = toWrap;
    handler = new AuthenticationCallHandler(handler);
    handler = new AuthenticationConstraintHandler(handler);
    RealmIdentityManager idm = new RealmIdentityManager(securityRealm);
    Set<AuthMechanism> mechanisms = securityRealm.getSupportedAuthenticationMechanisms();
    List<AuthenticationMechanism> undertowMechanisms = new ArrayList<AuthenticationMechanism>(mechanisms.size());
    undertowMechanisms.add(wrap(new CachedAuthenticatedSessionMechanism(), null));
    for (AuthMechanism current : mechanisms) {
        switch(current) {
            case DIGEST:
                List<DigestAlgorithm> digestAlgorithms = Collections.singletonList(DigestAlgorithm.MD5);
                List<DigestQop> digestQops = Collections.singletonList(DigestQop.AUTH);
                undertowMechanisms.add(wrap(new DigestAuthenticationMechanism(digestAlgorithms, digestQops, securityRealm.getName(), "Monitor", new SimpleNonceManager()), current));
                break;
            case PLAIN:
                undertowMechanisms.add(wrap(new BasicAuthenticationMechanism(securityRealm.getName()), current));
                break;
            case LOCAL:
                break;
            default:
        }
    }
    handler = new AuthenticationMechanismsHandler(handler, undertowMechanisms);
    handler = new SecurityInitialHandler(AuthenticationMode.PRO_ACTIVE, idm, handler);
    // the predicate handler takes care that all of the above
    // will only be enacted on relevant web contexts
    handler = new PredicateHandler(exchange -> {
        if (!monitor.getSecurityRealm().isPresent()) {
            return false;
        }
        if (Queries.isAggregatorEndpoint(monitor, exchange.getRelativePath())) {
            return true;
        }
        if (Queries.isDirectAccessToHealthEndpoint(monitor, exchange.getRelativePath())) {
            if (!hasTokenAuth(exchange)) {
                return true;
            }
            return false;
        }
        if (HttpContexts.getDefaultContextNames().contains(exchange.getRelativePath())) {
            return true;
        }
        return false;
    }, handler, toWrap);
    return handler;
}
Also used : DigestQop(io.undertow.security.impl.DigestQop) BasicAuthenticationMechanism(io.undertow.security.impl.BasicAuthenticationMechanism) HttpServerExchange(io.undertow.server.HttpServerExchange) NamingException(javax.naming.NamingException) SecurityRealm(org.jboss.as.domain.management.SecurityRealm) SecurityInitialHandler(io.undertow.security.handlers.SecurityInitialHandler) ArrayList(java.util.ArrayList) AuthenticationMechanismsHandler(io.undertow.security.handlers.AuthenticationMechanismsHandler) DigestAlgorithm(io.undertow.security.idm.DigestAlgorithm) AuthenticationMechanismWrapper(org.jboss.as.domain.http.server.security.AuthenticationMechanismWrapper) PredicateHandler(io.undertow.server.handlers.PredicateHandler) CachedAuthenticatedSessionMechanism(io.undertow.security.impl.CachedAuthenticatedSessionMechanism) DigestQop(io.undertow.security.impl.DigestQop) DigestAuthenticationMechanism(io.undertow.security.impl.DigestAuthenticationMechanism) Monitor(org.wildfly.swarm.microprofile.health.api.Monitor) Vetoed(javax.enterprise.inject.Vetoed) AuthenticationConstraintHandler(io.undertow.security.handlers.AuthenticationConstraintHandler) Set(java.util.Set) AuthenticationMode(io.undertow.security.api.AuthenticationMode) AuthMechanism(org.jboss.as.domain.management.AuthMechanism) HttpHandler(io.undertow.server.HttpHandler) List(java.util.List) SimpleNonceManager(io.undertow.security.impl.SimpleNonceManager) AuthenticationMechanism(io.undertow.security.api.AuthenticationMechanism) RealmIdentityManager(org.jboss.as.domain.http.server.security.RealmIdentityManager) AuthenticationCallHandler(io.undertow.security.handlers.AuthenticationCallHandler) Optional(java.util.Optional) Collections(java.util.Collections) HttpHandler(io.undertow.server.HttpHandler) AuthenticationConstraintHandler(io.undertow.security.handlers.AuthenticationConstraintHandler) DigestAuthenticationMechanism(io.undertow.security.impl.DigestAuthenticationMechanism) CachedAuthenticatedSessionMechanism(io.undertow.security.impl.CachedAuthenticatedSessionMechanism) BasicAuthenticationMechanism(io.undertow.security.impl.BasicAuthenticationMechanism) DigestAuthenticationMechanism(io.undertow.security.impl.DigestAuthenticationMechanism) AuthenticationMechanism(io.undertow.security.api.AuthenticationMechanism) RealmIdentityManager(org.jboss.as.domain.http.server.security.RealmIdentityManager) ArrayList(java.util.ArrayList) PredicateHandler(io.undertow.server.handlers.PredicateHandler) SimpleNonceManager(io.undertow.security.impl.SimpleNonceManager) AuthMechanism(org.jboss.as.domain.management.AuthMechanism) SecurityInitialHandler(io.undertow.security.handlers.SecurityInitialHandler) AuthenticationMechanismsHandler(io.undertow.security.handlers.AuthenticationMechanismsHandler) AuthenticationCallHandler(io.undertow.security.handlers.AuthenticationCallHandler) BasicAuthenticationMechanism(io.undertow.security.impl.BasicAuthenticationMechanism) DigestAlgorithm(io.undertow.security.idm.DigestAlgorithm)

Example 2 with AuthMechanism

use of org.jboss.as.domain.management.AuthMechanism in project wildfly-swarm by wildfly-swarm.

the class SecureHttpContexts method secureHandler.

/**
 * Wraps the target handler and makes it inheritSecurity.
 * Includes a predicate for relevant web contexts.
 */
@SuppressWarnings("deprecation")
private HttpHandler secureHandler(final HttpHandler toWrap, SecurityRealm securityRealm) {
    HttpHandler handler = toWrap;
    handler = new AuthenticationCallHandler(handler);
    handler = new AuthenticationConstraintHandler(handler);
    RealmIdentityManager idm = new RealmIdentityManager(securityRealm);
    Set<AuthMechanism> mechanisms = securityRealm.getSupportedAuthenticationMechanisms();
    List<AuthenticationMechanism> undertowMechanisms = new ArrayList<AuthenticationMechanism>(mechanisms.size());
    undertowMechanisms.add(wrap(new CachedAuthenticatedSessionMechanism(), null));
    for (AuthMechanism current : mechanisms) {
        switch(current) {
            case DIGEST:
                List<DigestAlgorithm> digestAlgorithms = Collections.singletonList(DigestAlgorithm.MD5);
                List<DigestQop> digestQops = Collections.singletonList(DigestQop.AUTH);
                undertowMechanisms.add(wrap(new DigestAuthenticationMechanism(digestAlgorithms, digestQops, securityRealm.getName(), "Monitor", new SimpleNonceManager()), current));
                break;
            case PLAIN:
                undertowMechanisms.add(wrap(new BasicAuthenticationMechanism(securityRealm.getName()), current));
                break;
            case LOCAL:
                break;
            default:
        }
    }
    handler = new AuthenticationMechanismsHandler(handler, undertowMechanisms);
    handler = new SecurityInitialHandler(AuthenticationMode.PRO_ACTIVE, idm, handler);
    // the predicate handler takes care that all of the above
    // will only be enacted on relevant web contexts
    handler = new PredicateHandler(exchange -> {
        if (!monitor.getSecurityRealm().isPresent()) {
            return false;
        }
        if (Queries.isAggregatorEndpoint(monitor, exchange.getRelativePath())) {
            return true;
        }
        if (Queries.isDirectAccessToHealthEndpoint(monitor, exchange.getRelativePath())) {
            if (!hasTokenAuth(exchange)) {
                return true;
            }
            return false;
        }
        if (HttpContexts.getDefaultContextNames().contains(exchange.getRelativePath())) {
            return true;
        }
        return false;
    }, handler, toWrap);
    return handler;
}
Also used : DigestQop(io.undertow.security.impl.DigestQop) BasicAuthenticationMechanism(io.undertow.security.impl.BasicAuthenticationMechanism) HttpServerExchange(io.undertow.server.HttpServerExchange) NamingException(javax.naming.NamingException) SecurityRealm(org.jboss.as.domain.management.SecurityRealm) SecurityInitialHandler(io.undertow.security.handlers.SecurityInitialHandler) ArrayList(java.util.ArrayList) AuthenticationMechanismsHandler(io.undertow.security.handlers.AuthenticationMechanismsHandler) DigestAlgorithm(io.undertow.security.idm.DigestAlgorithm) AuthenticationMechanismWrapper(org.jboss.as.domain.http.server.security.AuthenticationMechanismWrapper) PredicateHandler(io.undertow.server.handlers.PredicateHandler) CachedAuthenticatedSessionMechanism(io.undertow.security.impl.CachedAuthenticatedSessionMechanism) DigestQop(io.undertow.security.impl.DigestQop) DigestAuthenticationMechanism(io.undertow.security.impl.DigestAuthenticationMechanism) Vetoed(javax.enterprise.inject.Vetoed) AuthenticationConstraintHandler(io.undertow.security.handlers.AuthenticationConstraintHandler) Set(java.util.Set) AuthenticationMode(io.undertow.security.api.AuthenticationMode) AuthMechanism(org.jboss.as.domain.management.AuthMechanism) HttpHandler(io.undertow.server.HttpHandler) List(java.util.List) SimpleNonceManager(io.undertow.security.impl.SimpleNonceManager) AuthenticationMechanism(io.undertow.security.api.AuthenticationMechanism) RealmIdentityManager(org.jboss.as.domain.http.server.security.RealmIdentityManager) AuthenticationCallHandler(io.undertow.security.handlers.AuthenticationCallHandler) Optional(java.util.Optional) Collections(java.util.Collections) HttpHandler(io.undertow.server.HttpHandler) AuthenticationConstraintHandler(io.undertow.security.handlers.AuthenticationConstraintHandler) DigestAuthenticationMechanism(io.undertow.security.impl.DigestAuthenticationMechanism) CachedAuthenticatedSessionMechanism(io.undertow.security.impl.CachedAuthenticatedSessionMechanism) BasicAuthenticationMechanism(io.undertow.security.impl.BasicAuthenticationMechanism) DigestAuthenticationMechanism(io.undertow.security.impl.DigestAuthenticationMechanism) AuthenticationMechanism(io.undertow.security.api.AuthenticationMechanism) RealmIdentityManager(org.jboss.as.domain.http.server.security.RealmIdentityManager) ArrayList(java.util.ArrayList) PredicateHandler(io.undertow.server.handlers.PredicateHandler) SimpleNonceManager(io.undertow.security.impl.SimpleNonceManager) AuthMechanism(org.jboss.as.domain.management.AuthMechanism) SecurityInitialHandler(io.undertow.security.handlers.SecurityInitialHandler) AuthenticationMechanismsHandler(io.undertow.security.handlers.AuthenticationMechanismsHandler) AuthenticationCallHandler(io.undertow.security.handlers.AuthenticationCallHandler) BasicAuthenticationMechanism(io.undertow.security.impl.BasicAuthenticationMechanism) DigestAlgorithm(io.undertow.security.idm.DigestAlgorithm)

Example 3 with AuthMechanism

use of org.jboss.as.domain.management.AuthMechanism in project wildfly by wildfly.

the class RealmDirectLoginModule method initialize.

@Override
public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState, Map<String, ?> options) {
    addValidOptions(ALL_VALID_OPTIONS);
    super.initialize(subject, callbackHandler, sharedState, options);
    final String realm = options.containsKey(REALM_OPTION) ? (String) options.get(REALM_OPTION) : DEFAULT_REALM;
    final ServiceController<?> controller = currentServiceContainer().getService(SecurityRealm.ServiceUtil.createServiceName(realm));
    if (controller != null) {
        securityRealm = (SecurityRealm) controller.getValue();
    }
    if (securityRealm == null) {
        throw SecurityLogger.ROOT_LOGGER.realmNotFound(realm);
    }
    Set<AuthMechanism> authMechs = securityRealm.getSupportedAuthenticationMechanisms();
    if (authMechs.contains(AuthMechanism.DIGEST)) {
        chosenMech = AuthMechanism.DIGEST;
    } else if (authMechs.contains(AuthMechanism.PLAIN)) {
        chosenMech = AuthMechanism.PLAIN;
    } else {
        chosenMech = authMechs.iterator().next();
    }
    if (chosenMech == AuthMechanism.DIGEST || chosenMech == AuthMechanism.PLAIN) {
        Map<String, String> mechOpts = securityRealm.getMechanismConfig(chosenMech);
        if (mechOpts.containsKey(VERIFY_PASSWORD_CALLBACK_SUPPORTED) && Boolean.parseBoolean(mechOpts.get(VERIFY_PASSWORD_CALLBACK_SUPPORTED))) {
            // We give this mode priority as even if digest is supported the realm supplied
            // callback handler can handle the conversion comparison itself.
            validationMode = ValidationMode.VALIDATION;
        } else {
            if (chosenMech == AuthMechanism.DIGEST) {
                if (mechOpts.containsKey(DIGEST_PLAIN_TEXT) && Boolean.parseBoolean(mechOpts.get(DIGEST_PLAIN_TEXT))) {
                    validationMode = ValidationMode.PASSWORD;
                } else {
                    validationMode = ValidationMode.DIGEST;
                    try {
                        hashUtil = new UsernamePasswordHashUtil();
                    } catch (NoSuchAlgorithmException e) {
                        throw new IllegalStateException(e);
                    }
                }
            } else {
                validationMode = ValidationMode.PASSWORD;
            }
        }
    } else {
        validationMode = ValidationMode.NONE;
    }
}
Also used : AuthMechanism(org.jboss.as.domain.management.AuthMechanism) UsernamePasswordHashUtil(org.wildfly.security.sasl.util.UsernamePasswordHashUtil) NoSuchAlgorithmException(java.security.NoSuchAlgorithmException)

Aggregations

AuthMechanism (org.jboss.as.domain.management.AuthMechanism)3 AuthenticationMechanism (io.undertow.security.api.AuthenticationMechanism)2 AuthenticationMode (io.undertow.security.api.AuthenticationMode)2 AuthenticationCallHandler (io.undertow.security.handlers.AuthenticationCallHandler)2 AuthenticationConstraintHandler (io.undertow.security.handlers.AuthenticationConstraintHandler)2 AuthenticationMechanismsHandler (io.undertow.security.handlers.AuthenticationMechanismsHandler)2 SecurityInitialHandler (io.undertow.security.handlers.SecurityInitialHandler)2 DigestAlgorithm (io.undertow.security.idm.DigestAlgorithm)2 BasicAuthenticationMechanism (io.undertow.security.impl.BasicAuthenticationMechanism)2 CachedAuthenticatedSessionMechanism (io.undertow.security.impl.CachedAuthenticatedSessionMechanism)2 DigestAuthenticationMechanism (io.undertow.security.impl.DigestAuthenticationMechanism)2 DigestQop (io.undertow.security.impl.DigestQop)2 SimpleNonceManager (io.undertow.security.impl.SimpleNonceManager)2 HttpHandler (io.undertow.server.HttpHandler)2 HttpServerExchange (io.undertow.server.HttpServerExchange)2 PredicateHandler (io.undertow.server.handlers.PredicateHandler)2 ArrayList (java.util.ArrayList)2 Collections (java.util.Collections)2 List (java.util.List)2 Optional (java.util.Optional)2