Examples with NestableGroup org.jboss.security.NestableGroup used on opensource projects

Example 1 with NestableGroup

use of org.jboss.security.NestableGroup in project keycloak by keycloak.

the class JBossWebPrincipalFactory method createPrincipal.

@Override
public GenericPrincipal createPrincipal(Realm realm, final Principal identity, final Set<String> roleSet) {
    KeycloakAccount account = new KeycloakAccount() {

        @Override
        public Principal getPrincipal() {
            return identity;
        }

        @Override
        public Set<String> getRoles() {
            return roleSet;
        }
    };
    Subject subject = new Subject();
    Set<Principal> principals = subject.getPrincipals();
    principals.add(identity);
    Group[] roleSets = getRoleSets(roleSet);
    for (int g = 0; g < roleSets.length; g++) {
        Group group = roleSets[g];
        String name = group.getName();
        Group subjectGroup = createGroup(name, principals);
        if (subjectGroup instanceof NestableGroup) {
            /* A NestableGroup only allows Groups to be added to it so we
                need to add a SimpleGroup to subjectRoles to contain the roles
                */
            SimpleGroup tmp = new SimpleGroup("Roles");
            subjectGroup.addMember(tmp);
            subjectGroup = tmp;
        }
        // Copy the group members to the Subject group
        Enumeration<? extends Principal> members = group.members();
        while (members.hasMoreElements()) {
            Principal role = (Principal) members.nextElement();
            subjectGroup.addMember(role);
        }
    }
    // add the CallerPrincipal group if none has been added in getRoleSets
    Group callerGroup = new SimpleGroup(SecurityConstants.CALLER_PRINCIPAL_GROUP);
    callerGroup.addMember(identity);
    principals.add(callerGroup);
    SecurityContext sc = SecurityContextAssociation.getSecurityContext();
    Principal userPrincipal = getPrincipal(subject);
    sc.getUtil().createSubjectInfo(userPrincipal, account, subject);
    List<String> rolesAsStringList = new ArrayList<>(roleSet);
    try {
        return (GenericPrincipal) jbossWebPrincipalConstructor.newInstance(realm, userPrincipal.getName(), null, rolesAsStringList, userPrincipal, null, account, null, subject);
    } catch (Throwable t) {
        throw new RuntimeException("Failed to create JBossGenericPrincipal", t);
    }
}

Example 2 with NestableGroup

use of org.jboss.security.NestableGroup in project keycloak by keycloak.

the class WildflyRequestAuthenticator method propagateKeycloakContext.

@Override
protected void propagateKeycloakContext(KeycloakUndertowAccount account) {
    super.propagateKeycloakContext(account);
    SecurityInfoHelper.propagateSessionInfo(account);
    log.debug("propagate security context to wildfly");
    Subject subject = new Subject();
    Set<Principal> principals = subject.getPrincipals();
    principals.add(account.getPrincipal());
    Group[] roleSets = getRoleSets(account.getRoles());
    for (int g = 0; g < roleSets.length; g++) {
        Group group = roleSets[g];
        String name = group.getName();
        Group subjectGroup = createGroup(name, principals);
        if (subjectGroup instanceof NestableGroup) {
            /* A NestableGroup only allows Groups to be added to it so we
                need to add a SimpleGroup to subjectRoles to contain the roles
                */
            SimpleGroup tmp = new SimpleGroup("Roles");
            subjectGroup.addMember(tmp);
            subjectGroup = tmp;
        }
        // Copy the group members to the Subject group
        Enumeration<? extends Principal> members = group.members();
        while (members.hasMoreElements()) {
            Principal role = (Principal) members.nextElement();
            subjectGroup.addMember(role);
        }
    }
    // add the CallerPrincipal group if none has been added in getRoleSets
    Group callerGroup = new SimpleGroup(SecurityConstants.CALLER_PRINCIPAL_GROUP);
    callerGroup.addMember(account.getPrincipal());
    principals.add(callerGroup);
    org.jboss.security.SecurityContext sc = SecurityContextAssociation.getSecurityContext();
    Principal userPrincipal = getPrincipal(subject);
    sc.getUtil().createSubjectInfo(userPrincipal, account, subject);
    // Roles of subjectInfo are null, because is was constructed by
    // org.jboss.security.identity.extensions.CredentialIdentityFactory
    // .createIdentity(Principal [=userPrincipal], Object [=account], Role [=null]).
    // Therefore the roles are only contained in the authenticatedSubject (member of subjectInfo)
    // and subsequent logics do only access subjectInfo#roles instead of authenticatedSubject#roles.
    mapGroupMembersOfAuthenticatedSubjectIntoSecurityContext(sc);
}

Example 3 with NestableGroup

use of org.jboss.security.NestableGroup in project keycloak by keycloak.

the class SecurityInfoHelper method propagateSessionInfo.

public static void propagateSessionInfo(KeycloakAccount account) {
    Subject subject = new Subject();
    Set<Principal> principals = subject.getPrincipals();
    principals.add(account.getPrincipal());
    Group[] roleSets = getRoleSets(account.getRoles());
    for (int g = 0; g < roleSets.length; g++) {
        Group group = roleSets[g];
        String name = group.getName();
        Group subjectGroup = createGroup(name, principals);
        if (subjectGroup instanceof NestableGroup) {
            /* A NestableGroup only allows Groups to be added to it so we
                need to add a SimpleGroup to subjectRoles to contain the roles
                */
            SimpleGroup tmp = new SimpleGroup("Roles");
            subjectGroup.addMember(tmp);
            subjectGroup = tmp;
        }
        // Copy the group members to the Subject group
        Enumeration<? extends Principal> members = group.members();
        while (members.hasMoreElements()) {
            Principal role = (Principal) members.nextElement();
            subjectGroup.addMember(role);
        }
    }
    // add the CallerPrincipal group if none has been added in getRoleSets
    Group callerGroup = new SimpleGroup(SecurityConstants.CALLER_PRINCIPAL_GROUP);
    callerGroup.addMember(account.getPrincipal());
    principals.add(callerGroup);
    org.jboss.security.SecurityContext sc = SecurityContextAssociation.getSecurityContext();
    Principal userPrincipal = getPrincipal(subject);
    sc.getUtil().createSubjectInfo(userPrincipal, account, subject);
}

Example 4 with NestableGroup

use of org.jboss.security.NestableGroup in project keycloak by keycloak.

the class SecurityInfoHelper method propagateSessionInfo.

public static void propagateSessionInfo(KeycloakAccount account) {
    Subject subject = new Subject();
    Set<Principal> principals = subject.getPrincipals();
    principals.add(account.getPrincipal());
    Group[] roleSets = getRoleSets(account.getRoles());
    for (int g = 0; g < roleSets.length; g++) {
        Group group = roleSets[g];
        String name = group.getName();
        Group subjectGroup = createGroup(name, principals);
        if (subjectGroup instanceof NestableGroup) {
            /* A NestableGroup only allows Groups to be added to it so we
                need to add a SimpleGroup to subjectRoles to contain the roles
                */
            SimpleGroup tmp = new SimpleGroup("Roles");
            subjectGroup.addMember(tmp);
            subjectGroup = tmp;
        }
        // Copy the group members to the Subject group
        Enumeration<? extends Principal> members = group.members();
        while (members.hasMoreElements()) {
            Principal role = (Principal) members.nextElement();
            subjectGroup.addMember(role);
        }
    }
    // add the CallerPrincipal group if none has been added in getRoleSets
    Group callerGroup = new SimpleGroup(SecurityConstants.CALLER_PRINCIPAL_GROUP);
    callerGroup.addMember(account.getPrincipal());
    principals.add(callerGroup);
    org.jboss.security.SecurityContext sc = SecurityContextAssociation.getSecurityContext();
    Principal userPrincipal = getPrincipal(subject);
    sc.getUtil().createSubjectInfo(userPrincipal, account, subject);
}