use of org.jboss.security.RunAsIdentity in project wildfly by wildfly.
the class SimpleSecurityManager method push.
/**
* Must be called from within a privileged action.
*
* @param securityDomain
*/
public void push(final String securityDomain) {
// TODO - Handle a null securityDomain here? Yes I think so.
final SecurityContext previous = SecurityContextAssociation.getSecurityContext();
contexts.push(previous);
SecurityContext current = establishSecurityContext(securityDomain);
if (propagate && previous != null) {
current.setSubjectInfo(getSubjectInfo(previous));
current.setIncomingRunAs(previous.getOutgoingRunAs());
}
RunAs currentRunAs = current.getIncomingRunAs();
boolean trusted = currentRunAs != null && currentRunAs instanceof RunAsIdentity;
if (trusted == false) {
/*
* We should only be switching to a context based on an identity from the Remoting connection if we don't already
* have a trusted identity - this allows for beans to reauthenticate as a different identity.
*/
if (SecurityActions.remotingContextIsSet()) {
// In this case the principal and credential will not have been set to set some random values.
SecurityContextUtil util = current.getUtil();
Connection connection = SecurityActions.remotingContextGetConnection();
Principal p = null;
Object credential = null;
SecurityIdentity localIdentity = connection.getLocalIdentity();
if (localIdentity != null) {
p = new SimplePrincipal(localIdentity.getPrincipal().getName());
IdentityCredentials privateCredentials = localIdentity.getPrivateCredentials();
PasswordCredential passwordCredential = privateCredentials.getCredential(PasswordCredential.class, ClearPassword.ALGORITHM_CLEAR);
if (passwordCredential != null) {
credential = new String(passwordCredential.getPassword(ClearPassword.class).getPassword());
} else {
credential = new RemotingConnectionCredential(connection);
}
} else {
throw SecurityLogger.ROOT_LOGGER.noUserPrincipalFound();
}
SecurityActions.remotingContextClear();
util.createSubjectInfo(p, credential, null);
}
}
}
use of org.jboss.security.RunAsIdentity in project wildfly by wildfly.
the class RunAsLifecycleInterceptor method handle.
private void handle(ServletInfo servletInfo, LifecycleContext context) throws ServletException {
RunAsIdentityMetaData identity = null;
RunAs old = null;
SecurityContext sc = SecurityActions.getSecurityContext();
if (sc == null) {
context.proceed();
return;
}
try {
identity = runAsIdentityMetaDataMap.get(servletInfo.getName());
RunAsIdentity runAsIdentity = null;
if (identity != null) {
UndertowLogger.ROOT_LOGGER.tracef("%s, runAs: %s", servletInfo.getName(), identity);
runAsIdentity = new RunAsIdentity(identity.getRoleName(), identity.getPrincipalName(), identity.getRunAsRoles());
}
old = SecurityActions.setRunAsIdentity(runAsIdentity, sc);
// Perform the request
context.proceed();
} finally {
if (identity != null) {
SecurityActions.setRunAsIdentity(old, sc);
}
}
}
use of org.jboss.security.RunAsIdentity in project wildfly by wildfly.
the class SecurityContextAssociationHandler method handleRequest.
@Override
public void handleRequest(final HttpServerExchange exchange) throws Exception {
SecurityContext sc = exchange.getAttachment(UndertowSecurityAttachments.SECURITY_CONTEXT_ATTACHMENT);
RunAsIdentityMetaData identity = null;
RunAs old = null;
try {
final ServletChain servlet = exchange.getAttachment(ServletRequestContext.ATTACHMENT_KEY).getCurrentServlet();
identity = runAsIdentityMetaDataMap.get(servlet.getManagedServlet().getServletInfo().getName());
RunAsIdentity runAsIdentity = null;
if (identity != null) {
UndertowLogger.ROOT_LOGGER.tracef("%s, runAs: %s", servlet.getManagedServlet().getServletInfo().getName(), identity);
runAsIdentity = new RunAsIdentity(identity.getRoleName(), identity.getPrincipalName(), identity.getRunAsRoles());
}
old = SecurityActions.setRunAsIdentity(runAsIdentity, sc);
// Perform the request
next.handleRequest(exchange);
} finally {
if (identity != null) {
SecurityActions.setRunAsIdentity(old, sc);
}
}
}
use of org.jboss.security.RunAsIdentity in project wildfly by wildfly.
the class SimpleSecurityManager method authenticate.
public void authenticate(final String runAs, final String runAsPrincipal, final Set<String> extraRoles) {
SecurityContext current = SecurityContextAssociation.getSecurityContext();
SecurityContext previous = contexts.peek();
// skip reauthentication if the current context already has an authenticated subject (copied from the previous context
// upon creation - see push method) and if both contexts use the same security domain.
boolean skipReauthentication = current.getSubjectInfo() != null && current.getSubjectInfo().getAuthenticatedSubject() != null && previous != null && current.getSecurityDomain().equals(previous.getSecurityDomain());
if (!skipReauthentication) {
SecurityContextUtil util = current.getUtil();
Object credential = util.getCredential();
Subject subject = null;
if (credential instanceof RemotingConnectionCredential) {
subject = ((RemotingConnectionCredential) credential).getSubject();
}
if (authenticate(current, subject) == false) {
throw SecurityLogger.ROOT_LOGGER.invalidUserException();
}
}
// setup the run-as identity.
if (runAs != null) {
RunAs runAsIdentity = new RunAsIdentity(runAs, runAsPrincipal, extraRoles);
current.setOutgoingRunAs(runAsIdentity);
} else if (propagate && previous != null && previous.getOutgoingRunAs() != null) {
// Ensure the propagation continues.
current.setOutgoingRunAs(previous.getOutgoingRunAs());
}
}
use of org.jboss.security.RunAsIdentity in project wildfly by wildfly.
the class SimpleSecurityManager method push.
public void push(final String securityDomain, String userName, char[] password, final Subject subject) {
final SecurityContext previous = SecurityContextAssociation.getSecurityContext();
contexts.push(previous);
SecurityContext current = establishSecurityContext(securityDomain);
if (propagate && previous != null) {
current.setSubjectInfo(getSubjectInfo(previous));
current.setIncomingRunAs(previous.getOutgoingRunAs());
}
RunAs currentRunAs = current.getIncomingRunAs();
boolean trusted = currentRunAs != null && currentRunAs instanceof RunAsIdentity;
if (trusted == false) {
SecurityContextUtil util = current.getUtil();
util.createSubjectInfo(new SimplePrincipal(userName), new String(password), subject);
}
}
Aggregations