Search in sources :

Example 1 with SessionManagementBridge

use of org.keycloak.adapters.undertow.SessionManagementBridge in project keycloak by keycloak.

the class UndertowKeycloakConsumer method handleRequest.

@Override
public void handleRequest(HttpServerExchange httpExchange) throws Exception {
    if (shouldSkip(httpExchange.getRequestPath())) {
        super.handleRequest(httpExchange);
        return;
    }
    // perform only non-blocking operation on exchange
    if (httpExchange.isInIoThread()) {
        httpExchange.dispatch(this);
        return;
    }
    OIDCUndertowHttpFacade facade = new OIDCUndertowHttpFacade(httpExchange);
    KeycloakDeployment deployment = deploymentContext.resolveDeployment(facade);
    if (deployment == null || !deployment.isConfigured()) {
        httpExchange.setStatusCode(StatusCodes.FORBIDDEN);
        LOG.fine("deployment not configured");
        return;
    }
    LOG.fine("executing PreAuthActionsHandler");
    SessionManagementBridge bridge = new SessionManagementBridge(userSessionManagement, sessionManager);
    PreAuthActionsHandler preAuth = new PreAuthActionsHandler(bridge, deploymentContext, facade);
    if (preAuth.handleRequest())
        return;
    SecurityContext securityContext = httpExchange.getSecurityContext();
    if (securityContext == null) {
        securityContext = new SecurityContextImpl(httpExchange, IDENTITY_MANAGER);
    }
    AdapterTokenStore tokenStore = getTokenStore(httpExchange, facade, deployment, securityContext);
    tokenStore.checkCurrentToken();
    LOG.fine("executing AuthenticatedActionsHandler");
    RequestAuthenticator authenticator = new UndertowRequestAuthenticator(facade, deployment, confidentialPort, securityContext, httpExchange, tokenStore);
    AuthOutcome outcome = authenticator.authenticate();
    if (outcome == AuthOutcome.AUTHENTICATED) {
        LOG.fine("AUTHENTICATED");
        if (httpExchange.isResponseComplete()) {
            return;
        }
        AuthenticatedActionsHandler actions = new AuthenticatedActionsHandler(deployment, facade);
        if (actions.handledRequest()) {
            return;
        } else {
            final Account authenticatedAccount = securityContext.getAuthenticatedAccount();
            if (authenticatedAccount instanceof KeycloakUndertowAccount) {
                final KeycloakUndertowAccount kua = (KeycloakUndertowAccount) authenticatedAccount;
                httpExchange.putAttachment(KEYCLOAK_PRINCIPAL_KEY, (KeycloakPrincipal) kua.getPrincipal());
            }
            Set<String> roles = authenticatedAccount.getRoles();
            if (roles == null) {
                roles = Collections.EMPTY_SET;
            }
            LOG.log(Level.FINE, "Allowed roles: {0}, current roles: {1}", new Object[] { allowedRoles, roles });
            if (isRoleAllowed(roles, httpExchange)) {
                super.handleRequest(httpExchange);
            } else {
                httpExchange.setStatusCode(StatusCodes.FORBIDDEN);
            }
            return;
        }
    }
    AuthChallenge challenge = authenticator.getChallenge();
    if (challenge != null) {
        LOG.fine("challenge");
        challenge.challenge(facade);
        return;
    }
    httpExchange.setStatusCode(StatusCodes.FORBIDDEN);
}
Also used : AuthenticatedActionsHandler(org.keycloak.adapters.AuthenticatedActionsHandler) Account(io.undertow.security.idm.Account) KeycloakUndertowAccount(org.keycloak.adapters.undertow.KeycloakUndertowAccount) SecurityContextImpl(io.undertow.security.impl.SecurityContextImpl) AuthChallenge(org.keycloak.adapters.spi.AuthChallenge) UndertowRequestAuthenticator(org.keycloak.adapters.undertow.UndertowRequestAuthenticator) RequestAuthenticator(org.keycloak.adapters.RequestAuthenticator) AuthOutcome(org.keycloak.adapters.spi.AuthOutcome) PreAuthActionsHandler(org.keycloak.adapters.PreAuthActionsHandler) KeycloakUndertowAccount(org.keycloak.adapters.undertow.KeycloakUndertowAccount) OIDCUndertowHttpFacade(org.keycloak.adapters.undertow.OIDCUndertowHttpFacade) KeycloakDeployment(org.keycloak.adapters.KeycloakDeployment) SecurityContext(io.undertow.security.api.SecurityContext) SessionManagementBridge(org.keycloak.adapters.undertow.SessionManagementBridge) UndertowRequestAuthenticator(org.keycloak.adapters.undertow.UndertowRequestAuthenticator) AdapterTokenStore(org.keycloak.adapters.AdapterTokenStore)

Aggregations

SecurityContext (io.undertow.security.api.SecurityContext)1 Account (io.undertow.security.idm.Account)1 SecurityContextImpl (io.undertow.security.impl.SecurityContextImpl)1 AdapterTokenStore (org.keycloak.adapters.AdapterTokenStore)1 AuthenticatedActionsHandler (org.keycloak.adapters.AuthenticatedActionsHandler)1 KeycloakDeployment (org.keycloak.adapters.KeycloakDeployment)1 PreAuthActionsHandler (org.keycloak.adapters.PreAuthActionsHandler)1 RequestAuthenticator (org.keycloak.adapters.RequestAuthenticator)1 AuthChallenge (org.keycloak.adapters.spi.AuthChallenge)1 AuthOutcome (org.keycloak.adapters.spi.AuthOutcome)1 KeycloakUndertowAccount (org.keycloak.adapters.undertow.KeycloakUndertowAccount)1 OIDCUndertowHttpFacade (org.keycloak.adapters.undertow.OIDCUndertowHttpFacade)1 SessionManagementBridge (org.keycloak.adapters.undertow.SessionManagementBridge)1 UndertowRequestAuthenticator (org.keycloak.adapters.undertow.UndertowRequestAuthenticator)1