Examples with SecurityContext org.neo4j.kernel.api.security.SecurityContext used on opensource projects

Example 26 with SecurityContext

use of org.neo4j.kernel.api.security.SecurityContext in project neo4j by neo4j.

the class AuthorizationEnabledFilter method doFilter.

@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
    validateRequestType(servletRequest);
    validateResponseType(servletResponse);
    final HttpServletRequest request = (HttpServletRequest) servletRequest;
    final HttpServletResponse response = (HttpServletResponse) servletResponse;
    final String path = request.getContextPath() + (request.getPathInfo() == null ? "" : request.getPathInfo());
    if (request.getMethod().equals("OPTIONS") || whitelisted(path)) {
        // NOTE: If starting transactions with access mode on whitelisted uris should be possible we need to
        //       wrap servletRequest in an AuthorizedRequestWarpper here
        filterChain.doFilter(servletRequest, servletResponse);
        return;
    }
    final String header = request.getHeader(HttpHeaders.AUTHORIZATION);
    if (header == null) {
        requestAuthentication(request, noHeader).accept(response);
        return;
    }
    final String[] usernameAndPassword = extractCredential(header);
    if (usernameAndPassword == null) {
        badHeader.accept(response);
        return;
    }
    final String username = usernameAndPassword[0];
    final String password = usernameAndPassword[1];
    try {
        SecurityContext securityContext = authenticate(username, password);
        switch(securityContext.subject().getAuthenticationResult()) {
            case PASSWORD_CHANGE_REQUIRED:
                if (!PASSWORD_CHANGE_WHITELIST.matcher(path).matches()) {
                    passwordChangeRequired(username, baseURL(request)).accept(response);
                    return;
                }
            // fall through
            case SUCCESS:
                try {
                    filterChain.doFilter(new AuthorizedRequestWrapper(BASIC_AUTH, username, request, securityContext), servletResponse);
                } catch (AuthorizationViolationException e) {
                    unauthorizedAccess(e.getMessage()).accept(response);
                }
                return;
            case TOO_MANY_ATTEMPTS:
                tooManyAttempts.accept(response);
                return;
            default:
                log.warn("Failed authentication attempt for '%s' from %s", username, request.getRemoteAddr());
                requestAuthentication(request, invalidCredential).accept(response);
        }
    } catch (InvalidAuthTokenException e) {
        requestAuthentication(request, invalidAuthToken(e.getMessage())).accept(response);
    } catch (AuthProviderTimeoutException e) {
        authProviderTimeout.accept(response);
    } catch (AuthProviderFailedException e) {
        authProviderFailed.accept(response);
    }
}

Example 27 with SecurityContext

use of org.neo4j.kernel.api.security.SecurityContext in project neo4j by neo4j.

the class UserService method setPassword.

@POST
@Path("/{username}/password")
public Response setPassword(@PathParam("username") String username, @Context HttpServletRequest req, String payload) {
    Principal principal = req.getUserPrincipal();
    if (principal == null || !principal.getName().equals(username)) {
        return output.notFound();
    }
    final Map<String, Object> deserialized;
    try {
        deserialized = input.readMap(payload);
    } catch (BadInputException e) {
        return output.response(BAD_REQUEST, new ExceptionRepresentation(new Neo4jError(Status.Request.InvalidFormat, e.getMessage())));
    }
    Object o = deserialized.get(PASSWORD);
    if (o == null) {
        return output.response(UNPROCESSABLE, new ExceptionRepresentation(new Neo4jError(Status.Request.InvalidFormat, String.format("Required parameter '%s' is missing.", PASSWORD))));
    }
    if (!(o instanceof String)) {
        return output.response(UNPROCESSABLE, new ExceptionRepresentation(new Neo4jError(Status.Request.InvalidFormat, String.format("Expected '%s' to be a string.", PASSWORD))));
    }
    String newPassword = (String) o;
    try {
        SecurityContext securityContext = getSecurityContextFromUserPrincipal(principal);
        if (securityContext == null) {
            return output.notFound();
        } else {
            UserManager userManager = userManagerSupplier.getUserManager(securityContext);
            userManager.setUserPassword(username, newPassword, false);
        }
    } catch (IOException e) {
        return output.serverErrorWithoutLegacyStacktrace(e);
    } catch (InvalidArgumentsException e) {
        return output.response(UNPROCESSABLE, new ExceptionRepresentation(new Neo4jError(e.status(), e.getMessage())));
    }
    return output.ok();
}

Example 28 with SecurityContext

use of org.neo4j.kernel.api.security.SecurityContext in project neo4j by neo4j.

the class SecurityContextDescriptionTest method shouldMakeNiceDescriptionWithMode.

@Test
public void shouldMakeNiceDescriptionWithMode() throws Throwable {
    SecurityContext modified = context.withMode(AccessMode.Static.WRITE);
    assertThat(modified.description(), equalTo("user 'johan' with WRITE"));
}

Example 29 with SecurityContext

use of org.neo4j.kernel.api.security.SecurityContext in project neo4j by neo4j.

the class SecurityContextDescriptionTest method shouldMakeNiceDescriptionRestricted.

@Test
public void shouldMakeNiceDescriptionRestricted() throws Throwable {
    SecurityContext restricted = context.withMode(new RestrictedAccessMode(context.mode(), AccessMode.Static.READ));
    assertThat(restricted.description(), equalTo("user 'johan' with FULL restricted to READ"));
}

Example 30 with SecurityContext

use of org.neo4j.kernel.api.security.SecurityContext in project neo4j by neo4j.

the class BasicAuthManagerTest method assertLoginGivesResult.

private void assertLoginGivesResult(String username, String password, AuthenticationResult expectedResult) throws InvalidAuthTokenException {
    SecurityContext securityContext = manager.login(authToken(username, password));
    assertThat(securityContext.subject().getAuthenticationResult(), equalTo(expectedResult));
}