Examples with PreAuthenticatedAuthenticationToken org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken used on opensource projects

Example 56 with PreAuthenticatedAuthenticationToken

use of org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken in project midpoint by Evolveum.

the class MidpointRequestHeaderAuthenticationFilter method doAuthenticate.

private void doAuthenticate(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
    Authentication authResult;
    Object principal = getPreAuthenticatedPrincipal(request);
    Object credentials = getPreAuthenticatedCredentials(request);
    if (principal == null) {
        AuthenticationException failed = new AuthenticationCredentialsNotFoundException("web.security.provider.invalid.credentials");
        unsuccessfulAuthentication(request, response, failed);
        return;
    }
    try {
        PreAuthenticatedAuthenticationToken authRequest = new PreAuthenticatedAuthenticationToken(principal, credentials);
        authRequest.setDetails(authenticationDetailsSource.buildDetails(request));
        authResult = authenticationManager.authenticate(authRequest);
        if (sessionRegistry != null) {
            sessionRegistry.registerNewSession(request.getSession().getId(), authResult.getPrincipal());
        }
        successfulAuthentication(request, response, authResult);
    } catch (AuthenticationException failed) {
        unsuccessfulAuthentication(request, response, failed);
    }
}

Example 57 with PreAuthenticatedAuthenticationToken

use of org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken in project midpoint by Evolveum.

the class SecurityContextManagerImpl method setupPreAuthenticatedSecurityContext.

@Override
public void setupPreAuthenticatedSecurityContext(MidPointPrincipal principal) {
    // Make sure that constructor with authorities is used. Otherwise the context will not be authenticated.
    Authentication authentication = new PreAuthenticatedAuthenticationToken(principal, null, principal.getAuthorities());
    setupPreAuthenticatedSecurityContext(authentication);
}

Example 58 with PreAuthenticatedAuthenticationToken

use of org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken in project midpoint by Evolveum.

the class PasswordProvider method internalAuthentication.

@Override
protected Authentication internalAuthentication(Authentication authentication, List<ObjectReferenceType> requireAssignment, AuthenticationChannel channel, Class<? extends FocusType> focusType) throws AuthenticationException {
    if (authentication.isAuthenticated() && authentication.getPrincipal() instanceof GuiProfiledPrincipal) {
        return authentication;
    }
    String enteredUsername = (String) authentication.getPrincipal();
    LOGGER.trace("Authenticating username '{}'", enteredUsername);
    ConnectionEnvironment connEnv = createEnvironment(channel);
    try {
        Authentication token;
        if (authentication instanceof UsernamePasswordAuthenticationToken) {
            String enteredPassword = (String) authentication.getCredentials();
            PasswordAuthenticationContext authContext = new PasswordAuthenticationContext(enteredUsername, enteredPassword, focusType, requireAssignment);
            if (channel != null) {
                authContext.setSupportActivationByChannel(channel.isSupportActivationByChannel());
            }
            token = getEvaluator().authenticate(connEnv, authContext);
        } else if (authentication instanceof PreAuthenticatedAuthenticationToken) {
            token = getEvaluator().authenticateUserPreAuthenticated(connEnv, new PreAuthenticationContext(enteredUsername, focusType, requireAssignment));
        } else {
            LOGGER.error("Unsupported authentication {}", authentication);
            throw new AuthenticationServiceException("web.security.provider.unavailable");
        }
        MidPointPrincipal principal = (MidPointPrincipal) token.getPrincipal();
        LOGGER.debug("User '{}' authenticated ({}), authorities: {}", authentication.getPrincipal(), authentication.getClass().getSimpleName(), principal.getAuthorities());
        return token;
    } catch (AuthenticationException e) {
        LOGGER.info("Authentication failed for {}: {}", enteredUsername, e.getMessage());
        throw e;
    }
}

Example 59 with PreAuthenticatedAuthenticationToken

use of org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken in project spring-security by spring-projects.

the class PreAuthenticatedAuthenticationTokenMixinTests method deserializeAuthenticatedUsernamePasswordAuthenticationTokenMixinTest.

@Test
public void deserializeAuthenticatedUsernamePasswordAuthenticationTokenMixinTest() throws Exception {
    PreAuthenticatedAuthenticationToken deserialized = this.mapper.readValue(PREAUTH_JSON, PreAuthenticatedAuthenticationToken.class);
    assertThat(deserialized).isNotNull();
    assertThat(deserialized.isAuthenticated()).isTrue();
    assertThat(deserialized.getAuthorities()).isEqualTo(this.expected.getAuthorities());
}

Example 60 with PreAuthenticatedAuthenticationToken

use of org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken in project webofneeds by researchstudio-sat.

the class WonAclAccessDecisionVoter method vote.

@Override
@Transactional
public int vote(final Authentication authentication, final FilterInvocation filterInvocation, final Collection<ConfigAttribute> configAttributes) {
    StopWatch stopWatch = new StopWatch();
    stopWatch.start();
    if (configAttributes.stream().map(Object::toString).anyMatch(x -> x.equals("permitAll"))) {
        // check ACLs
        return ACCESS_GRANTED;
    }
    String webId = null;
    AuthToken authToken = null;
    if (authentication instanceof PreAuthenticatedAuthenticationToken) {
        Object principal = authentication.getPrincipal();
        if (principal instanceof WebIdUserDetails) {
            WebIdUserDetails userDetails = (WebIdUserDetails) principal;
            // check if the WebId was verified successfully, otherwise treat as anonymous
            if (authentication.getAuthorities().stream().map(GrantedAuthority::getAuthority).filter(r -> "ROLE_WEBID".equals(r)).findAny().isPresent()) {
                // if the webid was not verified, use none
                webId = userDetails.getUsername();
            }
        }
    } else if (authentication instanceof WonAclTokenAuthentication) {
        authToken = (AuthToken) ((WonAclTokenAuthentication) authentication).getDetails();
    }
    if (webId != null && webId.equals(cryptographyService.getDefaultPrivateKeyAlias())) {
        // if the WoN node itself is the requestor, bypass all checks and allow
        if (logger.isDebugEnabled()) {
            logger.debug("Requestor is WonNode itself, authenticated by its WebID. Bypassing any ACL checks");
        }
        WonAclRequestHelper.setWonAclEvaluationContext(filterInvocation.getRequest(), WonAclEvalContext.allowAll());
        return ACCESS_GRANTED;
    }
    String resource = filterInvocation.getRequest().getRequestURL().toString();
    URI resourceUri = null;
    try {
        resourceUri = uriService.toResourceURIIfPossible(new URI(resource));
    } catch (URISyntaxException e) {
        logger.debug("Cannot process ACL for resource {}", resource);
        return ACCESS_DENIED;
    }
    if (logger.isDebugEnabled()) {
        logger.debug("Processing WoN ACL for request to resource {}", resourceUri);
    }
    int result = ACCESS_DENIED;
    // perform our hard coded access control checks
    // prepare the legacy implementation in case the target atom(s) have no acl
    // graph
    final List<String> webids = webId != null ? List.of(webId) : Collections.emptyList();
    Supplier<Integer> legacyImpl = () -> {
        if (defaultAccessControlRules.isAccessPermitted(resource, webids)) {
            return ACCESS_GRANTED;
        }
        return ACCESS_DENIED;
    };
    if (WonMessageUriHelper.isLocalMessageURI(resourceUri, uriService.getMessageResourceURIPrefix())) {
        // handle request for message
        result = voteForMessageRequest(webId, authToken, resourceUri, filterInvocation, legacyImpl);
    } else {
        // handle other requests
        result = voteForNonMessageRequest(webId, authToken, resourceUri, filterInvocation, legacyImpl);
    }
    stopWatch.stop();
    if (logger.isDebugEnabled()) {
        logger.debug("access control check for {} with webid {}, token {} took {} millis, result: {} ", new Object[] { resourceUri, webId, authToken == null ? "(no token)" : "present", stopWatch.getLastTaskTimeMillis(), (result == ACCESS_GRANTED ? "granted" : (result == ACCESS_DENIED ? "denied" : (result == ACCESS_ABSTAIN ? "abstain" : result))) });
    }
    return result;
}