use of org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor in project wildfly by wildfly.
the class UndertowDeploymentInfoService method createServletConfig.
private DeploymentInfo createServletConfig() throws StartException {
final ComponentRegistry componentRegistry = componentRegistryInjectedValue.getValue();
try {
if (!mergedMetaData.isMetadataComplete()) {
mergedMetaData.resolveAnnotations();
}
mergedMetaData.resolveRunAs();
final DeploymentInfo d = new DeploymentInfo();
d.setContextPath(resolveContextPath());
if (mergedMetaData.getDescriptionGroup() != null) {
d.setDisplayName(mergedMetaData.getDescriptionGroup().getDisplayName());
}
d.setDeploymentName(deploymentName);
d.setHostName(host.getValue().getName());
final ServletContainerService servletContainer = container.getValue();
try {
//TODO: make the caching limits configurable
List<String> externalOverlays = mergedMetaData.getOverlays();
ResourceManager resourceManager = new ServletResourceManager(deploymentRoot, overlays, explodedDeployment, mergedMetaData.isSymbolicLinkingEnabled(), servletContainer.isDisableFileWatchService(), externalOverlays);
resourceManager = new CachingResourceManager(100, 10 * 1024 * 1024, servletContainer.getBufferCache(), resourceManager, explodedDeployment ? 2000 : -1);
if (externalResources != null && !externalResources.isEmpty()) {
//TODO: we don't cache external deployments, as they are intended for development use
//should be make this configurable or something?
List<ResourceManager> delegates = new ArrayList<>();
for (File resource : externalResources) {
delegates.add(new FileResourceManager(resource.getCanonicalFile(), 1024, true, mergedMetaData.isSymbolicLinkingEnabled(), "/"));
}
delegates.add(resourceManager);
resourceManager = new DelegatingResourceManager(delegates);
}
d.setResourceManager(resourceManager);
} catch (IOException e) {
throw new StartException(e);
}
d.setTempDir(tempDir);
d.setClassLoader(module.getClassLoader());
final String servletVersion = mergedMetaData.getServletVersion();
if (servletVersion != null) {
d.setMajorVersion(Integer.parseInt(servletVersion.charAt(0) + ""));
d.setMinorVersion(Integer.parseInt(servletVersion.charAt(2) + ""));
} else {
d.setMajorVersion(3);
d.setMinorVersion(1);
}
//in most cases flush just hurts performance for no good reason
d.setIgnoreFlush(servletContainer.isIgnoreFlush());
//controls initialization of filters on start of application
d.setEagerFilterInit(servletContainer.isEagerFilterInit());
d.setAllowNonStandardWrappers(servletContainer.isAllowNonStandardWrappers());
d.setServletStackTraces(servletContainer.getStackTraces());
d.setDisableCachingForSecuredPages(servletContainer.isDisableCachingForSecuredPages());
if (servletContainer.getSessionPersistenceManager() != null) {
d.setSessionPersistenceManager(servletContainer.getSessionPersistenceManager());
}
//for 2.2 apps we do not require a leading / in path mappings
boolean is22OrOlder;
if (d.getMajorVersion() == 1) {
is22OrOlder = true;
} else if (d.getMajorVersion() == 2) {
is22OrOlder = d.getMinorVersion() < 3;
} else {
is22OrOlder = false;
}
JSPConfig jspConfig = servletContainer.getJspConfig();
final Set<String> seenMappings = new HashSet<>();
HashMap<String, TagLibraryInfo> tldInfo = createTldsInfo(tldsMetaData, sharedTlds);
//default JSP servlet
final ServletInfo jspServlet = jspConfig != null ? jspConfig.createJSPServletInfo() : null;
if (jspServlet != null) {
//this would be null if jsp support is disabled
HashMap<String, JspPropertyGroup> propertyGroups = createJspConfig(mergedMetaData);
JspServletBuilder.setupDeployment(d, propertyGroups, tldInfo, new UndertowJSPInstanceManager(new WebInjectionContainer(module.getClassLoader(), componentRegistryInjectedValue.getValue())));
if (mergedMetaData.getJspConfig() != null) {
Collection<JspPropertyGroup> values = new LinkedHashSet<>(propertyGroups.values());
d.setJspConfigDescriptor(new JspConfigDescriptorImpl(tldInfo.values(), values));
}
d.addServlet(jspServlet);
final Set<String> jspPropertyGroupMappings = propertyGroups.keySet();
for (final String mapping : jspPropertyGroupMappings) {
if (!jspServlet.getMappings().contains(mapping)) {
jspServlet.addMapping(mapping);
}
}
seenMappings.addAll(jspPropertyGroupMappings);
//setup JSP application context initializing listener
d.addListener(new ListenerInfo(JspInitializationListener.class));
d.addServletContextAttribute(JspInitializationListener.CONTEXT_KEY, expressionFactoryWrappers);
}
d.setClassIntrospecter(new ComponentClassIntrospector(componentRegistry));
final Map<String, List<ServletMappingMetaData>> servletMappings = new HashMap<>();
if (mergedMetaData.getExecutorName() != null) {
d.setExecutor(executorsByName.get(mergedMetaData.getExecutorName()).getValue());
}
Boolean proactiveAuthentication = mergedMetaData.getProactiveAuthentication();
if (proactiveAuthentication == null) {
proactiveAuthentication = container.getValue().isProactiveAuth();
}
d.setAuthenticationMode(proactiveAuthentication ? AuthenticationMode.PRO_ACTIVE : AuthenticationMode.CONSTRAINT_DRIVEN);
if (servletExtensions != null) {
for (ServletExtension extension : servletExtensions) {
d.addServletExtension(extension);
}
}
if (mergedMetaData.getServletMappings() != null) {
for (final ServletMappingMetaData mapping : mergedMetaData.getServletMappings()) {
List<ServletMappingMetaData> list = servletMappings.get(mapping.getServletName());
if (list == null) {
servletMappings.put(mapping.getServletName(), list = new ArrayList<>());
}
list.add(mapping);
}
}
if (jspServlet != null) {
// we need to clear the file attribute if it is set (WFLY-4106)
jspServlet.addHandlerChainWrapper(JspFileHandler.jspFileHandlerWrapper(null));
List<ServletMappingMetaData> list = servletMappings.get(jspServlet.getName());
if (list != null && !list.isEmpty()) {
for (final ServletMappingMetaData mapping : list) {
for (String urlPattern : mapping.getUrlPatterns()) {
jspServlet.addMapping(urlPattern);
}
seenMappings.addAll(mapping.getUrlPatterns());
}
}
}
final List<JBossServletMetaData> servlets = new ArrayList<JBossServletMetaData>();
for (JBossServletMetaData servlet : mergedMetaData.getServlets()) {
servlets.add(servlet);
}
for (final JBossServletMetaData servlet : mergedMetaData.getServlets()) {
final ServletInfo s;
if (servlet.getJspFile() != null) {
s = new ServletInfo(servlet.getName(), JspServlet.class);
s.addHandlerChainWrapper(JspFileHandler.jspFileHandlerWrapper(servlet.getJspFile()));
} else {
if (servlet.getServletClass() == null) {
if (DEFAULT_SERVLET_NAME.equals(servlet.getName())) {
s = new ServletInfo(servlet.getName(), DefaultServlet.class);
} else {
throw UndertowLogger.ROOT_LOGGER.servletClassNotDefined(servlet.getServletName());
}
} else {
Class<? extends Servlet> servletClass = (Class<? extends Servlet>) module.getClassLoader().loadClass(servlet.getServletClass());
ManagedReferenceFactory creator = componentRegistry.createInstanceFactory(servletClass);
if (creator != null) {
InstanceFactory<Servlet> factory = createInstanceFactory(creator);
s = new ServletInfo(servlet.getName(), servletClass, factory);
} else {
s = new ServletInfo(servlet.getName(), servletClass);
}
}
}
s.setAsyncSupported(servlet.isAsyncSupported()).setJspFile(servlet.getJspFile()).setEnabled(servlet.isEnabled());
if (servlet.getRunAs() != null) {
s.setRunAs(servlet.getRunAs().getRoleName());
}
if (servlet.getLoadOnStartupSet()) {
//todo why not cleanup api and just use int everywhere
s.setLoadOnStartup(servlet.getLoadOnStartupInt());
}
if (servlet.getExecutorName() != null) {
s.setExecutor(executorsByName.get(servlet.getExecutorName()).getValue());
}
handleServletMappings(is22OrOlder, seenMappings, servletMappings, s);
if (servlet.getInitParam() != null) {
for (ParamValueMetaData initParam : servlet.getInitParam()) {
if (!s.getInitParams().containsKey(initParam.getParamName())) {
s.addInitParam(initParam.getParamName(), initParam.getParamValue());
}
}
}
if (servlet.getServletSecurity() != null) {
ServletSecurityInfo securityInfo = new ServletSecurityInfo();
s.setServletSecurityInfo(securityInfo);
securityInfo.setEmptyRoleSemantic(servlet.getServletSecurity().getEmptyRoleSemantic() == EmptyRoleSemanticType.DENY ? DENY : PERMIT).setTransportGuaranteeType(transportGuaranteeType(servlet.getServletSecurity().getTransportGuarantee())).addRolesAllowed(servlet.getServletSecurity().getRolesAllowed());
if (servlet.getServletSecurity().getHttpMethodConstraints() != null) {
for (HttpMethodConstraintMetaData method : servlet.getServletSecurity().getHttpMethodConstraints()) {
securityInfo.addHttpMethodSecurityInfo(new HttpMethodSecurityInfo().setEmptyRoleSemantic(method.getEmptyRoleSemantic() == EmptyRoleSemanticType.DENY ? DENY : PERMIT).setTransportGuaranteeType(transportGuaranteeType(method.getTransportGuarantee())).addRolesAllowed(method.getRolesAllowed()).setMethod(method.getMethod()));
}
}
}
if (servlet.getSecurityRoleRefs() != null) {
for (final SecurityRoleRefMetaData ref : servlet.getSecurityRoleRefs()) {
s.addSecurityRoleRef(ref.getRoleName(), ref.getRoleLink());
}
}
if (servlet.getMultipartConfig() != null) {
MultipartConfigMetaData mp = servlet.getMultipartConfig();
s.setMultipartConfig(Servlets.multipartConfig(mp.getLocation(), mp.getMaxFileSize(), mp.getMaxRequestSize(), mp.getFileSizeThreshold()));
}
d.addServlet(s);
}
if (jspServlet != null) {
if (!seenMappings.contains("*.jsp")) {
jspServlet.addMapping("*.jsp");
}
if (!seenMappings.contains("*.jspx")) {
jspServlet.addMapping("*.jspx");
}
}
//we explicitly add the default servlet, to allow it to be mapped
if (!mergedMetaData.getServlets().containsKey(ServletPathMatches.DEFAULT_SERVLET_NAME)) {
ServletInfo defaultServlet = Servlets.servlet(DEFAULT_SERVLET_NAME, DefaultServlet.class);
handleServletMappings(is22OrOlder, seenMappings, servletMappings, defaultServlet);
d.addServlet(defaultServlet);
}
if (servletContainer.getDirectoryListingEnabled() != null) {
ServletInfo defaultServlet = d.getServlets().get(DEFAULT_SERVLET_NAME);
defaultServlet.addInitParam(DefaultServlet.DIRECTORY_LISTING, servletContainer.getDirectoryListingEnabled().toString());
}
if (mergedMetaData.getFilters() != null) {
for (final FilterMetaData filter : mergedMetaData.getFilters()) {
Class<? extends Filter> filterClass = (Class<? extends Filter>) module.getClassLoader().loadClass(filter.getFilterClass());
ManagedReferenceFactory creator = componentRegistry.createInstanceFactory(filterClass);
FilterInfo f;
if (creator != null) {
InstanceFactory<Filter> instanceFactory = createInstanceFactory(creator);
f = new FilterInfo(filter.getName(), filterClass, instanceFactory);
} else {
f = new FilterInfo(filter.getName(), filterClass);
}
f.setAsyncSupported(filter.isAsyncSupported());
d.addFilter(f);
if (filter.getInitParam() != null) {
for (ParamValueMetaData initParam : filter.getInitParam()) {
f.addInitParam(initParam.getParamName(), initParam.getParamValue());
}
}
}
}
if (mergedMetaData.getFilterMappings() != null) {
for (final FilterMappingMetaData mapping : mergedMetaData.getFilterMappings()) {
if (mapping.getUrlPatterns() != null) {
for (String url : mapping.getUrlPatterns()) {
if (is22OrOlder && !url.startsWith("*") && !url.startsWith("/")) {
url = "/" + url;
}
if (mapping.getDispatchers() != null && !mapping.getDispatchers().isEmpty()) {
for (DispatcherType dispatcher : mapping.getDispatchers()) {
d.addFilterUrlMapping(mapping.getFilterName(), url, javax.servlet.DispatcherType.valueOf(dispatcher.name()));
}
} else {
d.addFilterUrlMapping(mapping.getFilterName(), url, javax.servlet.DispatcherType.REQUEST);
}
}
}
if (mapping.getServletNames() != null) {
for (String servletName : mapping.getServletNames()) {
if (mapping.getDispatchers() != null && !mapping.getDispatchers().isEmpty()) {
for (DispatcherType dispatcher : mapping.getDispatchers()) {
d.addFilterServletNameMapping(mapping.getFilterName(), servletName, javax.servlet.DispatcherType.valueOf(dispatcher.name()));
}
} else {
d.addFilterServletNameMapping(mapping.getFilterName(), servletName, javax.servlet.DispatcherType.REQUEST);
}
}
}
}
}
if (scisMetaData != null && scisMetaData.getHandlesTypes() != null) {
for (final ServletContainerInitializer sci : scisMetaData.getScis()) {
final ImmediateInstanceFactory<ServletContainerInitializer> instanceFactory = new ImmediateInstanceFactory<>(sci);
d.addServletContainerInitalizer(new ServletContainerInitializerInfo(sci.getClass(), instanceFactory, scisMetaData.getHandlesTypes().get(sci)));
}
}
if (mergedMetaData.getListeners() != null) {
for (ListenerMetaData listener : mergedMetaData.getListeners()) {
addListener(module.getClassLoader(), componentRegistry, d, listener);
}
}
if (mergedMetaData.getContextParams() != null) {
for (ParamValueMetaData param : mergedMetaData.getContextParams()) {
d.addInitParameter(param.getParamName(), param.getParamValue());
}
}
if (mergedMetaData.getWelcomeFileList() != null && mergedMetaData.getWelcomeFileList().getWelcomeFiles() != null) {
List<String> welcomeFiles = mergedMetaData.getWelcomeFileList().getWelcomeFiles();
for (String file : welcomeFiles) {
if (file.startsWith("/")) {
d.addWelcomePages(file.substring(1));
} else {
d.addWelcomePages(file);
}
}
} else {
d.addWelcomePages("index.html", "index.htm", "index.jsp");
}
d.addWelcomePages(servletContainer.getWelcomeFiles());
if (mergedMetaData.getErrorPages() != null) {
for (final ErrorPageMetaData page : mergedMetaData.getErrorPages()) {
final ErrorPage errorPage;
if (page.getExceptionType() != null && !page.getExceptionType().isEmpty()) {
errorPage = new ErrorPage(page.getLocation(), (Class<? extends Throwable>) module.getClassLoader().loadClass(page.getExceptionType()));
} else if (page.getErrorCode() != null && !page.getErrorCode().isEmpty()) {
errorPage = new ErrorPage(page.getLocation(), Integer.parseInt(page.getErrorCode()));
} else {
errorPage = new ErrorPage(page.getLocation());
}
d.addErrorPages(errorPage);
}
}
for (Map.Entry<String, String> entry : servletContainer.getMimeMappings().entrySet()) {
d.addMimeMapping(new MimeMapping(entry.getKey(), entry.getValue()));
}
if (mergedMetaData.getMimeMappings() != null) {
for (final MimeMappingMetaData mapping : mergedMetaData.getMimeMappings()) {
d.addMimeMapping(new MimeMapping(mapping.getExtension(), mapping.getMimeType()));
}
}
d.setDenyUncoveredHttpMethods(mergedMetaData.getDenyUncoveredHttpMethods() != null);
Set<String> securityRoleNames = mergedMetaData.getSecurityRoleNames();
if (mergedMetaData.getSecurityConstraints() != null) {
for (SecurityConstraintMetaData constraint : mergedMetaData.getSecurityConstraints()) {
SecurityConstraint securityConstraint = new SecurityConstraint().setTransportGuaranteeType(transportGuaranteeType(constraint.getTransportGuarantee()));
List<String> roleNames = constraint.getRoleNames();
if (constraint.getAuthConstraint() == null) {
// no auth constraint means we permit the empty roles
securityConstraint.setEmptyRoleSemantic(PERMIT);
} else if (roleNames.size() == 1 && roleNames.contains("*") && securityRoleNames.contains("*")) {
// AS7-6932 - Trying to do a * to * mapping which JBossWeb passed through, for Undertow enable
// authentication only mode.
// TODO - AS7-6933 - Revisit workaround added to allow switching between JBoss Web and Undertow.
securityConstraint.setEmptyRoleSemantic(AUTHENTICATE);
} else {
securityConstraint.addRolesAllowed(roleNames);
}
if (constraint.getResourceCollections() != null) {
for (final WebResourceCollectionMetaData resourceCollection : constraint.getResourceCollections()) {
securityConstraint.addWebResourceCollection(new WebResourceCollection().addHttpMethods(resourceCollection.getHttpMethods()).addHttpMethodOmissions(resourceCollection.getHttpMethodOmissions()).addUrlPatterns(resourceCollection.getUrlPatterns()));
}
}
d.addSecurityConstraint(securityConstraint);
}
}
final LoginConfigMetaData loginConfig = mergedMetaData.getLoginConfig();
if (loginConfig != null) {
List<AuthMethodConfig> authMethod = authMethod(loginConfig.getAuthMethod());
if (loginConfig.getFormLoginConfig() != null) {
d.setLoginConfig(new LoginConfig(loginConfig.getRealmName(), loginConfig.getFormLoginConfig().getLoginPage(), loginConfig.getFormLoginConfig().getErrorPage()));
} else {
d.setLoginConfig(new LoginConfig(loginConfig.getRealmName()));
}
for (AuthMethodConfig method : authMethod) {
d.getLoginConfig().addLastAuthMethod(method);
}
}
d.addSecurityRoles(mergedMetaData.getSecurityRoleNames());
Map<String, Set<String>> principalVersusRolesMap = mergedMetaData.getPrincipalVersusRolesMap();
BiFunction<DeploymentInfo, Function<String, RunAsIdentityMetaData>, Registration> securityFunction = this.securityFunction.getOptionalValue();
if (securityFunction != null) {
Map<String, RunAsIdentityMetaData> runAsIdentityMap = mergedMetaData.getRunAsIdentity();
registration = securityFunction.apply(d, runAsIdentityMap::get);
d.addOuterHandlerChainWrapper(JACCContextIdHandler.wrapper(jaccContextId));
if (mergedMetaData.isUseJBossAuthorization()) {
UndertowLogger.ROOT_LOGGER.configurationOptionIgnoredWhenUsingElytron("use-jboss-authorization");
}
} else {
if (securityDomain != null) {
d.addThreadSetupAction(new SecurityContextThreadSetupAction(securityDomain, securityDomainContextValue.getValue(), principalVersusRolesMap));
d.addInnerHandlerChainWrapper(SecurityContextAssociationHandler.wrapper(mergedMetaData.getRunAsIdentity()));
d.addOuterHandlerChainWrapper(JACCContextIdHandler.wrapper(jaccContextId));
d.addLifecycleInterceptor(new RunAsLifecycleInterceptor(mergedMetaData.getRunAsIdentity()));
}
}
if (principalVersusRolesMap != null) {
for (Map.Entry<String, Set<String>> entry : principalVersusRolesMap.entrySet()) {
d.addPrincipalVsRoleMappings(entry.getKey(), entry.getValue());
}
}
// Setup an deployer configured ServletContext attributes
if (attributes != null) {
for (ServletContextAttribute attribute : attributes) {
d.addServletContextAttribute(attribute.getName(), attribute.getValue());
}
}
//now setup websockets if they are enabled
if (servletContainer.isWebsocketsEnabled() && webSocketDeploymentInfo != null) {
webSocketDeploymentInfo.setBuffers(servletContainer.getWebsocketsBufferPool().getValue());
webSocketDeploymentInfo.setWorker(servletContainer.getWebsocketsWorker().getValue());
webSocketDeploymentInfo.setDispatchToWorkerThread(servletContainer.isDispatchWebsocketInvocationToWorker());
if (servletContainer.isPerMessageDeflate()) {
PerMessageDeflateHandshake perMessageDeflate = new PerMessageDeflateHandshake(false, servletContainer.getDeflaterLevel());
webSocketDeploymentInfo.addExtension(perMessageDeflate);
}
final AtomicReference<ServerActivity> serverActivity = new AtomicReference<>();
webSocketDeploymentInfo.addListener(wsc -> {
serverActivity.set(new ServerActivity() {
@Override
public void preSuspend(ServerActivityCallback listener) {
listener.done();
}
@Override
public void suspended(final ServerActivityCallback listener) {
if (wsc.getConfiguredServerEndpoints().isEmpty()) {
listener.done();
return;
}
wsc.pause(new ServerWebSocketContainer.PauseListener() {
@Override
public void paused() {
listener.done();
}
@Override
public void resumed() {
}
});
}
@Override
public void resume() {
wsc.resume();
}
});
suspendControllerInjectedValue.getValue().registerActivity(serverActivity.get());
});
ServletContextListener sl = new ServletContextListener() {
@Override
public void contextInitialized(ServletContextEvent sce) {
}
@Override
public void contextDestroyed(ServletContextEvent sce) {
final ServerActivity activity = serverActivity.get();
if (activity != null) {
suspendControllerInjectedValue.getValue().unRegisterActivity(activity);
}
}
};
d.addListener(new ListenerInfo(sl.getClass(), new ImmediateInstanceFactory<EventListener>(sl)));
d.addServletContextAttribute(WebSocketDeploymentInfo.ATTRIBUTE_NAME, webSocketDeploymentInfo);
}
if (mergedMetaData.getLocalEncodings() != null && mergedMetaData.getLocalEncodings().getMappings() != null) {
for (LocaleEncodingMetaData locale : mergedMetaData.getLocalEncodings().getMappings()) {
d.addLocaleCharsetMapping(locale.getLocale(), locale.getEncoding());
}
}
if (predicatedHandlers != null && !predicatedHandlers.isEmpty()) {
d.addOuterHandlerChainWrapper(new RewriteCorrectingHandlerWrappers.PostWrapper());
d.addOuterHandlerChainWrapper(new HandlerWrapper() {
@Override
public HttpHandler wrap(HttpHandler handler) {
if (predicatedHandlers.size() == 1) {
PredicatedHandler ph = predicatedHandlers.get(0);
return Handlers.predicate(ph.getPredicate(), ph.getHandler().wrap(handler), handler);
} else {
return Handlers.predicates(predicatedHandlers, handler);
}
}
});
d.addOuterHandlerChainWrapper(new RewriteCorrectingHandlerWrappers.PreWrapper());
}
if (mergedMetaData.getDefaultEncoding() != null) {
d.setDefaultEncoding(mergedMetaData.getDefaultEncoding());
} else if (servletContainer.getDefaultEncoding() != null) {
d.setDefaultEncoding(servletContainer.getDefaultEncoding());
}
d.setCrawlerSessionManagerConfig(servletContainer.getCrawlerSessionManagerConfig());
return d;
} catch (ClassNotFoundException e) {
throw new StartException(e);
}
}
Aggregations