Examples with Authenticator org.wso2.carbon.identity.api.server.authenticators.v1.model.Authenticator used on opensource projects

Example 1 with Authenticator

use of org.wso2.carbon.identity.api.server.authenticators.v1.model.Authenticator in project carbon-apimgt by wso2.

the class APIAuthenticationHandler method isAuthenticate.

/**
 * Authenticates the given request using the authenticators which have been initialized.
 *
 * @param messageContext The message to be authenticated
 * @return true if the authentication is successful (never returns false)
 * @throws APISecurityException If an authentication failure or some other error occurs
 */
protected boolean isAuthenticate(MessageContext messageContext) throws APISecurityException, APIManagementException {
    boolean authenticated = false;
    AuthenticationResponse authenticationResponse;
    List<AuthenticationResponse> authResponses = new ArrayList<>();
    for (Authenticator authenticator : authenticators) {
        authenticationResponse = authenticator.authenticate(messageContext);
        if (authenticationResponse.isMandatoryAuthentication()) {
            // Update authentication status only if the authentication is a mandatory one
            authenticated = authenticationResponse.isAuthenticated();
        }
        if (!authenticationResponse.isAuthenticated()) {
            authResponses.add(authenticationResponse);
        }
        if (!authenticationResponse.isContinueToNextAuthenticator()) {
            break;
        }
    }
    if (!authenticated) {
        Pair<Integer, String> error = getError(authResponses);
        throw new APISecurityException(error.getKey(), error.getValue());
    }
    return true;
}

Example 2 with Authenticator

use of org.wso2.carbon.identity.api.server.authenticators.v1.model.Authenticator in project carbon-identity-framework by wso2.

the class FileBasedConfigurationBuilder method processAuthenticatorConfigElement.

/**
 * Create AuthenticatorBean elements for each authenticator entry
 *
 * @param authenticatorConfigElem OMElement for Authenticator
 * @return AuthenticatorBean object
 */
private AuthenticatorConfig processAuthenticatorConfigElement(OMElement authenticatorConfigElem) {
    // read the name of the authenticator. this is a mandatory attribute.
    OMAttribute nameAttr = authenticatorConfigElem.getAttribute(new QName(FrameworkConstants.Config.ATTR_AUTHENTICATOR_CONFIG_NAME));
    // if the name is not given, do not register this authenticator
    if (nameAttr == null) {
        log.warn("Each Authenticator Configuration should have a unique name attribute. +" + "This Authenticator will not be registered.");
        return null;
    }
    String authenticatorName = nameAttr.getAttributeValue();
    // Check whether the enabled attribute is set. By default it will be true if not configured.
    boolean enabled = true;
    OMAttribute enabledAttr = authenticatorConfigElem.getAttribute(new QName(FrameworkConstants.Config.ATTR_AUTHENTICATOR_ENABLED));
    if (enabledAttr != null) {
        enabled = Boolean.parseBoolean(enabledAttr.getAttributeValue());
    }
    // read the config parameters
    Map<String, String> parameterMap = new HashMap<>();
    for (Iterator paramIterator = authenticatorConfigElem.getChildrenWithLocalName(FrameworkConstants.Config.ELEM_PARAMETER); paramIterator.hasNext(); ) {
        OMElement paramElem = (OMElement) paramIterator.next();
        OMAttribute paramNameAttr = paramElem.getAttribute(new QName(FrameworkConstants.Config.ATTR_PARAMETER_NAME));
        if (paramNameAttr == null) {
            log.warn("An Authenticator Parameter should have a name attribute. Skipping the parameter.");
            continue;
        }
        parameterMap.put(paramNameAttr.getAttributeValue(), paramElem.getText());
    }
    AuthenticatorConfig authenticatorConfig = new AuthenticatorConfig(authenticatorName, enabled, parameterMap);
    authenticatorConfig.setApplicationAuthenticator(FrameworkUtils.getAppAuthenticatorByName(authenticatorName));
    return authenticatorConfig;
}

Example 3 with Authenticator

use of org.wso2.carbon.identity.api.server.authenticators.v1.model.Authenticator in project carbon-identity-framework by wso2.

the class UIBasedConfigurationLoader method loadRequestPathAuthenticators.

protected void loadRequestPathAuthenticators(SequenceConfig sequenceConfig, ServiceProvider serviceProvider) {
    if (serviceProvider.getRequestPathAuthenticatorConfigs() != null && serviceProvider.getRequestPathAuthenticatorConfigs().length > 0) {
        List<AuthenticatorConfig> requestPathAuthenticators = new ArrayList<AuthenticatorConfig>();
        RequestPathAuthenticatorConfig[] reqAuths = serviceProvider.getRequestPathAuthenticatorConfigs();
        // for each request path authenticator
        for (RequestPathAuthenticatorConfig reqAuth : reqAuths) {
            AuthenticatorConfig authConfig = new AuthenticatorConfig();
            String authenticatorName = reqAuth.getName();
            authConfig.setName(authenticatorName);
            authConfig.setEnabled(true);
            // iterate through each system authentication config
            for (ApplicationAuthenticator appAuthenticator : FrameworkServiceComponent.getAuthenticators()) {
                if (authenticatorName.equalsIgnoreCase(appAuthenticator.getName())) {
                    authConfig.setApplicationAuthenticator(appAuthenticator);
                    break;
                }
            }
            requestPathAuthenticators.add(authConfig);
        }
        sequenceConfig.setReqPathAuthenticators(requestPathAuthenticators);
    }
}

Example 4 with Authenticator

use of org.wso2.carbon.identity.api.server.authenticators.v1.model.Authenticator in project carbon-identity-framework by wso2.

the class JsGraphBuilder method filterOptions.

/**
 * Filter out options in the step config to retain only the options provided in authentication options
 *
 * @param authenticationOptions Authentication options to keep
 * @param stepConfig            The step config to be modified
 */
protected void filterOptions(Map<String, Map<String, String>> authenticationOptions, StepConfig stepConfig) {
    Map<String, Set<String>> filteredOptions = new HashMap<>();
    authenticationOptions.forEach((id, option) -> {
        String idp = option.get(FrameworkConstants.JSAttributes.IDP);
        String authenticator = option.get(FrameworkConstants.JSAttributes.AUTHENTICATOR);
        if (StringUtils.isNotBlank(authenticator) && StringUtils.isBlank(idp)) {
            // If Idp is not set, but authenticator is set, idp is assumed as local
            idp = FrameworkConstants.LOCAL_IDP_NAME;
        }
        if (StringUtils.isNotBlank(idp)) {
            filteredOptions.putIfAbsent(idp, new HashSet<>());
            if (StringUtils.isNotBlank(authenticator)) {
                filteredOptions.get(idp).add(authenticator.toLowerCase());
            }
        }
    });
    if (log.isDebugEnabled()) {
        StringBuilder sb = new StringBuilder();
        for (Map.Entry<String, Set<String>> entry : filteredOptions.entrySet()) {
            sb.append('\n').append(entry.getKey()).append(" : ");
            sb.append(StringUtils.join(entry.getValue(), ","));
        }
        log.debug("Authenticator options: " + sb.toString());
    }
    Set<AuthenticatorConfig> authenticatorsToRemove = new HashSet<>();
    Map<String, AuthenticatorConfig> idpsToRemove = new HashMap<>();
    stepConfig.getAuthenticatorList().forEach(authenticatorConfig -> authenticatorConfig.getIdps().forEach((idpName, idp) -> {
        Set<String> authenticators = filteredOptions.get(idpName);
        boolean removeOption = false;
        if (authenticators == null) {
            if (log.isDebugEnabled()) {
                log.debug(String.format("Authentication options didn't include idp: %s. Hence excluding from " + "options list", idpName));
            }
            removeOption = true;
        } else if (!authenticators.isEmpty()) {
            // Both idp and authenticator present, but authenticator is given by display name due to the fact
            // that it is the one available at UI. Should translate the display name to actual name, and
            // keep/remove option
            removeOption = true;
            if (FrameworkConstants.LOCAL_IDP_NAME.equals(idpName)) {
                List<LocalAuthenticatorConfig> localAuthenticators = ApplicationAuthenticatorService.getInstance().getLocalAuthenticators();
                for (LocalAuthenticatorConfig localAuthenticatorConfig : localAuthenticators) {
                    if (authenticatorConfig.getName().equals(localAuthenticatorConfig.getName()) && authenticators.contains(localAuthenticatorConfig.getDisplayName().toLowerCase())) {
                        removeOption = false;
                        break;
                    }
                }
                if (log.isDebugEnabled()) {
                    if (removeOption) {
                        log.debug(String.format("Authenticator options don't match any entry for local" + "authenticator: %s. Hence removing the option", authenticatorConfig.getName()));
                    } else {
                        log.debug(String.format("Authenticator options contained a match for local " + "authenticator: %s. Hence keeping the option", authenticatorConfig.getName()));
                    }
                }
            } else {
                for (FederatedAuthenticatorConfig federatedAuthConfig : idp.getFederatedAuthenticatorConfigs()) {
                    if (authenticatorConfig.getName().equals(federatedAuthConfig.getName()) && authenticators.contains(federatedAuthConfig.getDisplayName().toLowerCase())) {
                        removeOption = false;
                        break;
                    }
                }
                if (log.isDebugEnabled()) {
                    if (removeOption) {
                        log.debug(String.format("Authenticator options don't match any entry for idp: %s, " + "authenticator: %s. Hence removing the option", idpName, authenticatorConfig.getName()));
                    } else {
                        log.debug(String.format("Authenticator options contained a match for idp: %s, " + "authenticator: %s. Hence keeping the option", idpName, authenticatorConfig.getName()));
                    }
                }
            }
        } else {
            if (log.isDebugEnabled()) {
                log.debug(String.format("No authenticator filters for idp %s, hence keeping it as an option", idpName));
            }
        }
        if (removeOption) {
            if (authenticatorConfig.getIdps().size() > 1) {
                idpsToRemove.put(idpName, authenticatorConfig);
            } else {
                authenticatorsToRemove.add(authenticatorConfig);
            }
        }
    }));
    if (stepConfig.getAuthenticatorList().size() > authenticatorsToRemove.size()) {
        idpsToRemove.forEach((idp, authenticatorConfig) -> {
            int index = stepConfig.getAuthenticatorList().indexOf(authenticatorConfig);
            stepConfig.getAuthenticatorList().get(index).getIdps().remove(idp);
            stepConfig.getAuthenticatorList().get(index).getIdpNames().remove(idp);
            if (log.isDebugEnabled()) {
                log.debug("Removed " + idp + " option from " + authenticatorConfig.getName() + " as it " + "doesn't match the provided authenticator options");
            }
        });
        // If all idps are removed from the authenticator the authenticator should be removed.
        stepConfig.getAuthenticatorList().forEach(authenticatorConfig -> {
            if (authenticatorConfig.getIdps().isEmpty()) {
                authenticatorsToRemove.add(authenticatorConfig);
            }
        });
        stepConfig.getAuthenticatorList().removeAll(authenticatorsToRemove);
        if (log.isDebugEnabled()) {
            log.debug("Removed " + authenticatorsToRemove.size() + " options which doesn't match the " + "provided authenticator options");
        }
    } else {
        log.warn("The filtered authenticator list is empty, hence proceeding without filtering");
    }
}

Example 5 with Authenticator

use of org.wso2.carbon.identity.api.server.authenticators.v1.model.Authenticator in project carbon-identity-framework by wso2.

the class UIBasedConfigurationLoader method loadFederatedAuthenticators.

protected void loadFederatedAuthenticators(AuthenticationStep authenticationStep, StepConfig stepConfig, String tenantDomain) throws FrameworkException {
    IdentityProvider[] federatedIDPs = authenticationStep.getFederatedIdentityProviders();
    if (federatedIDPs != null) {
        // for each idp in the step
        for (IdentityProvider federatedIDP : federatedIDPs) {
            FederatedAuthenticatorConfig federatedAuthenticator = federatedIDP.getDefaultAuthenticatorConfig();
            // retrieve the federated IDP and load
            if (federatedAuthenticator == null) {
                try {
                    federatedAuthenticator = IdentityProviderManager.getInstance().getIdPByName(federatedIDP.getIdentityProviderName(), tenantDomain).getDefaultAuthenticatorConfig();
                } catch (IdentityProviderManagementException e) {
                    throw new FrameworkException("Failed to load the default authenticator for IDP : " + federatedIDP.getIdentityProviderName(), e);
                }
            }
            String actualAuthenticatorName = federatedAuthenticator.getName();
            // assign it to the step
            loadStepAuthenticator(stepConfig, federatedIDP, actualAuthenticatorName);
        }
    }
}