Java AuthStatus.SUCCESS属性代码示例

@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject) throws AuthException {

    HttpServletRequest request = (HttpServletRequest) messageInfo.getRequestMessage();
    LOGGER.log(Level.FINE, "Validating request @" + request.getMethod() + " " + request.getRequestURI());

    String login = (String) request.getSession().getAttribute("login");
    String groups = (String) request.getSession().getAttribute("groups");

    CallerPrincipalCallback callerPrincipalCallback = new CallerPrincipalCallback(clientSubject, login);
    GroupPrincipalCallback groupPrincipalCallback = new GroupPrincipalCallback(clientSubject, new String[]{groups});
    Callback[] callbacks = new Callback[]{callerPrincipalCallback, groupPrincipalCallback};

    try {
        callbackHandler.handle(callbacks);
    } catch (IOException | UnsupportedCallbackException e) {
        throw new AuthException(e.getMessage());
    }

    return AuthStatus.SUCCESS;
}
 

@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject) throws AuthException {

    HttpServletRequest request = (HttpServletRequest) messageInfo.getRequestMessage();
    LOGGER.log(Level.FINE, "Validating request @" + request.getMethod() + " " + request.getRequestURI());

    CallerPrincipalCallback callerPrincipalCallback = new CallerPrincipalCallback(clientSubject, "");
    GroupPrincipalCallback groupPrincipalCallback = new GroupPrincipalCallback(clientSubject, new String[]{UserGroupMapping.GUEST_ROLE_ID});
    Callback[] callbacks = {callerPrincipalCallback, groupPrincipalCallback};

    try {
        callbackHandler.handle(callbacks);
    } catch (IOException | UnsupportedCallbackException e) {
        throw new AuthException(e.getMessage());
    }

    return AuthStatus.SUCCESS;

}
 

@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject) throws AuthException {

    HttpServletRequest request = (HttpServletRequest) messageInfo.getRequestMessage();
    HttpServletResponse response = (HttpServletResponse) messageInfo.getResponseMessage();
    AuthServices.addCORSHeaders(response);

    LOGGER.log(Level.FINE, "validateRequest @" + request.getMethod() + " " + request.getRequestURI());

    if (isOptionsRequest(request)) {
        return AuthStatus.SUCCESS;
    }

    CustomSAM module = getModule(messageInfo);

    if (module != null) {
        return module.validateRequest(messageInfo, clientSubject, serviceSubject);
    }

    response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);

    return AuthStatus.FAILURE;
}
 

@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject) throws AuthException {

    HttpServletRequest request = (HttpServletRequest) messageInfo.getRequestMessage();
    HttpServletResponse response = (HttpServletResponse) messageInfo.getResponseMessage();

    LOGGER.log(Level.FINE, "Validating request @" + request.getMethod() + " " + request.getRequestURI());

    String authorization = request.getHeader("Authorization");
    String[] splitAuthorization = authorization.split(" ");
    String jwt = splitAuthorization[1];

    JWTokenUserGroupMapping jwTokenUserGroupMapping = JWTokenFactory.validateAuthToken(key, jwt);

    if (jwTokenUserGroupMapping != null) {

        UserGroupMapping userGroupMapping = jwTokenUserGroupMapping.getUserGroupMapping();
        CallerPrincipalCallback callerPrincipalCallback = new CallerPrincipalCallback(clientSubject, userGroupMapping.getLogin());
        GroupPrincipalCallback groupPrincipalCallback = new GroupPrincipalCallback(clientSubject, new String[]{userGroupMapping.getGroupName()});
        Callback[] callbacks = new Callback[]{callerPrincipalCallback, groupPrincipalCallback};

        try {
            callbackHandler.handle(callbacks);
        } catch (IOException | UnsupportedCallbackException e) {
            throw new AuthException(e.getMessage());
        }

        JWTokenFactory.refreshTokenIfNeeded(key, response, jwTokenUserGroupMapping);

        return AuthStatus.SUCCESS;
    }

    response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
    return AuthStatus.FAILURE;

}
 

/**
 * This method delegates to a login module if configured in the module options.
 * The sub classes will need to validate the request 
 */
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, 
      Subject serviceSubject) 
throws AuthException
{
   String loginModuleName = (String) options.get("login-module-delegate");
   if(loginModuleName != null)
   {
      ClassLoader tcl = SecurityActions.getContextClassLoader();
      try
      {
         Class clazz = tcl.loadClass(loginModuleName);
         LoginModule lm = (LoginModule) clazz.newInstance();
         lm.initialize(clientSubject, callbackHandler, new HashMap(), options);
         lm.login();
         lm.commit();
      }
      catch (Exception e)
      {
         throw new AuthException(e.getLocalizedMessage());
      }
   } 
   else
   {
      return validate(clientSubject, messageInfo) ? AuthStatus.SUCCESS : AuthStatus.FAILURE;
   } 
   
   return AuthStatus.SUCCESS;
}
 

/**
 * @see ClientAuthModule#secureRequest(javax.security.auth.message.MessageInfo, javax.security.auth.Subject)
 */
public AuthStatus secureRequest(MessageInfo param, Subject source) 
throws AuthException
{ 
   source.getPrincipals().add(this.principal);
   source.getPublicCredentials().add(this.credential);
   return AuthStatus.SUCCESS;
}
 

/**
 * @see ClientAuthModule#validateResponse(javax.security.auth.message.MessageInfo, javax.security.auth.Subject, javax.security.auth.Subject)
 */
public AuthStatus validateResponse(MessageInfo messageInfo, Subject source, Subject recipient) throws AuthException
{  
   //Custom check: Check that the source of the response and the recipient
   // of the response have identical credentials
   Set sourceSet = source.getPrincipals(SimplePrincipal.class);
   Set recipientSet = recipient.getPrincipals(SimplePrincipal.class);
   if(sourceSet == null && recipientSet == null)
      throw new AuthException();
   if(sourceSet.size() != recipientSet.size())
      throw new AuthException(PicketBoxMessages.MESSAGES.sizeMismatchMessage("source", "recipient"));
   return AuthStatus.SUCCESS;
}
 

@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject)
    throws AuthException {
  _logger.debug("Enter validateRequest");

  if (!requiresAuthentication(messageInfo)) {
    _logger.debug("Returning success, auth policy not mandatory");
    return AuthStatus.SUCCESS;
  }

  HttpServletRequest req = (HttpServletRequest) messageInfo.getRequestMessage();
  HttpServletResponse resp = (HttpServletResponse) messageInfo.getResponseMessage();

  try {
    UserAccount account = (UserAccount) req.getSession().getAttribute(USER_ACCOUNT_SESSION_KEY);
    if (account != null) {
      _logger.debug("Returning success, user already logged in");
      addPrincipalsToSubject(clientSubject, account);
      return AuthStatus.SUCCESS;
    }

    if (!req.getRequestURI().endsWith(LOGIN_PAGE)) {
      redirectToLoginPage(req, resp);
      return AuthStatus.SEND_CONTINUE;
    }

    if ("GET".equals(req.getMethod())) {
      forwardToLoginPage(req, resp, "GET request");
      return AuthStatus.SEND_CONTINUE;
    }

    String userName = req.getParameter("j_username");
    String password = req.getParameter("j_password");
    String otp = req.getParameter("j_otp");

    if (userName == null || password == null || otp == null) {
      _logger.debug("Returning failure, missing request parameter(s)");
      forwardToFailedLoginPage(req, resp, null);
      return AuthStatus.SEND_CONTINUE;
    }

    UserAccount userAccount = _accountMap.get(userName);
    if (userAccount != null
        && userAccount.getHashedPassword().equals(
            PasswordEncoder.encodePasswordForUser(userName, userAccount.getSalt(), password))
        && YubicoClient.isValidOTPFormat(otp)) {
      _logger.debug("Verifying Yubikey for {}...", userName);
      VerificationResponse response = _yubicoClient.verify(otp);
      if (response.isOk()) {
        if (response.getPublicId().equals(userAccount.getPublicYubiId())) {
          addPrincipalsToSubject(clientSubject, userAccount);
          req.getSession().setAttribute(USER_ACCOUNT_SESSION_KEY, userAccount);

          String originalUri = (String) req.getSession().getAttribute(ORIGINAL_URI_SESSION_KEY);
          if (originalUri != null) {
            _logger.debug("Login successful for {}, redirecting to {}", userName, originalUri);
            resp.sendRedirect(originalUri);
            return AuthStatus.SEND_CONTINUE;
          } else {
            _logger.debug("Login successful for {}, returning success", userName);
            return AuthStatus.SUCCESS;
          }
        } else {
          _logger.warn("Login attempt for {} with wrong Yubikey {}!", userName, response.getPublicId());
        }
      } else {
        _logger.info("Failed to verify Yubikey for {}, response not OK", userName);
      }
    }

    forwardToFailedLoginPage(req, resp, "authentication failed");
    return AuthStatus.SEND_CONTINUE;
  } catch (Exception e) {
    _logger.error("Authentication failed with exception", e);
    throw new AuthException(e.getMessage());
  }
}
 

@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject) throws AuthException
{
   return AuthStatus.SUCCESS;
}
 

public AuthStatus secureResponse(MessageInfo messageInfo, Subject arg1) throws AuthException
{
   return AuthStatus.SUCCESS;
}
 

public AuthStatus secureRequest(MessageInfo messageInfo, Subject source) throws AuthException
{
   log = "secureRequest";
   return AuthStatus.SUCCESS;
}
 

public AuthStatus validateResponse(MessageInfo messageInfo, Subject source, Subject recipient) throws AuthException
{
   return AuthStatus.SUCCESS;
}
 

/**
 * <p>
 * Checks for the presence of the cookie, if it is present it will use that
 * as the subject if not it will redirect to a login screen.
 * </p>
 * {@inheritDoc}
 */
@Override
public AuthStatus validateRequest(final MessageInfo messageInfo,
    final Subject client,
    final Subject serviceSubject)
        throws AuthException {

    final HttpServletRequest req = (HttpServletRequest) messageInfo.getRequestMessage();
    final HttpServletResponse resp = (HttpServletResponse) messageInfo.getResponseMessage();
    try {

        final String localRequestUri = req.getRequestURI().substring(req.getContextPath().length());

        if (LOGIN_ENDPOINT.equals(localRequestUri)) {
            return handleLoginEndpoint(req, resp);
        }

        if (LOGOUT_ENDPOINT.equals(localRequestUri)) {
            return handleLogoutEndpoint(req, resp);
        }

        // Allow if authentication is not required.
        if (!mandatory) {
            return AuthStatus.SUCCESS;
        }

        // require SSL if mandatory
        if (!req.isSecure()) {
            resp.sendError(HttpURLConnection.HTTP_FORBIDDEN, "SSL Required");
            return AuthStatus.SEND_FAILURE;
        }

        final String subject = getSubject(req);

        // Check if there is no subject then redirect to login endpoint
        if (subject == null) {
            return handleRedirectToLoginEndpoint(req, resp);
        }

        handler.handle(new Callback[] {
            new CallerPrincipalCallback(client, subject),
            new GroupPrincipalCallback(client, GROUPS)
        });
        return AuthStatus.SUCCESS;

    } catch (final IOException
        | ServletException
        | UnsupportedCallbackException e) {
        LOG.throwing(TestServerAuthModule.class.getName(), "validateRequest", e);
        throw new AuthException(e.getMessage());
    }
}
 

@Override
public AuthStatus validateRequest(final ValidateContext context) throws IOException {

    return AuthStatus.SUCCESS;
}
 

private AuthStatus invokeModules(MessageInfo messageInfo,
      Subject clientSubject, Subject serviceSubject) 
throws AuthException
{
   //Control Flag behavior
   boolean encounteredRequiredError = false; 
   boolean encounteredOptionalError = false; 
   AuthException moduleException = null;
   AuthStatus overallDecision = AuthStatus.FAILURE;
   
   int length = modules.size();
   for(int i = 0; i < length; i++)
   {
      ServerAuthModule module = (ServerAuthModule)modules.get(i);
      ControlFlag flag = (ControlFlag)this.controlFlags.get(i); 
      AuthStatus decision = AuthStatus.FAILURE;
      try
      {
         decision = module.validateRequest(messageInfo, clientSubject, serviceSubject);
      }
      catch(Exception ae)
      { 
         decision = AuthStatus.FAILURE;
         if(moduleException == null)
            moduleException = new AuthException(ae.getMessage());
      }
      
      if(decision == AuthStatus.SUCCESS)
      { 
         overallDecision =  AuthStatus.SUCCESS;
         //SUFFICIENT case
         if(flag == ControlFlag.SUFFICIENT && encounteredRequiredError == false)
            return AuthStatus.SUCCESS;
         continue; //Continue with the other modules
      }
      //Go through the failure cases 
      //REQUISITE case
      if(flag == ControlFlag.REQUISITE)
      {
         if(moduleException == null)
            moduleException = new AuthException(PicketBoxMessages.MESSAGES.authenticationFailedMessage());
         else
            throw moduleException;
      }
      //REQUIRED Case
      if(flag == ControlFlag.REQUIRED)
      {
         if(encounteredRequiredError == false)
            encounteredRequiredError = true;
      }
      if(flag == ControlFlag.OPTIONAL)
         encounteredOptionalError = true; 
   }
   
   //All the authorization modules have been visited.
   String msg = getAdditionalErrorMessage(moduleException);
   if(encounteredRequiredError)
      throw new AuthException(PicketBoxMessages.MESSAGES.authenticationFailedMessage() + msg);
   if(overallDecision == AuthStatus.FAILURE && encounteredOptionalError)
      throw new AuthException(PicketBoxMessages.MESSAGES.authenticationFailedMessage() + msg);
   if(overallDecision == AuthStatus.FAILURE)
      throw new AuthException(PicketBoxMessages.MESSAGES.authenticationFailedMessage());
   return AuthStatus.SUCCESS;
}