Java AuthStatus类代码示例

import javax.security.auth.message.AuthStatus; //导入依赖的package包/类
@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject) throws AuthException {

    HttpServletRequest request = (HttpServletRequest) messageInfo.getRequestMessage();
    LOGGER.log(Level.FINE, "Validating request @" + request.getMethod() + " " + request.getRequestURI());

    String login = (String) request.getSession().getAttribute("login");
    String groups = (String) request.getSession().getAttribute("groups");

    CallerPrincipalCallback callerPrincipalCallback = new CallerPrincipalCallback(clientSubject, login);
    GroupPrincipalCallback groupPrincipalCallback = new GroupPrincipalCallback(clientSubject, new String[]{groups});
    Callback[] callbacks = new Callback[]{callerPrincipalCallback, groupPrincipalCallback};

    try {
        callbackHandler.handle(callbacks);
    } catch (IOException | UnsupportedCallbackException e) {
        throw new AuthException(e.getMessage());
    }

    return AuthStatus.SUCCESS;
}
 

import javax.security.auth.message.AuthStatus; //导入依赖的package包/类
@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject) throws AuthException {

    HttpServletRequest request = (HttpServletRequest) messageInfo.getRequestMessage();
    LOGGER.log(Level.FINE, "Validating request @" + request.getMethod() + " " + request.getRequestURI());

    CallerPrincipalCallback callerPrincipalCallback = new CallerPrincipalCallback(clientSubject, "");
    GroupPrincipalCallback groupPrincipalCallback = new GroupPrincipalCallback(clientSubject, new String[]{UserGroupMapping.GUEST_ROLE_ID});
    Callback[] callbacks = {callerPrincipalCallback, groupPrincipalCallback};

    try {
        callbackHandler.handle(callbacks);
    } catch (IOException | UnsupportedCallbackException e) {
        throw new AuthException(e.getMessage());
    }

    return AuthStatus.SUCCESS;

}
 

import javax.security.auth.message.AuthStatus; //导入依赖的package包/类
@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject) throws AuthException {

    HttpServletRequest request = (HttpServletRequest) messageInfo.getRequestMessage();
    HttpServletResponse response = (HttpServletResponse) messageInfo.getResponseMessage();
    AuthServices.addCORSHeaders(response);

    LOGGER.log(Level.FINE, "validateRequest @" + request.getMethod() + " " + request.getRequestURI());

    if (isOptionsRequest(request)) {
        return AuthStatus.SUCCESS;
    }

    CustomSAM module = getModule(messageInfo);

    if (module != null) {
        return module.validateRequest(messageInfo, clientSubject, serviceSubject);
    }

    response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);

    return AuthStatus.FAILURE;
}
 

import javax.security.auth.message.AuthStatus; //导入依赖的package包/类
@Override
public AuthStatus secureResponse(MessageInfo messageInfo, Subject serviceSubject) throws AuthException {

    HttpServletRequest request = (HttpServletRequest) messageInfo.getRequestMessage();
    HttpServletResponse response = (HttpServletResponse) messageInfo.getResponseMessage();
    AuthServices.addCORSHeaders(response);

    LOGGER.log(Level.FINE, "secureResponse @" + request.getMethod() + " " + request.getRequestURI());

    if (isOptionsRequest(request)) {
        return AuthStatus.SEND_SUCCESS;
    }

    CustomSAM module = getModule(messageInfo);

    if (module != null) {
        return module.secureResponse(messageInfo, serviceSubject);
    }

    return AuthStatus.SEND_FAILURE;
}
 

import javax.security.auth.message.AuthStatus; //导入依赖的package包/类
public void login() {

        FacesContext context = FacesContext.getCurrentInstance();
        Credential credential = new UsernamePasswordCredential(username, new Password(password));

        // Request for authentication
        AuthStatus status = securityContext.authenticate(
                getRequest(context),
                getResponse(context),
                withParams().credential(credential));

        if (status.equals(SEND_CONTINUE)) {
            // Authentication mechanism has send a redirect, should not
            // send anything to response from JSF now.
            context.responseComplete();
        } else if (status.equals(SEND_FAILURE) || status.equals(FAILURE)) {
            // TODO: only 1 status should be returned. Change to enum or fix source.
            addError(context, "Authentication failed");
        }

    }
 

import javax.security.auth.message.AuthStatus; //导入依赖的package包/类
@Override
public AuthStatus validateRequest(HttpServletRequest request, HttpServletResponse response, HttpMessageContext httpMsgContext) throws AuthException {

    String[] credentials = getCredentials(request);
    if (!isEmpty(credentials)) {

        IdentityStore identityStore = CDI.current().select(IdentityStore.class).get();

        CredentialValidationResult result = identityStore.validate(
                new UsernamePasswordCredential(credentials[0], new Password(credentials[1])));

        if (result.getStatus() == VALID) {
            return httpMsgContext.notifyContainerAboutLogin(
                    result.getCallerName(), result.getCallerGroups());
        }
    }

    if (httpMsgContext.isProtected()) {
        response.setHeader("WWW-Authenticate", basicHeaderValue);
        return httpMsgContext.responseUnAuthorized();
    }

    return httpMsgContext.doNothing();
}
 

import javax.security.auth.message.AuthStatus; //导入依赖的package包/类
/**
 * Handles the POST method for login endpoint.
 *
 * @param req
 *            request
 * @param resp
 *            response
 * @param stateUri
 *            URI for the state
 * @param nonce
 *            nonce
 * @return {@link AuthStatus#SEND_SUCCESS}
 * @throws IOException
 *             servlet error
 * @throws ServletException
 *             servlet error
 * @throws AuthException
 *             authentication error
 */
private static AuthStatus handleLoginPost(final HttpServletRequest req,
    final HttpServletResponse resp,
    final URI stateUri,
    final String nonce) throws ServletException,
        IOException,
        AuthException {

    final HttpSession session = req.getSession(false);
    if (session == null) {
        throw new AuthException("session is required");
    }
    if (!nonce.equals(session.getAttribute(NONCE_SESSION_KEY))) {
        throw new AuthException("nonce mismatch");
    }
    final String subject = UriBuilder.fromUri("https://test-server-auth-module").userInfo(req.getParameter("j_username"))
        .build().toASCIIString();
    session.setAttribute(SUBJECT_SESSION_KEY, subject);

    // Remove nonce as it is no longer required
    session.removeAttribute(NONCE_SESSION_KEY);
    final String redirectUri = req.getContextPath() + stateUri.toASCIIString();
    resp.sendRedirect(URI.create(redirectUri).normalize().toASCIIString());
    return AuthStatus.SEND_SUCCESS;
}
 

import javax.security.auth.message.AuthStatus; //导入依赖的package包/类
/**
 * Handle the logout endpoint. This will clear the cookie and redirect to
 * the URI that has been specified.
 *
 * @param req
 *            request
 * @param resp
 *            response
 * @return authentication status
 * @throws AuthException
 *             happens when there is invalid request data
 * @throws IOException
 *             servlet error
 * @throws ServletException
 *             servlet error
 */
private static AuthStatus handleLogoutEndpoint(final HttpServletRequest req,
    final HttpServletResponse resp) throws AuthException,
        ServletException,
        IOException {

    final String postLogoutRedirectUri = req.getParameter(POST_LOGOUT_REDIRECT_URI);
    if (postLogoutRedirectUri != null) {

        final String postLogoutRedirectUriNormalized = URI.create(postLogoutRedirectUri).normalize().toASCIIString();
        // Check that the post logout redirect uri is relative to the application if not fail.
        final String contextUri = URI.create(req.getRequestURL().toString()).resolve(req.getContextPath()).toASCIIString();
        if (!postLogoutRedirectUriNormalized.startsWith(contextUri)) {
            throw new AuthException("invalid post_logout_redirect_uri");
        }

        final HttpSession session = req.getSession(false);
        if (session != null) {
            session.removeAttribute(SUBJECT_SESSION_KEY);
            session.removeAttribute(NONCE_SESSION_KEY);
        }
        resp.sendRedirect(postLogoutRedirectUriNormalized);
        return AuthStatus.SEND_SUCCESS;
    }
    throw new AuthException("missing post_logout_redirect_uri");
}
 

import javax.security.auth.message.AuthStatus; //导入依赖的package包/类
/**
 * Handle the logout endpoint. This will clear the cookie and redirect to
 * the URI that has been specified.
 *
 * @param req
 *            request
 * @param resp
 *            response
 * @return authentication status
 * @throws AuthException
 *             happens when there is invalid request data
 * @throws IOException
 *             servlet error
 * @throws ServletException
 *             servlet error
 */
private static AuthStatus handleLogoutEndpoint(final HttpServletRequest req,
    final HttpServletResponse resp) throws AuthException,
        ServletException,
        IOException {

    final String postLogoutRedirectUri = req.getParameter(POST_LOGOUT_REDIRECT_URI);
    if (postLogoutRedirectUri != null) {

        final String postLogoutRedirectUriNormalized = URI.create(postLogoutRedirectUri).normalize().toASCIIString();
        // Check that the post logout redirect uri is relative to the application if not fail.
        final String contextUri = URI.create(req.getRequestURL().toString()).resolve(req.getContextPath()).toASCIIString();
        if (!postLogoutRedirectUriNormalized.startsWith(contextUri)) {
            throw new AuthException("invalid post_logout_redirect_uri");
        }

        final Cookie cookie = new Cookie(SUBJECT_COOKIE_KEY, "");
        cookie.setMaxAge(0);
        cookie.setSecure(true);
        resp.addCookie(cookie);
        resp.sendRedirect(postLogoutRedirectUriNormalized);
        return AuthStatus.SEND_SUCCESS;
    }
    throw new AuthException("missing post_logout_redirect_uri");
}
 

import javax.security.auth.message.AuthStatus; //导入依赖的package包/类
/**
 * Builds the redirect URI including the assembly of <code>state</code>.
 *
 * @param req
 *            servlet request
 * @param resp
 *            servlet response
 * @return {@link AuthStatus#SEND_SUCCESS}
 * @throws AuthException
 *             happens when there is invalid request data
 * @throws IOException
 *             servlet error
 * @throws ServletException
 *             servlet error
 */
private static AuthStatus handleRedirectToLoginEndpoint(final HttpServletRequest req,
    final HttpServletResponse resp) throws AuthException,
        ServletException,
        IOException {

    if (!"GET".equals(req.getMethod())) {
        throw new AuthException("Only 'GET' method is supported when redirecting to the endpoint");
    }
    final StringBuilder stateBuilder = new StringBuilder(req.getRequestURI().substring(req.getContextPath().length()));
    if (req.getQueryString() != null) {
        stateBuilder.append('?');
        stateBuilder.append(req.getQueryString());
    }
    final StringBuilder redirectUriBuilder = new StringBuilder(req.getContextPath());
    redirectUriBuilder.append(LOGIN_ENDPOINT);
    redirectUriBuilder.append("?state=");
    redirectUriBuilder.append(
        URLEncoder.encode(stateBuilder.toString(), "US-ASCII"));
    resp.sendRedirect(URI.create(redirectUriBuilder.toString()).normalize().toASCIIString());

    // The JASPIC spec is ambiguous for this scenario, however
    // SEND_SUCCESS works on the top three application servers.

    return AuthStatus.SEND_SUCCESS;
}
 

import javax.security.auth.message.AuthStatus; //导入依赖的package包/类
/**
 * The policy has determined it is not mandatory without SSL.
 */
@Test
public void testNoAuthNeededWithoutSSL() throws Exception {

    final TestServerAuthModule module = new TestServerAuthModule();
    final CallbackHandler h = mock(CallbackHandler.class);

    final MessagePolicy mockRequestPolicy = mock(MessagePolicy.class);
    when(mockRequestPolicy.isMandatory()).thenReturn(false);

    module.initialize(mockRequestPolicy, null, h, options);

    final MessageInfo messageInfo = mock(MessageInfo.class);

    final HttpServletRequest servletRequest = mock(HttpServletRequest.class);
    when(servletRequest.getMethod()).thenReturn("GET");
    when(servletRequest.isSecure()).thenReturn(false);
    when(servletRequest.getRequestURI()).thenReturn("/util/ejb2");
    when(servletRequest.getContextPath()).thenReturn("/util");
    when(messageInfo.getRequestMessage()).thenReturn(servletRequest);

    final Subject client = new Subject();
    assertEquals(AuthStatus.SUCCESS, module.validateRequest(messageInfo, client, null));
    verifyZeroInteractions(h);
}
 

import javax.security.auth.message.AuthStatus; //导入依赖的package包/类
/**
 * The policy has determined it is not mandatory.
 */
@Test
public void testNoAuthNeededWithSSL() throws Exception {

    final TestServerAuthModule module = new TestServerAuthModule();
    final MessagePolicy mockRequestPolicy = mock(MessagePolicy.class);
    when(mockRequestPolicy.isMandatory()).thenReturn(false);

    final CallbackHandler h = mock(CallbackHandler.class);
    module.initialize(mockRequestPolicy, null, h, options);

    final MessageInfo messageInfo = mock(MessageInfo.class);

    final HttpServletRequest servletRequest = mock(HttpServletRequest.class);
    when(servletRequest.getMethod()).thenReturn("GET");
    when(servletRequest.isSecure()).thenReturn(true);
    when(servletRequest.getRequestURI()).thenReturn("/util/ejb2");
    when(servletRequest.getContextPath()).thenReturn("/util");
    when(messageInfo.getRequestMessage()).thenReturn(servletRequest);

    final Subject client = new Subject();
    assertEquals(AuthStatus.SUCCESS, module.validateRequest(messageInfo, client, null));
    verifyZeroInteractions(h);
}
 

import javax.security.auth.message.AuthStatus; //导入依赖的package包/类
@Test
public void testSSLRequired() throws Exception {

    final TestServerAuthModule module = new TestServerAuthModule();
    final MessagePolicy mockRequestPolicy = mock(MessagePolicy.class);
    when(mockRequestPolicy.isMandatory()).thenReturn(true);

    module.initialize(mockRequestPolicy, null, null, options);

    final MessageInfo messageInfo = mock(MessageInfo.class);

    final HttpServletRequest servletRequest = mock(HttpServletRequest.class);
    when(servletRequest.getMethod()).thenReturn("GET");
    when(servletRequest.isSecure()).thenReturn(false);
    when(servletRequest.getRequestURI()).thenReturn("/util/ejb2");
    when(servletRequest.getContextPath()).thenReturn("/util");
    when(messageInfo.getRequestMessage()).thenReturn(servletRequest);

    final HttpServletResponse servletResponse = mock(HttpServletResponse.class);
    when(messageInfo.getResponseMessage()).thenReturn(servletResponse);

    final Subject client = new Subject();
    assertEquals(AuthStatus.SEND_FAILURE, module.validateRequest(messageInfo, client, null));
    verify(servletResponse).sendError(HttpURLConnection.HTTP_FORBIDDEN, "SSL Required");
}
 

import javax.security.auth.message.AuthStatus; //导入依赖的package包/类
/**
 * Tests the login endpoint GET operation.
 */
@Test
public void testLogin() throws Exception {

    final TestServerAuthModule module = new TestServerAuthModule();
    final MessagePolicy mockRequestPolicy = mock(MessagePolicy.class);
    when(mockRequestPolicy.isMandatory()).thenReturn(true);

    final CallbackHandler h = mock(CallbackHandler.class);
    module.initialize(mockRequestPolicy, null, h, options);

    final MessageInfo messageInfo = mock(MessageInfo.class);

    final HttpServletRequest servletRequest = mock(HttpServletRequest.class);
    when(servletRequest.getMethod()).thenReturn("GET");
    when(servletRequest.isSecure()).thenReturn(true);
    when(servletRequest.getRequestURI()).thenReturn("/util/j_security_check");
    when(servletRequest.getContextPath()).thenReturn("/util");
    when(servletRequest.getParameter("state")).thenReturn("/");
    when(servletRequest.getRequestDispatcher(Matchers.anyString())).thenReturn(mock(RequestDispatcher.class));
    when(messageInfo.getRequestMessage()).thenReturn(servletRequest);

    final Subject client = new Subject();
    assertEquals(AuthStatus.SEND_SUCCESS, module.validateRequest(messageInfo, client, null));
    verifyZeroInteractions(h);
}
 

import javax.security.auth.message.AuthStatus; //导入依赖的package包/类
/**
 * @see ClientAuthContext#validateResponse(javax.security.auth.message.MessageInfo, javax.security.auth.Subject, javax.security.auth.Subject)
 */ 
@SuppressWarnings("rawtypes")
public AuthStatus validateResponse(MessageInfo messageInfo, Subject clientSubject, 
      Subject serviceSubject) throws AuthException
{
   Iterator iter = config.getClientAuthModules().iterator();
   AuthStatus status = null;
   while(iter.hasNext())
   {
      status = ((ClientAuthModule)iter.next()).validateResponse(messageInfo,clientSubject,
                                                                             serviceSubject);
      if(status == AuthStatus.FAILURE)
         break;
   }
   return status;
}