Java AuthenticationContext类代码示例

import org.wildfly.security.auth.client.AuthenticationContext; //导入依赖的package包/类
/**
 * Tests if DIGEST-* mechanism with default realm used works correctly for both valid and invalid username/password
 * combinations.
 *
 * @param mechanism DIGEST mechanism name
 */
private void assertDefaultRealmWorks(String mechanism) throws Exception {
    try (CLIWrapper cli = new CLIWrapper(true)) {
        cli.sendLine(String.format(
                "/subsystem=elytron/sasl-authentication-factory=%s:write-attribute(name=mechanism-configurations, value=[{mechanism-name=%s}])",
                NAME, mechanism));
    }
    ServerReload.reloadIfRequired(TestSuiteEnvironment.getModelControllerClient());

    AuthenticationConfiguration authnCfg = AuthenticationConfiguration.empty()
            .setSaslMechanismSelector(SaslMechanismSelector.fromString(mechanism)).useName(USERNAME)
            .usePassword(USERNAME + PASSWORD_SFX);
    AuthenticationContext.empty().with(MatchRule.ALL, authnCfg).run(() -> assertWhoAmI(USERNAME));

    authnCfg = AuthenticationConfiguration.empty().setSaslMechanismSelector(SaslMechanismSelector.fromString(mechanism))
            .useName("noSuchUser").usePassword("aPassword");
    AuthenticationContext.empty().with(MatchRule.ALL, authnCfg).run(() -> assertAuthenticationFails(
            "Authentication should fail when the user doesn't exist in the security-realm"));
}
 

import org.wildfly.security.auth.client.AuthenticationContext; //导入依赖的package包/类
/**
 * Asserts that given user can authenticate with given Kerberos SASL mechanism.
 */
protected void assertKerberosSaslMechPasses(String mech, String user, String password, boolean withSsl)
        throws MalformedURLException, LoginException, Exception {
    // 1. Authenticate to Kerberos.
    final LoginContext lc = KerberosTestUtils.loginWithKerberos(KRB5_CONFIGURATION, user, password);
    try {
        AuthenticationConfiguration authCfg = AuthenticationConfiguration.empty()
                .setSaslMechanismSelector(SaslMechanismSelector.fromString(mech))
                .useGSSCredential(getGSSCredential(lc.getSubject()));

        AuthenticationContext authnCtx = AuthenticationContext.empty().with(MatchRule.ALL, authCfg);
        if (withSsl) {
            authnCtx = authnCtx.withSsl(MatchRule.ALL, sslFactory);
        }
        final AuthenticationContext authnCtxFinal = authnCtx;
        Subject.doAs(lc.getSubject(), (PrivilegedAction<Void>) () -> {
            authnCtxFinal.run(() -> assertWhoAmI(user + "@JBOSS.ORG", withSsl));
            return null;
        });
    } finally {
        lc.logout();
    }
}
 

import org.wildfly.security.auth.client.AuthenticationContext; //导入依赖的package包/类
protected void assertKerberosSaslMechFails(String mech, String user, String password, boolean withSsl)
        throws MalformedURLException, LoginException, Exception {
    // 1. Authenticate to Kerberos.
    final LoginContext lc = KerberosTestUtils.loginWithKerberos(KRB5_CONFIGURATION, user, password);
    try {
        AuthenticationConfiguration authCfg = AuthenticationConfiguration.empty()
                .setSaslMechanismSelector(SaslMechanismSelector.fromString(mech))
                .useGSSCredential(getGSSCredential(lc.getSubject()));

        AuthenticationContext authnCtx = AuthenticationContext.empty().with(MatchRule.ALL, authCfg);
        if (withSsl) {
            authnCtx = authnCtx.withSsl(MatchRule.ALL, sslFactory);
        }
        final AuthenticationContext authnCtxFinal = authnCtx;
        Subject.doAs(lc.getSubject(), (PrivilegedAction<Void>) () -> {
            authnCtxFinal.run(() -> assertAuthenticationFails(null, null, withSsl));
            return null;
        });
    } finally {
        lc.logout();
    }
}
 

import org.wildfly.security.auth.client.AuthenticationContext; //导入依赖的package包/类
/**
 * Tests SASL mechanism filtering through policy properties which are matched by EXTERNAL mechanism.
 *
 * @see <a href="https://issues.jboss.org/browse/ELY-982">ELY-982</a>
 */
@Test
public void testMatchingFilteringProperties() throws Exception {
    Map<String, String> mechanismProperties = new HashMap<>();
    mechanismProperties.put(Sasl.POLICY_NOPLAINTEXT, "true");
    mechanismProperties.put(Sasl.POLICY_NOACTIVE, "true");
    mechanismProperties.put(Sasl.POLICY_NODICTIONARY, "true");
    AuthenticationConfiguration authCfg = AuthenticationConfiguration.empty()
            .setSaslMechanismSelector(SaslMechanismSelector.fromString(MECHANISM))
            .useMechanismProperties(mechanismProperties);

    SecurityFactory<SSLContext> ssl = new SSLContextBuilder().setClientMode(true)
            .setKeyManager(getKeyManager(CLIENT_KEYSTORE_FILE)).setTrustManager(getTrustManager()).build();
    AuthenticationContext.empty().with(MatchRule.ALL, authCfg).withSsl(MatchRule.ALL, ssl)
            .run(() -> assertWhoAmI("client"));
}
 

import org.wildfly.security.auth.client.AuthenticationContext; //导入依赖的package包/类
/**
 * Tests wrongly configured security Provider in the clients AuthenticationConfiguration.
 */
@Test
public void testNullProvider() throws Exception {
    String mechanismName = getMechanism();
    AuthenticationConfiguration authnCfg = AuthenticationConfiguration.empty()
            .setSaslMechanismSelector(SaslMechanismSelector.fromString(mechanismName))
            .useProviders(() -> new Provider[] { null });
    if ("ANONYMOUS".equals(mechanismName)) {
        authnCfg = authnCfg.useAnonymous();
    } else if ("OAUTHBEARER".equals(mechanismName)) {
        authnCfg = authnCfg.useBearerTokenCredential(new BearerTokenCredential(JWT_TOKEN));
    } else if (!"JBOSS-LOCAL-USER".equals(mechanismName)) {
        authnCfg = authnCfg.useName(USERNAME).usePassword(USERNAME + PASSWORD_SFX);
    }
    AuthenticationContext.empty().with(MatchRule.ALL, authnCfg).run(() -> assertAuthenticationFails());
}
 

import org.wildfly.security.auth.client.AuthenticationContext; //导入依赖的package包/类
/**
 * Create a new model controller client. The client can (and should) be closed without affecting other usages.
 *
 * @param authConfigUri the path to the {@code wildfly-config.xml} to use or {@code null}
 *
 * @return the domain client
 */
public DomainClient createDomainClient(final URI authConfigUri) {
    final DomainTestConnection connection = this.connection;
    if(connection == null) {
        throw new IllegalStateException();
    }
    if (authConfigUri == null) {
        return DomainClient.Factory.create(connection.createClient());
    }
    try {
        final AuthenticationContext context = ElytronXmlParser.parseAuthenticationClientConfiguration(authConfigUri).create();
        return DomainClient.Factory.create(new ContextualModelControllerClient(connection.createClient(), context));
    } catch (GeneralSecurityException | ConfigXMLParseException e) {
        throw new RuntimeException("Failed to parse authentication configuration: " + authConfigUri, e);
    }
}
 

import org.wildfly.security.auth.client.AuthenticationContext; //导入依赖的package包/类
RemoteDomainConnection(final String localHostName, final ProtocolConnectionConfiguration configuration, final AuthenticationContext authenticationContext,
                       final SecurityRealm realm,  final String username, final List<DiscoveryOption> discoveryOptions,
                       final ExecutorService executorService,
                       final ScheduledExecutorService scheduledExecutorService,
                       final HostRegistrationCallback callback,
                       final RunningMode runningMode) {
    this.callback = callback;
    this.localHostName = localHostName;
    this.configuration = configuration;
    this.authenticationContext = authenticationContext;
    this.username = username;
    this.realm = realm;
    this.discoveryOptions = discoveryOptions;
    this.executorService = executorService;
    this.channelHandler = new ManagementChannelHandler(this, executorService);
    this.scheduledExecutorService = scheduledExecutorService;
    this.runningMode = runningMode;
    this.connectionManager = ProtocolConnectionManager.create(new InitialConnectTask());
}
 

import org.wildfly.security.auth.client.AuthenticationContext; //导入依赖的package包/类
@Override
public void deploy(DeploymentPhaseContext context) throws DeploymentUnitProcessingException {
    AuthenticationContext authenticationContext = context.getAttachment(AUTHENTICATION_CONTEXT_KEY);
    if (authenticationContext != null) {
        AuthenticationContext.getContextManager().setClassLoaderDefault(
                context.getDeploymentUnit().getAttachment(MODULE).getClassLoader(), authenticationContext);
    }
}
 

import org.wildfly.security.auth.client.AuthenticationContext; //导入依赖的package包/类
protected void performRuntime(final OperationContext context, final ModelNode operation, final ModelNode model) throws OperationFailedException {

            RuntimeCapability<Void> runtimeCapability = DIR_CONTEXT_RUNTIME_CAPABILITY.fromBaseCapability(context.getCurrentAddressValue());
            ServiceName serviceName = runtimeCapability.getCapabilityServiceName(DirContextSupplier.class);

            final InjectedValue<ExceptionSupplier<CredentialSource, Exception>> credentialSourceSupplierInjector = new InjectedValue<>();
            final InjectedValue<AuthenticationContext> authenticationContextInjector = new InjectedValue<>();
            final InjectedValue<SSLContext> sslContextInjector = new InjectedValue<>();

            TrivialService<DirContextSupplier> service = new TrivialService<>(obtainDirContextSupplier(context, model, credentialSourceSupplierInjector, authenticationContextInjector, sslContextInjector));
            ServiceBuilder<DirContextSupplier> serviceBuilder = context.getServiceTarget().addService(serviceName, service);

            String sslContextName = SSL_CONTEXT.resolveModelAttribute(context, model).asStringOrNull();
            if (sslContextName != null) {
                String sslCapability = RuntimeCapability.buildDynamicCapabilityName(SSL_CONTEXT_CAPABILITY, sslContextName);
                ServiceName sslServiceName = context.getCapabilityServiceName(sslCapability, SSLContext.class);
                serviceBuilder.addDependency(sslServiceName, SSLContext.class, sslContextInjector);
            }

            if (CREDENTIAL_REFERENCE.resolveModelAttribute(context, model).isDefined()) {
                credentialSourceSupplierInjector.inject(CredentialReference.getCredentialSourceSupplier(context, CREDENTIAL_REFERENCE, model, serviceBuilder));
            }

            String authenticationContextName = AUTHENTICATION_CONTEXT.resolveModelAttribute(context, model).asStringOrNull();
            if (authenticationContextName != null) {
                String acCapability = RuntimeCapability.buildDynamicCapabilityName(AUTHENTICATION_CONTEXT_CAPABILITY, authenticationContextName);
                ServiceName acServiceName = context.getCapabilityServiceName(acCapability, AuthenticationContext.class);
                serviceBuilder.addDependency(acServiceName, AuthenticationContext.class, authenticationContextInjector);
            }

            serviceBuilder
                    .setInitialMode(ServiceController.Mode.ACTIVE)
                    .install();
        }
 

import org.wildfly.security.auth.client.AuthenticationContext; //导入依赖的package包/类
/**
 * Tests that client is able to use mechanism when server allows it.
 */
@Test
public void testCorrectMechanismPasses() throws Exception {
    AuthenticationConfiguration authCfg = AuthenticationConfiguration.empty()
            .setSaslMechanismSelector(SaslMechanismSelector.fromString(MECHANISM));

    SecurityFactory<SSLContext> ssl = new SSLContextBuilder().setClientMode(true)
            .setKeyManager(getKeyManager(CLIENT_KEYSTORE_FILE)).setTrustManager(getTrustManager()).build();
    AuthenticationContext.empty().with(MatchRule.ALL, authCfg).withSsl(MatchRule.ALL, ssl)
            .run(() -> assertWhoAmI("client"));
}
 

import org.wildfly.security.auth.client.AuthenticationContext; //导入依赖的package包/类
/**
 * @param policyProperty
 * @throws Exception
 */
private void assertUnmatchingFilteringPropertyFails(String policyProperty) throws Exception {
    Map<String, String> mechanismProperties = new HashMap<>();
    mechanismProperties.put(policyProperty, "true");
    AuthenticationConfiguration authCfg = AuthenticationConfiguration.empty()
            .setSaslMechanismSelector(SaslMechanismSelector.fromString(MECHANISM))
            .useMechanismProperties(mechanismProperties);

    SecurityFactory<SSLContext> ssl = new SSLContextBuilder().setClientMode(true)
            .setKeyManager(getKeyManager(CLIENT_KEYSTORE_FILE)).setTrustManager(getTrustManager()).build();
    AuthenticationContext.empty().with(MatchRule.ALL, authCfg).withSsl(MatchRule.ALL, ssl)
            .run(() -> assertAuthenticationFails(
                    String.format("The EXTERNAL SASL mechanism should not be selected, when property %s is true.", policyProperty)));
}
 

import org.wildfly.security.auth.client.AuthenticationContext; //导入依赖的package包/类
/**
 * Tests that client with wrong (untrusted) certificate is not able to execute operation on server through the mechanism.
 */
@Test
public void testUntrustedCertFails() throws Exception {
    AuthenticationConfiguration authCfg = AuthenticationConfiguration.empty()
            .setSaslMechanismSelector(SaslMechanismSelector.fromString(MECHANISM));

    SecurityFactory<SSLContext> ssl = new SSLContextBuilder().setClientMode(true)
            .setKeyManager(getKeyManager(UNTRUSTED_STORE_FILE)).setTrustManager(getTrustManager()).build();
    AuthenticationContext.empty().with(MatchRule.ALL, authCfg).withSsl(MatchRule.ALL, ssl)
            .run(() -> assertCertAuthenticationFails(
                    "Client certificate authentication should fail for an untrusted certificate."));
}
 

import org.wildfly.security.auth.client.AuthenticationContext; //导入依赖的package包/类
/**
 * Tests that invalid credentials results in authentication failure.
 */
@Test
public void testWrongCredentialsFail() throws Exception {
    String mechanismName = getMechanism();
    if ("ANONYMOUS".equals(mechanismName)) {
        LOGGER.info("We don't test ANONYMOUS mechanism with wrong user credentials.");
        return;
    }

    AuthenticationConfiguration authnCfg = AuthenticationConfiguration.empty()
            .setSaslMechanismSelector(SaslMechanismSelector.fromString(mechanismName)).useName(USERNAME)
            .usePassword("wrongPassword").useProviders(() -> new Provider[] { PROVIDER_ELYTRON });
    AuthenticationContext.empty().with(MatchRule.ALL, authnCfg).run(() -> assertAuthenticationFails());
}
 

import org.wildfly.security.auth.client.AuthenticationContext; //导入依赖的package包/类
protected AuthenticationContext createValidConfigForMechanism(String mechanismName, String username) {
    AuthenticationConfiguration authnCfg = AuthenticationConfiguration.empty()
            .setSaslMechanismSelector(SaslMechanismSelector.fromString(mechanismName));
    if ("ANONYMOUS".equals(mechanismName)) {
        authnCfg = authnCfg.useAnonymous();
    } else if ("OAUTHBEARER".equals(mechanismName)) {
        authnCfg = authnCfg.useBearerTokenCredential(new BearerTokenCredential(JWT_TOKEN));
    } else if (!"JBOSS-LOCAL-USER".equals(mechanismName)) {
        authnCfg = authnCfg.useName(username).usePassword(username + PASSWORD_SFX);
    }
    return AuthenticationContext.empty().with(MatchRule.ALL, authnCfg);
}
 

import org.wildfly.security.auth.client.AuthenticationContext; //导入依赖的package包/类
@Test
public void testExpiredToken() throws Exception {
    AuthenticationContext.empty()
            .with(MatchRule.ALL,
                    AuthenticationConfiguration.empty().setSaslMechanismSelector(SaslMechanismSelector.ALL)
                            .useBearerTokenCredential(new BearerTokenCredential(TOKEN_EXPIRED)))
            .run(() -> assertAuthenticationFails());
}