Java AuthenticatedUser.setUserStoreDomain方法代码示例

import org.wso2.carbon.identity.application.authentication.framework.model.AuthenticatedUser; //导入方法依赖的package包/类
private AuthenticatedUser getUsername(AuthenticationContext context) throws AuthenticationFailedException {
    //username from authentication context.
    AuthenticatedUser authenticatedUser = null;
    for (int i = 1; i <= context.getSequenceConfig().getStepMap().size(); i++) {
        StepConfig stepConfig = context.getSequenceConfig().getStepMap().get(i);
        if (stepConfig.getAuthenticatedUser() != null && stepConfig.getAuthenticatedAutenticator()
                .getApplicationAuthenticator() instanceof LocalApplicationAuthenticator) {
            authenticatedUser = stepConfig.getAuthenticatedUser();
            if (authenticatedUser.getUserStoreDomain() == null) {
                authenticatedUser.setUserStoreDomain(UserCoreConstants.PRIMARY_DEFAULT_DOMAIN_NAME);
            }


            if (log.isDebugEnabled()) {
                log.debug("username :" + authenticatedUser.toString());
            }
            break;
        }
    }
    if(authenticatedUser == null){
        throw new AuthenticationFailedException("Could not locate an authenticated username from previous steps " +
                "of the sequence. Hence cannot continue with FIDO authentication.");
    }
    return authenticatedUser;
}
 

import org.wso2.carbon.identity.application.authentication.framework.model.AuthenticatedUser; //导入方法依赖的package包/类
@Test(dataProvider = "postAuthenticationDataProvider")
public void testHandlePostAuthenticationSubjectIdentifier(String subjectClaimUriFromAppConfig,
                                                          String spSubjectClaimValue,
                                                          boolean appendTenantDomainToSubject,
                                                          boolean appendUserStoreDomainToSubject,
                                                          String authenticatedUserNameInSequence,
                                                          String expectedSubjectIdentifier) throws Exception {

    stepBasedSequenceHandler = new DefaultStepBasedSequenceHandler();
    ApplicationConfig applicationConfig = spy(new ApplicationConfig(new ServiceProvider()));
    when(applicationConfig.getSubjectClaimUri()).thenReturn(subjectClaimUriFromAppConfig);
    when(applicationConfig.isUseTenantDomainInLocalSubjectIdentifier()).thenReturn(appendTenantDomainToSubject);
    when(applicationConfig.isUseUserstoreDomainInLocalSubjectIdentifier())
            .thenReturn(appendUserStoreDomainToSubject);

    AuthenticatedUser authenticatedUser = new AuthenticatedUser();
    authenticatedUser.setUserName(authenticatedUserNameInSequence);
    authenticatedUser.setTenantDomain(FOO_TENANT);
    authenticatedUser.setUserStoreDomain(XY_USER_STORE_DOMAIN);

    SequenceConfig sequenceConfig = new SequenceConfig();
    sequenceConfig.setAuthenticatedUser(authenticatedUser);
    sequenceConfig.setApplicationConfig(applicationConfig);

    // SP subject claim value
    context.setProperty(FrameworkConstants.SERVICE_PROVIDER_SUBJECT_CLAIM_VALUE, spSubjectClaimValue);
    context.setSequenceConfig(sequenceConfig);

    stepBasedSequenceHandler.handlePostAuthentication(request, response, context);

    assertEquals(context.getSequenceConfig().getAuthenticatedUser().getAuthenticatedSubjectIdentifier(),
            expectedSubjectIdentifier);
}
 

import org.wso2.carbon.identity.application.authentication.framework.model.AuthenticatedUser; //导入方法依赖的package包/类
/**
 * Update existing consumer application.
 *
 * @param consumerAppDTO <code>OAuthConsumerAppDTO</code> with updated application information
 * @throws IdentityOAuthAdminException Error when updating the underlying identity persistence store.
 */
public void updateConsumerApplication(OAuthConsumerAppDTO consumerAppDTO) throws IdentityOAuthAdminException {
    String userName = CarbonContext.getThreadLocalCarbonContext().getUsername();
    String tenantAwareUsername = MultitenantUtils.getTenantAwareUsername(userName);
    int tenantId = CarbonContext.getThreadLocalCarbonContext().getTenantId();
    String tenantDomain = CarbonContext.getThreadLocalCarbonContext().getTenantDomain();
    OAuthAppDAO dao = new OAuthAppDAO();
    OAuthAppDO oauthappdo = new OAuthAppDO();
    AuthenticatedUser user = new AuthenticatedUser();
    user.setUserName(UserCoreUtil.removeDomainFromName(tenantAwareUsername));
    user.setTenantDomain(tenantDomain);
    user.setUserStoreDomain(IdentityUtil.extractDomainFromName(userName));
    oauthappdo.setUser(user);
    oauthappdo.setOauthConsumerKey(consumerAppDTO.getOauthConsumerKey());
    oauthappdo.setOauthConsumerSecret(consumerAppDTO.getOauthConsumerSecret());
    oauthappdo.setCallbackUrl(consumerAppDTO.getCallbackUrl());
    oauthappdo.setApplicationName(consumerAppDTO.getApplicationName());
    if (OAuthConstants.OAuthVersions.VERSION_2.equals(consumerAppDTO.getOAuthVersion())) {
        List<String> allowedGrants = new ArrayList<>(Arrays.asList(getAllowedGrantTypes()));
        String[] requestGrants = consumerAppDTO.getGrantTypes().split("\\s");
        for (String requestedGrant : requestGrants) {
            if (StringUtils.isBlank(requestedGrant)) {
                continue;
            }
            if (!allowedGrants.contains(requestedGrant)) {
                throw new IdentityOAuthAdminException(requestedGrant + " not allowed");
            }
        }
        oauthappdo.setGrantTypes(consumerAppDTO.getGrantTypes());
    }
    dao.updateConsumerApplication(oauthappdo);
    if (OAuthServerConfiguration.getInstance().isCacheEnabled()) {
        appInfoCache.addToCache(oauthappdo.getOauthConsumerKey(), oauthappdo);
    }
}
 

import org.wso2.carbon.identity.application.authentication.framework.model.AuthenticatedUser; //导入方法依赖的package包/类
public static AuthenticatedUser getUserFromUserName(String username) throws IllegalArgumentException {
    if (StringUtils.isNotBlank(username)) {
        String tenantDomain = MultitenantUtils.getTenantDomain(username);
        String tenantAwareUsername = MultitenantUtils.getTenantAwareUsername(username);
        String tenantAwareUsernameWithNoUserDomain = UserCoreUtil.removeDomainFromName(tenantAwareUsername);
        String userStoreDomain = IdentityUtil.extractDomainFromName(username).toUpperCase();
        AuthenticatedUser user = new AuthenticatedUser();
        user.setUserName(tenantAwareUsernameWithNoUserDomain);
        user.setTenantDomain(tenantDomain);
        user.setUserStoreDomain(userStoreDomain);

        return user;
    }
    throw new IllegalArgumentException("Cannot create user from empty user name");
}
 

import org.wso2.carbon.identity.application.authentication.framework.model.AuthenticatedUser; //导入方法依赖的package包/类
@Override
protected void processAuthenticationResponse(HttpServletRequest request, HttpServletResponse response,
                                             AuthenticationContext context) throws AuthenticationFailedException {
    super.processAuthenticationResponse(request, response, context);
    IWAAuthenticatedUserBean iwaAuthenticatedUserBean;
    HttpSession session = request.getSession(false);
    final String gssToken = (String) session.getAttribute(IWAConstants.KERBEROS_TOKEN);
    IWAAuthenticationUtil.invalidateSession(request);

    Map authenticatorProperties = context.getAuthenticatorProperties();
    GSSCredential gssCredential;
    String userStoreDomains;
    try {
        // Service Principal Name : an identifier representing IS registered at the Kerberos Server, this can
        // sometimes be the service account of the IS at the Kerberos Server
        String spnName = (String) authenticatorProperties.get(IWAConstants.SPN_NAME);

        // User store domains in which we need to check whether the authenicated user in Kerberos ticket exists in
        userStoreDomains = (String) authenticatorProperties.get(IWAConstants.USER_STORE_DOMAINS);

        // Password of the service account of IS at the Kerberos Server
        char[] spnPassword = authenticatorProperties.get(IWAConstants.SPN_PASSWORD).toString().toCharArray();

        String errorMsg = null;
       if (StringUtils.isBlank(spnName)) {
            errorMsg = "Service Principal Name (SPN) cannot be empty.";
        } else if (ArrayUtils.isEmpty(spnPassword)) {
            errorMsg = "Service Principal password cannot be empty.";
        }

        if (errorMsg != null) {
            throw new AuthenticationFailedException(errorMsg);
        }

        // create credentials to decrypt the Kerberos Token used to authenticate the user
        gssCredential = IWAAuthenticationUtil.createCredentials(spnName, spnPassword);

    } catch (PrivilegedActionException | LoginException | GSSException ex) {
        throw new AuthenticationFailedException("Cannot create kerberos credentials for server.", ex);
    }

    // get the authenticated username from the GSS Token
    String fullyQualifiedName = getAuthenticatedUserFromToken(gssCredential, Base64.decode(gssToken));
    String authenticatedUserName = IWAAuthenticationUtil.getDomainAwareUserName(fullyQualifiedName);

    if (log.isDebugEnabled()) {
        log.debug("Authenticated Federated User : " + authenticatedUserName);
    }

    if (StringUtils.isEmpty(userStoreDomains)) {
        // No UserStoreDomain values were set in the UI, so we don't have to check for existence of user in
        // user stores. ie. we will consider this user as a federated one.
        context.setSubject(
                AuthenticatedUser.createFederateAuthenticatedUserFromSubjectIdentifier(authenticatedUserName));
    } else {
        // We need to check the user's existence in specified user store domains
        iwaAuthenticatedUserBean = userInformationInListedUserStores(authenticatedUserName,
                context.getTenantDomain(), userStoreDomains);

        if (!iwaAuthenticatedUserBean.isUserExists()) {
            String msg = "User: %s not found in any of specified userstores: %s of tenant: %s.";
            throw new AuthenticationFailedException("Authentication Failed, " +
                    String.format(msg, authenticatedUserName, userStoreDomains, context.getTenantDomain()));
        }

        //Creates local authenticated user since this refer available user stores for user.
        AuthenticatedUser authenticatedUser = new AuthenticatedUser();
        authenticatedUser.setUserName(iwaAuthenticatedUserBean.getUser());
        authenticatedUser.setUserStoreDomain(iwaAuthenticatedUserBean.getUserStoreDomain());
        authenticatedUser.setTenantDomain(MultitenantUtils.getTenantDomain(iwaAuthenticatedUserBean.getTenantDomain()));
        authenticatedUser.setAuthenticatedSubjectIdentifier(iwaAuthenticatedUserBean.getUser());
        authenticatedUser.setUserAttributes(
                IWAAuthenticationUtil.buildClaimMappingMap(getUserClaims(iwaAuthenticatedUserBean)));
        context.setSubject(authenticatedUser);
    }
}
 

import org.wso2.carbon.identity.application.authentication.framework.model.AuthenticatedUser; //导入方法依赖的package包/类
public OAuthAppDO getAppInformation(String consumerKey) throws InvalidOAuthClientException, IdentityOAuth2Exception {
    Connection connection = IdentityDatabaseUtil.getDBConnection();
    PreparedStatement prepStmt = null;
    ResultSet rSet = null;
    OAuthAppDO oauthApp = null;

    try {
        prepStmt = connection.prepareStatement(SQLQueries.OAuthAppDAOSQLQueries.GET_APP_INFO);
        prepStmt.setString(1, persistenceProcessor.getProcessedClientId(consumerKey));

        rSet = prepStmt.executeQuery();
        List<OAuthAppDO> oauthApps = new ArrayList<>();
        /**
         * We need to determine whether the result set has more than 1 row. Meaning, we found an application for
         * the given consumer key. There can be situations where a user passed a key which doesn't yet have an
         * associated application. We need to barf with a meaningful error message for this case
         */
        boolean rSetHasRows = false;
        while (rSet.next()) {
            // There is at least one application associated with a given key
            rSetHasRows = true;
            if (rSet.getString(4) != null && rSet.getString(4).length() > 0) {
                oauthApp = new OAuthAppDO();
                oauthApp.setOauthConsumerKey(consumerKey);
                oauthApp.setOauthConsumerSecret(persistenceProcessor.getPreprocessedClientSecret(rSet.getString(1)));
                AuthenticatedUser authenticatedUser = new AuthenticatedUser();
                authenticatedUser.setUserName(rSet.getString(2));
                oauthApp.setApplicationName(rSet.getString(3));
                oauthApp.setOauthVersion(rSet.getString(4));
                oauthApp.setCallbackUrl(rSet.getString(5));
                authenticatedUser.setTenantDomain(IdentityTenantUtil.getTenantDomain(rSet.getInt(6)));
                authenticatedUser.setUserStoreDomain(rSet.getString(7));
                oauthApp.setUser(authenticatedUser);
                oauthApp.setGrantTypes(rSet.getString(8));
                oauthApp.setId(rSet.getInt(9));
                oauthApps.add(oauthApp);
            }
        }
        if (!rSetHasRows) {
            /**
             * We come here because user submitted a key that doesn't have any associated application with it.
             * We're throwing an error here because we cannot continue without this info. Otherwise it'll throw
             * a null values not supported error when it tries to cache this info
             */

            throw new InvalidOAuthClientException("Cannot find an application associated with the given consumer key : " + consumerKey);
        }
        connection.commit();
    } catch (SQLException e) {
        throw new IdentityOAuth2Exception("Error while retrieving the app information", e);
    } finally {
        IdentityDatabaseUtil.closeAllConnections(connection, rSet, prepStmt);
    }
    return oauthApp;
}
 

import org.wso2.carbon.identity.application.authentication.framework.model.AuthenticatedUser; //导入方法依赖的package包/类
public OAuthAppDO getAppInformationByAppName(String appName) throws InvalidOAuthClientException, IdentityOAuth2Exception {
    Connection connection = IdentityDatabaseUtil.getDBConnection();
    PreparedStatement prepStmt = null;
    ResultSet rSet = null;
    OAuthAppDO oauthApp = null;

    try {
        int tenantID = CarbonContext.getThreadLocalCarbonContext().getTenantId();
        prepStmt = connection.prepareStatement(SQLQueries.OAuthAppDAOSQLQueries.GET_APP_INFO_BY_APP_NAME);
        prepStmt.setString(1, appName);
        prepStmt.setInt(2, tenantID);

        rSet = prepStmt.executeQuery();
        List<OAuthAppDO> oauthApps = new ArrayList<>();
        oauthApp = new OAuthAppDO();
        oauthApp.setApplicationName(appName);
        AuthenticatedUser user = new AuthenticatedUser();
        user.setTenantDomain(IdentityTenantUtil.getTenantDomain(tenantID));
        /**
         * We need to determine whether the result set has more than 1 row. Meaning, we found an application for
         * the given consumer key. There can be situations where a user passed a key which doesn't yet have an
         * associated application. We need to barf with a meaningful error message for this case
         */
        boolean rSetHasRows = false;
        while (rSet.next()) {
            // There is at least one application associated with a given key
            rSetHasRows = true;
            if (rSet.getString(4) != null && rSet.getString(4).length() > 0) {
                oauthApp.setOauthConsumerSecret(persistenceProcessor.getPreprocessedClientSecret(rSet.getString(1)));
                user.setUserName(rSet.getString(2));
                user.setUserStoreDomain(rSet.getString(3));
                oauthApp.setUser(user);
                oauthApp.setOauthConsumerKey(persistenceProcessor.getPreprocessedClientId(rSet.getString(4)));
                oauthApp.setOauthVersion(rSet.getString(5));
                oauthApp.setCallbackUrl(rSet.getString(6));
                oauthApp.setGrantTypes(rSet.getString(7));
                oauthApp.setId(rSet.getInt(8));
                oauthApps.add(oauthApp);
            }
        }
        if (!rSetHasRows) {
            /**
             * We come here because user submitted a key that doesn't have any associated application with it.
             * We're throwing an error here because we cannot continue without this info. Otherwise it'll throw
             * a null values not supported error when it tries to cache this info
             */
            String message = "Cannot find an application associated with the given consumer key : " + appName;
            if(log.isDebugEnabled()) {
                log.debug(message);
            }
            throw new InvalidOAuthClientException(message);
        }
        connection.commit();
    } catch (SQLException e) {
        throw new IdentityOAuth2Exception("Error while retrieving the app information", e);
    } finally {
        IdentityDatabaseUtil.closeAllConnections(connection, rSet, prepStmt);
    }
    return oauthApp;
}
 

import org.wso2.carbon.identity.application.authentication.framework.model.AuthenticatedUser; //导入方法依赖的package包/类
/**
 * Registers an OAuth consumer application.
 *
 * @param application <code>OAuthConsumerAppDTO</code> with application information
 * @throws Exception Error when persisting the application information to the persistence store
 */
public void registerOAuthApplicationData(OAuthConsumerAppDTO application) throws IdentityOAuthAdminException{
    String userName = CarbonContext.getThreadLocalCarbonContext().getUsername();
    if (userName != null) {
        String tenantUser = MultitenantUtils.getTenantAwareUsername(userName);
        int tenantId = CarbonContext.getThreadLocalCarbonContext().getTenantId();
        String tenantDomain = CarbonContext.getThreadLocalCarbonContext().getTenantDomain();

        OAuthAppDAO dao = new OAuthAppDAO();
        OAuthAppDO app = new OAuthAppDO();
        if (application != null) {
            app.setApplicationName(application.getApplicationName());
            if ((application.getGrantTypes().contains(AUTHORIZATION_CODE) || application.getGrantTypes()
                    .contains(IMPLICIT)) && StringUtils.isEmpty(application.getCallbackUrl())) {
                throw new IdentityOAuthAdminException("Callback Url is required for Code or Implicit grant types");
            }
            app.setCallbackUrl(application.getCallbackUrl());
            if (application.getOauthConsumerKey() == null) {
                app.setOauthConsumerKey(OAuthUtil.getRandomNumber());
                app.setOauthConsumerSecret(OAuthUtil.getRandomNumber());
            } else {
                app.setOauthConsumerKey(application.getOauthConsumerKey());
                app.setOauthConsumerSecret(application.getOauthConsumerSecret());
            }
            String applicationUser = application.getUsername();
            if (applicationUser != null && applicationUser.trim().length() > 0) {
                try {
                    if (CarbonContext.getThreadLocalCarbonContext().getUserRealm().
                            getUserStoreManager().isExistingUser(application.getUsername())) {
                        tenantUser = applicationUser;
                    } else {
                        log.warn("OAuth application registrant user name " + applicationUser +
                                " does not exist in the user store. Using logged-in user name " + tenantUser +
                                " as registrant name");
                    }
                } catch (UserStoreException e) {
                    throw new IdentityOAuthAdminException("Error while retrieving the user store manager", e);
                }

            }
            AuthenticatedUser user = new AuthenticatedUser();
            user.setUserName(UserCoreUtil.removeDomainFromName(tenantUser));
            user.setTenantDomain(tenantDomain);
            user.setUserStoreDomain(IdentityUtil.extractDomainFromName(userName));
            app.setUser(user);
            if (application.getOAuthVersion() != null) {
                app.setOauthVersion(application.getOAuthVersion());
            } else {   // by default, assume OAuth 2.0, if it is not set.
                app.setOauthVersion(OAuthConstants.OAuthVersions.VERSION_2);
            }
            if (OAuthConstants.OAuthVersions.VERSION_2.equals(application.getOAuthVersion())) {
                List<String> allowedGrants = new ArrayList<>(Arrays.asList(getAllowedGrantTypes()));
                String[] requestGrants = application.getGrantTypes().split("\\s");
                for (String requestedGrant : requestGrants) {
                    if (StringUtils.isBlank(requestedGrant)){
                        continue;
                    }
                    if (!allowedGrants.contains(requestedGrant)) {
                        throw new IdentityOAuthAdminException(requestedGrant + " not allowed");
                    }
                }
                app.setGrantTypes(application.getGrantTypes());
            }
            dao.addOAuthApplication(app);
            if (OAuthServerConfiguration.getInstance().isCacheEnabled()) {
                appInfoCache.addToCache(app.getOauthConsumerKey(), app);
            }
        }
    }
}
 

import org.wso2.carbon.identity.application.authentication.framework.model.AuthenticatedUser; //导入方法依赖的package包/类
public List<AuthzCodeDO> getLatestAuthorizationCodesOfTenant(int tenantId) throws IdentityOAuth2Exception {

        //we do not support access token partitioning here
        Connection connection = IdentityDatabaseUtil.getDBConnection();;
        PreparedStatement ps = null;
        ResultSet rs = null;

        List<AuthzCodeDO> latestAuthzCodes = new ArrayList<>();
        try {
            String sqlQuery = SQLQueries.LIST_LATEST_AUTHZ_CODES_IN_TENANT;
            ps = connection.prepareStatement(sqlQuery);
            ps.setInt(1, tenantId);
            rs = ps.executeQuery();
            while (rs.next()) {
                String authzCodeId = rs.getString(1);
                String authzCode = rs.getString(2);
                String consumerKey = rs.getString(3);
                String authzUser = rs.getString(4);
                String[] scope = OAuth2Util.buildScopeArray(rs.getString(5));
                Timestamp issuedTime = rs.getTimestamp(6, Calendar.getInstance(TimeZone.getTimeZone(UTC)));
                long validityPeriodInMillis = rs.getLong(7);
                String callbackUrl = rs.getString(8);
                String userStoreDomain = rs.getString(9);

                AuthenticatedUser user = new AuthenticatedUser();
                user.setUserName(authzUser);
                user.setUserStoreDomain(userStoreDomain);
                user.setTenantDomain(OAuth2Util.getTenantDomain(tenantId));
                latestAuthzCodes.add(new AuthzCodeDO(user, scope, issuedTime, validityPeriodInMillis, callbackUrl,
                        consumerKey, authzCode, authzCodeId));
            }
            connection.commit();
        } catch (SQLException e) {
            IdentityDatabaseUtil.rollBack(connection);
            throw new IdentityOAuth2Exception("Error occurred while retrieving latest authorization codes of tenant " +
                    ":" + tenantId, e);
        } finally {
            IdentityDatabaseUtil.closeAllConnections(connection, rs, ps);
        }
        return latestAuthzCodes;
    }
 

import org.wso2.carbon.identity.application.authentication.framework.model.AuthenticatedUser; //导入方法依赖的package包/类
public List<AuthzCodeDO> getLatestAuthorizationCodesOfUserStore(int tenantId, String userStorDomain) throws
        IdentityOAuth2Exception {

    //we do not support access token partitioning here
    Connection connection = IdentityDatabaseUtil.getDBConnection();
    PreparedStatement ps = null;
    ResultSet rs = null;

    List<AuthzCodeDO> latestAuthzCodes = new ArrayList<>();
    try {
        String sqlQuery = SQLQueries.LIST_LATEST_AUTHZ_CODES_IN_USER_DOMAIN;
        ps = connection.prepareStatement(sqlQuery);
        ps.setInt(1, tenantId);
        ps.setString(2, userStorDomain.toUpperCase());
        rs = ps.executeQuery();
        while (rs.next()) {
            String authzCodeId = rs.getString(1);
            String authzCode = rs.getString(2);
            String consumerKey = rs.getString(3);
            String authzUser = rs.getString(4);
            String[] scope = OAuth2Util.buildScopeArray(rs.getString(5));
            Timestamp issuedTime = rs.getTimestamp(6, Calendar.getInstance(TimeZone.getTimeZone(UTC)));
            long validityPeriodInMillis = rs.getLong(7);
            String callbackUrl = rs.getString(8);

            AuthenticatedUser user = new AuthenticatedUser();
            user.setUserName(authzUser);
            user.setUserStoreDomain(userStorDomain);
            user.setTenantDomain(OAuth2Util.getTenantDomain(tenantId));
            latestAuthzCodes.add(new AuthzCodeDO(user, scope, issuedTime, validityPeriodInMillis, callbackUrl,
                    consumerKey, authzCode, authzCodeId));
        }
        connection.commit();
    } catch (SQLException e) {
        IdentityDatabaseUtil.rollBack(connection);
        throw new IdentityOAuth2Exception("Error occurred while retrieving latest authorization codes of user " +
                "store : " + userStorDomain + " in tenant :" + tenantId, e);
    } finally {
        IdentityDatabaseUtil.closeAllConnections(connection, rs, ps);
    }
    return latestAuthzCodes;
}