Java Authentications類代碼示例

import org.camunda.bpm.webapp.impl.security.auth.Authentications; //導入依賴的package包/類
@Override
protected void doLogin(Authentications authentications, String username, String engineName) {
  // initialize with null, to allow fall back to identity service, if nothing provided by container
  List<String> groupIds = null;

  // get user's groups
  AccessControlContext acc = AccessController.getContext();
  Subject subject = Subject.getSubject(acc);
  if (subject != null) {
    Set<Principal> groupPrincipals = subject.getPrincipals();
    if (groupPrincipals != null && !groupPrincipals.isEmpty()) {
      // transform into array of strings:
      groupIds = new ArrayList<String>();
      for (Principal groupPrincipal : groupPrincipals) {
        groupIds.add(groupPrincipal.getName());
      }
    }
  }

  new ContainerBasedUserAuthenticationResource().doLogin(engineName, username, authentications, groupIds);
}
 

import org.camunda.bpm.webapp.impl.security.auth.Authentications; //導入依賴的package包/類
protected void setKnownPrinicipal(final HttpServletRequest request, Authentications authentications) {
  String username = getUserName(request);
  if (username != null && !username.isEmpty()) {
    for (Authentication auth : authentications.getAuthentications()) {
      if (username.equals(auth.getName())) {
        // already in the list - nothing to do
        LOGGER.fine(request.getSession().getId() + " already authorized.");
        return;
      }
    }
    String engineName = getEngineName(request);
    
    doLogin(authentications, username, engineName);
    
    LOGGER.fine(request.getSession().getId() + " " + username + " " + engineName);
  } else {
    LOGGER.fine(request.getSession().getId() + " no user provided from application server!");
  }
}
 

import org.camunda.bpm.webapp.impl.security.auth.Authentications; //導入依賴的package包/類
/**
 * This method is a copy of {@link org.camunda.bpm.webapp.impl.security.auth.AuthenticationFilter#doFilter(ServletRequest, ServletResponse, FilterChain)}
 * except for the invocation of {@link #setKnownPrinicipal(ServletRequest, Authentications)}.
 * 
 * It should be kept in sync with the latest version from Camunda,
 * e.g. by doing a diff between the Java files.
 */
@Override
public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain) throws IOException, ServletException {
    final HttpServletRequest req = (HttpServletRequest) request;

    // get authentication from session
    Authentications authentications = Authentications.getFromSession(req.getSession());
    setKnownPrinicipal(req, authentications);
    Authentications.setCurrent(authentications);
    try {

        SecurityActions.runWithAuthentications(new SecurityAction<Void>() {
            public Void execute() throws IOException, ServletException {
                chain.doFilter(request, response);
                return null;
            }
        }, authentications);
    } finally {
        Authentications.clearCurrent();
        Authentications.updateSession(req.getSession(), authentications);
    }

}
 

import org.camunda.bpm.webapp.impl.security.auth.Authentications; //導入依賴的package包/類
public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain) throws IOException, ServletException {
	final HttpServletRequest req = (HttpServletRequest) request;

	// get authentication from session
	Authentications authentications = Authentications.getFromSession(req.getSession());

	// This function is added to the normal AuthenticationFilter
	setAutoLoginAuthentication(request, authentications);

	// set current authentication to the one restored from session (maybe
	// auto login was added)
	Authentications.setCurrent(authentications);

	try {

		SecurityActions.runWithAuthentications(new SecurityAction<Void>() {
			public Void execute() {
				try {
					chain.doFilter(request, response);
				} catch (Exception e) {
					throw new RuntimeException(e);
				}
				return null;
			}
		}, authentications);
	} finally {
		Authentications.clearCurrent();
		// store updated authentication object in session for next request
		Authentications.updateSession(req.getSession(), authentications);
	}
}
 

import org.camunda.bpm.webapp.impl.security.auth.Authentications; //導入依賴的package包/類
private String getCurrentUserId(HttpSession session) {
    Authentications authentications = (Authentications) session.getAttribute("authenticatedUser");
    return authentications.getAuthentications().get(0).getIdentityId();
}
 

import org.camunda.bpm.webapp.impl.security.auth.Authentications; //導入依賴的package包/類
/**
 * Reads the auto-login-username from the URL parameters and create an
 * {@link Authentication} for it containing its groups, tenants and
 * authorized apps.
 * 
 * No password check is done here, so you can log onto every user without a
 * password. Only makes sense in demo environments!
 */
protected void setAutoLoginAuthentication(final ServletRequest request, Authentications authentications) {
	final HttpServletRequest req = (HttpServletRequest) request;
	final ProcessEngine engine = getEngine();

	// Get the username from the user in SSO
	String username = retrieveUsername(req);

	// if not set - no auto login
	if (username == null) {
		return;
	}

	// if already in the list of logged in users - nothing to do
	Authentication authentication = authentications.getAuthenticationForProcessEngine(engine.getName());
	if (authentication != null && authentication.getName() == username) {
		return;
	}

	AuthorizationService authorizationService = engine.getAuthorizationService();

	// query group information
	List<String> groupIds = getGroupsOfUser(engine, username);
	List<String> tenantIds = getTenantsOfUser(engine, username);

	// check user's app authorizations by iterating of list of apps and ask
	// if permitted
	HashSet<String> authorizedApps = new HashSet<String>();
	authorizedApps.add("admin");
	if (engine.getProcessEngineConfiguration().isAuthorizationEnabled()) {
		for (String application : APPS) {
			if (authorizationService.isUserAuthorized(username, groupIds, ACCESS, APPLICATION, application)) {
				authorizedApps.add(application);
			}
		}
	} else {
		Collections.addAll(authorizedApps, APPS);
	}

	// create new authentication object to store authentication
	UserAuthentication newAuthentication = new UserAuthentication(username, engine.getName());
	newAuthentication.setGroupIds(groupIds);
	newAuthentication.setTenantIds(tenantIds);
	newAuthentication.setAuthorizedApps(authorizedApps);

	// and add the new logged in user
	authentications.addAuthentication(newAuthentication);
}
 

import org.camunda.bpm.webapp.impl.security.auth.Authentications; //導入依賴的package包/類
/**
 * Login a user that has already been authenticated and
 * optionally provide its groups.
 *
 * This method is a copy of {@link UserAuthenticationResource#doLogin(String, String, String, String)}
 * except that it neither checks the password nor for application permissions
 * and works on a given list of authentications.
 * 
 * The password (or any other proof of identity) MUST be checked by the
 * application server before it passes the request to the application.
 * 
 * Application permissions are checked by the applications themselves.
 * 
 * It should be kept in sync with the latest version from Camunda,
 * e.g. by doing a diff between the Java files.
 * Hint: Ignore whitespace when doing the diff.
 *
 * @param engineName Name of the engine to login to
 * @param username Id of the authenticated user
 * @param authentications Current authentications from the session
 * @param groupIds Groups of the authenticated user
 *   If groupIds is null, they will be retrieved from the {@link IdentityService}.
 */
public void doLogin(
    String engineName,
    String username,
    Authentications authentications,
    List<String> groupIds) {

  final ProcessEngine processEngine = lookupProcessEngine(engineName);
  if(processEngine == null) {
    throw new InvalidRequestException(Status.BAD_REQUEST, "Process engine with name "+engineName+" does not exist");
  }

  // make sure authentication is executed without authentication :)
  processEngine.getIdentityService().clearAuthentication();

  if (groupIds == null)
    groupIds = getGroupsOfUser(processEngine, username);
  List<String> tenantIds = getTenantsOfUser(processEngine, username);

  // check user's app authorizations
  AuthorizationService authorizationService = processEngine.getAuthorizationService();

  HashSet<String> authorizedApps = new HashSet<String>();
  authorizedApps.add("welcome");

  if (processEngine.getProcessEngineConfiguration().isAuthorizationEnabled()) {
    for (String application: APPS) {
      if (isAuthorizedForApp(authorizationService, username, groupIds, application)) {
        authorizedApps.add(application);
      }
    }

  } else {
    Collections.addAll(authorizedApps, APPS);
  }

  // create new authentication
  UserAuthentication newAuthentication = new UserAuthentication(username, engineName);
  newAuthentication.setGroupIds(groupIds);
  newAuthentication.setTenantIds(tenantIds);
  newAuthentication.setAuthorizedApps(authorizedApps);
  authentications.addAuthentication(newAuthentication);
}
 

import org.camunda.bpm.webapp.impl.security.auth.Authentications; //導入依賴的package包/類
protected void doLogin(Authentications authentications, String username, String engineName) {
  new ContainerBasedUserAuthenticationResource().doLogin(engineName, username, authentications);
}