io.undertow.security.api.SecurityNotification Java Examples

protected void registerNotifications(final SecurityContext securityContext) {

        final NotificationReceiver logoutReceiver = new NotificationReceiver() {
            @Override
            public void handleNotification(SecurityNotification notification) {
                if (notification.getEventType() != SecurityNotification.EventType.LOGGED_OUT)
                    return;

                HttpServerExchange exchange = notification.getExchange();
                UndertowHttpFacade facade = createFacade(exchange);
                SamlDeployment deployment = deploymentContext.resolveDeployment(facade);
                SamlSessionStore sessionStore = getTokenStore(exchange, facade, deployment, securityContext);
                sessionStore.logoutAccount();
            }
        };

        securityContext.registerNotificationReceiver(logoutReceiver);
    }
 

protected void registerNotifications(final SecurityContext securityContext) {

        final NotificationReceiver logoutReceiver = new NotificationReceiver() {
            @Override
            public void handleNotification(SecurityNotification notification) {
                if (notification.getEventType() != SecurityNotification.EventType.LOGGED_OUT) return;

                HttpServerExchange exchange = notification.getExchange();
                UndertowHttpFacade facade = createFacade(exchange);
                KeycloakDeployment deployment = deploymentContext.resolveDeployment(facade);
                KeycloakSecurityContext ksc = exchange.getAttachment(OIDCUndertowHttpFacade.KEYCLOAK_SECURITY_CONTEXT_KEY);
                if (!deployment.isBearerOnly() && ksc != null && ksc instanceof RefreshableKeycloakSecurityContext) {
                    ((RefreshableKeycloakSecurityContext) ksc).logout(deployment);
                }
                AdapterTokenStore tokenStore = getTokenStore(exchange, facade, deployment, securityContext);
                tokenStore.logout();
            }
        };

        securityContext.registerNotificationReceiver(logoutReceiver);
    }
 

public List<SecurityNotification> takeNotifications() {
    try {
        return new ArrayList<>(receivedNotifications);
    } finally {
        receivedNotifications.clear();
    }
}
 

@Override
public void logout() {
    if (!isAuthenticated()) {
        return;
    }
    UndertowLogger.SECURITY_LOGGER.debugf("Logged out %s", exchange);
    sendNoticiation(new SecurityNotification(exchange, SecurityNotification.EventType.LOGGED_OUT, account, mechanismName, true,
            MESSAGES.userLoggedOut(account.getPrincipal().getName()), true));

    this.account = null;
    this.mechanismName = null;
}
 

private void sendNoticiation(final SecurityNotification notification) {
    Node<NotificationReceiver> cur = notificationReceivers;
    while (cur != null) {
        cur.item.handleNotification(notification);
        cur = cur.next;
    }
}
 

protected void authenticationComplete(Account account, String mechanism, boolean programatic, final boolean cachingRequired) {
    this.account = account;
    this.mechanismName = mechanism;

    UndertowLogger.SECURITY_LOGGER.debugf("Authenticated as %s, roles %s", account.getPrincipal().getName(), account.getRoles());
    sendNoticiation(new SecurityNotification(exchange, EventType.AUTHENTICATED, account, mechanism, programatic,
            MESSAGES.userAuthenticated(account.getPrincipal().getName()), cachingRequired));
}
 

@Override
public AuthenticationMechanismOutcome authenticate(HttpServerExchange exchange, SecurityContext securityContext) {
    Cookie cookie = exchange.getRequestCookies().get(cookieName);
    if (cookie != null) {
        final String ssoId = cookie.getValue();
        log.tracef("Found SSO cookie %s", ssoId);
        try (SingleSignOn sso = this.singleSignOnManager.findSingleSignOn(ssoId)) {
            if (sso != null) {
                if(log.isTraceEnabled()) {
                    log.tracef("SSO session with ID: %s found.", ssoId);
                }
                Account verified = getIdentityManager(securityContext).verify(sso.getAccount());
                if (verified == null) {
                    if(log.isTraceEnabled()) {
                        log.tracef("Account not found. Returning 'not attempted' here.");
                    }
                    //we return not attempted here to allow other mechanisms to proceed as normal
                    return AuthenticationMechanismOutcome.NOT_ATTEMPTED;
                }
                final Session session = getSession(exchange);
                registerSessionIfRequired(sso, session);
                securityContext.authenticationComplete(verified, sso.getMechanismName(), false);
                securityContext.registerNotificationReceiver(new NotificationReceiver() {
                    @Override
                    public void handleNotification(SecurityNotification notification) {
                        if (notification.getEventType() == SecurityNotification.EventType.LOGGED_OUT) {
                            singleSignOnManager.removeSingleSignOn(sso);
                        }
                    }
                });
                log.tracef("Authenticated account %s using SSO", verified.getPrincipal().getName());
                return AuthenticationMechanismOutcome.AUTHENTICATED;
            }
        }
        clearSsoCookie(exchange);
    }
    exchange.addResponseWrapper(responseListener);
    return AuthenticationMechanismOutcome.NOT_ATTEMPTED;
}
 

@Override
public void handleNotification(SecurityNotification notification) {
    EventType eventType = notification.getEventType();
    HttpServerExchange exchange = notification.getExchange();
    SessionManager sessionManager = exchange.getAttachment(SessionManager.ATTACHMENT_KEY);
    SessionConfig sessionConfig = exchange.getAttachment(SessionConfig.ATTACHMENT_KEY);
    if (sessionManager == null || sessionConfig == null) {
        return;
    }
    Session httpSession = sessionManager.getSession(exchange, sessionConfig);
    switch (eventType) {
        case AUTHENTICATED:
            if (isCacheable(notification)) {
                if (httpSession == null) {
                    httpSession = sessionManager.createSession(exchange, sessionConfig);
                }

                // It is normal for this notification to be received when using a previously cached session - in that
                // case the IDM would have been given an opportunity to re-load the Account so updating here ready for
                // the next request is desired.
                httpSession.setAttribute(ATTRIBUTE_NAME,
                        new AuthenticatedSession(notification.getAccount(), notification.getMechanism()));
            }
            break;
        case LOGGED_OUT:
            if (httpSession != null) {
                httpSession.removeAttribute(ATTRIBUTE_NAME);
                httpSession.removeAttribute(NO_ID_CHANGE_REQUIRED);
            }
            break;
    }
}
 

protected static void assertNotifiactions(final SecurityNotification.EventType ... eventTypes) {
    List<SecurityNotification> notifications = auditReceiver.takeNotifications();
    assertEquals("A single notification is expected.", eventTypes.length, notifications.size());
    final List<SecurityNotification.EventType> types = new ArrayList<>();
    for(SecurityNotification i : notifications) {
        types.add(i.getEventType());
    }
    assertEquals("Expected EventType not matched.", Arrays.asList(eventTypes), types);
}
 

@Override
public void logout() {
    if (!isAuthenticated()) {
        return;
    }
    UndertowLogger.SECURITY_LOGGER.debugf("Logged out %s", exchange);
    sendNoticiation(new SecurityNotification(exchange, SecurityNotification.EventType.LOGGED_OUT, account, mechanismName, true,
            MESSAGES.userLoggedOut(account.getPrincipal().getName()), true));

    this.account = null;
    this.mechanismName = null;
}
 

private void sendNoticiation(final SecurityNotification notification) {
    Node<NotificationReceiver> cur = notificationReceivers;
    while (cur != null) {
        cur.item.handleNotification(notification);
        cur = cur.next;
    }
}
 

protected void authenticationComplete(Account account, String mechanism, boolean programatic, final boolean cachingRequired) {
    this.account = account;
    this.mechanismName = mechanism;

    UndertowLogger.SECURITY_LOGGER.debugf("Authenticated as %s, roles %s", account.getPrincipal().getName(), account.getRoles());
    sendNoticiation(new SecurityNotification(exchange, EventType.AUTHENTICATED, account, mechanism, programatic,
            MESSAGES.userAuthenticated(account.getPrincipal().getName()), cachingRequired));
}
 

@Override
public AuthenticationMechanismOutcome authenticate(HttpServerExchange exchange, SecurityContext securityContext) {
    Cookie cookie = exchange.getRequestCookies().get(cookieName);
    if (cookie != null) {
        final String ssoId = cookie.getValue();
        log.tracef("Found SSO cookie %s", ssoId);
        try (SingleSignOn sso = this.singleSignOnManager.findSingleSignOn(ssoId)) {
            if (sso != null) {
                if (log.isTraceEnabled()) {
                    log.tracef("SSO session with ID: %s found.", ssoId);
                }
                Account verified = getIdentityManager(securityContext).verify(sso.getAccount());
                if (verified == null) {
                    if (log.isTraceEnabled()) {
                        log.tracef("Account not found. Returning 'not attempted' here.");
                    }
                    //we return not attempted here to allow other mechanisms to proceed as normal
                    return AuthenticationMechanismOutcome.NOT_ATTEMPTED;
                }
                final Session session = getSession(exchange);
                registerSessionIfRequired(sso, session);
                securityContext.authenticationComplete(verified, sso.getMechanismName(), false);
                securityContext.registerNotificationReceiver(new NotificationReceiver() {
                    @Override
                    public void handleNotification(SecurityNotification notification) {
                        if (notification.getEventType() == SecurityNotification.EventType.LOGGED_OUT) {
                            singleSignOnManager.removeSingleSignOn(sso);
                        }
                    }
                });
                log.tracef("Authenticated account %s using SSO", verified.getPrincipal().getName());
                return AuthenticationMechanismOutcome.AUTHENTICATED;
            }
        }
        clearSsoCookie(exchange);
    }
    exchange.addResponseCommitListener(responseListener);
    return AuthenticationMechanismOutcome.NOT_ATTEMPTED;
}
 

@Override
public void handleNotification(SecurityNotification notification) {
    EventType eventType = notification.getEventType();
    HttpServerExchange exchange = notification.getExchange();
    SessionManager sessionManager = exchange.getAttachment(SessionManager.ATTACHMENT_KEY);
    SessionConfig sessionConfig = exchange.getAttachment(SessionConfig.ATTACHMENT_KEY);
    if (sessionManager == null || sessionConfig == null) {
        return;
    }
    Session httpSession = sessionManager.getSession(exchange, sessionConfig);
    switch (eventType) {
        case AUTHENTICATED:
            if (isCacheable(notification)) {
                if (httpSession == null) {
                    httpSession = sessionManager.createSession(exchange, sessionConfig);
                }

                // It is normal for this notification to be received when using a previously cached session - in that
                // case the IDM would have been given an opportunity to re-load the Account so updating here ready for
                // the next request is desired.
                httpSession.setAttribute(ATTRIBUTE_NAME,
                        new AuthenticatedSession(notification.getAccount(), notification.getMechanism()));
            }
            break;
        case LOGGED_OUT:
            if (httpSession != null) {
                httpSession.removeAttribute(ATTRIBUTE_NAME);
                httpSession.removeAttribute(NO_ID_CHANGE_REQUIRED);
            }
            break;
    }
}
 

protected static void assertSingleNotificationType(final SecurityNotification.EventType eventType) {
    List<SecurityNotification> notifications = auditReceiver.takeNotifications();
    assertEquals("A single notification is expected.", 1, notifications.size());
    assertEquals("Expected EventType not matched.", eventType, notifications.get(0).getEventType());
}
 

@Override
public void handleNotification(SecurityNotification notification) {
    receivedNotifications.add(notification);
}
 

private boolean isCacheable(final SecurityNotification notification) {
    return notification.isProgramatic() || notification.isCachingRequired();
}
 

private boolean isCacheable(final SecurityNotification notification) {
    return notification.isProgramatic() || notification.isCachingRequired();
}
 

@Override
public void authenticationFailed(String message, String mechanism) {
    UndertowLogger.SECURITY_LOGGER.debugf("Authentication failed with message %s and mechanism %s for %s", message, mechanism, exchange);
    sendNoticiation(new SecurityNotification(exchange, EventType.FAILED_AUTHENTICATION, null, mechanism, false, message, true));
}
 

@Override
public void authenticationFailed(String message, String mechanism) {
    UndertowLogger.SECURITY_LOGGER.debugf("Authentication failed with message %s and mechanism %s for %s", message, mechanism, exchange);
    sendNoticiation(new SecurityNotification(exchange, EventType.FAILED_AUTHENTICATION, null, mechanism, false, message, true));
}
 

private boolean isCacheable(final SecurityNotification notification) {
    return notification.isProgramatic() || notification.isCachingRequired();
}
 

private boolean isCacheable(final SecurityNotification notification) {
    return notification.isProgramatic() || notification.isCachingRequired();
}