io.undertow.servlet.api.ServletSecurityInfo Java Examples

The following examples show how to use io.undertow.servlet.api.ServletSecurityInfo. You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example #1
Source File: ServletSecurityInfoSubstitution.java    From quarkus with Apache License 2.0 6 votes vote down vote up 
@Override
public ServletSecurityInfoProxy serialize(ServletSecurityInfo obj) {
    ServletSecurityInfoProxy sub = new ServletSecurityInfoProxy();
    sub.setEmptyRoleSemantic(obj.getEmptyRoleSemantic());
    sub.setTransportGuaranteeType(obj.getTransportGuaranteeType());
    sub.getRolesAllowed().addAll(obj.getRolesAllowed());

    for (HttpMethodSecurityInfo i : obj.getHttpMethodSecurityInfo()) {
        ServletSecurityInfoProxy ns = new ServletSecurityInfoProxy();
        ns.setTransportGuaranteeType(i.getTransportGuaranteeType());
        ns.setEmptyRoleSemantic(i.getEmptyRoleSemantic());
        ns.getRolesAllowed().addAll(i.getRolesAllowed());
        ns.setMethod(i.getMethod());
        sub.getHttpMethodSecurityInfo().add(ns);
    }
    return sub;
}
Example #2
Source File: ServletSecurityInfoSubstitution.java    From quarkus with Apache License 2.0 6 votes vote down vote up 
@Override
public ServletSecurityInfo deserialize(ServletSecurityInfoProxy obj) {
    ServletSecurityInfo sub = new ServletSecurityInfo();
    sub.setEmptyRoleSemantic(obj.getEmptyRoleSemantic());
    sub.setTransportGuaranteeType(obj.getTransportGuaranteeType());
    sub.addRolesAllowed(obj.getRolesAllowed());

    for (ServletSecurityInfoProxy i : obj.getHttpMethodSecurityInfo()) {
        HttpMethodSecurityInfo ns = new HttpMethodSecurityInfo();
        ns.setTransportGuaranteeType(i.getTransportGuaranteeType());
        ns.setEmptyRoleSemantic(i.getEmptyRoleSemantic());
        ns.addRolesAllowed(i.getRolesAllowed());
        ns.setMethod(i.getMethod());
        sub.addHttpMethodSecurityInfo(ns);
    }
    return sub;
}
Example #3
Source File: ServletContextImpl.java    From quarkus-http with Apache License 2.0 5 votes vote down vote up 
@Override
public Void run() {
    final ServletSecurity security = servletInfo.getServletClass().getAnnotation(ServletSecurity.class);
    if (security != null) {

        ServletSecurityInfo servletSecurityInfo = new ServletSecurityInfo()
                .setEmptyRoleSemantic(security.value().value() == ServletSecurity.EmptyRoleSemantic.DENY ? SecurityInfo.EmptyRoleSemantic.DENY : SecurityInfo.EmptyRoleSemantic.PERMIT)
                .setTransportGuaranteeType(security.value().transportGuarantee() == ServletSecurity.TransportGuarantee.CONFIDENTIAL ? TransportGuaranteeType.CONFIDENTIAL : TransportGuaranteeType.NONE)
                .addRolesAllowed(security.value().rolesAllowed());
        for (HttpMethodConstraint constraint : security.httpMethodConstraints()) {
            servletSecurityInfo.addHttpMethodSecurityInfo(new HttpMethodSecurityInfo()
                    .setMethod(constraint.value()))
                    .setEmptyRoleSemantic(constraint.emptyRoleSemantic() == ServletSecurity.EmptyRoleSemantic.DENY ? SecurityInfo.EmptyRoleSemantic.DENY : SecurityInfo.EmptyRoleSemantic.PERMIT)
                    .setTransportGuaranteeType(constraint.transportGuarantee() == ServletSecurity.TransportGuarantee.CONFIDENTIAL ? TransportGuaranteeType.CONFIDENTIAL : TransportGuaranteeType.NONE)
                    .addRolesAllowed(constraint.rolesAllowed());
        }
        servletInfo.setServletSecurityInfo(servletSecurityInfo);
    }
    final MultipartConfig multipartConfig = servletInfo.getServletClass().getAnnotation(MultipartConfig.class);
    if (multipartConfig != null) {
        servletInfo.setMultipartConfig(new MultipartConfigElement(multipartConfig.location(), multipartConfig.maxFileSize(), multipartConfig.maxRequestSize(), multipartConfig.fileSizeThreshold()));
    }
    final RunAs runAs = servletInfo.getServletClass().getAnnotation(RunAs.class);
    if (runAs != null) {
        servletInfo.setRunAs(runAs.value());
    }
    final DeclareRoles declareRoles = servletInfo.getServletClass().getAnnotation(DeclareRoles.class);
    if (declareRoles != null) {
        deploymentInfo.addSecurityRoles(declareRoles.value());
    }
    return null;
}
Example #4
Source File: ServletRegistrationImpl.java    From quarkus-http with Apache License 2.0 5 votes vote down vote up 
@Override
public Set<String> setServletSecurity(final ServletSecurityElement constraint) {
    if (constraint == null) {
        throw UndertowMessages.MESSAGES.argumentCannotBeNull("constraint");
    }
    DeploymentInfo deploymentInfo = deployment.getDeploymentInfo();

    //this is not super efficient, but it does not really matter
    final Set<String> urlPatterns = new HashSet<>();
    for (SecurityConstraint sc : deploymentInfo.getSecurityConstraints()) {
        for (WebResourceCollection webResources : sc.getWebResourceCollections()) {
            urlPatterns.addAll(webResources.getUrlPatterns());
        }
    }
    final Set<String> ret = new HashSet<>();
    for (String url : servletInfo.getMappings()) {
        if (urlPatterns.contains(url)) {
            ret.add(url);
        }
    }
    ServletSecurityInfo info = new ServletSecurityInfo();
    servletInfo.setServletSecurityInfo(info);
    info.setTransportGuaranteeType(constraint.getTransportGuarantee() == CONFIDENTIAL ? TransportGuaranteeType.CONFIDENTIAL : TransportGuaranteeType.NONE)
            .setEmptyRoleSemantic(emptyRoleSemantic(constraint.getEmptyRoleSemantic()))
            .addRolesAllowed(constraint.getRolesAllowed());

    for (final HttpMethodConstraintElement methodConstraint : constraint.getHttpMethodConstraints()) {
        info.addHttpMethodSecurityInfo(new HttpMethodSecurityInfo()
                .setTransportGuaranteeType(methodConstraint.getTransportGuarantee() == CONFIDENTIAL ? TransportGuaranteeType.CONFIDENTIAL : TransportGuaranteeType.NONE)
                .setMethod(methodConstraint.getMethodName())
                .setEmptyRoleSemantic(emptyRoleSemantic(methodConstraint.getEmptyRoleSemantic()))
                .addRolesAllowed(methodConstraint.getRolesAllowed()));
    }
    return ret;
}
Example #5
Source File: ServletCustomAuthTestCase.java    From quarkus-http with Apache License 2.0 5 votes vote down vote up 
@BeforeClass
public static void setup() throws ServletException {

    final PathHandler path = new PathHandler();

    final ServletContainer container = ServletContainer.Factory.newInstance();

    ServletInfo s = new ServletInfo("servlet", SendUsernameServlet.class)
            .setServletSecurityInfo(new ServletSecurityInfo()
                    .addRoleAllowed("role1"))
            .addMapping("/secured/*");

    ServletInfo s1 = new ServletInfo("loginPage", FormLoginServlet.class)
            .setServletSecurityInfo(new ServletSecurityInfo()
                    .addRoleAllowed("group1"))
            .addMapping("/FormLoginServlet");


    ServletIdentityManager identityManager = new ServletIdentityManager();
    identityManager.addUser("user1", "password1", "role1");

    DeploymentInfo builder = new DeploymentInfo()
            .setClassLoader(SimpleServletTestCase.class.getClassLoader())
            .setContextPath("/servletContext")
            .setClassIntrospecter(TestClassIntrospector.INSTANCE)
            .setDeploymentName("servletContext.war")
            .setIdentityManager(identityManager)
            .setLoginConfig(new LoginConfig("FORM", "Test Realm", "/FormLoginServlet", "/error.html"))
            .addServlets(s, s1)
            .addAuthenticationMechanism("FORM", CustomAuthenticationMechanism.FACTORY);

    DeploymentManager manager = container.addDeployment(builder);
    manager.deploy();
    path.addPrefixPath(builder.getContextPath(), manager.start());

    DefaultServer.setRootHandler(path);
}
Example #6
Source File: WelcomeFileSecurityTestCase.java    From quarkus-http with Apache License 2.0 5 votes vote down vote up 
@BeforeClass
public static void setup() throws ServletException {

    final PathHandler root = new PathHandler();
    final ServletContainer container = ServletContainer.Factory.newInstance();


    ServletIdentityManager identityManager = new ServletIdentityManager();
    identityManager.addUser("user1", "password1", "role1");


    DeploymentInfo builder = new DeploymentInfo()
            .setClassIntrospecter(TestClassIntrospector.INSTANCE)
            .setClassLoader(ServletPathMappingTestCase.class.getClassLoader())
            .setContextPath("/servletContext")
            .setDeploymentName("servletContext.war")
            .setResourceManager(new TestResourceLoader(WelcomeFileSecurityTestCase.class))
            .addWelcomePages("doesnotexist.html", "index.html", "default")
            .setIdentityManager(identityManager)
            .setLoginConfig(new LoginConfig("BASIC", "Test Realm"))
            .addServlet(
                    new ServletInfo("DefaultTestServlet", PathTestServlet.class)
                            .setServletSecurityInfo(
                                    new ServletSecurityInfo()
                                            .addRoleAllowed("role1"))
                            .addMapping("/path/default"))
            .addSecurityConstraint(new SecurityConstraint()
                    .addRoleAllowed("role1")
                    .addWebResourceCollection(new WebResourceCollection()
                            .addUrlPattern("/index.html")));


    DeploymentManager manager = container.addDeployment(builder);
    manager.deploy();
    root.addPrefixPath(builder.getContextPath(), manager.start());

    DefaultServer.setRootHandler(root);
}
Example #7
Source File: ServletContextImpl.java    From lams with GNU General Public License v2.0 5 votes vote down vote up 
@Override
public Void run() {
    final ServletSecurity security = servletInfo.getServletClass().getAnnotation(ServletSecurity.class);
    if (security != null) {

        ServletSecurityInfo servletSecurityInfo = new ServletSecurityInfo()
                .setEmptyRoleSemantic(security.value().value() == ServletSecurity.EmptyRoleSemantic.DENY ? SecurityInfo.EmptyRoleSemantic.DENY : SecurityInfo.EmptyRoleSemantic.PERMIT)
                .setTransportGuaranteeType(security.value().transportGuarantee() == ServletSecurity.TransportGuarantee.CONFIDENTIAL ? TransportGuaranteeType.CONFIDENTIAL : TransportGuaranteeType.NONE)
                .addRolesAllowed(security.value().rolesAllowed());
        for (HttpMethodConstraint constraint : security.httpMethodConstraints()) {
            servletSecurityInfo.addHttpMethodSecurityInfo(new HttpMethodSecurityInfo()
                    .setMethod(constraint.value()))
                    .setEmptyRoleSemantic(constraint.emptyRoleSemantic() == ServletSecurity.EmptyRoleSemantic.DENY ? SecurityInfo.EmptyRoleSemantic.DENY : SecurityInfo.EmptyRoleSemantic.PERMIT)
                    .setTransportGuaranteeType(constraint.transportGuarantee() == ServletSecurity.TransportGuarantee.CONFIDENTIAL ? TransportGuaranteeType.CONFIDENTIAL : TransportGuaranteeType.NONE)
                    .addRolesAllowed(constraint.rolesAllowed());
        }
        servletInfo.setServletSecurityInfo(servletSecurityInfo);
    }
    final MultipartConfig multipartConfig = servletInfo.getServletClass().getAnnotation(MultipartConfig.class);
    if (multipartConfig != null) {
        servletInfo.setMultipartConfig(new MultipartConfigElement(multipartConfig.location(), multipartConfig.maxFileSize(), multipartConfig.maxRequestSize(), multipartConfig.fileSizeThreshold()));
    }
    final RunAs runAs = servletInfo.getServletClass().getAnnotation(RunAs.class);
    if (runAs != null) {
        servletInfo.setRunAs(runAs.value());
    }
    final DeclareRoles declareRoles = servletInfo.getServletClass().getAnnotation(DeclareRoles.class);
    if (declareRoles != null) {
        deploymentInfo.addSecurityRoles(declareRoles.value());
    }
    return null;
}
Example #8
Source File: ServletRegistrationImpl.java    From lams with GNU General Public License v2.0 5 votes vote down vote up 
@Override
public Set<String> setServletSecurity(final ServletSecurityElement constraint) {
    if (constraint == null) {
        throw UndertowMessages.MESSAGES.argumentCannotBeNull("constraint");
    }
    DeploymentInfo deploymentInfo = deployment.getDeploymentInfo();

    //this is not super efficient, but it does not really matter
    final Set<String> urlPatterns = new HashSet<>();
    for (SecurityConstraint sc : deploymentInfo.getSecurityConstraints()) {
        for (WebResourceCollection webResources : sc.getWebResourceCollections()) {
            urlPatterns.addAll(webResources.getUrlPatterns());
        }
    }
    final Set<String> ret = new HashSet<>();
    for (String url : servletInfo.getMappings()) {
        if (urlPatterns.contains(url)) {
            ret.add(url);
        }
    }
    ServletSecurityInfo info = new ServletSecurityInfo();
    servletInfo.setServletSecurityInfo(info);
    info.setTransportGuaranteeType(constraint.getTransportGuarantee() == CONFIDENTIAL ? TransportGuaranteeType.CONFIDENTIAL : TransportGuaranteeType.NONE)
            .setEmptyRoleSemantic(emptyRoleSemantic(constraint.getEmptyRoleSemantic()))
            .addRolesAllowed(constraint.getRolesAllowed());

    for (final HttpMethodConstraintElement methodConstraint : constraint.getHttpMethodConstraints()) {
        info.addHttpMethodSecurityInfo(new HttpMethodSecurityInfo()
                .setTransportGuaranteeType(methodConstraint.getTransportGuarantee() == CONFIDENTIAL ? TransportGuaranteeType.CONFIDENTIAL : TransportGuaranteeType.NONE)
                .setMethod(methodConstraint.getMethodName())
                .setEmptyRoleSemantic(emptyRoleSemantic(methodConstraint.getEmptyRoleSemantic()))
                .addRolesAllowed(methodConstraint.getRolesAllowed()));
    }
    return ret;
}
Example #9
Source File: SaveOriginalPostRequestTestCase.java    From quarkus-http with Apache License 2.0 4 votes vote down vote up 
@BeforeClass
public static void setup() throws ServletException {
    final PathHandler path = new PathHandler();
    final ServletContainer container = ServletContainer.Factory.newInstance();

    ServletInfo securedRequestDumper = new ServletInfo("SecuredRequestDumperServlet", RequestDumper.class)
                                       .setServletSecurityInfo(new ServletSecurityInfo()
                                                               .addRoleAllowed("role1"))
                                       .addMapping("/secured/dumpRequest");

    ServletInfo securedIndexRequestDumper = new ServletInfo("SecuredIndexRequestDumperServlet", RequestDumper.class)
            .setServletSecurityInfo(new ServletSecurityInfo()
                    .addRoleAllowed("role1"))
            .addMapping("/index.html");
    ServletInfo unsecuredRequestDumper = new ServletInfo("UnsecuredRequestDumperServlet", RequestDumper.class)
                                         .addMapping("/dumpRequest");
    ServletInfo loginFormServlet = new ServletInfo("loginPage", FormLoginServlet.class)
                     .setServletSecurityInfo(new ServletSecurityInfo()
                                             .addRoleAllowed("group1"))
                     .addMapping("/FormLoginServlet");

    ServletIdentityManager identityManager = new ServletIdentityManager();

    identityManager.addUser("user1", "password1", "role1");

    DeploymentInfo builder = new DeploymentInfo()
                             .setClassLoader(SimpleServletTestCase.class.getClassLoader())
                             .setContextPath("/servletContext")
                             .setClassIntrospecter(TestClassIntrospector.INSTANCE)
                             .setDeploymentName("servletContext.war")
                             .setIdentityManager(identityManager)
                             .addWelcomePage("index.html")
                             .setResourceManager(new TestResourceLoader(SaveOriginalPostRequestTestCase.class))
                             .setLoginConfig(new LoginConfig("FORM", "Test Realm", "/FormLoginServlet", "/error.html"))
                             .addServlets(securedRequestDumper, unsecuredRequestDumper, loginFormServlet, securedIndexRequestDumper);

    DeploymentManager manager = container.addDeployment(builder);

    manager.deploy();

    path.addPrefixPath(builder.getContextPath(), manager.start());

    DefaultServer.setRootHandler(path);
}
Example #10
Source File: ServletFormAuthTestCase.java    From quarkus-http with Apache License 2.0 4 votes vote down vote up 
@BeforeClass
public static void setup() throws ServletException {

    final PathHandler path = new PathHandler();

    final ServletContainer container = ServletContainer.Factory.newInstance();

    ServletInfo s = new ServletInfo("servlet", SendUsernameServlet.class)
            .setServletSecurityInfo(new ServletSecurityInfo()
                    .addRoleAllowed("role1"))
            .addMapping("/secured/*");

    ServletInfo echo = new ServletInfo("echo", EchoServlet.class)
            .setServletSecurityInfo(new ServletSecurityInfo()
                    .addRoleAllowed("role1"))
            .addMapping("/secured/echo");

    ServletInfo echoParam = new ServletInfo("echoParam", RequestParamEchoServlet.class)
            .setServletSecurityInfo(new ServletSecurityInfo()
                    .addRoleAllowed("role1"))
            .addMapping("/secured/echoParam");

    ServletInfo s1 = new ServletInfo("loginPage", FormLoginServlet.class)
            .setServletSecurityInfo(new ServletSecurityInfo()
                    .addRoleAllowed("group1"))
            .addMapping("/FormLoginServlet");


    ServletIdentityManager identityManager = new ServletIdentityManager();
    identityManager.addUser("user1", "password1", "role1");

    DeploymentInfo builder = new DeploymentInfo()
            .setClassLoader(SimpleServletTestCase.class.getClassLoader())
            .setContextPath("/servletContext")
            .setClassIntrospecter(TestClassIntrospector.INSTANCE)
            .setDeploymentName("servletContext.war")
            .setAuthenticationMode(AuthenticationMode.CONSTRAINT_DRIVEN)
            .setIdentityManager(identityManager)
            .setLoginConfig(new LoginConfig("FORM", "Test Realm", "/FormLoginServlet", "/error.html"))
            .addServlets(s, s1, echo,echoParam);

    DeploymentManager manager = container.addDeployment(builder);
    manager.deploy();
    path.addPrefixPath(builder.getContextPath(), manager.start());

    DefaultServer.setRootHandler(path);
}
Example #11
Source File: ServletFormAuthURLRewriteTestCase.java    From quarkus-http with Apache License 2.0 4 votes vote down vote up 
@BeforeClass
public static void setup() throws ServletException {

    final PathHandler path = new PathHandler();

    final ServletContainer container = ServletContainer.Factory.newInstance();

    ServletInfo s = new ServletInfo("servlet", SendUsernameServlet.class)
            .setServletSecurityInfo(new ServletSecurityInfo()
                    .addRoleAllowed("role1"))
            .addMapping("/secured/*");

    ServletInfo echo = new ServletInfo("echo", EchoServlet.class)
            .setServletSecurityInfo(new ServletSecurityInfo()
                    .addRoleAllowed("role1"))
            .addMapping("/secured/echo");

    ServletInfo echoParam = new ServletInfo("echoParam", RequestParamEchoServlet.class)
            .setServletSecurityInfo(new ServletSecurityInfo()
                    .addRoleAllowed("role1"))
            .addMapping("/secured/echoParam");

    ServletInfo s1 = new ServletInfo("loginPage", FormLoginServlet.class)
            .setServletSecurityInfo(new ServletSecurityInfo()
                    .addRoleAllowed("group1"))
            .addMapping("/FormLoginServlet");


    ServletIdentityManager identityManager = new ServletIdentityManager();
    identityManager.addUser("user1", "password1", "role1");

    DeploymentInfo builder = new DeploymentInfo()
            .setServletSessionConfig(new ServletSessionConfig().setSessionTrackingModes(Collections.singleton(SessionTrackingMode.URL)))
            .setClassLoader(SimpleServletTestCase.class.getClassLoader())
            .setContextPath("/servletContext")
            .setClassIntrospecter(TestClassIntrospector.INSTANCE)
            .setDeploymentName("servletContext.war")
            .setAuthenticationMode(AuthenticationMode.CONSTRAINT_DRIVEN)
            .setIdentityManager(identityManager)
            .setLoginConfig(new LoginConfig("FORM", "Test Realm", "/FormLoginServlet", "/error.html"))
            .addServlets(s, s1, echo,echoParam);

    DeploymentManager manager = container.addDeployment(builder);
    manager.deploy();
    path.addPrefixPath(builder.getContextPath(), manager.start());

    DefaultServer.setRootHandler(path);
}
Example #12
Source File: UndertowDeploymentRecorder.java    From quarkus with Apache License 2.0 2 votes vote down vote up 
/**
 * @param sref
 * @param securityInfo
 */
public void setSecurityInfo(RuntimeValue<ServletInfo> sref, ServletSecurityInfo securityInfo) {
    sref.getValue().setServletSecurityInfo(securityInfo);
}