org.jboss.security.SecurityContextAssociation Java Examples

public void push(Principal principal, Object credential, Subject subject,
      String securityDomain)
{
   //SecurityAssociation.pushSubjectContext(subject, principal, credential);
   SecurityContext sc = SecurityContextAssociation.getSecurityContext();
   if(sc == null)
   {
      try
      {
         sc = SecurityContextFactory.createSecurityContext(principal, credential,
               subject, securityDomain);
      }
      catch (Exception e)
      {
         throw new RuntimeException(e);
      }
   }
   else
   {
      sc.getUtil().createSubjectInfo(principal, credential, subject); 
   }
   SecurityContextAssociation.setSecurityContext(sc); 
}
 

/**
 * {@inheritDoc}
 */
public void setSecurityContext(org.jboss.jca.core.spi.security.SecurityContext context)
{
   if (context == null)
   {
      SecurityContextAssociation.setSecurityContext(null);
   }
   else if (context instanceof PicketBoxSecurityContext)
   {
      PicketBoxSecurityContext psc = (PicketBoxSecurityContext)context;
      SecurityContextAssociation.setSecurityContext(psc.getDelegator());
   }
   else
   {
      throw new IllegalArgumentException("Invalid SecurityContext: " + context);
   }
}
 

/**
 * {@inheritDoc}
 */
public void setSecurityContext(org.ironjacamar.core.spi.security.SecurityContext context)
{
   if (context == null)
   {
      SecurityContextAssociation.setSecurityContext(null);
   }
   else if (context instanceof PicketBoxSecurityContext)
   {
      PicketBoxSecurityContext psc = (PicketBoxSecurityContext)context;
      SecurityContextAssociation.setSecurityContext(psc.getDelegator());
   }
   else
   {
      throw new IllegalArgumentException("Invalid SecurityContext: " + context);
   }
}
 

public void push(Principal principal, Object credential, Subject subject,
      String securityDomain)
{
   //SecurityAssociation.pushSubjectContext(subject, principal, credential);
   SecurityContext sc = SecurityContextAssociation.getSecurityContext();
   if(sc == null)
   {
      try
      {
         sc = SecurityContextFactory.createSecurityContext(principal, credential,
               subject, securityDomain);
      }
      catch (Exception e)
      {
         throw new RuntimeException(e);
      }
   }
   else
   {
      sc.getUtil().createSubjectInfo(principal, credential, subject); 
   }
   SecurityContextAssociation.setSecurityContext(sc); 
}
 

/** Get the currently authenticated Subject. This is a thread local
 property shared across all JaasSecurityManager instances.
 @return The Subject authenticated in the current thread if one
 exists, null otherwise.
 */
public Subject getActiveSubject()
{
   /* This does not use SubjectActions.getActiveSubject since the caller
      must have the correct permissions to access the
      SecurityAssociation.getSubject method.
   */
   //return SecurityAssociation.getSubject();
   Subject subj = null;
   SecurityContext sc = SecurityContextAssociation.getSecurityContext();
   if(sc != null)
   {
      subj = sc.getUtil().getSubject();
   }
   return subj;
}
 

static void setSecurityContext(final SecurityContext sc)
{
   AccessController.doPrivileged(new PrivilegedAction<Object>()
   {
      public Object run()
      {
         SecurityContextAssociation.setSecurityContext(sc);
         return null;
      }
   });
}
 

public void push(final Principal principal, final Object credential,
   final Subject subject, final String securityDomain) 
{
   AccessController.doPrivileged(
      new PrivilegedAction<Object>()
      {
         public Object run()
         {
            //SecurityAssociation.pushSubjectContext(subject, principal, credential);
            SecurityContext sc = SecurityContextAssociation.getSecurityContext();
            if(sc == null)
            {
               try
               {
                  sc = SecurityContextFactory.createSecurityContext(principal, credential,
                        subject, securityDomain);
               }
               catch (Exception e)
               {
                  throw new RuntimeException(e);
               }
            }
            SecurityContextAssociation.setSecurityContext(sc);
            return null;
         }
      }
   );
}
 

static SecurityContext getSecurityContext()
{ 
   return AccessController.doPrivileged(new PrivilegedAction<SecurityContext>(){

      public SecurityContext run()
      {   
         return SecurityContextAssociation.getSecurityContext();
      }});
}
 

static void setSecurityContext(final SecurityContext sc)
{ 
   AccessController.doPrivileged(new PrivilegedAction<SecurityContext>(){

      public SecurityContext run()
      { 
         SecurityContextAssociation.setSecurityContext(sc);
         return null;
      }});
}
 

static void setSecurityContext(final SecurityContext sc)
{
   AccessController.doPrivileged(new PrivilegedAction<Object>()
   {
      public Object run()
      {
         SecurityContextAssociation.setSecurityContext(sc);
         return null;
      }
   });
}
 

static SecurityContext getSecurityContext() throws PrivilegedActionException
{
   return AccessController.doPrivileged(new PrivilegedExceptionAction<SecurityContext>()
   {
      public SecurityContext run() throws Exception
      {
         return SecurityContextAssociation.getSecurityContext();
      }
   });
}
 

public void pop()
{
   AccessController.doPrivileged(
      new PrivilegedAction<Object>()
      {
         public Object run()
         {
            //SecurityAssociation.popSubjectContext();
            SecurityContextAssociation.clearSecurityContext();
            return null;
         }
      }
   );
}
 

/**
 * Extract the Authorization header and validate the bearer token if it exists. If it does, and is validated, this
 * builds the org.jboss.security.SecurityContext authenticated Subject that drives the container APIs as well as
 * the authorization layers.
 *
 * @param exchange        - the http request exchange object
 * @param securityContext - the current security context that
 * @return one of AUTHENTICATED, NOT_AUTHENTICATED or NOT_ATTEMPTED depending on the header and authentication outcome.
 */
@SuppressWarnings("deprecation")
@Override
public AuthenticationMechanismOutcome authenticate(HttpServerExchange exchange, SecurityContext securityContext) {
    String jwtToken = new UndertowBearerTokenExtractor(authContextInfo, exchange).getBearerToken();
    if (jwtToken != null) {
        try {
            identityManager = securityContext.getIdentityManager();
            JWTCredential credential = new JWTCredential(jwtToken, authContextInfo);
            // Install the JWT principal as the caller
            Account account = identityManager.verify(credential.getName(), credential);
            if (account != null) {
                JsonWebToken jwtPrincipal = (JsonWebToken) account.getPrincipal();
                preparePrincipalProducer(jwtPrincipal);
                securityContext.authenticationComplete(account, "MP-JWT", false);
                // Workaround authenticated JWTPrincipal not being installed as user principal
                // https://issues.jboss.org/browse/WFLY-9212
                org.jboss.security.SecurityContext jbSC = SecurityContextAssociation.getSecurityContext();
                Subject subject = jbSC.getUtil().getSubject();
                jbSC.getUtil().createSubjectInfo(jwtPrincipal, jwtToken, subject);
                RoleGroup roles = extract(subject);
                jbSC.getUtil().setRoles(roles);
                UndertowLogger.SECURITY_LOGGER.debugf("Authenticated caller(%s) for path(%s) with roles: %s",
                        credential.getName(), exchange.getRequestPath(), account.getRoles());
                return AuthenticationMechanismOutcome.AUTHENTICATED;
            } else {
                UndertowLogger.SECURITY_LOGGER.info("Failed to authenticate JWT bearer token");
                return AuthenticationMechanismOutcome.NOT_AUTHENTICATED;
            }
        } catch (Exception e) {
            UndertowLogger.SECURITY_LOGGER.infof(e, "Failed to validate JWT bearer token");
            return AuthenticationMechanismOutcome.NOT_AUTHENTICATED;
        }
    }

    // No suitable header has been found in this request,
    return AuthenticationMechanismOutcome.NOT_ATTEMPTED;
}
 

@Override
public Boolean get() {
    if (WildFlySecurityManager.isChecking()) {
        return doPrivileged((PrivilegedAction<Boolean>) () -> SecurityContextAssociation.getSecurityContext() != null);
    } else {
        return SecurityContextAssociation.getSecurityContext() != null;
    }
}
 

/**
 * {@inheritDoc}
 */
public org.ironjacamar.core.spi.security.SecurityContext getSecurityContext()
{
   org.jboss.security.SecurityContext sc = SecurityContextAssociation.getSecurityContext();

   if (sc == null)
      return null;

   return new PicketBoxSecurityContext(sc);
}
 

public static void propagateSessionInfo(KeycloakAccount account) {
    Subject subject = new Subject();
    Set<Principal> principals = subject.getPrincipals();
    principals.add(account.getPrincipal());
    Group[] roleSets = getRoleSets(account.getRoles());
    for (int g = 0; g < roleSets.length; g++) {
        Group group = roleSets[g];
        String name = group.getName();
        Group subjectGroup = createGroup(name, principals);
        if (subjectGroup instanceof NestableGroup) {
            /* A NestableGroup only allows Groups to be added to it so we
            need to add a SimpleGroup to subjectRoles to contain the roles
            */
            SimpleGroup tmp = new SimpleGroup("Roles");
            subjectGroup.addMember(tmp);
            subjectGroup = tmp;
        }
        // Copy the group members to the Subject group
        Enumeration<? extends Principal> members = group.members();
        while (members.hasMoreElements()) {
            Principal role = (Principal) members.nextElement();
            subjectGroup.addMember(role);
        }
    }
    // add the CallerPrincipal group if none has been added in getRoleSets
    Group callerGroup = new SimpleGroup(SecurityConstants.CALLER_PRINCIPAL_GROUP);
    callerGroup.addMember(account.getPrincipal());
    principals.add(callerGroup);
    org.jboss.security.SecurityContext sc = SecurityContextAssociation.getSecurityContext();
    Principal userPrincipal = getPrincipal(subject);
    sc.getUtil().createSubjectInfo(userPrincipal, account, subject);
}
 

public static void propagateSessionInfo(KeycloakAccount account) {
    Subject subject = new Subject();
    Set<Principal> principals = subject.getPrincipals();
    principals.add(account.getPrincipal());
    Group[] roleSets = getRoleSets(account.getRoles());
    for (int g = 0; g < roleSets.length; g++) {
        Group group = roleSets[g];
        String name = group.getName();
        Group subjectGroup = createGroup(name, principals);
        if (subjectGroup instanceof NestableGroup) {
            /* A NestableGroup only allows Groups to be added to it so we
            need to add a SimpleGroup to subjectRoles to contain the roles
            */
            SimpleGroup tmp = new SimpleGroup("Roles");
            subjectGroup.addMember(tmp);
            subjectGroup = tmp;
        }
        // Copy the group members to the Subject group
        Enumeration<? extends Principal> members = group.members();
        while (members.hasMoreElements()) {
            Principal role = (Principal) members.nextElement();
            subjectGroup.addMember(role);
        }
    }
    // add the CallerPrincipal group if none has been added in getRoleSets
    Group callerGroup = new SimpleGroup(SecurityConstants.CALLER_PRINCIPAL_GROUP);
    callerGroup.addMember(account.getPrincipal());
    principals.add(callerGroup);
    org.jboss.security.SecurityContext sc = SecurityContextAssociation.getSecurityContext();
    Principal userPrincipal = getPrincipal(subject);
    sc.getUtil().createSubjectInfo(userPrincipal, account, subject);
}
 

/**
 * Set the vm wide association of security context
 * (Default : false)s
 * @param vmwideAssociation
 */
public void setVmwideAssociation(boolean vmwideAssociation)
{
   this.vmwideAssociation = vmwideAssociation;
   if(vmwideAssociation)
      SecurityContextAssociation.setClient();
}
 

@Override
public void modifyHandshake(ServerEndpointConfig sec, HandshakeRequest request, HandshakeResponse response) {
    super.modifyHandshake(sec, request, response);
    
    sec.getUserProperties().put(WebsocketSecurityInterceptor.SESSION_PRINCIPAL, request.getUserPrincipal());
    sec.getUserProperties().put(WebsocketSecurityInterceptor.SESSION_SUBJECT, SecurityContextAssociation.getSubject());
    sec.getUserProperties().put(WebsocketSecurityInterceptor.SESSION_CREDENTIAL, SecurityContextAssociation.getPrincipal());
    Map<String,List<String>> headers = request.getHeaders();
    if (headers != null) {
        List<String> loginHeader = headers.get(REQUEST_LOGIN_TIME_HEADER);
        if (loginHeader != null && !loginHeader.isEmpty()) {
            sec.getUserProperties().put(REQUEST_LOGIN_TIME_HEADER, loginHeader.get(0));
        }
    }
}
 

/**
 * {@inheritDoc}
 */
public org.jboss.jca.core.spi.security.SecurityContext getSecurityContext()
{
   org.jboss.security.SecurityContext sc = SecurityContextAssociation.getSecurityContext();

   if (sc == null)
      return null;

   return new PicketBoxSecurityContext(sc);
}
 

static SecurityContext getSecurityContext()
{
   return AccessController.doPrivileged(new PrivilegedAction<SecurityContext>()
   {

      public SecurityContext run()
      {
         return SecurityContextAssociation.getSecurityContext();
      }
   });
}
 

/**
 * Push the run as role using the SecurityAssociation.pushRunAsIdentity method
 * @see SecurityContextAssociation#pushRunAsIdentity(org.jboss.security.RunAs)
 */
public boolean login()
{
   RunAsIdentity runAsRole = new RunAsIdentity(roleName, principalName);
   SecurityContextAssociation.pushRunAsIdentity(runAsRole);
   pushedRole = true;
   return true;
}
 

/**
 * Pop the run as role using the SecurityAssociation.popRunAsIdentity method
 * @see SecurityContextAssociation#popRunAsIdentity()
 */
public boolean abort()
{
   if( pushedRole == false )
      return false;

   SecurityContextAssociation.popRunAsIdentity();
   return true;
}
 

static SecurityContext getCurrentSecurityContext()
 {
    return AccessController.doPrivileged( new PrivilegedAction<SecurityContext>() 
    {

public SecurityContext run() 
{
	return SecurityContextAssociation.getSecurityContext();
}
    });
 }
 

public Object run()
{
   //Set it on the current security context also
   SecurityContext sc = SecurityContextAssociation.getSecurityContext();
   if(sc != null)
   {
      sc.getData().put(key, value);
   }
   return SecurityContextAssociation.setContextInfo(key, value);
}
 

public Object run()
{
   //Set it on the current security context also
   SecurityContext sc = SecurityContextAssociation.getSecurityContext();
   if(sc != null)
   {
      sc.getData().put(key, value);
   }
   return SecurityContextAssociation.setContextInfo(key, value);
}
 

public void push(final Principal principal, final Object credential,
   final Subject subject, final String securityDomain) 
{
   AccessController.doPrivileged(
      new PrivilegedAction<Object>()
      {
         public Object run()
         {
            SecurityContext sc = SecurityContextAssociation.getSecurityContext();
            if(sc == null)
            {
               try
               {
                  sc = SecurityContextFactory.createSecurityContext(principal, credential,
                        subject, securityDomain);
               }
               catch (Exception e)
               {
                  throw new RuntimeException(e);
               }
            }
            SecurityContextAssociation.setSecurityContext(sc);
            return null;
         }
      }
   );
}
 

public void pop()
{
   AccessController.doPrivileged(
      new PrivilegedAction<Object>()
      {
         public Object run()
         {
            //SecurityAssociation.popSubjectContext();
            SecurityContextAssociation.clearSecurityContext();
            return null;
         }
      }
   );
}
 

public Principal run()
{
   return SecurityContextAssociation.getPrincipal();
}
 

public RunAs peek()
{
   return SecurityContextAssociation.peekRunAsIdentity();
}