private String getCurrentUsername() { Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal(); if (principal instanceof UserDetails) { return ((UserDetails) principal).getUsername(); } if (principal instanceof Principal) { return ((Principal) principal).getName(); } return String.valueOf(principal); }
@Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException { String authHeader = request.getHeader(this.tokenHeader); if (authHeader != null && authHeader.startsWith(this.tokenHead)) { String authToken = authHeader.substring(this.tokenHead.length());// The part after "Bearer " String username = jwtTokenUtil.getUserNameFromToken(authToken); LOGGER.info("checking username:{}", username); if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) { UserDetails userDetails = this.userDetailsService.loadUserByUsername(username); if (jwtTokenUtil.validateToken(authToken, userDetails)) { UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities()); authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request)); LOGGER.info("authenticated user:{}", username); SecurityContextHolder.getContext().setAuthentication(authentication); } } } chain.doFilter(request, response); } }
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { UserDetails user = users.get(username.toLowerCase()); if (user == null) { throw new UsernameNotFoundException(username); } return new User(user.getUsername(), user.getPassword(), user.isEnabled(), user.isAccountNonExpired(), user.isCredentialsNonExpired(), user.isAccountNonLocked(), user.getAuthorities()); }
public void setValues(PreparedStatement ps) throws SQLException { ps.setString(1, user.getPassword()); ps.setBoolean(2, user.isEnabled()); ps.setString(3, user.getUsername()); } });
private void insertUserAuthorities(UserDetails user) { for (GrantedAuthority auth : user.getAuthorities()) { getJdbcTemplate().update(createAuthoritySql, user.getUsername(), auth.getAuthority()); } }
SecurityContextHolder.getContext().setAuthentication(null); MockFilterChain chain = new MockFilterChain(); chain = new MockFilterChain(); clientDigestString(tmp, testUserName, testPassword, request.getMethod()); request.addHeader("Authorization", headerValue); getProxy().doFilter(request, response, chain); assertEquals(HttpServletResponse.SC_OK, response.getStatus()); .SPRING_SECURITY_CONTEXT_KEY); assertNotNull(ctx); Authentication auth = ctx.getAuthentication(); assertNotNull(auth); assertNull(SecurityContextHolder.getContext().getAuthentication()); checkForAuthenticatedRole(auth); assertEquals(testUserName, ((UserDetails) auth.getPrincipal()).getUsername()); assertTrue(auth.getAuthorities().contains(new GeoServerRole(rootRole))); assertTrue(auth.getAuthorities().contains(new GeoServerRole(derivedRole))); chain = new MockFilterChain(); assertEquals(testUserName, ((UserDetails) auth.getPrincipal()).getUsername());
@Secured("IS_AUTHENTICATED_FULLY") @RequestMapping(path = "/whoami/roles", method = RequestMethod.GET) public List<String> user() { UserDetails userDetails = (UserDetails) SecurityContextHolder.getContext(). getAuthentication().getPrincipal(); return userDetails.getAuthorities().stream().map(ga -> ga.getAuthority()).collect(Collectors.toList()); } }
@RequestMapping(value = "/api/info", method = { RequestMethod.GET }) public AuthenticationToken info() { final String username = SecurityContextHolder.getContext().getAuthentication().getName(); final UserDetails details = this.userDetailsService.loadUserByUsername(username); final List<String> roles = new ArrayList<>(); for (GrantedAuthority authority : details.getAuthorities()) { roles.add(authority.toString()); } return new AuthenticationToken(details.getUsername(), roles); }
@RequestMapping(value = "/login", method = RequestMethod.POST) @ResponseBody public ResponseEntity<MemberAuthToken> login(@RequestParam String id, @RequestParam String password, HttpServletRequest request) { UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(id, password); Authentication authentication = this.authenticationManager.authenticate(token); SecurityContextHolder.getContext().setAuthentication(authentication); HttpSession session = request.getSession(true); session.setAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY, SecurityContextHolder.getContext()); session.setAttribute(LOGIN_MEMBER_SESSION_ID_KEY, authentication.getName()); MemberCommand.Login memberLoginCommand = new MemberCommand.Login(id, password); memberService.login(memberLoginCommand); UserDetails details = this.memberService.loadUserByUsername(id); final MemberAuthToken memberAuthToken = new MemberAuthToken(details.getUsername(), session.getId()); return new ResponseEntity<>(memberAuthToken, HttpStatus.OK); }
@RequestMapping(value = "/api/authenticate", method = { RequestMethod.POST }) public AuthenticationToken authorize( @RequestBody AuthenticationRequest authenticationRequest, HttpServletRequest request) { final UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken( authenticationRequest.getUsername(), authenticationRequest.getPassword()); final Authentication authentication = this.authenticationManager.authenticate(token); SecurityContextHolder.getContext().setAuthentication(authentication); final HttpSession session = request.getSession(true); session.setAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY, SecurityContextHolder.getContext()); final UserDetails details = this.userDetailsService.loadUserByUsername(authenticationRequest.getUsername()); final List<String> roles = new ArrayList<>(); for (GrantedAuthority authority : details.getAuthorities()) { roles.add(authority.toString()); } return new AuthenticationToken(details.getUsername(), roles); } }
SecurityContextHolder.getContext().setAuthentication(null); MockFilterChain chain = new MockFilterChain(); chain = new MockFilterChain(); request.setMethod("POST"); request.addParameter(config.getUsernameParameterName(), testUserName); request.addParameter(config.getPasswordParameterName(), testPassword); getProxy().doFilter(request, response, chain); .SPRING_SECURITY_CONTEXT_KEY); assertNotNull(ctx); Authentication auth = ctx.getAuthentication(); assertNotNull(auth); assertNull(SecurityContextHolder.getContext().getAuthentication()); checkForAuthenticatedRole(auth); assertEquals(testUserName, ((UserDetails) auth.getPrincipal()).getUsername()); assertTrue(auth.getAuthorities().contains(new GeoServerRole(rootRole))); assertTrue(auth.getAuthorities().contains(new GeoServerRole(derivedRole))); chain = new MockFilterChain();
SecurityContextHolder.getContext().setAuthentication(null); request.addParameter("_spring_security_remember_me", "yes"); MockHttpServletResponse response = new MockHttpServletResponse(); MockFilterChain chain = new MockFilterChain(); request.addParameter("_spring_security_remember_me", "yes"); response = new MockHttpServletResponse(); chain = new MockFilterChain(); request.addHeader( "Authorization", "Basic " + new String(Base64.encodeBytes(("abc@xyz.com:abc").getBytes()))); auth = ctx.getAuthentication(); assertNotNull(auth); assertNull(SecurityContextHolder.getContext().getAuthentication()); checkForAuthenticatedRole(auth); assertEquals("abc@xyz.com", ((UserDetails) auth.getPrincipal()).getUsername()); assertNull(SecurityContextHolder.getContext().getAuthentication()); checkForAuthenticatedRole(auth); assertEquals("abc@xyz.com", ((UserDetails) auth.getPrincipal()).getUsername());
@Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { byte[] hashKey = hf.hashString(authentication.getName() + authentication.getCredentials()).asBytes(); String userKey = Arrays.toString(hashKey); SecurityContextHolder.getContext().setAuthentication(authed); } else { try { if (authed.getDetails() == null) { if (authed.getDetails() instanceof UserDetails) { UserDetails details = (UserDetails) authed.getDetails(); user = new ManagedUser(details.getUsername(), details.getPassword(), false, details.getAuthorities()); } else { user = new ManagedUser(authentication.getName(), "skippped-ldap", false, authed.getAuthorities());
@Override public String signIn(String username, Connection<?> connection, NativeWebRequest request) { UserDetails principal = userDetailsService.loadUserByUsername(username); UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(principal, null, principal.getAuthorities()); SecurityContextHolder.getContext().setAuthentication(token); return null; }
Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (auth == null || !auth.isAuthenticated()) { throw new AuthenticationCredentialsNotFoundException("Authentication was null, not authenticated, or not logged in."); UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(principal, principal.getPassword(), auth.getAuthorities()); SecurityContextHolder.getContext().setAuthentication(token);
@Test public void changePasswordSucceedsWithIfReAuthenticationSucceeds() { insertJoe(); Authentication currentAuth = authenticateJoe(); AuthenticationManager am = mock(AuthenticationManager.class); when(am.authenticate(currentAuth)).thenReturn(currentAuth); manager.setAuthenticationManager(am); manager.changePassword("password", "newPassword"); UserDetails newJoe = manager.loadUserByUsername("joe"); assertThat(newJoe.getPassword()).isEqualTo("newPassword"); // The password in the context should also be altered Authentication newAuth = SecurityContextHolder.getContext().getAuthentication(); assertThat(newAuth.getName()).isEqualTo("joe"); assertThat(newAuth.getDetails()).isEqualTo(currentAuth.getDetails()); assertThat(newAuth.getCredentials()).isNull(); assertThat(cache.getUserMap().containsKey("joe")).isFalse(); }
@Test public void changePasswordFailsIfReAuthenticationFails() { insertJoe(); authenticateJoe(); AuthenticationManager am = mock(AuthenticationManager.class); when(am.authenticate(any(Authentication.class))).thenThrow( new BadCredentialsException("")); manager.setAuthenticationManager(am); try { manager.changePassword("password", "newPassword"); fail("Expected BadCredentialsException"); } catch (BadCredentialsException expected) { } // Check password hasn't changed. UserDetails newJoe = manager.loadUserByUsername("joe"); assertThat(newJoe.getPassword()).isEqualTo("password"); assertThat(SecurityContextHolder.getContext().getAuthentication().getCredentials()).isEqualTo("password"); assertThat(cache.getUserMap().containsKey("joe")).isTrue(); }
@Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { String username = (String) authentication.getPrincipal(); String password = (String) authentication.getCredentials(); UserDetails userDetails = userDetailsService.loadUserByUsername(username); if (!password.equals(userDetails.getPassword())) { return new UsernamePasswordAuthenticationToken(username, null, null); } return null; }
protected Authentication createNewAuthentication(Authentication currentAuth, String newPassword) { UserDetails user = loadUserByUsername(currentAuth.getName()); UsernamePasswordAuthenticationToken newAuthentication = new UsernamePasswordAuthenticationToken( user, null, user.getAuthorities()); newAuthentication.setDetails(currentAuth.getDetails()); return newAuthentication; }
public PrincipalSid(Authentication authentication) { Assert.notNull(authentication, "Authentication required"); Assert.notNull(authentication.getPrincipal(), "Principal required"); if (authentication.getPrincipal() instanceof UserDetails) { this.principal = ((UserDetails) authentication.getPrincipal()).getUsername(); } else { this.principal = authentication.getPrincipal().toString(); } }