@Override public String readAttribute(HttpServerExchange exchange) { SecurityContext sc = exchange.getSecurityContext(); if(sc == null) { return null; } return sc.getMechanismName(); }
@Override public boolean resolve(HttpServerExchange value) { SecurityContext sc = value.getSecurityContext(); if(sc == null) { return false; } return sc.isAuthenticationRequired(); }
/** * * @return The account that was associated with the SSE request */ public Account getAccount() { SecurityContext sc = exchange.getSecurityContext(); if (sc != null) { return sc.getAuthenticatedAccount(); } return null; }
/** * <p>The authentication is mandatory if the servlet has http constraints (eg.: {@link * javax.servlet.annotation.HttpConstraint}).</p> * * @param attachment * @return */ private Boolean isMandatory(final ServletRequestContext attachment) { return attachment.getExchange().getSecurityContext() != null && attachment.getExchange().getSecurityContext().isAuthenticationRequired(); }
@Override public boolean isUserInRole(String role) { SecurityContext sc = exchange.getSecurityContext(); if(sc == null) { return false; } Account authenticatedAccount = sc.getAuthenticatedAccount(); if(authenticatedAccount == null) { return false; } return authenticatedAccount.getRoles().contains(role); }
@Override public Principal getUserPrincipal() { SecurityContext sc = exchange.getSecurityContext(); if(sc == null) { return null; } Account authenticatedAccount = sc.getAuthenticatedAccount(); if(authenticatedAccount == null) { return null; } return authenticatedAccount.getPrincipal(); }
@Override public void handleRequest(HttpServerExchange exchange) throws Exception { SecurityContext sc = exchange.getSecurityContext(); for (int i = 0; i < receivers.length; ++i) { sc.registerNotificationReceiver(receivers[i]); } next.handleRequest(exchange); }
@Override public void handleRequest(final HttpServerExchange exchange) throws Exception { final SecurityContext sc = exchange.getSecurityContext(); if(sc != null && sc instanceof AuthenticationMechanismContext) { AuthenticationMechanismContext amc = (AuthenticationMechanismContext) sc; for(int i = 0; i < authenticationMechanisms.length; ++i) { amc.addAuthenticationMechanism(authenticationMechanisms[i]); } } next.handleRequest(exchange); }
@Override public String readAttribute(final HttpServerExchange exchange) { SecurityContext sc = exchange.getSecurityContext(); if (sc == null || !sc.isAuthenticated()) { return null; } return sc.getAuthenticatedAccount().getPrincipal().getName(); }
/** * @see io.undertow.server.HttpHandler#handleRequest(io.undertow.server.HttpServerExchange) */ @Override public void handleRequest(HttpServerExchange exchange) throws Exception { if (isAuthenticationRequired(exchange)) { SecurityContext context = exchange.getSecurityContext(); UndertowLogger.SECURITY_LOGGER.debugf("Setting authentication required for exchange %s", exchange); context.setAuthenticationRequired(); } next.handleRequest(exchange); }
private void sessionDestroyedImpl(HttpSessionEvent se) { //we need to get the current account //there are two options here, we can look for the account in the current request //or we can look for the account that has been saved in the session //for maximum compatibility we do both ServletRequestContext src = ServletRequestContext.current(); Account requestAccount = null; if (src != null) { SecurityContext securityContext = src.getExchange().getSecurityContext(); if(securityContext != null) { requestAccount = securityContext.getAuthenticatedAccount(); if (requestAccount != null) { clearAccount(requestAccount); } } } if (se.getSession() instanceof HttpSessionImpl) { final HttpSessionImpl impl = (HttpSessionImpl) se.getSession(); Session session = impl.getSession(); if (session != null) { AuthenticatedSessionManager.AuthenticatedSession authenticatedSession = (AuthenticatedSessionManager.AuthenticatedSession) session.getAttribute(CachedAuthenticatedSessionHandler.class.getName() + ".AuthenticatedSession"); if(authenticatedSession != null) { Account sessionAccount = authenticatedSession.getAccount(); if (sessionAccount != null && !sessionAccount.equals(requestAccount)) { clearAccount(sessionAccount); } } } } }
final StringBuilder sb = new StringBuilder(); final SecurityContext sc = exchange.getSecurityContext(); sb.append("\n----------------------------REQUEST---------------------------\n"); sb.append(" URI=" + exchange.getRequestURI() + "\n");
SecurityContext sc = exchange.getSecurityContext(); if (sc == null || !sc.isAuthenticated()) { jdbcLogAttribute.user = null;
/** * Only allow the request through if successfully authenticated or if authentication is not required. * * @see io.undertow.server.HttpHandler#handleRequest(io.undertow.server.HttpServerExchange) */ @Override public void handleRequest(final HttpServerExchange exchange) throws Exception { if(exchange.isInIoThread()) { exchange.dispatch(this); return; } SecurityContext context = exchange.getSecurityContext(); if (context.authenticate()) { if(!exchange.isComplete()) { next.handleRequest(exchange); } } else { exchange.endExchange(); } }
@Override public void handleRequest(HttpServerExchange exchange) throws Exception { SecurityContext securityContext = exchange.getSecurityContext(); securityContext.registerNotificationReceiver(NOTIFICATION_RECEIVER); SessionManager sessionManager = exchange.getAttachment(SessionManager.ATTACHMENT_KEY); SessionConfig sessionConfig = exchange.getAttachment(SessionConfig.ATTACHMENT_KEY); if (sessionManager == null || sessionConfig == null) { next.handleRequest(exchange); return; } Session session = sessionManager.getSession(exchange, sessionConfig); // If there was no existing HttpSession then there could not be a cached AuthenticatedSession so don't bother setting // the AuthenticatedSessionManager. if (session != null) { exchange.putAttachment(AuthenticatedSessionManager.ATTACHMENT_KEY, SESSION_MANAGER); } next.handleRequest(exchange); }
@Override public StreamSinkConduit wrap(ConduitFactory<StreamSinkConduit> factory, HttpServerExchange exchange) { SecurityContext sc = exchange.getSecurityContext(); Account account = sc.getAuthenticatedAccount(); if (account != null) { try (SingleSignOn sso = singleSignOnManager.createSingleSignOn(account, sc.getMechanismName())) { Session session = getSession(exchange); registerSessionIfRequired(sso, session); exchange.getResponseCookies().put(cookieName, new CookieImpl(cookieName, sso.getId()).setHttpOnly(httpOnly).setSecure(secure).setDomain(domain).setPath(path)); } } return factory.create(); } }
final JASPICSecurityContext jaspicSecurityContext = (JASPICSecurityContext) exchange.getSecurityContext(); final AuthenticatedSessionManager sessionManager = exchange.getAttachment(AuthenticatedSessionManager.ATTACHMENT_KEY);
/** * <p>The authentication is mandatory if the servlet has http constraints (eg.: {@link * javax.servlet.annotation.HttpConstraint}).</p> * * @param attachment * @return */ private Boolean isMandatory(final ServletRequestContext attachment) { return attachment.getExchange().getSecurityContext() != null && attachment.getExchange().getSecurityContext().isAuthenticationRequired(); }
@Override public void handleRequest(HttpServerExchange exchange, RequestContext context) throws Exception { if (isAuthenticationRequired(exchange)) { SecurityContext scontext = exchange.getSecurityContext(); scontext.setAuthenticationRequired(); } next(exchange, context); } }
@Override public void logout() throws ServletException { SecurityContext sc = exchange.getSecurityContext(); sc.logout(); if(servletContext.getDeployment().getDeploymentInfo().isInvalidateSessionOnLogout()) { HttpSession session = getSession(false); if(session != null) { session.invalidate(); } } }