You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2017/09/08 14:45:23 UTC
[2/2] cxf git commit: Add some hooks to either set or get some
information relating to the kerberos authentication process
Add some hooks to either set or get some information relating to the kerberos authentication process
# Conflicts:
# rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/security/KerberosAuthenticationFilter.java
# rt/transports/http/src/main/java/org/apache/cxf/transport/http/auth/AbstractSpnegoAuthSupplier.java
Project: http://git-wip-us.apache.org/repos/asf/cxf/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/82581d6d
Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/82581d6d
Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/82581d6d
Branch: refs/heads/3.1.x-fixes
Commit: 82581d6d720c0c1db73df0c128b3371ad9d734f8
Parents: fe33fce
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Fri Sep 8 15:42:03 2017 +0100
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Fri Sep 8 15:45:15 2017 +0100
----------------------------------------------------------------------
.../jaxrs/security/KerberosAuthenticationFilter.java | 14 ++++++++------
.../http/auth/AbstractSpnegoAuthSupplier.java | 11 +++++++++--
.../cxf/ws/security/kerberos/KerberosClient.java | 6 +++++-
3 files changed, 22 insertions(+), 9 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf/blob/82581d6d/rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/security/KerberosAuthenticationFilter.java
----------------------------------------------------------------------
diff --git a/rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/security/KerberosAuthenticationFilter.java b/rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/security/KerberosAuthenticationFilter.java
index 3390104..e3cd617 100644
--- a/rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/security/KerberosAuthenticationFilter.java
+++ b/rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/security/KerberosAuthenticationFilter.java
@@ -105,16 +105,13 @@ public class KerberosAuthenticationFilter implements ContainerRequestFilter {
if (index > 0) {
simpleUserName = simpleUserName.substring(0, index);
}
+ Message m = JAXRSUtils.getCurrentMessage();
+ m.put(SecurityContext.class, createSecurityContext(simpleUserName, complexUserName, gssContext));
+
if (!gssContext.getCredDelegState()) {
gssContext.dispose();
gssContext = null;
}
- Message m = JAXRSUtils.getCurrentMessage();
- m.put(SecurityContext.class,
- new KerberosSecurityContext(new KerberosPrincipal(simpleUserName,
- complexUserName),
- gssContext));
-
} catch (LoginException e) {
LOG.fine("Unsuccessful JAAS login for the service principal: " + e.getMessage());
throw ExceptionUtils.toNotAuthorizedException(e, getFaultResponse());
@@ -127,6 +124,11 @@ public class KerberosAuthenticationFilter implements ContainerRequestFilter {
}
}
+ protected SecurityContext createSecurityContext(String simpleUserName, String complexUserName,
+ GSSContext gssContext) {
+ return new KerberosSecurityContext(new KerberosPrincipal(simpleUserName, complexUserName), gssContext);
+ }
+
protected GSSContext createGSSContext() throws GSSException {
boolean useKerberosOid = MessageUtils.isTrue(
messageContext.getContextualProperty(PROPERTY_USE_KERBEROS_OID));
http://git-wip-us.apache.org/repos/asf/cxf/blob/82581d6d/rt/transports/http/src/main/java/org/apache/cxf/transport/http/auth/AbstractSpnegoAuthSupplier.java
----------------------------------------------------------------------
diff --git a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/auth/AbstractSpnegoAuthSupplier.java b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/auth/AbstractSpnegoAuthSupplier.java
index 172d110..f62947e 100644
--- a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/auth/AbstractSpnegoAuthSupplier.java
+++ b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/auth/AbstractSpnegoAuthSupplier.java
@@ -138,7 +138,9 @@ public abstract class AbstractSpnegoAuthSupplier {
if (delegatedCred != null) {
return context.initSecContext(token, 0, token.length);
}
-
+
+ decorateSubject(subject);
+
try {
return (byte[])Subject.doAs(subject, new CreateServiceTicketAction(context, token));
} catch (PrivilegedActionException e) {
@@ -149,7 +151,12 @@ public abstract class AbstractSpnegoAuthSupplier {
return null;
}
}
-
+
+ // Allow subclasses to decorate the Subject if required.
+ protected void decorateSubject(Subject subject) {
+
+ }
+
protected boolean isCredDelegationRequired(Message message) {
Object prop = message.getContextualProperty(PROPERTY_REQUIRE_CRED_DELEGATION);
return prop == null ? credDelegation : MessageUtils.isTrue(prop);
http://git-wip-us.apache.org/repos/asf/cxf/blob/82581d6d/rt/ws/security/src/main/java/org/apache/cxf/ws/security/kerberos/KerberosClient.java
----------------------------------------------------------------------
diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/kerberos/KerberosClient.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/kerberos/KerberosClient.java
index cce09cb..51fdbe2 100644
--- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/kerberos/KerberosClient.java
+++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/kerberos/KerberosClient.java
@@ -147,7 +147,7 @@ public class KerberosClient implements Configurable {
LOG.fine("Requesting Kerberos ticket for " + serviceName
+ " using JAAS Login Module: " + getContextName());
}
- KerberosSecurity bst = new KerberosSecurity(DOMUtils.createDocument());
+ KerberosSecurity bst = createKerberosSecurity();
bst.retrieveServiceTicket(getContextName(), callbackHandler, serviceName,
isUsernameServiceNameForm, requestCredentialDelegation,
delegatedCredential);
@@ -170,6 +170,10 @@ public class KerberosClient implements Configurable {
return token;
}
+ protected KerberosSecurity createKerberosSecurity() {
+ return new KerberosSecurity(DOMUtils.createDocument());
+ }
+
public boolean isUsernameServiceNameForm() {
return isUsernameServiceNameForm;
}