I'm new here even though I've found many answers to my problems in here before.
Now I'm looking for help with this: I have this little example resource on my little REST API:
#Path("/greeting")
#PermitAll
public class HelloResource {
#GET
#Produces(MediaType.TEXT_PLAIN)
#Path("all")
public String sayHelloToAll() {
return "Hello, everybody!";
}
#GET
#Produces(MediaType.TEXT_PLAIN)
#RolesAllowed("admin")
#Path("admin")
public String sayHelloToAdmin() {
return "Hello, admin!";
}
}
In order to filter roles, I have this implementation of SecurityContext:
public class Authorizer implements SecurityContext {
#Override
public String getAuthenticationScheme() {
return null;
}
#Override
public Principal getUserPrincipal() {
return null;
}
#Override
public boolean isSecure() {
return false;
}
#Override
public boolean isUserInRole(String role) {
return true;
}
}
And this implementation of ContainerRequestFilter:
#Provider
#Priority(Priorities.AUTHENTICATION)
public class AuthorizationFilter implements ContainerRequestFilter {
#Override
public void filter(ContainerRequestContext requestContext) throws IOException {
requestContext.setSecurityContext(new Authorizer());
}
}
This is my application class:
#ApplicationPath("/")
public class Application extends ResourceConfig {
public Application() {
super(HelloResource.class);
register(AuthorizationFilter.class);
register(RolesAllowedDynamicFeature.class);
}
}
With all this, when I request the URI greeting/all, everything is ok, the string "Hello, everybody!" is shown. But when I request the URI greeting/admin, which should be called when an user in admin role requests it, is never invoked, even when my isUserInRole method always returns true. In fact, my filter method is always called, but my isUserInRole method is never called.
I have followed many advices:
SecurityContext doesn't work with #RolesAllowed
Authorization with RolesAllowedDynamicFeature and Jersey
How to access Jersey resource secured by #RolesAllowed
Best practice for REST token-based authentication with JAX-RS and Jersey
But it doesn't seem to work with anything.
Can anyone please help me? I don't know is there is something I am missing
Thank you all in advance.
EDIT: When I request the URI greeting/admin I get 403 Forbiden by the way (I forgot to say that)
Take a look at the source code for the RoleAllowedRequestFilter. When a user is authenticated, it is expected that there be an associated Principal. The filter checks it here
if (rolesAllowed.length > 0 && !isAuthenticated(requestContext)) {
throw new ForbiddenException(LocalizationMessages.USER_NOT_AUTHORIZED());
}
...
private static boolean isAuthenticated(final ContainerRequestContext requestContext) {
return requestContext.getSecurityContext().getUserPrincipal() != null;
}
So you need to return a Principal in the getUserPrincipal of the SecurityContext
#Override
public Principal getUserPrincipal() {
return new Principal() {
#Override
public String getName() {
return "Some Name";
}
};
}
Related
I have a quite simple quarkus extension which defines a ContainerRequestFilter to filter authentication and add data to a custom AuthenticationContext.
Here is my code:
runtime/AuthenticationContext.java
public interface AuthenticationContext {
User getCurrentUser();
}
runtime/AuthenticationContextImpl.java
#RequestScoped
public class AuthenticationContextImpl implements AuthenticationContext {
private User user;
#Override
public User getCurrentUser() {
return user;
}
public void setCurrentUser(User user) {
this.user = user;
}
}
runtime/MyFilter.java
#ApplicationScoped
public class MyFilter implements ContainerRequestFilter {
#Inject
AuthenticationContextImpl authCtx;
#Override
public void filter(ContainerRequestContext requestContext){
// doing some stuff like retrieving the user from the request Context
// ...
authCtx.setCurrentUser(retrievedUser)
}
}
deployment/MyProcessor.java:
class MyProcessor {
//... Some stuff
#BuildStep
AdditionalBeanBuildItem createContext() {
return new AdditionalBeanBuildItem(AuthenticationContextImpl.class);
}
}
I have a Null Pointer Exception in authCtx.setCurrentUser(retrievedUser) call (authCtx is never injected)
What am I missing here ?
Thanks
Indexing the runtime module of the extension fixes the problem.
There are multiple ways to do that as mentioned in https://stackoverflow.com/a/55513723/2504224
I have a Quarkus application in which I implemented the ContainerRequestFilter interface to save a header from incoming requests:
#PreMatching
public class SecurityFilter implements ContainerRequestFilter {
private static final String HEADER_EMAIL = "HD-Email";
#Override
public void filter(ContainerRequestContext requestContext) throws IOException {
String email = requestContext.getHeaders().getFirst(HEADER_EMAIL);
if (email == null) {
throw new AuthenticationFailedException("Email header is required");
}
requestContext.setSecurityContext(new SecurityContext() {
#Override
public Principal getUserPrincipal() {
return () -> email;
}
#Override
public boolean isUserInRole(String role) {
return false;
}
#Override
public boolean isSecure() {
return false;
}
#Override
public String getAuthenticationScheme() {
return null;
}
});
}
}
In a class annotated with ApplicationScoped I injected the context as follows:
#ApplicationScoped
public class ProjectService {
#Context
SecurityContext context;
...
}
The problem is that the context attribute is actually never injected, as it is always null.
What am I doing wrong? What should I do to be able to retrieve the SecurityContext throughout the application's code?
I like to abstract this problem, so that the business logic does not depend on JAX-RS-specific constructs. So, I create a class to describe my user, say User, and another interface, the AuthenticationContext, that holds the current user and any other authentication-related information I need, e.g.:
public interface AuthenticationContext {
User getCurrentUser();
}
I create a RequestScoped implementation of this class, that also has the relevant setter(s):
#RequestScoped
public class AuthenticationContextImpl implements AuthenticationContext {
private User user;
#Override
public User getCurrentUser() {
return user;
}
public void setCurrentUser(User user) {
this.user = user;
}
}
Now, I inject this bean and the JAX-RS SecurityContext in a filter, that knows how to create the User and set it into my application-specific AuthenticationContext:
#PreMatching
public class SecurityFilter implements ContainerRequestFilter {
#Inject AuthenticationContextImpl authCtx; // Injecting the implementation,
// not the interface!!!
#Context SecurityContext securityCtx;
#Override
public void filter(ContainerRequestContext requestContext) throws IOException {
User user = ...// translate the securityCtx into a User
authCtx.setCurrentUser(user);
}
}
And then, any business bean that needs the user data, injects the environment-neutral, application-specific AuthenticationContext.
#Context can only be used in JAX-RS classes - i.e. classes annotated with #Path.
In your case, ProjectService is a CDI bean, not a JAX-RS class.
The canonical way to do what you want is to inject the SecurityContext into a JAX-RS resource and then pass that as a method parameter to your ProjectService
I am using Dropwizard and wrote a Security Provider that should check the session. If a user is available, it should return it. Otherwise it should throw an exception. How can I get the Session from an HttpRequestContext?
public class SecurityProvider<T> implements InjectableProvider<Auth, Parameter> {
private static class Injectable<T> extends AbstractHttpContextInjectable<T> {
#Override
public T getValue(HttpContext c) {
//Here, get somehow the session,
//then check if user is in session,
//if so, proceed
return null;
}
}
#Override
public ComponentScope getScope() {
return ComponentScope.PerRequest;
}
#Override
public com.sun.jersey.spi.inject.Injectable getInjectable(ComponentContext ic, Auth auth, Parameter parameter) {
return new Injectable<T>();
}
}
I want to make an small application using dropwizard in 0.8.0-rc3-SNAPSHOT. In that I want if any user will call my api user should pass an authtoken in the header part.What I have done till now is---
#Override
public void run(HelloWorldConfigurationhelloWorldConfiguration,Environment environment) throws Exception{
environment.jersey().register(new ViewResource());
environment.servlets().addFilter("MyCustomRequestFilter", new MyCustomRequestFilter())
.addMappingForUrlPatterns(EnumSet.of(DispatcherType.REQUEST),false, "/*");
}
public class MyCustomRequestFilter implements ContainerRequestFilter {
#Override
public ContainerRequest filter(ContainerRequest request) {
System.out.print("test");
if ( request.getQueryParameters().containsKey("validateMeParam") ) {
/* validation logic */
}
// finished validation
return request;
}
}
I don't know what I am doing wrong.It's not working.
ContainerRequestFilter is not a Servlet Filter, which is what you are assuming by doing environment.servlets().addFilter. This should be added to the Jersey configuration.
environment.jersey().register(MyCustomRequestFilter.class);
And don't forget the #Provider annotation on the filter class.
See more about filters in Jersey Filters in the Dropwizard documentation.
UPDATE
I see another serious problem. You say you're using Dropwizard 0.8.0, which uses Jersey 2. In which case, the ContainerRequestFilter you posted should not even exist. In Jersey 1, the parameter to the filter method, is ContainerRequest, while the argument in Jersey 2 is ContainerRequestContext. Please show you dependencies, and verify that the class you have above is the actual class
I hope you are looking for this type of samples
https://github.com/stevenalexander/dropwizard-security
/* An example security provider that will look at each request when received by an endpoint using the auth attribute */
public class ExampleSecurityProvider<T> implements InjectableProvider<Auth, Parameter> {
public final static String CUSTOM_HEADER = "custom-security-token";
private final Authenticator<ExampleCredentials, T> authenticator;
public ExampleSecurityProvider(Authenticator<ExampleCredentials, T> authenticator) {
this.authenticator = authenticator;
}
private static class ExampleSecurityInjectable<T> extends AbstractHttpContextInjectable<T> {
private final Authenticator<ExampleCredentials, T> authenticator;
private final boolean required;
private ExampleSecurityInjectable(Authenticator<ExampleCredentials, T> authenticator, boolean required) {
this.authenticator = authenticator;
this.required = required;
}
#Override
public T getValue(HttpContext c) {
// This is where the credentials are extracted from the request
final String header = c.getRequest().getHeaderValue(CUSTOM_HEADER);
try {
if (header != null) {
final Optional<T> result = authenticator.authenticate(new ExampleCredentials(header));
if (result.isPresent()) {
return result.get();
}
}
} catch (AuthenticationException e) {
throw new WebApplicationException(Response.Status.UNAUTHORIZED);
}
if (required) {
throw new WebApplicationException(Response.Status.UNAUTHORIZED);
}
return null;
}
}
I am developing a REST API using Jersey 2 and at the moment I am trying to incorporate basic authentication by use of an annotation similar to the #Auth found in Dropwizard. With
#Path("hello")
public class HelloResource {
#GET
#Produces("application/json")
public String hello(#Auth final Principal principal) {
return principal.getUsername();
}
}
the hello resource invocation should be intercepted by some code performing basic authentication using the credentials passed in the Authorization HTTP request header and on success injecting the principal into the method principal parameter.
I have started creating an #Auth resolver, see below, but I do not see how I can access the Authorization HTTP request header from within that?
#Singleton
public class AuthResolver {
public static class AuthInjectionResolver extends ParamInjectionResolver<Auth> {
public AuthInjectionResolver() {
super(AuthValueFactoryProvider.class);
}
}
#Singleton
public static class AuthValueFactoryProvider extends AbstractValueFactoryProvider {
#Inject
public AuthValueFactoryProvider(final MultivaluedParameterExtractorProvider extractorProvider, final ServiceLocator injector) {
super(extractorProvider, injector, UNKNOWN);
}
#Override
protected Factory<?> createValueFactory(final Parameter parameter) {
final Class<?> classType = parameter.getRawType();
return classType == null || !classType.equals(Principal.class) ? null :
new AbstractContainerRequestValueFactory<Principal>() {
#Override
public Principal provide() {
// Authentication?
}
};
}
}
public static class Binder extends AbstractBinder {
#Override
protected void configure() {
bind(AuthValueFactoryProvider.class).to(ValueFactoryProvider.class).in(Singleton.class);
bind(AuthInjectionResolver.class).to(
new TypeLiteral<InjectionResolver<Auth>>() {
}
).in(Singleton.class);
}
}
}
How to approach this? :)
Ah, in AbstractContainerRequestValueFactory<Principal> I can add
#Context private ResourceContext context;
and then extract the HTTP request and it's headers from there inside the provide method.