org.pac4j.core.engine.SecurityLogic Java Examples

@Override
protected final void internalFilter(final HttpServletRequest request, final HttpServletResponse response,
                                    final FilterChain filterChain) throws IOException, ServletException {

    final Config config = getSharedConfig();

    final SessionStore<JEEContext> bestSessionStore = FindBest.sessionStore(null, config, JEESessionStore.INSTANCE);
    final HttpActionAdapter<Object, JEEContext> bestAdapter = FindBest.httpActionAdapter(null, config, JEEHttpActionAdapter.INSTANCE);
    final SecurityLogic<Object, JEEContext> bestLogic = FindBest.securityLogic(securityLogic, config, DefaultSecurityLogic.INSTANCE);

    final JEEContext context = new JEEContext(request, response, bestSessionStore);
    bestLogic.perform(context, config, (ctx, profiles, parameters) -> {
        // if no profiles are loaded, pac4j is not concerned with this request
        filterChain.doFilter(profiles.isEmpty() ? request : new Pac4JHttpServletRequestWrapper(request, profiles), response);
        return null;
    }, bestAdapter, clients, authorizers, matchers, multiProfile);
}
 

@Override
public void setup(Bootstrap<?> bootstrap) {
    ObjectMapper om = bootstrap.getObjectMapper();

    // for Config
    om.addMixIn(SessionStore.class, sessionStoreMixin());
    om.addMixIn(Authorizer.class, authorizerMixin());
    om.addMixIn(HttpActionAdapter.class, httpActionAdapterMixin());
    om.addMixIn(Matcher.class, matcherMixin());
    om.addMixIn(SecurityLogic.class, securityLogicMixin());
    om.addMixIn(CallbackLogic.class, callbackLogicMixin());
    om.addMixIn(LogoutLogic.class, logoutLogicMixin());

    // for Clients
    om.addMixIn(Client.class, clientMixin());
    om.addMixIn(BaseClient.class, baseClientMixin());

    // for Clients and Client subsclasses
    om.addMixIn(AjaxRequestResolver.class, ajaxRequestResolverMixin());
    om.addMixIn(UrlResolver.class, urlResolverMixin());
    om.addMixIn(CallbackUrlResolver.class, callbackUrlResolverMixin());
    om.addMixIn(AuthorizationGenerator.class,
            authorizationGeneratorMixin());

    // for Client/BaseClient
    om.addMixIn(Authenticator.class, authenticatorMixin());
    om.addMixIn(CredentialsExtractor.class, credentialExtractorMixin());
    om.addMixIn(ProfileCreator.class, profileCreatorMixin());

    // for IndirectClient
    om.addMixIn(RedirectActionBuilder.class, redirectActionBuilderMixin());
    om.addMixIn(LogoutActionBuilder.class, logoutActionBuilderMixin());
    
    // for some of the Authenticators
    om.addMixIn(PasswordEncoder.class, passwordEncoderMixin());
}
 

protected SecurityLogic<Object, JaxRsContext> buildLogic(Config config) {
    if (securityLogic != null) {
        return securityLogic;
    } else if (config.getSecurityLogic() != null) {
        return config.getSecurityLogic();
    } else {
        DefaultSecurityLogic<Object, JaxRsContext> logic = new DefaultSecurityLogic<>();
        logic.setProfileManagerFactory(JaxRsProfileManager::new);
        return logic;
    }
}
 

@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {

    final SessionStore<JEEContext> bestSessionStore = FindBest.sessionStore(null, config, JEESessionStore.INSTANCE);
    final HttpActionAdapter<Boolean, JEEContext> bestAdapter = FindBest.httpActionAdapter(httpActionAdapter, config, JEEHttpActionAdapter.INSTANCE);
    final SecurityLogic<Boolean, JEEContext> bestLogic = FindBest.securityLogic(securityLogic, config, DefaultSecurityLogic.INSTANCE);

    final JEEContext context = (JEEContext) FindBest.webContextFactory(null, config, JEEContextFactory.INSTANCE)
            .newContext(request, response, bestSessionStore);
    final Object result = bestLogic.perform(context, config, (ctx, profiles, parameters) -> true, bestAdapter, clients, authorizers, matchers, multiProfile);
    if (result == null) {
        return false;
    }
    return Boolean.parseBoolean(result.toString());
}
 

@Override
public void handle(final RoutingContext routingContext) {

    final SecurityLogic<Void, VertxWebContext> bestLogic = FindBest.securityLogic(null, config, DefaultSecurityLogic.INSTANCE);
    final HttpActionAdapter<Void, VertxWebContext> bestAdapter = FindBest.httpActionAdapter(null, config, VertxHttpActionAdapter.INSTANCE);

    final VertxWebContext webContext = new VertxWebContext(routingContext, sessionStore);

    vertx.executeBlocking(future -> bestLogic.perform(webContext, config,
        (ctx, profiles, parameters) -> {
            // This is what should occur if we are authenticated and authorized to view the requested
            // resource
            future.complete();
            return null;
        },
        bestAdapter,
        clientNames,
        authorizerName,
        matcherName,
        multiProfile),
    asyncResult -> {
        // If we succeeded we're all good here, the job is done either through approving, or redirect, or
        // forbidding
        // However, if an error occurred we need to handle this here
        if (asyncResult.failed()) {
            unexpectedFailure(routingContext, asyncResult.cause());
        } else {
            LOG.info("Authorised to view resource " + routingContext.request().path());
            routingContext.next();
        }
    });

}
 

@JsonProperty
public SecurityLogic getSecurityLogic() {
    return securityLogic;
}
 

public SecurityLogic<Object, JaxRsContext> getSecurityLogic() {
    return securityLogic;
}
 

public void setSecurityLogic(SecurityLogic<Object, JaxRsContext> securityLogic) {
    this.securityLogic = securityLogic;
}
 

public SecurityLogic<Boolean, JEEContext> getSecurityLogic() {
    return securityLogic;
}
 

public void setSecurityLogic(final SecurityLogic<Boolean, JEEContext> securityLogic) {
    this.securityLogic = securityLogic;
}
 

public SecurityLogic<Object, PippoWebContext> getSecurityLogic() {
    return securityLogic;
}
 

public Pac4jSecurityHandler setSecurityLogic(SecurityLogic<Object, PippoWebContext> securityLogic) {
    this.securityLogic = securityLogic;

    return this;
}
 

public SecurityLogic<Object, JEEContext> getSecurityLogic() {
    return securityLogic;
}
 

public void setSecurityLogic(final SecurityLogic<Object, JEEContext> securityLogic) {
    this.securityLogic = securityLogic;
}
 

/**
 * @since 1.1.1
 *
 * @param securityLogic
 *            the {@link SecurityLogic} to use globally
 */
@JsonProperty
public void setSecurityLogic(SecurityLogic securityLogic) {
    this.securityLogic = securityLogic;
}