From 78f0b346c81c94f159747bbe91f8734d0197d522 Mon Sep 17 00:00:00 2001 From: Axel Uhl Date: Mon, 27 Jan 2020 11:09:04 +0100 Subject: [PATCH 1/2] aftermath to broken 178e7375f4edbdab3ef0cc707a7eef2029e2d65d: moved anonymous access filter to SSE --- ...cOrFormAuthenticationFilterSAPSailing.java | 4 +- ...onymousAuthenticationFilterSAPSailing.java | 18 ++------ java/com.sap.sse.security/resources/shiro.ini | 2 +- ...OrFormOrAnonymousAuthenticationFilter.java | 43 +++++++++++++++++++ 4 files changed, 51 insertions(+), 16 deletions(-) create mode 100755 java/com.sap.sse.security/src/com/sap/sse/security/BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilter.java diff --git a/java/com.sap.sailing.server/src/com/sap/sailing/server/security/BearerTokenOrBasicOrFormAuthenticationFilterSAPSailing.java b/java/com.sap.sailing.server/src/com/sap/sailing/server/security/BearerTokenOrBasicOrFormAuthenticationFilterSAPSailing.java index e883216033c..57af684b4bc 100644 --- a/java/com.sap.sailing.server/src/com/sap/sailing/server/security/BearerTokenOrBasicOrFormAuthenticationFilterSAPSailing.java +++ b/java/com.sap.sailing.server/src/com/sap/sailing/server/security/BearerTokenOrBasicOrFormAuthenticationFilterSAPSailing.java @@ -6,7 +6,9 @@ import com.sap.sse.security.BearerTokenOrBasicOrFormAuthenticationFilter; public class BearerTokenOrBasicOrFormAuthenticationFilterSAPSailing extends BearerTokenOrBasicOrFormAuthenticationFilter { + protected static final String SAP_SAILING_ANALYTICS_APPLICATION_NAME = "SAP Sailing Analytics (" + /* application name */ ServerInfo.getName() + ")"; + public BearerTokenOrBasicOrFormAuthenticationFilterSAPSailing() { - super("SAP Sailing Analytics (" + /* application name */ ServerInfo.getName() + ")"); + super(SAP_SAILING_ANALYTICS_APPLICATION_NAME); } } diff --git a/java/com.sap.sailing.server/src/com/sap/sailing/server/security/BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing.java b/java/com.sap.sailing.server/src/com/sap/sailing/server/security/BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing.java index 9a5eac98719..1f40c003434 100644 --- a/java/com.sap.sailing.server/src/com/sap/sailing/server/security/BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing.java +++ b/java/com.sap.sailing.server/src/com/sap/sailing/server/security/BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing.java @@ -1,20 +1,10 @@ package com.sap.sailing.server.security; -import javax.servlet.ServletRequest; -import javax.servlet.ServletResponse; +import com.sap.sse.security.BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilter; public class BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing - extends BearerTokenOrBasicOrFormAuthenticationFilterSAPSailing { - - @Override - protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception { - super.onAccessDenied(request, response); - return true; // The request should always be processed, in case of doubt anonymously. + extends BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilter { + public BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing() { + super(BearerTokenOrBasicOrFormAuthenticationFilterSAPSailing.SAP_SAILING_ANALYTICS_APPLICATION_NAME); } - - @Override - protected boolean sendChallenge(ServletRequest request, ServletResponse response) { - return false; // Do not build a challenge for authorization in case of an anonymous user. - } - } diff --git a/java/com.sap.sse.security/resources/shiro.ini b/java/com.sap.sse.security/resources/shiro.ini index 34d88ba46ed..3f3b57c21ad 100755 --- a/java/com.sap.sse.security/resources/shiro.ini +++ b/java/com.sap.sse.security/resources/shiro.ini @@ -60,7 +60,7 @@ authc.successUrl = /api/restsecurity/hello # authentication ("Authentication: Basic ...") and then regular form-based # authentication with POST parameters "username" and "password". bearerToken = com.sap.sse.security.BearerTokenOrBasicOrFormAuthenticationFilter -bearerTokenOrAnonymous = com.sap.sailing.shared.server.security.BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing +bearerTokenOrAnonymous = com.sap.sse.security.BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilter # Specifying filter chains for URL patterns diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilter.java b/java/com.sap.sse.security/src/com/sap/sse/security/BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilter.java new file mode 100755 index 00000000000..22bd3d434a9 --- /dev/null +++ b/java/com.sap.sse.security/src/com/sap/sse/security/BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilter.java @@ -0,0 +1,43 @@ +package com.sap.sse.security; + + +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; + +import org.apache.shiro.web.filter.authc.FormAuthenticationFilter; + +import com.sap.sse.security.jaxrs.api.SecurityResource; + +/** + * Looks for an "Authorization: Bearer <token>" HTTP header. If found, tries to authenticate a user + * with the bearer token presented. If instead an "Authorization: Basic ..." header field is found, HTTP + * basic authentication is attempted using a regular username/password token. If that isn't found, looks + * for username/password fields in the POST parameters, like the {@link FormAuthenticationFilter} does.

+ * + * This filter can be used for securing REST requests, in conjunction with the {@link SecurityResource}'s + * {@link SecurityResource#accessToken(String, String)} through which a bearer token can be obtained using + * basic authentication. + * + * @author Axel Uhl (D043530) + * + */ +public class BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilter extends BearerTokenOrBasicOrFormAuthenticationFilter { + public BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilter() { + super(/* application name */ "SAP"); + } + + protected BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilter(String applicationName) { + super(applicationName); + } + + @Override + protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception { + super.onAccessDenied(request, response); + return true; // The request should always be processed, in case of doubt anonymously. + } + + @Override + protected boolean sendChallenge(ServletRequest request, ServletResponse response) { + return false; // Do not build a challenge for authorization in case of an anonymous user. + } +} From 26c77bb6856411f7a40047d6604d72dc87312d69 Mon Sep 17 00:00:00 2001 From: Axel Uhl Date: Mon, 27 Jan 2020 11:24:03 +0100 Subject: [PATCH 2/2] fixed PUT method implementation for ownership REST API --- .../src/com/sap/sse/security/jaxrs/api/OwnershipResource.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/OwnershipResource.java b/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/OwnershipResource.java index d4711bb5c2d..fbe346f7840 100644 --- a/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/OwnershipResource.java +++ b/java/com.sap.sse.security/src/com/sap/sse/security/jaxrs/api/OwnershipResource.java @@ -51,8 +51,8 @@ public class OwnershipResource extends AbstractSecurityResource { public Response setOwnership(@PathParam("objectType") String objectType, @PathParam("typeRelativeObjectId") String typeRelativeObjectId, String jsonBody) throws OwnershipException { final JSONObject json = (JSONObject) JSONValue.parse(jsonBody); - QualifiedObjectIdentifier identifier = new QualifiedObjectIdentifierImpl((String) json.get(KEY_OBJECT_TYPE), - new TypeRelativeObjectIdentifier((String) json.get(KEY_OBJECT_ID))); + QualifiedObjectIdentifier identifier = new QualifiedObjectIdentifierImpl(objectType, + new TypeRelativeObjectIdentifier(typeRelativeObjectId)); try { SecurityUtils.getSubject().checkPermission(identifier.getStringPermission(DefaultActions.CHANGE_OWNERSHIP)); } catch (Exception ex) {