Add support for conditional access based on roles. Part one.

This commit addresses issue eclipse-archived#579. It does not solve it fully, but creates a base for security mechanism which covers main entrypoints to Eclipse SmartHome - meaning REST and other servlet based interactions such icons and charts. Signed-off-by: Łukasz Dywicki <luke@code-house.org>
Code-House · Aug 14, 2018 · ea22e48 · ea22e48
1 parent c77dbf8
commit ea22e48
Show file tree

Hide file tree

Showing 155 changed files with 3,102 additions and 389 deletions.
diff --git a/bundles/auth/org.eclipse.smarthome.auth.jaas/META-INF/MANIFEST.MF b/bundles/auth/org.eclipse.smarthome.auth.jaas/META-INF/MANIFEST.MF
@@ -9,6 +9,7 @@ Bundle-Vendor: Eclipse.org/SmartHome
 Bundle-Version: 0.10.0.qualifier
 Import-Package: 
  org.eclipse.jdt.annotation;resolution:=optional,
+ org.eclipse.smarthome.auth.password,
  org.eclipse.smarthome.core.auth,
  org.osgi.service.cm,
  org.slf4j

diff --git a/...as/src/main/java/org/eclipse/smarthome/auth/jaas/internal/JaasAuthenticationProvider.java b/...as/src/main/java/org/eclipse/smarthome/auth/jaas/internal/JaasAuthenticationProvider.java
@@ -26,11 +26,11 @@
 import javax.security.auth.login.LoginContext;
 import javax.security.auth.login.LoginException;
 
+import org.eclipse.smarthome.auth.password.UsernamePasswordCredentials;
 import org.eclipse.smarthome.core.auth.Authentication;
 import org.eclipse.smarthome.core.auth.AuthenticationException;
 import org.eclipse.smarthome.core.auth.AuthenticationProvider;
 import org.eclipse.smarthome.core.auth.Credentials;
-import org.eclipse.smarthome.core.auth.UsernamePasswordCredentials;
 
 /**
  * Implementation of authentication provider which is backed by JAAS realm.
@@ -51,8 +51,13 @@ public Authentication authenticate(final Credentials credentials) {
             return null;
         }
 
-        final String name = getName(credentials);
-        final char[] password = getPassword(credentials);
+        if (!(credentials instanceof UsernamePasswordCredentials)) {
+            throw new AuthenticationException("Unsupported credentials passed to provider.");
+        }
+
+        UsernamePasswordCredentials userCredentials = (UsernamePasswordCredentials) credentials;
+        final String name = userCredentials.getUsername();
+        final char[] password = userCredentials.getPassword().toCharArray();
 
         try {
             LoginContext loginContext = new LoginContext(realmName, new CallbackHandler() {
@@ -90,20 +95,6 @@ private String[] getRoles(Set<Principal> principals) {
         return roles;
     }
 
-    private String getName(Credentials credentials) {
-        if (credentials instanceof UsernamePasswordCredentials) {
-            return ((UsernamePasswordCredentials) credentials).getUsername();
-        }
-        return null;
-    }
-
-    private char[] getPassword(Credentials credentials) {
-        if (credentials instanceof UsernamePasswordCredentials) {
-            return ((UsernamePasswordCredentials) credentials).getPassword().toCharArray();
-        }
-        return null;
-    }
-
     protected void activate(Map<String, Object> properties) {
         modified(properties);
     }
@@ -129,4 +120,9 @@ protected void modified(Map<String, Object> properties) {
             realmName = null;
         }
     }
+
+    @Override
+    public boolean supports(Class<? extends Credentials> type) {
+        return UsernamePasswordCredentials.class.isAssignableFrom(type);
+    }
 }
diff --git a/bundles/auth/org.eclipse.smarthome.auth.jwt/.classpath b/bundles/auth/org.eclipse.smarthome.auth.jwt/.classpath
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<classpath>
+	<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/JavaSE-1.8"/>
+	<classpathentry kind="con" path="org.eclipse.pde.core.requiredPlugins"/>
+	<classpathentry kind="src" output="target/classes" path="src/main/java"/>
+	<classpathentry kind="output" path="target/classes"/>
+</classpath>
diff --git a/bundles/auth/org.eclipse.smarthome.auth.jwt/.project b/bundles/auth/org.eclipse.smarthome.auth.jwt/.project
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<projectDescription>
+	<name>org.eclipse.smarthome.auth.jwt</name>
+	<comment>This project keeps JWT related authentication structures.</comment>
+	<projects>
+	</projects>
+	<buildSpec>
+		<buildCommand>
+			<name>org.eclipse.jdt.core.javabuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+		<buildCommand>
+			<name>org.eclipse.pde.ManifestBuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+		<buildCommand>
+			<name>org.eclipse.pde.SchemaBuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+		<buildCommand>
+			<name>org.eclipse.pde.ds.core.builder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+	</buildSpec>
+	<natures>
+		<nature>org.eclipse.jdt.core.javanature</nature>
+		<nature>org.eclipse.pde.PluginNature</nature>
+	</natures>
+</projectDescription>
diff --git a/bundles/auth/org.eclipse.smarthome.auth.jwt/.settings/org.eclipse.jdt.core.prefs b/bundles/auth/org.eclipse.smarthome.auth.jwt/.settings/org.eclipse.jdt.core.prefs
@@ -0,0 +1,8 @@
+eclipse.preferences.version=1
+org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled
+org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.8
+org.eclipse.jdt.core.compiler.compliance=1.8
+org.eclipse.jdt.core.compiler.problem.assertIdentifier=error
+org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
+org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
+org.eclipse.jdt.core.compiler.source=1.8
diff --git a/bundles/auth/org.eclipse.smarthome.auth.jwt/.settings/org.maven.ide.eclipse.prefs b/bundles/auth/org.eclipse.smarthome.auth.jwt/.settings/org.maven.ide.eclipse.prefs
@@ -0,0 +1,9 @@
+#Fri Feb 19 20:27:57 CET 2010
+activeProfiles=
+eclipse.preferences.version=1
+fullBuildGoals=process-test-resources
+includeModules=false
+resolveWorkspaceProjects=true
+resourceFilterGoals=process-resources resources\:testResources
+skipCompilerPlugin=true
+version=1
diff --git a/bundles/auth/org.eclipse.smarthome.auth.jwt/META-INF/MANIFEST.MF b/bundles/auth/org.eclipse.smarthome.auth.jwt/META-INF/MANIFEST.MF
@@ -0,0 +1,13 @@
+Manifest-Version: 1.0
+Bundle-ActivationPolicy: lazy
+Bundle-License: https://www.eclipse.org/legal/epl-2.0/
+Bundle-ManifestVersion: 2
+Bundle-Name: Eclipse SmartHome JWT Auth
+Bundle-RequiredExecutionEnvironment: JavaSE-1.8
+Bundle-SymbolicName: org.eclipse.smarthome.auth.jwt
+Bundle-Vendor: Eclipse.org/SmartHome
+Bundle-Version: 0.10.0.qualifier
+Export-Package: org.eclipse.smarthome.auth.jwt
+Import-Package: 
+ org.eclipse.jdt.annotation;resolution:=optional,
+ org.eclipse.smarthome.core.auth
diff --git a/bundles/auth/org.eclipse.smarthome.auth.jwt/NOTICE b/bundles/auth/org.eclipse.smarthome.auth.jwt/NOTICE
@@ -0,0 +1,19 @@
+This content is produced and maintained by the Eclipse SmartHome project.
+
+* Project home: https://eclipse.org/smarthome/
+
+== Declared Project Licenses
+
+This program and the accompanying materials are made available under the terms
+of the Eclipse Public License 2.0 which is available at
+https://www.eclipse.org/legal/epl-2.0/.
+
+== Source Code
+
+https://github.com/eclipse/smarthome
+
+== Copyright Holders
+
+See the NOTICE file distributed with the source code at
+https://github.com/eclipse/smarthome/blob/master/NOTICE
+for detailed information regarding copyright ownership.
diff --git a/bundles/auth/org.eclipse.smarthome.auth.jwt/build.properties b/bundles/auth/org.eclipse.smarthome.auth.jwt/build.properties
@@ -0,0 +1,5 @@
+output.. = target/classes/
+bin.includes = META-INF/,\
+               .,\
+               NOTICE
+source.. = src/main/java/
diff --git a/bundles/auth/org.eclipse.smarthome.auth.jwt/pom.xml b/bundles/auth/org.eclipse.smarthome.auth.jwt/pom.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+
+  <modelVersion>4.0.0</modelVersion>
+
+  <parent>
+    <artifactId>auth</artifactId>
+    <groupId>org.eclipse.smarthome.bundles</groupId>
+    <version>0.10.0-SNAPSHOT</version>
+  </parent>
+  <groupId>org.eclipse.smarthome.auth</groupId>
+  <artifactId>org.eclipse.smarthome.auth.jwt</artifactId>
+
+  <packaging>eclipse-plugin</packaging>
+
+  <name>Eclipse SmartHome JWT Authentication</name>
+
+</project>
diff --git a/...eclipse.smarthome.auth.jwt/src/main/java/org/eclipse/smarthome/auth/jwt/JsonWebToken.java b/...eclipse.smarthome.auth.jwt/src/main/java/org/eclipse/smarthome/auth/jwt/JsonWebToken.java
@@ -0,0 +1,26 @@
+/**
+ * Copyright (c) 2014,2018 Contributors to the Eclipse Foundation
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ */
+package org.eclipse.smarthome.auth.jwt;
+
+import org.eclipse.smarthome.core.auth.Credentials;
+
+/**
+ * Representation of json web token (JWT) needed for authentication mechanism in Eclipse Smart Home security framework.
+ *
+ * @author Łukasz Dywicki - initial contribution.
+ */
+public class JsonWebToken implements Credentials {
+
+    // TODO provide all contract methods needed here
+
+}
diff --git a/bundles/auth/org.eclipse.smarthome.auth.password/.classpath b/bundles/auth/org.eclipse.smarthome.auth.password/.classpath
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<classpath>
+	<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/JavaSE-1.8"/>
+	<classpathentry kind="con" path="org.eclipse.pde.core.requiredPlugins"/>
+	<classpathentry kind="src" output="target/classes" path="src/main/java"/>
+	<classpathentry kind="output" path="target/classes"/>
+</classpath>
diff --git a/bundles/auth/org.eclipse.smarthome.auth.password/.project b/bundles/auth/org.eclipse.smarthome.auth.password/.project
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<projectDescription>
+	<name>org.eclipse.smarthome.auth.password</name>
+	<comment>This project contains password related authentication structures.</comment>
+	<projects>
+	</projects>
+	<buildSpec>
+		<buildCommand>
+			<name>org.eclipse.jdt.core.javabuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+		<buildCommand>
+			<name>org.eclipse.pde.ManifestBuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+		<buildCommand>
+			<name>org.eclipse.pde.SchemaBuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+		<buildCommand>
+			<name>org.eclipse.pde.ds.core.builder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+	</buildSpec>
+	<natures>
+		<nature>org.eclipse.jdt.core.javanature</nature>
+		<nature>org.eclipse.pde.PluginNature</nature>
+	</natures>
+</projectDescription>
diff --git a/bundles/auth/org.eclipse.smarthome.auth.password/.settings/org.eclipse.jdt.core.prefs b/bundles/auth/org.eclipse.smarthome.auth.password/.settings/org.eclipse.jdt.core.prefs
@@ -0,0 +1,8 @@
+eclipse.preferences.version=1
+org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled
+org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.8
+org.eclipse.jdt.core.compiler.compliance=1.8
+org.eclipse.jdt.core.compiler.problem.assertIdentifier=error
+org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
+org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
+org.eclipse.jdt.core.compiler.source=1.8
diff --git a/bundles/auth/org.eclipse.smarthome.auth.password/.settings/org.maven.ide.eclipse.prefs b/bundles/auth/org.eclipse.smarthome.auth.password/.settings/org.maven.ide.eclipse.prefs
@@ -0,0 +1,9 @@
+#Fri Feb 19 20:27:57 CET 2010
+activeProfiles=
+eclipse.preferences.version=1
+fullBuildGoals=process-test-resources
+includeModules=false
+resolveWorkspaceProjects=true
+resourceFilterGoals=process-resources resources\:testResources
+skipCompilerPlugin=true
+version=1
diff --git a/bundles/auth/org.eclipse.smarthome.auth.password/META-INF/MANIFEST.MF b/bundles/auth/org.eclipse.smarthome.auth.password/META-INF/MANIFEST.MF
@@ -0,0 +1,13 @@
+Manifest-Version: 1.0
+Bundle-ActivationPolicy: lazy
+Bundle-License: https://www.eclipse.org/legal/epl-2.0/
+Bundle-ManifestVersion: 2
+Bundle-Name: Eclipse SmartHome Password Auth
+Bundle-RequiredExecutionEnvironment: JavaSE-1.8
+Bundle-SymbolicName: org.eclipse.smarthome.auth.password
+Bundle-Vendor: Eclipse.org/SmartHome
+Bundle-Version: 0.10.0.qualifier
+Export-Package: org.eclipse.smarthome.auth.password
+Import-Package: 
+ org.eclipse.jdt.annotation;resolution:=optional,
+ org.eclipse.smarthome.core.auth
diff --git a/bundles/auth/org.eclipse.smarthome.auth.password/NOTICE b/bundles/auth/org.eclipse.smarthome.auth.password/NOTICE
@@ -0,0 +1,19 @@
+This content is produced and maintained by the Eclipse SmartHome project.
+
+* Project home: https://eclipse.org/smarthome/
+
+== Declared Project Licenses
+
+This program and the accompanying materials are made available under the terms
+of the Eclipse Public License 2.0 which is available at
+https://www.eclipse.org/legal/epl-2.0/.
+
+== Source Code
+
+https://github.com/eclipse/smarthome
+
+== Copyright Holders
+
+See the NOTICE file distributed with the source code at
+https://github.com/eclipse/smarthome/blob/master/NOTICE
+for detailed information regarding copyright ownership.
diff --git a/bundles/auth/org.eclipse.smarthome.auth.password/build.properties b/bundles/auth/org.eclipse.smarthome.auth.password/build.properties
@@ -0,0 +1,5 @@
+output.. = target/classes/
+bin.includes = META-INF/,\
+               .,\
+               NOTICE
+source.. = src/main/java/
diff --git a/bundles/auth/org.eclipse.smarthome.auth.password/pom.xml b/bundles/auth/org.eclipse.smarthome.auth.password/pom.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+
+  <modelVersion>4.0.0</modelVersion>
+
+  <parent>
+    <artifactId>auth</artifactId>
+    <groupId>org.eclipse.smarthome.bundles</groupId>
+    <version>0.10.0-SNAPSHOT</version>
+  </parent>
+  <groupId>org.eclipse.smarthome.auth</groupId>
+  <artifactId>org.eclipse.smarthome.auth.password</artifactId>
+
+  <packaging>eclipse-plugin</packaging>
+
+  <name>Eclipse SmartHome Password based authentication</name>
+
+</project>
diff --git a/...ore/auth/UsernamePasswordCredentials.java → ...password/UsernamePasswordCredentials.java b/...ore/auth/UsernamePasswordCredentials.java → ...password/UsernamePasswordCredentials.java
@@ -10,7 +10,9 @@
  *
  * SPDX-License-Identifier: EPL-2.0
  */
-package org.eclipse.smarthome.core.auth;
+package org.eclipse.smarthome.auth.password;
+
+import org.eclipse.smarthome.core.auth.Credentials;
 
 /**
  * Credentials which represent user name and password.

diff --git a/bundles/auth/pom.xml b/bundles/auth/pom.xml
@@ -13,11 +13,14 @@
   <artifactId>auth</artifactId>
 
   <packaging>pom</packaging>
-	<name>Eclipse SmartHome Auth Components</name>
 
-	<modules>
-		<module>org.eclipse.smarthome.auth.jaas</module>
-		<module>org.eclipse.smarthome.auth.oauth2client</module>
-	</modules>
+  <name>Eclipse SmartHome Auth Components</name>
+
+  <modules>
+    <module>org.eclipse.smarthome.auth.jaas</module>
+    <module>org.eclipse.smarthome.auth.jwt</module>
+    <module>org.eclipse.smarthome.auth.password</module>
+    <module>org.eclipse.smarthome.auth.oauth2client</module>
+  </modules>
 
 </project>
diff --git a/bundles/core/org.eclipse.smarthome.core.audio/META-INF/MANIFEST.MF b/bundles/core/org.eclipse.smarthome.core.audio/META-INF/MANIFEST.MF
@@ -29,6 +29,7 @@ Import-Package:
  org.eclipse.smarthome.core.types,
  org.eclipse.smarthome.io.console,
  org.eclipse.smarthome.io.console.extensions,
+ org.eclipse.smarthome.io.http.core,
  org.osgi.framework,
  org.osgi.service.http,
  org.slf4j