/
WebSphereSecurityAdapter.java
117 lines (101 loc) · 4.18 KB
/
WebSphereSecurityAdapter.java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
/*
* Copyright 2015 Red Hat, Inc. and/or its affiliates.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.kie.server.services.impl.security.adapters;
import java.lang.reflect.Method;
import java.security.Principal;
import java.util.ArrayList;
import java.util.List;
import javax.naming.InitialContext;
import javax.security.auth.Subject;
import org.kie.server.api.security.SecurityAdapter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
public class WebSphereSecurityAdapter implements SecurityAdapter {
private static final Logger logger = LoggerFactory.getLogger(WebSphereSecurityAdapter.class);
private Object registry;
private Class subject;
private boolean active;
public WebSphereSecurityAdapter() {
try {
this.registry = InitialContext.doLookup("UserRegistry");
this.subject = Class.forName("com.ibm.websphere.security.auth.WSSubject");
active = true;
} catch ( Exception e ) {
active = false;
logger.debug("Unable to look up UserRegistry in JNDI under key 'UserRegistry', disabling websphere adapter");
}
}
@Override
public String getUser(Object ... params) {
if (active) {
try {
String principal = getPrincipalFromSubject(params);
if (principal == null) {
Method method = subject.getMethod("getCallerPrincipal", new Class[]{});
principal = (String) method.invoke(null, new Object[]{});
}
return principal;
} catch (Exception e) {
logger.debug( "Unable to get user from subject due to {}", e.getMessage(), e );
}
}
return null;
}
@Override
public List<String> getRoles(Object ... params) {
List<String> proles = new ArrayList<String>();
if (active) {
if ( registry == null ) {
return proles;
}
try {
Method method = registry.getClass().getMethod( "getGroupsForUser", new Class[]{ String.class } );
List rolesIn = (List) method.invoke( registry, new Object[]{ getUser(params) } );
if ( rolesIn != null ) {
for ( Object o : rolesIn ) {
proles.add(o.toString());
}
}
} catch ( Exception e ) {
logger.debug( "Unable to get groups from registry due to {}", e.getMessage(), e );
}
}
return proles;
}
protected String getPrincipalFromSubject(Object[] params) {
if (params != null && params.length > 0) {
try {
for (Object p : params) {
if (p instanceof Subject) {
Principal principal = ((Subject) p).getPrincipals().iterator().next();
if (principal != null) {
try {
// WSPrincipal.getUserName is the actual (short) name of the user
Method method = principal.getClass().getMethod( "getUserName", new Class[0] );
return (String) method.invoke( principal, new Object[0] );
} catch (Exception e) {
// while principal.getName is the full name including registry specific data
return principal.getName();
}
}
}
}
} catch (Exception e) {
logger.debug("Not able to find principal in params due to {}", e.getMessage());
}
}
return null;
}
}