in redback-integrations/redback-rest/redback-rest-services/src/main/java/org/apache/archiva/redback/rest/services/interceptors/PermissionsInterceptor.java [78:196]
public void filter( ContainerRequestContext containerRequestContext )
{
log.debug( "Filtering request" );
final String requestPath = containerRequestContext.getUriInfo( ).getPath( );
if (ignoreAuth( requestPath )) {
return;
}
RedbackAuthorization redbackAuthorization = getRedbackAuthorization( resourceInfo );
if ( redbackAuthorization != null )
{
if ( redbackAuthorization.noRestriction() )
{
log.debug( "redbackAuthorization.noRestriction() so skip permission check" );
// we are fine this services is marked as non restrictive access
return;
}
String[] permissions = redbackAuthorization.permissions();
HttpServletRequest request = getHttpServletRequest( );
//olamy: no value is an array with an empty String
if ( permissions != null && permissions.length > 0 //
&& !( permissions.length == 1 && StringUtils.isEmpty( permissions[0] ) ) )
{
SecuritySession securitySession = getSecuritySession( containerRequestContext, httpAuthenticator, request );
AuthenticationResult authenticationResult = getAuthenticationResult( containerRequestContext, httpAuthenticator, request );
log.debug( "authenticationResult from message: {}", authenticationResult );
if ( authenticationResult != null && authenticationResult.isAuthenticated() )
{
User userObject = securitySession == null ? authenticationResult.getUser( ) : securitySession.getUser( );
for ( String permission : permissions )
{
log.debug( "check permission: {} with securitySession {}", permission, securitySession );
if ( StringUtils.isBlank( permission ) )
{
continue;
}
try
{
String resource = redbackAuthorization.resource();
if (resource.startsWith("{") && resource.endsWith("}") && resource.length()>2) {
resource = getMethodParameter(containerRequestContext, resource.substring(1,resource.length()-1));
log.debug("Found resource from annotated parameter: {}",resource);
}
AuthorizationResult authorizationResult = null;
if (userObject!=null)
{
authorizationResult = securitySystem.authorize( userObject, permission, //
StringUtils.isBlank( resource ) //
? null : resource );
}
if ( authenticationResult != null && authorizationResult.isAuthorized() )
{
log.debug( "isAuthorized for permission {}", permission );
return;
}
else
{
if ( securitySession != null && securitySession.getUser() != null )
{
log.debug( "user {} not authorized for permission {}", //
securitySession.getUser().getUsername(), //
permission );
}
}
}
catch ( AuthorizationException e )
{
log.debug( " AuthorizationException " + e.getMessage() //
+ " checking permission " + permission, e );
containerRequestContext.abortWith( Response.status( Response.Status.FORBIDDEN ).build() );
return;
}
}
}
else
{
if ( securitySession != null && securitySession.getUser() != null )
{
log.debug( "user {} not authenticated, but permissions are set", securitySession.getUser().getUsername() );
}
containerRequestContext.abortWith( Response.status( Response.Status.FORBIDDEN ).build() );
return;
}
}
else
{
// The noPermission is only valid, if the user is authenticated
if ( redbackAuthorization.noPermission() )
{
AuthenticationResult authenticationResult = getAuthenticationResult( containerRequestContext, httpAuthenticator, request );
if (authenticationResult!=null && authenticationResult.isAuthenticated())
{
log.debug( "Path {} doesn't need special permission. User authenticated.", requestPath );
return;
} else {
log.debug( "Path {} is protected and needs authentication. User not authenticated.", requestPath );
containerRequestContext.abortWith( Response.status( Response.Status.UNAUTHORIZED )
.header( "WWW-Authenticate", "Bearer realm=\""+getAuthenticationRealm()+"\"" )
.build() );
return;
}
}
log.warn( "No permissions defined for the REST method and noPermission=false" );
containerRequestContext.abortWith( Response.status( Response.Status.FORBIDDEN ).build() );
return;
}
}
log.warn( "http path {} doesn't contain any informations regarding permissions ", //
containerRequestContext.getUriInfo().getRequestUri() );
// here we failed to authenticate so 403 as there is no detail on karma for this
// it must be marked as it's exposed
containerRequestContext.abortWith( Response.status( Response.Status.FORBIDDEN ).build() );
}