Package de.businesscode.bcdui.subjectsettings.services

Class OnBehalfIdentityRealm

java.lang.Object
org.apache.shiro.realm.CachingRealm
org.apache.shiro.realm.AuthenticatingRealm
de.businesscode.bcdui.subjectsettings.services.OnBehalfIdentityRealm
All Implemented Interfaces:
org.apache.shiro.authc.LogoutAware, org.apache.shiro.cache.CacheManagerAware, org.apache.shiro.lang.util.Initializable, org.apache.shiro.lang.util.Nameable, org.apache.shiro.realm.Realm
public class OnBehalfIdentityRealm extends org.apache.shiro.realm.AuthenticatingRealm
Verifies a trusted backend caller's on-behalf-of identity assertion (see RequestAuthenticationFilter/RequestAuthenticationToken): a shared secret establishes that the caller is a trusted client at all, then the asserted idType/onBehalfId is resolved to a BCD-UI technical user id. Currently there is only a global set of secrets - if per-client secrets are ever needed, the token/caller could later carry a client id and this realm could map it to its own secret, without changing anything about how it is wired up. Pure shiro.ini configuration, register once and add to the realm chain: 
 bcdOnBehalfIdentityRealm = de.businesscode.bcdui.subjectsettings.services.OnBehalfIdentityRealm
 bcdOnBehalfIdentityRealm.trustedClientsSecrets = ##shared-secret-1##, ##shared-secret-n##
 # Optional, defaults to DefaultUserIdResolver:
 # bcdOnBehalfIdentity.userIdResolverClass = com.project.MyUserIdResolver
 securityManager.realms = ..., $bcdOnBehalfIdentityRealm

  • Constructor Summary

    Constructors
    Constructor
    Description
    OnBehalfIdentityRealm()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    protected void
    assertCredentialsMatch(org.apache.shiro.authc.AuthenticationToken token, org.apache.shiro.authc.AuthenticationInfo info)
    Verification already happened in doGetAuthenticationInfo below - there is nothing left for Shiro's generic CredentialsMatcher to meaningfully compare here (same pattern as JdbcRealm uses for other externally-verified tokens).
    protected org.apache.shiro.authc.AuthenticationInfo
    doGetAuthenticationInfo(org.apache.shiro.authc.AuthenticationToken authToken)
    Take the AuthenticationToken and turns it into an actual Principial if the AuthenticationToken is valid.
    void
    setTrustedClientsSecrets(String trustedClientsSecrets)
    Set from shiro.ini: comma-separated shared secrets, any of which a trusted client may present.
    void
    setUserIdResolverClass(String className)
    Set from shiro.ini: overwrite if the default BindingItem-based lookup of DefaultUserIdResolver does not fit the project.
    boolean
    supports(org.apache.shiro.authc.AuthenticationToken token)
     

    Methods inherited from class org.apache.shiro.realm.AuthenticatingRealm

    afterCacheManagerSet, clearCachedAuthenticationInfo, doClearCache, getAuthenticationCache, getAuthenticationCacheKey, getAuthenticationCacheKey, getAuthenticationCacheName, getAuthenticationInfo, getAuthenticationTokenClass, getCredentialsMatcher, init, isAuthenticationCachingEnabled, isAuthenticationCachingEnabled, onInit, setAuthenticationCache, setAuthenticationCacheName, setAuthenticationCachingEnabled, setAuthenticationTokenClass, setCredentialsMatcher, setName

    Methods inherited from class org.apache.shiro.realm.CachingRealm

    clearCache, getAvailablePrincipal, getCacheManager, getName, isCachingEnabled, onLogout, setCacheManager, setCachingEnabled

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • OnBehalfIdentityRealm

      public OnBehalfIdentityRealm()

  • Method Details

    • setTrustedClientsSecrets

      public void setTrustedClientsSecrets(String trustedClientsSecrets)
      Set from shiro.ini: comma-separated shared secrets, any of which a trusted client may present.

    • setUserIdResolverClass

      public void setUserIdResolverClass(String className)
      Set from shiro.ini: overwrite if the default BindingItem-based lookup of DefaultUserIdResolver does not fit the project.

    • supports

      public boolean supports(org.apache.shiro.authc.AuthenticationToken token)
      Specified by:
      supports in interface org.apache.shiro.realm.Realm
      Overrides:
      supports in class org.apache.shiro.realm.AuthenticatingRealm

    • assertCredentialsMatch

      protected void assertCredentialsMatch(org.apache.shiro.authc.AuthenticationToken token, org.apache.shiro.authc.AuthenticationInfo info) throws org.apache.shiro.authc.AuthenticationException
      Verification already happened in doGetAuthenticationInfo below - there is nothing left for Shiro's generic CredentialsMatcher to meaningfully compare here (same pattern as JdbcRealm uses for other externally-verified tokens).
      Overrides:
      assertCredentialsMatch in class org.apache.shiro.realm.AuthenticatingRealm
      Throws:
      org.apache.shiro.authc.AuthenticationException

    • doGetAuthenticationInfo

      protected org.apache.shiro.authc.AuthenticationInfo doGetAuthenticationInfo(org.apache.shiro.authc.AuthenticationToken authToken) throws org.apache.shiro.authc.AuthenticationException
      Take the AuthenticationToken and turns it into an actual Principial if the AuthenticationToken is valid. It is valid, if the client knows one of our trustedClientsSecrets and userIdResolver can find a userId
      Specified by:
      doGetAuthenticationInfo in class org.apache.shiro.realm.AuthenticatingRealm
      Parameters:
      authToken - the authentication token containing the user's principal and credentials.
      Returns:
      Throws:
      org.apache.shiro.authc.AuthenticationException