@Test @Ignore public void testDoFilter() throws Exception { Users users = createNiceMock(Users.class); AuthenticationEntryPoint entryPoint = createNiceMock(AuthenticationEntryPoint.class); HttpServletRequest request = createNiceMock(HttpServletRequest.class); HttpServletResponse response = createNiceMock(HttpServletResponse.class); FilterChain chain = createNiceMock(FilterChain.class); AmbariGrantedAuthority authority = createNiceMock(AmbariGrantedAuthority.class); User user = createNiceMock(User.class); SignedJWT signedJWT = getSignedToken(); JwtAuthenticationProperties properties = createTestProperties(); JwtAuthenticationFilter filter = createMockBuilder(JwtAuthenticationFilter.class). addMockedMethod("getJWTFromCookie"). withConstructor(properties, entryPoint, users).createNiceMock(); expect(filter.getJWTFromCookie(anyObject(HttpServletRequest.class))).andReturn(signedJWT.serialize()); expect(users.getUser(eq("test-user"), eq(UserType.JWT))).andReturn(null).once(); expect(users.getUser(eq("test-user"), eq(UserType.JWT))).andReturn(user).anyTimes(); users.createUser(eq("test-user"), anyObject(String.class), eq(UserType.JWT), eq(true), eq(false)); expectLastCall(); expect(users.getUserAuthorities(eq("test-user"), eq(UserType.JWT))).andReturn(Collections.singletonList(authority)); expect(user.getUserName()).andReturn("test-user"); expect(user.getUserType()).andReturn(UserType.JWT); expect(user.getUserId()).andReturn(1); replay(users, request, response, chain, filter, entryPoint, user, authority); filter.doFilter(request, response, chain); Authentication authentication = SecurityContextHolder.getContext().getAuthentication(); assertEquals(1L, AuthorizationHelper.getAuthenticatedId()); verify(users, request, response, chain, filter, entryPoint, user, authority); assertEquals(true, authentication.isAuthenticated()); }
@Override public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException { if (jwtProperties == null) { filterChain.doFilter(servletRequest, servletResponse); return; } HttpServletRequest httpServletRequest = (HttpServletRequest) servletRequest; HttpServletResponse httpServletResponse = (HttpServletResponse) servletResponse; try { String serializedJWT = getJWTFromCookie(httpServletRequest); if (serializedJWT != null && isAuthenticationRequired(serializedJWT)) { try { SignedJWT jwtToken = SignedJWT.parse(serializedJWT); boolean valid = validateToken(jwtToken); if (valid) { String userName = jwtToken.getJWTClaimsSet().getSubject(); User user = users.getUser(userName, UserType.JWT); if (user == null) { user = users.getUser(userName, UserType.LDAP); } if (user == null) { User existingUser = users.getUser(userName, UserType.LOCAL); if (existingUser != null) { LOG.error("Access for JWT user [{}] restricted. Detected conflict with local user ", userName); } throw new AuthenticationJwtUserNotFoundException(userName, "Cannot find user from JWT. Please, ensure LDAP is configured and users are synced."); } Collection<AmbariGrantedAuthority> userAuthorities = users.getUserAuthorities(user.getUserName(), user.getUserType()); JwtAuthentication authentication = new JwtAuthentication(serializedJWT, user, userAuthorities); authentication.setAuthenticated(true); SecurityContextHolder.getContext().setAuthentication(authentication); onSuccessfulAuthentication(httpServletRequest, httpServletResponse, authentication); } else { throw new BadCredentialsException("Invalid JWT token"); } } catch (ParseException e) { LOG.warn("Unable to parse the JWT token", e); throw new BadCredentialsException("Unable to parse the JWT token - " + e.getLocalizedMessage()); } } else { LOG.trace("No JWT cookie found, do nothing"); } filterChain.doFilter(servletRequest, servletResponse); } catch (AuthenticationException e) { LOG.warn("JWT authentication failed - {}", e.getLocalizedMessage()); SecurityContextHolder.clearContext(); onUnsuccessfulAuthentication(httpServletRequest, httpServletResponse, e); if (ignoreFailure) { filterChain.doFilter(servletRequest, servletResponse); } else { entryPoint.commence(httpServletRequest, httpServletResponse, e); } } }
JwtAuthenticationFilter implements AmbariAuthenticationFilter { @Override public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException { if (jwtProperties == null) { filterChain.doFilter(servletRequest, servletResponse); return; } HttpServletRequest httpServletRequest = (HttpServletRequest) servletRequest; HttpServletResponse httpServletResponse = (HttpServletResponse) servletResponse; try { String serializedJWT = getJWTFromCookie(httpServletRequest); if (serializedJWT != null && isAuthenticationRequired(serializedJWT)) { try { SignedJWT jwtToken = SignedJWT.parse(serializedJWT); boolean valid = validateToken(jwtToken); if (valid) { String userName = jwtToken.getJWTClaimsSet().getSubject(); User user = users.getUser(userName, UserType.JWT); if (user == null) { user = users.getUser(userName, UserType.LDAP); } if (user == null) { User existingUser = users.getUser(userName, UserType.LOCAL); if (existingUser != null) { LOG.error("Access for JWT user [{}] restricted. Detected conflict with local user ", userName); } throw new AuthenticationJwtUserNotFoundException(userName, "Cannot find user from JWT. Please, ensure LDAP is configured and users are synced."); } Collection<AmbariGrantedAuthority> userAuthorities = users.getUserAuthorities(user.getUserName(), user.getUserType()); JwtAuthentication authentication = new JwtAuthentication(serializedJWT, user, userAuthorities); authentication.setAuthenticated(true); SecurityContextHolder.getContext().setAuthentication(authentication); onSuccessfulAuthentication(httpServletRequest, httpServletResponse, authentication); } else { throw new BadCredentialsException("Invalid JWT token"); } } catch (ParseException e) { LOG.warn("Unable to parse the JWT token", e); throw new BadCredentialsException("Unable to parse the JWT token - " + e.getLocalizedMessage()); } } else { LOG.trace("No JWT cookie found, do nothing"); } filterChain.doFilter(servletRequest, servletResponse); } catch (AuthenticationException e) { LOG.warn("JWT authentication failed - {}", e.getLocalizedMessage()); SecurityContextHolder.clearContext(); onUnsuccessfulAuthentication(httpServletRequest, httpServletResponse, e); if (ignoreFailure) { filterChain.doFilter(servletRequest, servletResponse); } else { entryPoint.commence(httpServletRequest, httpServletResponse, e); } } } }
JwtAuthenticationFilter implements AmbariAuthenticationFilter { @Override public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException { if (jwtProperties == null) { filterChain.doFilter(servletRequest, servletResponse); return; } HttpServletRequest httpServletRequest = (HttpServletRequest) servletRequest; HttpServletResponse httpServletResponse = (HttpServletResponse) servletResponse; try { String serializedJWT = getJWTFromCookie(httpServletRequest); if (serializedJWT != null && isAuthenticationRequired(serializedJWT)) { try { SignedJWT jwtToken = SignedJWT.parse(serializedJWT); boolean valid = validateToken(jwtToken); if (valid) { String userName = jwtToken.getJWTClaimsSet().getSubject(); User user = users.getUser(userName, UserType.JWT); if (user == null) { user = users.getUser(userName, UserType.LDAP); } if (user == null) { User existingUser = users.getUser(userName, UserType.LOCAL); if (existingUser != null) { LOG.error("Access for JWT user [{}] restricted. Detected conflict with local user ", userName); } throw new AuthenticationJwtUserNotFoundException(userName, "Cannot find user from JWT. Please, ensure LDAP is configured and users are synced."); } Collection<AmbariGrantedAuthority> userAuthorities = users.getUserAuthorities(user.getUserName(), user.getUserType()); JwtAuthentication authentication = new JwtAuthentication(serializedJWT, user, userAuthorities); authentication.setAuthenticated(true); SecurityContextHolder.getContext().setAuthentication(authentication); onSuccessfulAuthentication(httpServletRequest, httpServletResponse, authentication); } else { throw new BadCredentialsException("Invalid JWT token"); } } catch (ParseException e) { LOG.warn("Unable to parse the JWT token", e); throw new BadCredentialsException("Unable to parse the JWT token - " + e.getLocalizedMessage()); } } else { LOG.trace("No JWT cookie found, do nothing"); } filterChain.doFilter(servletRequest, servletResponse); } catch (AuthenticationException e) { LOG.warn("JWT authentication failed - {}", e.getLocalizedMessage()); SecurityContextHolder.clearContext(); onUnsuccessfulAuthentication(httpServletRequest, httpServletResponse, e); if (ignoreFailure) { filterChain.doFilter(servletRequest, servletResponse); } else { entryPoint.commence(httpServletRequest, httpServletResponse, e); } } } JwtAuthenticationFilter(Configuration configuration, AuthenticationEntryPoint entryPoint, Users users);  JwtAuthenticationFilter(JwtAuthenticationProperties jwtProperties, AuthenticationEntryPoint entryPoint,
                                 Users users); }
JwtAuthenticationFilter implements AmbariAuthenticationFilter { @Override public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException { if (jwtProperties == null) { filterChain.doFilter(servletRequest, servletResponse); return; } HttpServletRequest httpServletRequest = (HttpServletRequest) servletRequest; HttpServletResponse httpServletResponse = (HttpServletResponse) servletResponse; try { String serializedJWT = getJWTFromCookie(httpServletRequest); if (serializedJWT != null && isAuthenticationRequired(serializedJWT)) { try { SignedJWT jwtToken = SignedJWT.parse(serializedJWT); boolean valid = validateToken(jwtToken); if (valid) { String userName = jwtToken.getJWTClaimsSet().getSubject(); User user = users.getUser(userName, UserType.JWT); if (user == null) { user = users.getUser(userName, UserType.LDAP); } if (user == null) { User existingUser = users.getUser(userName, UserType.LOCAL); if (existingUser != null) { LOG.error("Access for JWT user [{}] restricted. Detected conflict with local user ", userName); } throw new AuthenticationJwtUserNotFoundException(userName, "Cannot find user from JWT. Please, ensure LDAP is configured and users are synced."); } Collection<AmbariGrantedAuthority> userAuthorities = users.getUserAuthorities(user.getUserName(), user.getUserType()); JwtAuthentication authentication = new JwtAuthentication(serializedJWT, user, userAuthorities); authentication.setAuthenticated(true); SecurityContextHolder.getContext().setAuthentication(authentication); onSuccessfulAuthentication(httpServletRequest, httpServletResponse, authentication); } else { throw new BadCredentialsException("Invalid JWT token"); } } catch (ParseException e) { LOG.warn("Unable to parse the JWT token", e); throw new BadCredentialsException("Unable to parse the JWT token - " + e.getLocalizedMessage()); } } else { LOG.trace("No JWT cookie found, do nothing"); } filterChain.doFilter(servletRequest, servletResponse); } catch (AuthenticationException e) { LOG.warn("JWT authentication failed - {}", e.getLocalizedMessage()); SecurityContextHolder.clearContext(); onUnsuccessfulAuthentication(httpServletRequest, httpServletResponse, e); if (ignoreFailure) { filterChain.doFilter(servletRequest, servletResponse); } else { entryPoint.commence(httpServletRequest, httpServletResponse, e); } } } JwtAuthenticationFilter(Configuration configuration, AuthenticationEntryPoint entryPoint, Users users);  JwtAuthenticationFilter(JwtAuthenticationProperties jwtProperties, AuthenticationEntryPoint entryPoint,
                                 Users users); @Override boolean shouldApply(HttpServletRequest httpServletRequest); @Override void init(FilterConfig filterConfig); @Override void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain); @Override void destroy(); }
JwtAuthenticationFilter implements AmbariAuthenticationFilter { @Override public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException { if (jwtProperties == null) { filterChain.doFilter(servletRequest, servletResponse); return; } HttpServletRequest httpServletRequest = (HttpServletRequest) servletRequest; HttpServletResponse httpServletResponse = (HttpServletResponse) servletResponse; try { String serializedJWT = getJWTFromCookie(httpServletRequest); if (serializedJWT != null && isAuthenticationRequired(serializedJWT)) { try { SignedJWT jwtToken = SignedJWT.parse(serializedJWT); boolean valid = validateToken(jwtToken); if (valid) { String userName = jwtToken.getJWTClaimsSet().getSubject(); User user = users.getUser(userName, UserType.JWT); if (user == null) { user = users.getUser(userName, UserType.LDAP); } if (user == null) { User existingUser = users.getUser(userName, UserType.LOCAL); if (existingUser != null) { LOG.error("Access for JWT user [{}] restricted. Detected conflict with local user ", userName); } throw new AuthenticationJwtUserNotFoundException(userName, "Cannot find user from JWT. Please, ensure LDAP is configured and users are synced."); } Collection<AmbariGrantedAuthority> userAuthorities = users.getUserAuthorities(user.getUserName(), user.getUserType()); JwtAuthentication authentication = new JwtAuthentication(serializedJWT, user, userAuthorities); authentication.setAuthenticated(true); SecurityContextHolder.getContext().setAuthentication(authentication); onSuccessfulAuthentication(httpServletRequest, httpServletResponse, authentication); } else { throw new BadCredentialsException("Invalid JWT token"); } } catch (ParseException e) { LOG.warn("Unable to parse the JWT token", e); throw new BadCredentialsException("Unable to parse the JWT token - " + e.getLocalizedMessage()); } } else { LOG.trace("No JWT cookie found, do nothing"); } filterChain.doFilter(servletRequest, servletResponse); } catch (AuthenticationException e) { LOG.warn("JWT authentication failed - {}", e.getLocalizedMessage()); SecurityContextHolder.clearContext(); onUnsuccessfulAuthentication(httpServletRequest, httpServletResponse, e); if (ignoreFailure) { filterChain.doFilter(servletRequest, servletResponse); } else { entryPoint.commence(httpServletRequest, httpServletResponse, e); } } } JwtAuthenticationFilter(Configuration configuration, AuthenticationEntryPoint entryPoint, Users users);  JwtAuthenticationFilter(JwtAuthenticationProperties jwtProperties, AuthenticationEntryPoint entryPoint,
                                 Users users); @Override boolean shouldApply(HttpServletRequest httpServletRequest); @Override void init(FilterConfig filterConfig); @Override void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain); @Override void destroy();  }