@Test public void testAnonymousWithOneProxy() { final NiFiAuthenticationToken auth = (NiFiAuthenticationToken) x509AuthenticationProvider.authenticate(getX509Request(buildProxyChain(ANONYMOUS), PROXY_1)); final NiFiUser user = ((NiFiUserDetails) auth.getDetails()).getNiFiUser(); assertNotNull(user); assertEquals(StandardNiFiUser.ANONYMOUS_IDENTITY, user.getIdentity()); assertTrue(user.isAnonymous()); assertNotNull(user.getChain()); assertEquals(PROXY_1, user.getChain().getIdentity()); assertFalse(user.getChain().isAnonymous()); }
@Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { final X509AuthenticationRequestToken request = (X509AuthenticationRequestToken) authentication; final AuthenticationResponse authenticationResponse; try { authenticationResponse = certificateIdentityProvider.authenticate(request.getCertificates()); } catch (final IllegalArgumentException iae) { throw new InvalidAuthenticationException(iae.getMessage(), iae); } if (StringUtils.isBlank(request.getProxiedEntitiesChain())) { final String mappedIdentity = mapIdentity(authenticationResponse.getIdentity()); return new NiFiAuthenticationToken(new NiFiUserDetails(new StandardNiFiUser(mappedIdentity, request.getClientAddress()))); } else { final List<String> proxyChain = new ArrayList<>(ProxiedEntitiesUtils.tokenizeProxiedEntitiesChain(request.getProxiedEntitiesChain())); proxyChain.add(authenticationResponse.getIdentity()); NiFiUser proxy = null; for (final ListIterator<String> chainIter = proxyChain.listIterator(proxyChain.size()); chainIter.hasPrevious(); ) { String identity = chainIter.previous(); final boolean isAnonymous = StringUtils.isBlank(identity); if (isAnonymous) { identity = StandardNiFiUser.ANONYMOUS_IDENTITY; } else { identity = mapIdentity(identity); } if (chainIter.hasPrevious()) { final AuthorizationRequest proxyAuthorizationRequest = new AuthorizationRequest.Builder() .identity(identity) .anonymous(isAnonymous) .accessAttempt(true) .action(RequestAction.WRITE) .resource(ResourceFactory.getProxyResource()) .userContext(proxy == null ? getUserContext(request) : null) .build(); final AuthorizationResult proxyAuthorizationResult = authorizer.authorize(proxyAuthorizationRequest); if (!Result.Approved.equals(proxyAuthorizationResult.getResult())) { throw new UntrustedProxyException(String.format("Untrusted proxy %s", identity)); } } String clientAddress = (proxy == null) ? request.getClientAddress() : null; proxy = createUser(identity, proxy, clientAddress, isAnonymous); } return new NiFiAuthenticationToken(new NiFiUserDetails(proxy)); } }
X509AuthenticationProvider extends NiFiAuthenticationProvider { @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { final X509AuthenticationRequestToken request = (X509AuthenticationRequestToken) authentication; final AuthenticationResponse authenticationResponse; try { authenticationResponse = certificateIdentityProvider.authenticate(request.getCertificates()); } catch (final IllegalArgumentException iae) { throw new InvalidAuthenticationException(iae.getMessage(), iae); } if (StringUtils.isBlank(request.getProxiedEntitiesChain())) { final String mappedIdentity = mapIdentity(authenticationResponse.getIdentity()); return new NiFiAuthenticationToken(new NiFiUserDetails(new StandardNiFiUser(mappedIdentity, request.getClientAddress()))); } else { final List<String> proxyChain = new ArrayList<>(ProxiedEntitiesUtils.tokenizeProxiedEntitiesChain(request.getProxiedEntitiesChain())); proxyChain.add(authenticationResponse.getIdentity()); NiFiUser proxy = null; for (final ListIterator<String> chainIter = proxyChain.listIterator(proxyChain.size()); chainIter.hasPrevious(); ) { String identity = chainIter.previous(); final boolean isAnonymous = StringUtils.isBlank(identity); if (isAnonymous) { identity = StandardNiFiUser.ANONYMOUS_IDENTITY; } else { identity = mapIdentity(identity); } if (chainIter.hasPrevious()) { final AuthorizationRequest proxyAuthorizationRequest = new AuthorizationRequest.Builder() .identity(identity) .anonymous(isAnonymous) .accessAttempt(true) .action(RequestAction.WRITE) .resource(ResourceFactory.getProxyResource()) .userContext(proxy == null ? getUserContext(request) : null) .build(); final AuthorizationResult proxyAuthorizationResult = authorizer.authorize(proxyAuthorizationRequest); if (!Result.Approved.equals(proxyAuthorizationResult.getResult())) { throw new UntrustedProxyException(String.format("Untrusted proxy %s", identity)); } } String clientAddress = (proxy == null) ? request.getClientAddress() : null; proxy = createUser(identity, proxy, clientAddress, isAnonymous); } return new NiFiAuthenticationToken(new NiFiUserDetails(proxy)); } } }
X509AuthenticationProvider extends NiFiAuthenticationProvider { @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { final X509AuthenticationRequestToken request = (X509AuthenticationRequestToken) authentication; final AuthenticationResponse authenticationResponse; try { authenticationResponse = certificateIdentityProvider.authenticate(request.getCertificates()); } catch (final IllegalArgumentException iae) { throw new InvalidAuthenticationException(iae.getMessage(), iae); } if (StringUtils.isBlank(request.getProxiedEntitiesChain())) { final String mappedIdentity = mapIdentity(authenticationResponse.getIdentity()); return new NiFiAuthenticationToken(new NiFiUserDetails(new StandardNiFiUser(mappedIdentity, request.getClientAddress()))); } else { final List<String> proxyChain = new ArrayList<>(ProxiedEntitiesUtils.tokenizeProxiedEntitiesChain(request.getProxiedEntitiesChain())); proxyChain.add(authenticationResponse.getIdentity()); NiFiUser proxy = null; for (final ListIterator<String> chainIter = proxyChain.listIterator(proxyChain.size()); chainIter.hasPrevious(); ) { String identity = chainIter.previous(); final boolean isAnonymous = StringUtils.isBlank(identity); if (isAnonymous) { identity = StandardNiFiUser.ANONYMOUS_IDENTITY; } else { identity = mapIdentity(identity); } if (chainIter.hasPrevious()) { final AuthorizationRequest proxyAuthorizationRequest = new AuthorizationRequest.Builder() .identity(identity) .anonymous(isAnonymous) .accessAttempt(true) .action(RequestAction.WRITE) .resource(ResourceFactory.getProxyResource()) .userContext(proxy == null ? getUserContext(request) : null) .build(); final AuthorizationResult proxyAuthorizationResult = authorizer.authorize(proxyAuthorizationRequest); if (!Result.Approved.equals(proxyAuthorizationResult.getResult())) { throw new UntrustedProxyException(String.format("Untrusted proxy %s", identity)); } } String clientAddress = (proxy == null) ? request.getClientAddress() : null; proxy = createUser(identity, proxy, clientAddress, isAnonymous); } return new NiFiAuthenticationToken(new NiFiUserDetails(proxy)); } } X509AuthenticationProvider(final X509IdentityProvider certificateIdentityProvider, final Authorizer authorizer, final NiFiProperties nifiProperties); }
X509AuthenticationProvider extends NiFiAuthenticationProvider { @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { final X509AuthenticationRequestToken request = (X509AuthenticationRequestToken) authentication; final AuthenticationResponse authenticationResponse; try { authenticationResponse = certificateIdentityProvider.authenticate(request.getCertificates()); } catch (final IllegalArgumentException iae) { throw new InvalidAuthenticationException(iae.getMessage(), iae); } if (StringUtils.isBlank(request.getProxiedEntitiesChain())) { final String mappedIdentity = mapIdentity(authenticationResponse.getIdentity()); return new NiFiAuthenticationToken(new NiFiUserDetails(new StandardNiFiUser(mappedIdentity, request.getClientAddress()))); } else { final List<String> proxyChain = new ArrayList<>(ProxiedEntitiesUtils.tokenizeProxiedEntitiesChain(request.getProxiedEntitiesChain())); proxyChain.add(authenticationResponse.getIdentity()); NiFiUser proxy = null; for (final ListIterator<String> chainIter = proxyChain.listIterator(proxyChain.size()); chainIter.hasPrevious(); ) { String identity = chainIter.previous(); final boolean isAnonymous = StringUtils.isBlank(identity); if (isAnonymous) { identity = StandardNiFiUser.ANONYMOUS_IDENTITY; } else { identity = mapIdentity(identity); } if (chainIter.hasPrevious()) { final AuthorizationRequest proxyAuthorizationRequest = new AuthorizationRequest.Builder() .identity(identity) .anonymous(isAnonymous) .accessAttempt(true) .action(RequestAction.WRITE) .resource(ResourceFactory.getProxyResource()) .userContext(proxy == null ? getUserContext(request) : null) .build(); final AuthorizationResult proxyAuthorizationResult = authorizer.authorize(proxyAuthorizationRequest); if (!Result.Approved.equals(proxyAuthorizationResult.getResult())) { throw new UntrustedProxyException(String.format("Untrusted proxy %s", identity)); } } String clientAddress = (proxy == null) ? request.getClientAddress() : null; proxy = createUser(identity, proxy, clientAddress, isAnonymous); } return new NiFiAuthenticationToken(new NiFiUserDetails(proxy)); } } X509AuthenticationProvider(final X509IdentityProvider certificateIdentityProvider, final Authorizer authorizer, final NiFiProperties nifiProperties); @Override Authentication authenticate(Authentication authentication); @Override boolean supports(Class<?> authentication); }
X509AuthenticationProvider extends NiFiAuthenticationProvider { @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { final X509AuthenticationRequestToken request = (X509AuthenticationRequestToken) authentication; final AuthenticationResponse authenticationResponse; try { authenticationResponse = certificateIdentityProvider.authenticate(request.getCertificates()); } catch (final IllegalArgumentException iae) { throw new InvalidAuthenticationException(iae.getMessage(), iae); } if (StringUtils.isBlank(request.getProxiedEntitiesChain())) { final String mappedIdentity = mapIdentity(authenticationResponse.getIdentity()); return new NiFiAuthenticationToken(new NiFiUserDetails(new StandardNiFiUser(mappedIdentity, request.getClientAddress()))); } else { final List<String> proxyChain = new ArrayList<>(ProxiedEntitiesUtils.tokenizeProxiedEntitiesChain(request.getProxiedEntitiesChain())); proxyChain.add(authenticationResponse.getIdentity()); NiFiUser proxy = null; for (final ListIterator<String> chainIter = proxyChain.listIterator(proxyChain.size()); chainIter.hasPrevious(); ) { String identity = chainIter.previous(); final boolean isAnonymous = StringUtils.isBlank(identity); if (isAnonymous) { identity = StandardNiFiUser.ANONYMOUS_IDENTITY; } else { identity = mapIdentity(identity); } if (chainIter.hasPrevious()) { final AuthorizationRequest proxyAuthorizationRequest = new AuthorizationRequest.Builder() .identity(identity) .anonymous(isAnonymous) .accessAttempt(true) .action(RequestAction.WRITE) .resource(ResourceFactory.getProxyResource()) .userContext(proxy == null ? getUserContext(request) : null) .build(); final AuthorizationResult proxyAuthorizationResult = authorizer.authorize(proxyAuthorizationRequest); if (!Result.Approved.equals(proxyAuthorizationResult.getResult())) { throw new UntrustedProxyException(String.format("Untrusted proxy %s", identity)); } } String clientAddress = (proxy == null) ? request.getClientAddress() : null; proxy = createUser(identity, proxy, clientAddress, isAnonymous); } return new NiFiAuthenticationToken(new NiFiUserDetails(proxy)); } } X509AuthenticationProvider(final X509IdentityProvider certificateIdentityProvider, final Authorizer authorizer, final NiFiProperties nifiProperties); @Override Authentication authenticate(Authentication authentication); @Override boolean supports(Class<?> authentication);  }