@Test public void getRealmRolesShouldReturnRoles() { X509Certificate[] certificates = new X509Certificate[2]; certificates[0] = x509Certificate; String cn1 = "foobar"; String cn2 = "barfoo"; X500Principal x500Principal1 = new X500Principal("CN=" + cn1 + ", OU=ou, o=PSA"); X500Principal x500Principal2 = new X500Principal("CN=" + cn2 + ", OU=ou, o=PSA"); when(x509Certificate.getIssuerX500Principal()).thenReturn(x500Principal1); X509Certificate x509Certificate2 = mock(X509Certificate.class); when(x509Certificate2.getIssuerX500Principal()).thenReturn(x500Principal2); certificates[1] = x509Certificate2; X509CertificatePrincipalProvider x509CertificatePp = new X509CertificatePrincipalProvider(certificates); Collection<PrincipalProvider<?>> list = new ArrayList<>(); list.add(x509CertificatePp); Set<String> roles = underTest.getRealmRoles(Principals.identityPrincipal("uid"), list); assertThat(roles).containsOnly(cn1, cn2); }
@Override public Set<String> getRealmRoles(PrincipalProvider<?> identityPrincipal, Collection<PrincipalProvider<?>> otherPrincipals) { Set<String> realmRoles = new HashSet<>(); Collection<PrincipalProvider<X509Certificate[]>> certificatePrincipals = Principals.getPrincipalsByType( otherPrincipals, X509Certificate[].class); if (certificatePrincipals.isEmpty()) { return Collections.emptySet(); } X509Certificate[] certificates = certificatePrincipals.iterator().next().get(); for (X509Certificate certificate : certificates) { String dn = certificate.getIssuerX500Principal().getName(X500Principal.RFC2253); LdapName ln; try { ln = new LdapName(dn); } catch (InvalidNameException e) { LOGGER.error("Certificate issuer does not have valid DN: " + dn, e); continue; } for (Rdn rdn : ln.getRdns()) { if (rdn.getType().equalsIgnoreCase(CN)) { realmRoles.add(rdn.getValue().toString()); break; } } } return realmRoles; }
X509CertificateRealm implements Realm { @Override public Set<String> getRealmRoles(PrincipalProvider<?> identityPrincipal, Collection<PrincipalProvider<?>> otherPrincipals) { Set<String> realmRoles = new HashSet<>(); Collection<PrincipalProvider<X509Certificate[]>> certificatePrincipals = Principals.getPrincipalsByType( otherPrincipals, X509Certificate[].class); if (certificatePrincipals.isEmpty()) { return Collections.emptySet(); } X509Certificate[] certificates = certificatePrincipals.iterator().next().get(); for (X509Certificate certificate : certificates) { String dn = certificate.getIssuerX500Principal().getName(X500Principal.RFC2253); LdapName ln; try { ln = new LdapName(dn); } catch (InvalidNameException e) { LOGGER.error("Certificate issuer does not have valid DN: " + dn, e); continue; } for (Rdn rdn : ln.getRdns()) { if (rdn.getType().equalsIgnoreCase(CN)) { realmRoles.add(rdn.getValue().toString()); break; } } } return realmRoles; } }
X509CertificateRealm implements Realm { @Override public Set<String> getRealmRoles(PrincipalProvider<?> identityPrincipal, Collection<PrincipalProvider<?>> otherPrincipals) { Set<String> realmRoles = new HashSet<>(); Collection<PrincipalProvider<X509Certificate[]>> certificatePrincipals = Principals.getPrincipalsByType( otherPrincipals, X509Certificate[].class); if (certificatePrincipals.isEmpty()) { return Collections.emptySet(); } X509Certificate[] certificates = certificatePrincipals.iterator().next().get(); for (X509Certificate certificate : certificates) { String dn = certificate.getIssuerX500Principal().getName(X500Principal.RFC2253); LdapName ln; try { ln = new LdapName(dn); } catch (InvalidNameException e) { LOGGER.error("Certificate issuer does not have valid DN: " + dn, e); continue; } for (Rdn rdn : ln.getRdns()) { if (rdn.getType().equalsIgnoreCase(CN)) { realmRoles.add(rdn.getValue().toString()); break; } } } return realmRoles; } @Inject protected  X509CertificateRealm(@Named("X509CertificateRealm-role-mapping") RoleMapping roleMapping,
            @Named("X509CertificateRealm-role-permission-resolver") RolePermissionResolver rolePermissionResolver); }
X509CertificateRealm implements Realm { @Override public Set<String> getRealmRoles(PrincipalProvider<?> identityPrincipal, Collection<PrincipalProvider<?>> otherPrincipals) { Set<String> realmRoles = new HashSet<>(); Collection<PrincipalProvider<X509Certificate[]>> certificatePrincipals = Principals.getPrincipalsByType( otherPrincipals, X509Certificate[].class); if (certificatePrincipals.isEmpty()) { return Collections.emptySet(); } X509Certificate[] certificates = certificatePrincipals.iterator().next().get(); for (X509Certificate certificate : certificates) { String dn = certificate.getIssuerX500Principal().getName(X500Principal.RFC2253); LdapName ln; try { ln = new LdapName(dn); } catch (InvalidNameException e) { LOGGER.error("Certificate issuer does not have valid DN: " + dn, e); continue; } for (Rdn rdn : ln.getRdns()) { if (rdn.getType().equalsIgnoreCase(CN)) { realmRoles.add(rdn.getValue().toString()); break; } } } return realmRoles; } @Inject protected  X509CertificateRealm(@Named("X509CertificateRealm-role-mapping") RoleMapping roleMapping,
            @Named("X509CertificateRealm-role-permission-resolver") RolePermissionResolver rolePermissionResolver); @Override AuthenticationInfo getAuthenticationInfo(AuthenticationToken token); @Override Set<String> getRealmRoles(PrincipalProvider<?> identityPrincipal,
            Collection<PrincipalProvider<?>> otherPrincipals); @Override RoleMapping getRoleMapping(); @Override RolePermissionResolver getRolePermissionResolver(); @Override Class<? extends AuthenticationToken> supportedToken(); }
X509CertificateRealm implements Realm { @Override public Set<String> getRealmRoles(PrincipalProvider<?> identityPrincipal, Collection<PrincipalProvider<?>> otherPrincipals) { Set<String> realmRoles = new HashSet<>(); Collection<PrincipalProvider<X509Certificate[]>> certificatePrincipals = Principals.getPrincipalsByType( otherPrincipals, X509Certificate[].class); if (certificatePrincipals.isEmpty()) { return Collections.emptySet(); } X509Certificate[] certificates = certificatePrincipals.iterator().next().get(); for (X509Certificate certificate : certificates) { String dn = certificate.getIssuerX500Principal().getName(X500Principal.RFC2253); LdapName ln; try { ln = new LdapName(dn); } catch (InvalidNameException e) { LOGGER.error("Certificate issuer does not have valid DN: " + dn, e); continue; } for (Rdn rdn : ln.getRdns()) { if (rdn.getType().equalsIgnoreCase(CN)) { realmRoles.add(rdn.getValue().toString()); break; } } } return realmRoles; } @Inject protected  X509CertificateRealm(@Named("X509CertificateRealm-role-mapping") RoleMapping roleMapping,
            @Named("X509CertificateRealm-role-permission-resolver") RolePermissionResolver rolePermissionResolver); @Override AuthenticationInfo getAuthenticationInfo(AuthenticationToken token); @Override Set<String> getRealmRoles(PrincipalProvider<?> identityPrincipal,
            Collection<PrincipalProvider<?>> otherPrincipals); @Override RoleMapping getRoleMapping(); @Override RolePermissionResolver getRolePermissionResolver(); @Override Class<? extends AuthenticationToken> supportedToken();  }