Package org.apache.syncope.core.spring.security

Class AuthDataAccessor

java.lang.Object

org.apache.syncope.core.spring.security.AuthDataAccessor

Direct Known Subclasses:

InstrumentedAuthDataAccessor

public class AuthDataAccessor
extends Object

Domain-sensible (via @Transactional) access to authentication / authorization data.

See Also:

• JWTAuthenticationFilter
• UsernamePasswordAuthenticationProvider
• SyncopeAuthenticationDetails

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	AuthDataAccessor.JWTAuthResult
static final record	AuthDataAccessor.UsernamePasswordAuthResult

Field Summary

Fields

Modifier and Type	Field	Description
protected final AccessTokenDAO	accessTokenDAO
protected static final Set<SyncopeGrantedAuthority>	ANONYMOUS_AUTHORITIES
protected static final Function<String,Set<String>>	ANYOBJECT_MANAGER_ENTITLEMENTS
protected final AnySearchDAO	anySearchDAO
protected final AuditManager	auditManager
protected static final Set<String>	BASE_MANAGER_ENTITLEMENTS
protected final ConfParamOps	confParamOps
protected final ConnectorManager	connectorManager
protected final DefaultCredentialChecker	credentialChecker
protected final DelegationDAO	delegationDAO
protected final EncryptorManager	encryptorManager
protected static final Set<String>	GROUP_MANAGER_ENTITLEMENTS
protected final GroupDAO	groupDAO
protected static final Logger	LOG
protected final MappingManager	mappingManager
protected static final Set<SyncopeGrantedAuthority>	MFA_ENROLL_AUTHORITIES
protected static final Set<SyncopeGrantedAuthority>	MUST_CHANGE_PASSWORD_AUTHORITIES
protected final RealmSearchDAO	realmSearchDAO
protected final ExternalResourceDAO	resourceDAO
protected final RoleDAO	roleDAO
protected final SecurityProperties	securityProperties
protected final dev.samstevens.totp.code.CodeVerifier	totpCodeVerifier
protected static final Set<String>	USER_MANAGER_ENTITLEMENTS
protected final UserDAO	userDAO

Constructor Summary

Constructors

Constructor

Description

AuthDataAccessor(SecurityProperties securityProperties, EncryptorManager encryptorManager, dev.samstevens.totp.code.CodeVerifier totpCodeVerifier, RealmSearchDAO realmSearchDAO, UserDAO userDAO, GroupDAO groupDAO, AnySearchDAO anySearchDAO, AccessTokenDAO accessTokenDAO, ConfParamOps confParamOps, RoleDAO roleDAO, DelegationDAO delegationDAO, ExternalResourceDAO resourceDAO, ConnectorManager connectorManager, AuditManager auditManager, MappingManager mappingManager, DefaultCredentialChecker credentialChecker, List<JWTSSOProvider> jwtSSOProviders)

Method Summary

Modifier and Type	Method	Description
void	audit(String domain, String username, String delegationKey, OpEvent.Outcome outcome, Object output, Object... input)
AuthDataAccessor.UsernamePasswordAuthResult	authenticate(Optional<Domain> domain, Authentication authentication)	Attempts to authenticate the given credentials against internal storage and pass-through resources (if configured): the first succeeding causes global success.
AuthDataAccessor.JWTAuthResult	authenticate(JWTAuthentication authentication)
protected AuthDataAccessor.UsernamePasswordAuthResult	authenticateAdmin(Optional<Domain> domain, Authentication authentication, boolean mfaEnabled)
protected AuthDataAccessor.UsernamePasswordAuthResult	authenticateAnonymous(Authentication authentication)
protected AuthDataAccessor.UsernamePasswordAuthResult	authenticateUser(String domain, Authentication authentication, boolean mfaEnabled, User user)
protected static Set<SyncopeGrantedAuthority>	buildAuthorities(Map<String,Set<String>> entForRealms)
protected AuthDataAccessor.UsernamePasswordAuthResult	doAuthenticateAdmin(String domainKey, boolean mfaEnabled, String password, String otp, CipherAlgorithm cipherAlgorithm, String encoded, String mfaSecret)
protected static Set<SyncopeGrantedAuthority>	getAdminAuthorities()
Set<SyncopeGrantedAuthority>	getAuthorities(String username, String delegationKey)
protected static Set<SyncopeGrantedAuthority>	getDelegatedAuthorities(Delegation delegation)
protected String	getDelegationKey(SyncopeAuthenticationDetails details, String delegatedKey)
JWTSSOProvider	getJWTSSOProvider(String issuer)
protected Set<ExternalResource>	getPassthroughResources(User user)
protected Set<SyncopeGrantedAuthority>	getUserAuthorities(User user)
protected static void	populateEntForRealms(Map<String,Set<String>> entForRealms, String entitlement, Collection<String> toAdd)
void	removeExpired(String tokenKey)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

LOG

protected static final Logger LOG

ANONYMOUS_AUTHORITIES

protected static final Set<SyncopeGrantedAuthority> ANONYMOUS_AUTHORITIES

MUST_CHANGE_PASSWORD_AUTHORITIES

protected static final Set<SyncopeGrantedAuthority> MUST_CHANGE_PASSWORD_AUTHORITIES

MFA_ENROLL_AUTHORITIES

protected static final Set<SyncopeGrantedAuthority> MFA_ENROLL_AUTHORITIES

BASE_MANAGER_ENTITLEMENTS

protected static final Set<String> BASE_MANAGER_ENTITLEMENTS

USER_MANAGER_ENTITLEMENTS

protected static final Set<String> USER_MANAGER_ENTITLEMENTS

GROUP_MANAGER_ENTITLEMENTS

protected static final Set<String> GROUP_MANAGER_ENTITLEMENTS

ANYOBJECT_MANAGER_ENTITLEMENTS

protected static final Function<String,Set<String>> ANYOBJECT_MANAGER_ENTITLEMENTS

securityProperties

protected final SecurityProperties securityProperties

encryptorManager

protected final EncryptorManager encryptorManager

totpCodeVerifier

protected final dev.samstevens.totp.code.CodeVerifier totpCodeVerifier

realmSearchDAO

protected final RealmSearchDAO realmSearchDAO

userDAO

protected final UserDAO userDAO

groupDAO

protected final GroupDAO groupDAO

anySearchDAO

protected final AnySearchDAO anySearchDAO

accessTokenDAO

protected final AccessTokenDAO accessTokenDAO

confParamOps

protected final ConfParamOps confParamOps

roleDAO

protected final RoleDAO roleDAO

delegationDAO

protected final DelegationDAO delegationDAO

resourceDAO

protected final ExternalResourceDAO resourceDAO

connectorManager

protected final ConnectorManager connectorManager

auditManager

protected final AuditManager auditManager

mappingManager

protected final MappingManager mappingManager

credentialChecker

protected final DefaultCredentialChecker credentialChecker

Constructor Details

AuthDataAccessor

public AuthDataAccessor(SecurityProperties securityProperties,
 EncryptorManager encryptorManager,
 dev.samstevens.totp.code.CodeVerifier totpCodeVerifier,
 RealmSearchDAO realmSearchDAO,
 UserDAO userDAO,
 GroupDAO groupDAO,
 AnySearchDAO anySearchDAO,
 AccessTokenDAO accessTokenDAO,
 ConfParamOps confParamOps,
 RoleDAO roleDAO,
 DelegationDAO delegationDAO,
 ExternalResourceDAO resourceDAO,
 ConnectorManager connectorManager,
 AuditManager auditManager,
 MappingManager mappingManager,
 DefaultCredentialChecker credentialChecker,
 List<JWTSSOProvider> jwtSSOProviders)

Method Details

getAdminAuthorities

protected static Set<SyncopeGrantedAuthority> getAdminAuthorities()

buildAuthorities

protected static Set<SyncopeGrantedAuthority> buildAuthorities(Map<String,Set<String>> entForRealms)

populateEntForRealms

protected static void populateEntForRealms(Map<String,Set<String>> entForRealms,
 String entitlement,
 Collection<String> toAdd)

getDelegatedAuthorities

protected static Set<SyncopeGrantedAuthority> getDelegatedAuthorities(Delegation delegation)

getJWTSSOProvider

public JWTSSOProvider getJWTSSOProvider(String issuer)

getDelegationKey

protected String getDelegationKey(SyncopeAuthenticationDetails details,
 String delegatedKey)

authenticateAnonymous

protected AuthDataAccessor.UsernamePasswordAuthResult authenticateAnonymous(Authentication authentication)

doAuthenticateAdmin

protected AuthDataAccessor.UsernamePasswordAuthResult doAuthenticateAdmin(String domainKey,
 boolean mfaEnabled,
 String password,
 String otp,
 CipherAlgorithm cipherAlgorithm,
 String encoded,
 String mfaSecret)

authenticateAdmin

protected AuthDataAccessor.UsernamePasswordAuthResult authenticateAdmin(Optional<Domain> domain,
 Authentication authentication,
 boolean mfaEnabled)

getPassthroughResources

protected Set<ExternalResource> getPassthroughResources(User user)

authenticateUser

protected AuthDataAccessor.UsernamePasswordAuthResult authenticateUser(String domain,
 Authentication authentication,
 boolean mfaEnabled,
 User user)

authenticate

@Transactional(noRollbackFor=org.springframework.security.authentication.DisabledException.class)
public AuthDataAccessor.UsernamePasswordAuthResult authenticate(Optional<Domain> domain,
 Authentication authentication)

Attempts to authenticate the given credentials against internal storage and pass-through resources (if configured): the first succeeding causes global success.

Parameters:

domain - domain

authentication - given credentials

Returns:

authentication result

getUserAuthorities

protected Set<SyncopeGrantedAuthority> getUserAuthorities(User user)

getAuthorities

@Transactional
public Set<SyncopeGrantedAuthority> getAuthorities(String username,
 String delegationKey)

authenticate

@Transactional
public AuthDataAccessor.JWTAuthResult authenticate(JWTAuthentication authentication)

removeExpired

@Transactional
public void removeExpired(String tokenKey)

audit

@Transactional(readOnly=true)
public void audit(String domain,
 String username,
 String delegationKey,
 OpEvent.Outcome outcome,
 Object output,
 Object... input)