[wildfly-dev] How to set an authorized identity to EltyronSecurity Context

[Darran Lofthouse]

It sounds to me then that the place to start is within the SAML validation,
this is effectively an authentication step so should be ported over to an
Elytron based authentication - the end result of the authentication would
then be the required SecurityIdentity to propagate from container to
container.


On Thu, 31 May 2018 at 03:57 Jim Ma <ema at redhat.com> wrote:

> On 05/30/2018 09:47 PM, Darran Lofthouse wrote:
>
> I am currently gathering together some information regarding how the JCA
> subsystem handles the requirement of populating a Subject for propagation
> into a resource adapter, however there is a general question about what is
> attempting to be achieved here.
>
> Once an EJB is secured using WildFly Elytron the associated identity is
> not accessed as a Subject instead it is accessed a SecurityIdentity the
> current SecurityIdentity can always be retrieved by calling the current
> SecurityDomain: -
>
>
> http://wildfly-security.github.io/wildfly-elytron/1.3.x/api-javadoc/org/wildfly/security/auth/server/SecurityDomain.html#getCurrent--
>
> http://wildfly-security.github.io/wildfly-elytron/1.3.x/api-javadoc/org/wildfly/security/auth/server/SecurityDomain.html#getCurrentSecurityIdentity--
>
> The SecurityIdentity has some similarity with the Subject in that amongst
> other things it also contains a collection of public credentials and a
> collection of private credentials: -
>
>
> http://wildfly-security.github.io/wildfly-elytron/1.3.x/api-javadoc/org/wildfly/security/auth/server/SecurityIdentity.html#getPublicCredentials--
>
> http://wildfly-security.github.io/wildfly-elytron/1.3.x/api-javadoc/org/wildfly/security/auth/server/SecurityIdentity.html#getPrivateCredentials--
>
> So I think the very first question is has the SecurityIdentity been
> correctly populated with any delegated credentials?  If not that is going
> to be a pre-requisite for any follow on steps regardless.
>
> Then secondly what is it that is making use of this identity?  Why can't
> it be ported to make use of the Elytron authentication client APIs which
> amongst other things provide support for delegation from the current
> identity.
>
>
> If we need to we can look at a conversion to a Subject but we are only
> doing that where it is really required.
>
>
>   We don't have the SecurityIdentity populated, there is only principal
> and subject created by jbossws/CXF's saml validator.
>   We need to convert the subject/principal to Elytron's SecurityIdentity
> or something else, then later on EJB subystem with Elytron
>   security can retrieve this authenticated info without check it twice. So
> we'd like to know how can we convert a subject/principal
>   to Elytron's SecurityIdentity and let Elytron know this is already
> authenticated and authorized.
>
> Thanks,
> Jim
>
>
>
> Regards,
> Darran Lofthouse.
>
>
> On Wed, 30 May 2018 at 10:27 Alessio Soldano <asoldano at redhat.com> wrote:
>
>> As suggested by Darran, I'm forwarding the message below to the list on
>> behalf of Jim.
>> The classes Jim is referring to are at
>> https://github.com/wildfly/wildfly/tree/master/webservices/server-integration/src/main/java/org/jboss/as/webservices/security
>>
>>
>> ---------- Forwarded message ----------
>> From: Jim Ma <ema at redhat.com>
>> Date: Wed, May 30, 2018 at 9:03 AM
>> Subject: Set an authorized identity to EltyronSecurity Context
>> To: Darran Lofthouse <darran.lofthouse at redhat.com>
>> Cc: Alessio Soldano <asoldano at redhat.com>
>>
>>
>> Hi Darran,
>>
>> We are helping look at a customer issue which requires propagate the
>> authenticated subject from webservice subsystem to
>>
>> ejb subystem. With old security domain , we can do this with creating a
>> subject :
>>
>>     @Override
>>     public void pushSubjectContext(final Subject subject, final Principal
>> principal, final Object credential) {
>>         AccessController.doPrivileged(new PrivilegedAction<Void>() {
>>
>>             public Void run() {
>>                 SecurityContext securityContext =
>> SecurityContextAssociation.getSecurityContext();
>>                 if (securityContext == null) {
>>                     securityContext =
>> createSecurityContext(getSecurityDomain());
>> setSecurityContextOnAssociation(securityContext);
>>                 }
>> securityContext.getUtil().createSubjectInfo(principal, credential,
>> subject);
>>                 return null;
>>             }
>>         });
>>     }
>>
>>
>> After Elytron,  what is the equivalent thing to do this  then ejb can
>> retrieve this security without check this twice ?
>>
>> Thanks,
>>
>> Jim
>>
>>
>>
>>
>> --
>>
>> Alessio Soldano
>>
>> Associate Manager
>>
>> Red Hat
>>
>> <https://www.redhat.com>
>> <https://red.ht/sig>
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/wildfly-dev/attachments/20180531/b48cc423/attachment-0001.html