2 * Copyright (C) 2017 EDIT
3 * European Distributed Institute of Taxonomy
4 * http://www.e-taxonomy.eu
6 * The contents of this file are subject to the Mozilla Public License Version 1.1
7 * See LICENSE.TXT at the top of this package for the full license terms.
9 package eu
.etaxonomy
.cdm
.api
.application
;
11 import java
.util
.ArrayList
;
12 import java
.util
.Collection
;
14 import org
.apache
.logging
.log4j
.LogManager
;
15 import org
.apache
.logging
.log4j
.Logger
;
16 import org
.springframework
.security
.access
.intercept
.RunAsUserToken
;
17 import org
.springframework
.security
.authentication
.AnonymousAuthenticationToken
;
18 import org
.springframework
.security
.authentication
.AuthenticationProvider
;
19 import org
.springframework
.security
.core
.Authentication
;
20 import org
.springframework
.security
.core
.GrantedAuthority
;
21 import org
.springframework
.security
.core
.context
.SecurityContext
;
22 import org
.springframework
.security
.core
.context
.SecurityContextHolder
;
26 * Helper class to work around the apparently broken @RunAs("ROLE_ADMIN")
27 * in spring see: https://jira.springsource.org/browse/SEC-1671
29 * @author a.kohlbecker
32 public class RunAsAuthenticator
{
34 private static final Logger logger
= LogManager
.getLogger();
37 * must match the key in eu/etaxonomy/cdm/services_security.xml
39 private static final String RUN_AS_KEY
= "TtlCx3pgKC4l";
41 // not to be autowired, since the FirstdataInserter must be usable without security
42 private AuthenticationProvider runAsAuthenticationProvider
= null;
44 private Authentication authentication
;
47 * needed to work around the broken @RunAs("ROLE_ADMIN") which seems to be
48 * broken in spring see: https://jira.springsource.org/browse/SEC-1671
51 public void runAsAuthentication(GrantedAuthority ga
) {
52 if(runAsAuthenticationProvider
== null){
53 logger
.debug("no RunAsAuthenticationProvider set, skipping run-as authentication");
57 SecurityContext securityContext
= SecurityContextHolder
.getContext();
58 authentication
= securityContext
.getAuthentication();
60 Collection
<GrantedAuthority
> rules
= new ArrayList
<>();
62 RunAsUserToken adminToken
= new RunAsUserToken(
67 (authentication
!= null ? authentication
.getClass() : AnonymousAuthenticationToken
.class));
69 Authentication runAsAuthentication
= runAsAuthenticationProvider
.authenticate(adminToken
);
70 SecurityContextHolder
.getContext().setAuthentication(runAsAuthentication
);
72 logger
.debug("switched to run-as authentication: " + runAsAuthentication
);
76 * needed to work around the broken @RunAs("ROLE_ADMIN") which
77 * seems to be broken in spring see: https://jira.springsource.org/browse/SEC-1671
79 public void restoreAuthentication() {
80 if(runAsAuthenticationProvider
== null){
81 logger
.debug("no RunAsAuthenticationProvider set, thus nothing to restore");
83 SecurityContext securityContext
= SecurityContextHolder
.getContext();
84 securityContext
.setAuthentication(authentication
);
85 logger
.debug("last authentication restored: " + (authentication
!= null ? authentication
: "NULL"));
88 public AuthenticationProvider
getRunAsAuthenticationProvider() {
89 return runAsAuthenticationProvider
;
91 public void setRunAsAuthenticationProvider(AuthenticationProvider runAsAuthenticationProvider
) {
92 this.runAsAuthenticationProvider
= runAsAuthenticationProvider
;