import javax.security.auth.message.callback.GroupPrincipalCallback; //导入依赖的package包/类
@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject) throws AuthException {

    HttpServletRequest request = (HttpServletRequest) messageInfo.getRequestMessage();
    LOGGER.log(Level.FINE, "Validating request @" + request.getMethod() + " " + request.getRequestURI());

    String login = (String) request.getSession().getAttribute("login");
    String groups = (String) request.getSession().getAttribute("groups");

    CallerPrincipalCallback callerPrincipalCallback = new CallerPrincipalCallback(clientSubject, login);
    GroupPrincipalCallback groupPrincipalCallback = new GroupPrincipalCallback(clientSubject, new String[]{groups});
    Callback[] callbacks = new Callback[]{callerPrincipalCallback, groupPrincipalCallback};

    try {
        callbackHandler.handle(callbacks);
    } catch (IOException | UnsupportedCallbackException e) {
        throw new AuthException(e.getMessage());
    }

    return AuthStatus.SUCCESS;
}
 

import javax.security.auth.message.callback.GroupPrincipalCallback; //导入依赖的package包/类
@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject) throws AuthException {

    HttpServletRequest request = (HttpServletRequest) messageInfo.getRequestMessage();
    LOGGER.log(Level.FINE, "Validating request @" + request.getMethod() + " " + request.getRequestURI());

    CallerPrincipalCallback callerPrincipalCallback = new CallerPrincipalCallback(clientSubject, "");
    GroupPrincipalCallback groupPrincipalCallback = new GroupPrincipalCallback(clientSubject, new String[]{UserGroupMapping.GUEST_ROLE_ID});
    Callback[] callbacks = {callerPrincipalCallback, groupPrincipalCallback};

    try {
        callbackHandler.handle(callbacks);
    } catch (IOException | UnsupportedCallbackException e) {
        throw new AuthException(e.getMessage());
    }

    return AuthStatus.SUCCESS;

}
 

import javax.security.auth.message.callback.GroupPrincipalCallback; //导入依赖的package包/类
/**
 * Updates the principal for the subject. This is done through the
 * callbacks.
 *
 * @param subject
 *            subject
 * @param jwtPayload
 *            JWT payload
 * @throws AuthException
 * @throws GeneralSecurityException
 */
private void updateSubjectPrincipal(final Subject subject,
    final JsonObject jwtPayload)
        throws GeneralSecurityException {

    try {
        final String iss = googleWorkaround(jwtPayload.getString("iss"));
        handler.handle(
            new Callback[] {
                new CallerPrincipalCallback(subject,
                    UriBuilder.fromUri(iss).userInfo(jwtPayload.getString("sub")).build()
                        .toASCIIString()),
                new GroupPrincipalCallback(subject, new String[] {
                    iss
                        })
        });
    } catch (final IOException
        | UnsupportedCallbackException e) {
        // Should not happen
        Log.getInstance().log(Level.SEVERE, "updatePrincipalException", e.getMessage());
        Log.getInstance().throwing(this.getClass().getName(), "updateSubjectPrincipal", e);
        throw new AuthException(MessageFormat.format(Log.r("updatePrincipalException"), e.getMessage()));
    }
}
 

import javax.security.auth.message.callback.GroupPrincipalCallback; //导入依赖的package包/类
/**
 * Updates the principal for the subject. This is done through the
 * callbacks.
 *
 * @param subject
 *            subject
 * @param jwtPayload
 *            JWT payload
 * @throws AuthException
 * @throws GeneralSecurityException
 */
private void updateSubjectPrincipal(final Subject subject,
    final JsonObject jwtPayload,
    final ValidateContext context) throws GeneralSecurityException {

    try {
        final String iss = googleWorkaround(jwtPayload.getString("iss"));
        context.getHandler()
            .handle(new Callback[] {
                new CallerPrincipalCallback(subject, UriBuilder.fromUri(iss)
                    .userInfo(jwtPayload.getString("sub"))
                    .build()
                    .toASCIIString()),
                new GroupPrincipalCallback(subject, new String[] {
                    iss
                        })
        });
    } catch (final IOException
        | UnsupportedCallbackException e) {
        // Should not happen
        LOG.log(Level.SEVERE, "updatePrincipalException", e.getMessage());
        LOG.throwing(this.getClass()
            .getName(), "updateSubjectPrincipal", e);
        throw new AuthException(MessageFormat.format(Log.r("updatePrincipalException"), e.getMessage()));
    }
}
 

import javax.security.auth.message.callback.GroupPrincipalCallback; //导入依赖的package包/类
@Test
public void testGroupPrincipalCallback() throws Exception
{   
   JASPICallbackHandler cbh = new JASPICallbackHandler();
    
   GroupPrincipalCallback gpc = new GroupPrincipalCallback( subject, new String[] { "role1", "role2" } );
   
   cbh.handle( new Callback[] { gpc } ); 
   
   SecurityContext currentSC = SecurityContextAssociation.getSecurityContext();
   
   assertNotNull( "subject is not null" , gpc.getSubject() ); 
   assertEquals( subject, currentSC.getUtil().getSubject() );
   
   RoleGroup roles = currentSC.getUtil().getRoles();
   
   assertEquals( 2, roles.getRoles().size() );
   assertTrue( roles.containsRole( new SimpleRole( "role1" )));
   assertTrue( roles.containsRole( new SimpleRole( "role2" )));
}
 

import javax.security.auth.message.callback.GroupPrincipalCallback; //导入依赖的package包/类
@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject)
        throws AuthException {

    HttpServletResponse response = (HttpServletResponse) messageInfo.getResponseMessage();

    try {
        response.getWriter().write("validateRequest invoked\n");

        handler.handle(new Callback[] { 
            new CallerPrincipalCallback(clientSubject, "test"),
            new GroupPrincipalCallback(clientSubject, new String[] { "architect" }) });
    } catch (IOException | UnsupportedCallbackException e) {
        throw (AuthException) new AuthException().initCause(e);
    }

    return SUCCESS;
}
 

import javax.security.auth.message.callback.GroupPrincipalCallback; //导入依赖的package包/类
@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject)
        throws AuthException {

    try {
        handler.handle(new Callback[] { 
            new CallerPrincipalCallback(clientSubject, "test"),
            new GroupPrincipalCallback(clientSubject, new String[] { "architect" }) });
    } catch (IOException | UnsupportedCallbackException e) {
        throw (AuthException) new AuthException().initCause(e);
    }

    // Wrap the request - the resource to be invoked should get to see this
    messageInfo.setRequestMessage(new TestHttpServletRequestWrapper(
        (HttpServletRequest) messageInfo.getRequestMessage())
    );

    // Wrap the response - the resource to be invoked should get to see this
    messageInfo.setResponseMessage(new TestHttpServletResponseWrapper(
        (HttpServletResponse) messageInfo.getResponseMessage())
    );

    return SUCCESS;
}
 

import javax.security.auth.message.callback.GroupPrincipalCallback; //导入依赖的package包/类
@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject)
        throws AuthException {

    HttpServletRequest request = (HttpServletRequest) messageInfo.getRequestMessage();

    Callback[] callbacks;

    if (request.getParameter("doLogin") != null) {

        callbacks = new Callback[] { new CallerPrincipalCallback(clientSubject, "test"),
                new GroupPrincipalCallback(clientSubject, new String[] { "architect" }) };
    } else {

        // The JASPIC protocol for "do nothing"
        callbacks = new Callback[] { new CallerPrincipalCallback(clientSubject, (Principal) null) };
    }

    try {
        handler.handle(callbacks);
    } catch (IOException | UnsupportedCallbackException e) {
        throw (AuthException) new AuthException().initCause(e);
    }

    return SUCCESS;
}
 

import javax.security.auth.message.callback.GroupPrincipalCallback; //导入依赖的package包/类
@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject) throws AuthException {
	
	HttpServletResponse response = (HttpServletResponse) messageInfo.getResponseMessage();
	
	try {
		response.getWriter().write("validateRequest invoked\n");
		
		handler.handle(new Callback[] { 
				new CallerPrincipalCallback(clientSubject, "test"),
				new GroupPrincipalCallback(clientSubject, new String[] { "architect" }) 
		});
	} catch (IOException | UnsupportedCallbackException e) {
		throw (AuthException) new AuthException().initCause(e);
	}

	return SUCCESS;
}
 

import javax.security.auth.message.callback.GroupPrincipalCallback; //导入依赖的package包/类
@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject) throws AuthException {
	
	try {
		handler.handle(new Callback[] { 
			new CallerPrincipalCallback(clientSubject, "test"),
			new GroupPrincipalCallback(clientSubject, new String[] { "architect" }) 
		});
	} catch (IOException | UnsupportedCallbackException e) {
		throw (AuthException) new AuthException().initCause(e);
	}

	
	// Wrap the request - the resource to be invoked should get to see this
	messageInfo.setRequestMessage(
		new TestHttpServletRequestWrapper((HttpServletRequest) messageInfo.getRequestMessage())
       );
	
	// Wrap the response - the resource to be invoked should get to see this
	messageInfo.setResponseMessage(
		new TestHttpServletResponseWrapper((HttpServletResponse) messageInfo.getResponseMessage())
	);

	return SUCCESS;
}
 

import javax.security.auth.message.callback.GroupPrincipalCallback; //导入依赖的package包/类
@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject)
        throws AuthException {

    HttpServletRequest request = (HttpServletRequest) messageInfo.getRequestMessage();

    Callback[] callbacks;

    if (request.getParameter("doLogin") != null) {
        callbacks = new Callback[]{new CallerPrincipalCallback(clientSubject, "test"),
                new GroupPrincipalCallback(clientSubject, new String[]{"architect"})};
    } else {
        callbacks = new Callback[]{new CallerPrincipalCallback(clientSubject, (Principal) null)};
    }

    try {
        handler.handle(callbacks);
    } catch (IOException | UnsupportedCallbackException e) {
        throw (AuthException) new AuthException().initCause(e);
    }

    cdi(messageInfo, "vr");

    return SUCCESS;
}
 

import javax.security.auth.message.callback.GroupPrincipalCallback; //导入依赖的package包/类
@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject) throws AuthException {

    HttpServletRequest request = (HttpServletRequest) messageInfo.getRequestMessage();
    HttpServletResponse response = (HttpServletResponse) messageInfo.getResponseMessage();

    LOGGER.log(Level.FINE, "Validating request @" + request.getMethod() + " " + request.getRequestURI());

    String authorization = request.getHeader("Authorization");
    String[] splitAuthorization = authorization.split(" ");
    String jwt = splitAuthorization[1];

    JWTokenUserGroupMapping jwTokenUserGroupMapping = JWTokenFactory.validateAuthToken(key, jwt);

    if (jwTokenUserGroupMapping != null) {

        UserGroupMapping userGroupMapping = jwTokenUserGroupMapping.getUserGroupMapping();
        CallerPrincipalCallback callerPrincipalCallback = new CallerPrincipalCallback(clientSubject, userGroupMapping.getLogin());
        GroupPrincipalCallback groupPrincipalCallback = new GroupPrincipalCallback(clientSubject, new String[]{userGroupMapping.getGroupName()});
        Callback[] callbacks = new Callback[]{callerPrincipalCallback, groupPrincipalCallback};

        try {
            callbackHandler.handle(callbacks);
        } catch (IOException | UnsupportedCallbackException e) {
            throw new AuthException(e.getMessage());
        }

        JWTokenFactory.refreshTokenIfNeeded(key, response, jwTokenUserGroupMapping);

        return AuthStatus.SUCCESS;
    }

    response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
    return AuthStatus.FAILURE;

}
 

import javax.security.auth.message.callback.GroupPrincipalCallback; //导入依赖的package包/类
public static void notifyContainerAboutLogin(Subject clientSubject, CallbackHandler handler, String username, List<String> roles) {

        try {
            // 1. Create a handler (kind of directive) to add the caller principal (AKA user principal =basically user name, or user id) that
            // the authenticator provides.
            //
            // This will be the name of the principal returned by e.g. HttpServletRequest#getUserPrincipal
            //
            // 2 Execute the handler right away
            //
            // This will typically eventually (NOT right away) add the provided principal in an application server specific way to the JAAS 
            // Subject.
            // (it could become entries in a hash table inside the subject, or individual principles, or nested group principles etc.)

            handler.handle(new Callback[]{new CallerPrincipalCallback(clientSubject, username)});

            if (!isEmpty(roles)) {
                // 1. Create a handler to add the groups (AKA roles) that the authenticator provides.
                //
                // This is what e.g. HttpServletRequest#isUserInRole and @RolesAllowed for
                //
                // 2. Execute the handler right away
                //
                // This will typically eventually (NOT right away) add the provided roles in an application server specific way to the JAAS 
                // Subject.
                // (it could become entries in a hash table inside the subject, or individual principles, or nested group principles etc.)

                handler.handle(new Callback[]{new GroupPrincipalCallback(clientSubject, roles.toArray(new String[roles.size()]))});
            }

        } catch (IOException | UnsupportedCallbackException e) {
            // Should not happen
            throw new IllegalStateException(e);
        }
    }
 

import javax.security.auth.message.callback.GroupPrincipalCallback; //导入依赖的package包/类
/**
 * Setup the information associated with a user
 * @param subject the subject to set up
 * @param userId the user's id
 */
protected void setupUser(Subject s, String userId)
        throws IOException, UnsupportedCallbackException
{
    // get the set of groups from the resolver
    String[] groupNames = groupManager.getGroupsForUser(userId);

    // create a principal with the user and the groups they belong to
    Principal p = new UserGroupPrincipal(userId, groupNames);

    // use a callback to set the principal and groups for this user
    handler.handle(new Callback[] {
                new CallerPrincipalCallback(s, p),
                new GroupPrincipalCallback(s, groupNames) });
}
 

import javax.security.auth.message.callback.GroupPrincipalCallback; //导入依赖的package包/类
@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject)
        throws AuthException {

    HttpServletRequest request = (HttpServletRequest) messageInfo.getRequestMessage();

    Callback[] callbacks;

    if (request.getParameter("doLogin") != null) {

        // For the test perform a login by directly "returning" the details of the authenticated user.
        // Normally credentials would be checked and the details fetched from some repository

        callbacks = new Callback[] { 
            // The name of the authenticated user
            new CallerPrincipalCallback(clientSubject, "test"), 
            // the roles of the authenticated user
            new GroupPrincipalCallback(clientSubject, new String[] { "architect" }) 
        };
    } else {

        // The JASPIC protocol for "do nothing"
        callbacks = new Callback[] { new CallerPrincipalCallback(clientSubject, (Principal) null) };
    }

    try {

        // Communicate the details of the authenticated user to the container. In many
        // cases the handler will just store the details and the container will actually handle
        // the login after we return from this method.
        handler.handle(callbacks);

    } catch (IOException | UnsupportedCallbackException e) {
        throw (AuthException) new AuthException().initCause(e);
    }

    return SUCCESS;
}
 

import javax.security.auth.message.callback.GroupPrincipalCallback; //导入依赖的package包/类
@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject) throws AuthException {
	
	HttpServletRequest request = (HttpServletRequest) messageInfo.getRequestMessage();
	
	System.out.println("Session = " + request.getSession().getId());
	System.out.println("\n\n**** validateRequest ****\n\n");
	
	Callback[] callbacks;
	
	if (request.getParameter("doLogin") != null) {
		
		System.out.println("\n\n**** doLogin ****\n\n");
		
		callbacks = new Callback[] { 
			new CallerPrincipalCallback(clientSubject, "test"),
			new GroupPrincipalCallback(clientSubject, new String[] { "architect" }) 
		};
	} else {
		
		System.out.println("\n\n**** do nothing ****\n\n");
		
		// The JASPIC protocol for "do nothing"
		callbacks = new Callback[] { new CallerPrincipalCallback(clientSubject, (Principal) null) };
	}
	
	try {
		handler.handle(callbacks);
	} catch (IOException | UnsupportedCallbackException e) {
		throw (AuthException) new AuthException().initCause(e);
	}

	return SUCCESS;
}
 

import javax.security.auth.message.callback.GroupPrincipalCallback; //导入依赖的package包/类
public void handle(final Callback[] callbacks) throws IOException, UnsupportedCallbackException {
    for (final Callback callback : callbacks) {
        // jaspi to server communication
        if (callback instanceof CallerPrincipalCallback) {
            callerPrincipal = ((CallerPrincipalCallback) callback).getPrincipal();
        } else if (callback instanceof GroupPrincipalCallback) {
            groupsArray = ((GroupPrincipalCallback) callback).getGroups();
        } else if (callback instanceof PasswordValidationCallback) {
            final PasswordValidationCallback passwordValidationCallback = (PasswordValidationCallback) callback;
            final String userName = passwordValidationCallback.getUsername();
            final char[] password = passwordValidationCallback.getPassword();

            final SecurityService securityService = SystemInstance.get().getComponent(SecurityService.class);
            try {
                final Object loginObj = securityService.login(securityRealmName, userName, password == null ? "" : new String(password));
                securityService.associate(loginObj);
                callerPrincipal = securityService.getCallerPrincipal();
                passwordValidationCallback.setResult(true);
            } catch (final LoginException e) {
                passwordValidationCallback.setResult(false);
            }
        }
        // server to jaspi communication
        else if (callback instanceof CertStoreCallback) { //NOPMD
            // TODO implement me
        } else if (callback instanceof PrivateKeyCallback) { //NOPMD
            // TODO implement me
        } else if (callback instanceof SecretKeyCallback) { //NOPMD
            // TODO implement me
        } else if (callback instanceof TrustStoreCallback) { //NOPMD
            // TODO implement me
        } else {
            throw new UnsupportedCallbackException(callback);
        }
    }
}
 

import javax.security.auth.message.callback.GroupPrincipalCallback; //导入依赖的package包/类
private void addPrincipalsToSubject(Subject clientSubject, UserAccount account) throws IOException,
    UnsupportedCallbackException {
  handler.handle(new Callback[] { new CallerPrincipalCallback(clientSubject, account.getEmail()),
      new GroupPrincipalCallback(clientSubject, account.getRoles().toArray(new String[0])) });
}
 

import javax.security.auth.message.callback.GroupPrincipalCallback; //导入依赖的package包/类
/**
 * <p>
 * Checks for the presence of the cookie, if it is present it will use that
 * as the subject if not it will redirect to a login screen.
 * </p>
 * {@inheritDoc}
 */
@Override
public AuthStatus validateRequest(final MessageInfo messageInfo,
    final Subject client,
    final Subject serviceSubject)
        throws AuthException {

    final HttpServletRequest req = (HttpServletRequest) messageInfo.getRequestMessage();
    final HttpServletResponse resp = (HttpServletResponse) messageInfo.getResponseMessage();
    try {

        final String localRequestUri = req.getRequestURI().substring(req.getContextPath().length());

        if (LOGIN_ENDPOINT.equals(localRequestUri)) {
            return handleLoginEndpoint(req, resp);
        }

        if (LOGOUT_ENDPOINT.equals(localRequestUri)) {
            return handleLogoutEndpoint(req, resp);
        }

        // Allow if authentication is not required.
        if (!mandatory) {
            return AuthStatus.SUCCESS;
        }

        // require SSL if mandatory
        if (!req.isSecure()) {
            resp.sendError(HttpURLConnection.HTTP_FORBIDDEN, "SSL Required");
            return AuthStatus.SEND_FAILURE;
        }

        final String subject = getSubject(req);

        // Check if there is no subject then redirect to login endpoint
        if (subject == null) {
            return handleRedirectToLoginEndpoint(req, resp);
        }

        handler.handle(new Callback[] {
            new CallerPrincipalCallback(client, subject),
            new GroupPrincipalCallback(client, GROUPS)
        });
        return AuthStatus.SUCCESS;

    } catch (final IOException
        | ServletException
        | UnsupportedCallbackException e) {
        LOG.throwing(TestServerAuthModule.class.getName(), "validateRequest", e);
        throw new AuthException(e.getMessage());
    }
}
 

import javax.security.auth.message.callback.GroupPrincipalCallback; //导入依赖的package包/类
@SuppressWarnings("unchecked")
@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject)
        throws AuthException {

    HttpServletRequest request = (HttpServletRequest) messageInfo.getRequestMessage();
    Callback[] callbacks;
    
    Principal userPrincipal = request.getUserPrincipal();
    if (userPrincipal != null && request.getParameter("continueSession") != null) {
        
        // ### If already authenticated before, continue this session
        
        // Execute protocol to signal container registered authentication session be used.
        callbacks = new Callback[] { new CallerPrincipalCallback(clientSubject, userPrincipal) };
        
    } else if (request.getParameter("doLogin") != null) {
        
        // ### If not authenticated before, do a new login if so requested

        // For the test perform a login by directly "returning" the details of the authenticated user.
        // Normally credentials would be checked and the details fetched from some repository

        callbacks = new Callback[] {
                // The name of the authenticated user
                new CallerPrincipalCallback(clientSubject, "test"),
                // the roles of the authenticated user
                new GroupPrincipalCallback(clientSubject, new String[] { "architect" }) };

        // Tell container to register an authentication session.
        messageInfo.getMap().put("javax.servlet.http.registerSession", TRUE.toString());
    } else {
        
        // ### If no registered session and no login request "do nothing"
        
        // The JASPIC protocol for "do nothing"
        callbacks = new Callback[] { new CallerPrincipalCallback(clientSubject, (Principal) null) };
    }

    try {

        // Communicate the details of the authenticated user to the container. In many
        // cases the handler will just store the details and the container will actually handle
        // the login after we return from this method.
        handler.handle(callbacks);

    } catch (IOException | UnsupportedCallbackException e) {
        throw (AuthException) new AuthException().initCause(e);
    }

    return SUCCESS;
}