* @param runAsPrincipal
* @param extraRoles
*/
public void push(final String securityDomain, final String runAs, final String runAsPrincipal, final Set<String> extraRoles) {
// TODO - Handle a null securityDomain here? Yes I think so.
final SecurityContext previous = SecurityContextAssociation.getSecurityContext();
contexts.push(previous);
SecurityContext current = establishSecurityContext(securityDomain);
if (previous != null) {
current.setSubjectInfo(previous.getSubjectInfo());
current.setIncomingRunAs(previous.getOutgoingRunAs());
}
RunAs currentRunAs = current.getIncomingRunAs();
boolean trusted = currentRunAs != null && currentRunAs instanceof RunAsIdentity;
if (trusted == false) {
/*
* We should only be switching to a context based on an identity from the Remoting connection
* if we don't already have a trusted identity - this allows for beans to reauthenticate as a
* different identity.
*/
boolean authenticated = false;
if (RemotingContext.isSet()) {
// In this case the principal and credential will not have been set to set some random values.
SecurityContextUtil util = current.getUtil();
UserInfo userInfo = RemotingContext.getConnection().getUserInfo();
Principal p = null;
String credential = null;
Subject subject = null;
if (userInfo instanceof SubjectUserInfo) {
SubjectUserInfo sinfo = (SubjectUserInfo) userInfo;
subject = sinfo.getSubject();
Set<PasswordCredential> pcSet = subject.getPrivateCredentials(PasswordCredential.class);
if (pcSet.size() > 0) {
PasswordCredential pc = pcSet.iterator().next();
p = new SimplePrincipal(pc.getUserName());
credential = new String(pc.getCredential());
RemotingContext.clear(); // Now that it has been used clear it.
}
}
if (p == null || credential == null) {
p = new SimplePrincipal(UUID.randomUUID().toString());
credential = UUID.randomUUID().toString();
}
util.createSubjectInfo(p, credential, subject);
}
// If we have a trusted identity no need for a re-auth.
if (authenticated == false) {
authenticated = authenticate(current);
}
if (authenticated == false) {
// TODO - Better type needed.
throw SecurityMessages.MESSAGES.invalidUserException();
}
}
if (runAs != null) {
RunAs runAsIdentity = new RunAsIdentity(runAs, runAsPrincipal, extraRoles);
current.setOutgoingRunAs(runAsIdentity);
} else if (previous != null && previous.getOutgoingRunAs() != null) {
// Ensure the propagation continues.
current.setOutgoingRunAs(previous.getOutgoingRunAs());
}
}