Download as
Browse Code »

Commit e4eb0b693b618f5d46611a29a842ca2d010e998a

Authored by Paulo Gladson
1 parent b0000174

Ajuste nos escopos e correções no JWT

Showing 6 changed files with 15 additions and 20 deletions   Show diff stats
demoiselle-security-jwt/pom.xml
  Diff comments   View file @e4eb0b6
@@ -26,14 +26,7 @@ @@ -26,14 +26,7 @@
26 <dependency> 26 <dependency>
27 <groupId>org.bitbucket.b_c</groupId> 27 <groupId>org.bitbucket.b_c</groupId>
28 <artifactId>jose4j</artifactId> 28 <artifactId>jose4j</artifactId>
29 - <version>0.4.1</version>  
30 - </dependency>  
31 -  
32 - <dependency>  
33 - <groupId>com.google.code.gson</groupId>  
34 - <artifactId>gson</artifactId>  
35 - <version>2.2.2</version>  
36 - <scope>compile</scope> 29 + <version>0.5.2</version>
37 </dependency> 30 </dependency>
38 31
39 </dependencies> 32 </dependencies>
demoiselle-security-jwt/src/main/java/org/demoiselle/jee/security/jwt/impl/TokensManagerImpl.java
  Diff comments   View file @e4eb0b6
@@ -14,6 +14,7 @@ import javax.servlet.http.HttpServletRequest; @@ -14,6 +14,7 @@ import javax.servlet.http.HttpServletRequest;
14 import org.demoiselle.jee.core.interfaces.security.DemoisellePrincipal; 14 import org.demoiselle.jee.core.interfaces.security.DemoisellePrincipal;
15 import org.demoiselle.jee.core.interfaces.security.Token; 15 import org.demoiselle.jee.core.interfaces.security.Token;
16 import org.demoiselle.jee.core.interfaces.security.TokensManager; 16 import org.demoiselle.jee.core.interfaces.security.TokensManager;
  17 +import org.jose4j.jwk.JsonWebKey;
17 import org.jose4j.jwk.RsaJsonWebKey; 18 import org.jose4j.jwk.RsaJsonWebKey;
18 import org.jose4j.jwk.RsaJwkGenerator; 19 import org.jose4j.jwk.RsaJwkGenerator;
19 import org.jose4j.jws.AlgorithmIdentifiers; 20 import org.jose4j.jws.AlgorithmIdentifiers;
@@ -47,7 +48,8 @@ public class TokensManagerImpl implements TokensManager { @@ -47,7 +48,8 @@ public class TokensManagerImpl implements TokensManager {
47 48
48 public TokensManagerImpl() throws JoseException { 49 public TokensManagerImpl() throws JoseException {
49 if (rsaJsonWebKey == null) { 50 if (rsaJsonWebKey == null) {
50 - rsaJsonWebKey = (RsaJsonWebKey) RsaJsonWebKey.Factory.newPublicJwk(RsaJwkGenerator.generateJwk(2048).getKey()); 51 + String chave = RsaJwkGenerator.generateJwk(2048).toJson(JsonWebKey.OutputControlLevel.INCLUDE_PRIVATE);
  52 + rsaJsonWebKey = (RsaJsonWebKey) RsaJsonWebKey.Factory.newPublicJwk(chave);
51 rsaJsonWebKey.setKeyId("demoiselle-security-jwt"); 53 rsaJsonWebKey.setKeyId("demoiselle-security-jwt");
52 } 54 }
53 } 55 }
@@ -61,7 +63,8 @@ public class TokensManagerImpl implements TokensManager { @@ -61,7 +63,8 @@ public class TokensManagerImpl implements TokensManager {
61 .setAllowedClockSkewInSeconds(60) // allow some leeway in validating time based claims to account for clock skew 63 .setAllowedClockSkewInSeconds(60) // allow some leeway in validating time based claims to account for clock skew
62 .setExpectedIssuer("demoiselle") // whom the JWT needs to have been issued by 64 .setExpectedIssuer("demoiselle") // whom the JWT needs to have been issued by
63 .setExpectedAudience("demoiselle") // to whom the JWT is intended for 65 .setExpectedAudience("demoiselle") // to whom the JWT is intended for
64 - .setVerificationKey(rsaJsonWebKey.getKey()) // verify the signature with the public key 66 + .setDecryptionKey(rsaJsonWebKey.getPrivateKey()) // decrypt with the receiver's private key
  67 + .setVerificationKey(rsaJsonWebKey.getPublicKey())
65 .build(); // create the JwtConsumer instance 68 .build(); // create the JwtConsumer instance
66 JwtClaims jwtClaims = jwtConsumer.processToClaims(token.getKey()); 69 JwtClaims jwtClaims = jwtConsumer.processToClaims(token.getKey());
67 loggedUser.setId((String) jwtClaims.getClaimValue("id")); 70 loggedUser.setId((String) jwtClaims.getClaimValue("id"));
@@ -102,14 +105,14 @@ public class TokensManagerImpl implements TokensManager { @@ -102,14 +105,14 @@ public class TokensManagerImpl implements TokensManager {
102 105
103 JsonWebSignature jws = new JsonWebSignature(); 106 JsonWebSignature jws = new JsonWebSignature();
104 jws.setPayload(claims.toJson()); 107 jws.setPayload(claims.toJson());
105 - jws.setKey(rsaJsonWebKey.getKey()); 108 + jws.setKey(rsaJsonWebKey.getRsaPrivateKey());
106 jws.setKeyIdHeaderValue(rsaJsonWebKey.getKeyId()); 109 jws.setKeyIdHeaderValue(rsaJsonWebKey.getKeyId());
107 - jws.setAlgorithmHeaderValue(AlgorithmIdentifiers.HMAC_SHA512); 110 + jws.setAlgorithmHeaderValue(AlgorithmIdentifiers.RSA_USING_SHA256);
108 token.setKey(jws.getCompactSerialization()); 111 token.setKey(jws.getCompactSerialization());
109 token.setType("JWT"); 112 token.setType("JWT");
110 } catch (JoseException ex) { 113 } catch (JoseException ex) {
111 - ex.printStackTrace();  
112 - // logger.severe(ex.getMessage()); 114 + //ex.printStackTrace();
  115 + logger.severe(ex.getMessage());
113 } 116 }
114 117
115 } 118 }
demoiselle-security-token/src/main/java/org/demoiselle/jee/security/token/impl/TokensManagerImpl.java
  Diff comments   View file @e4eb0b6
@@ -8,7 +8,7 @@ package org.demoiselle.jee.security.token.impl; @@ -8,7 +8,7 @@ package org.demoiselle.jee.security.token.impl;
8 import static java.util.UUID.randomUUID; 8 import static java.util.UUID.randomUUID;
9 import java.util.concurrent.ConcurrentHashMap; 9 import java.util.concurrent.ConcurrentHashMap;
10 import java.util.logging.Logger; 10 import java.util.logging.Logger;
11 -import javax.enterprise.context.Dependent; 11 +import javax.enterprise.context.ApplicationScoped;
12 import javax.inject.Inject; 12 import javax.inject.Inject;
13 import org.demoiselle.jee.core.interfaces.security.DemoisellePrincipal; 13 import org.demoiselle.jee.core.interfaces.security.DemoisellePrincipal;
14 import org.demoiselle.jee.core.interfaces.security.Token; 14 import org.demoiselle.jee.core.interfaces.security.Token;
@@ -18,10 +18,10 @@ import org.demoiselle.jee.core.interfaces.security.TokensManager; @@ -18,10 +18,10 @@ import org.demoiselle.jee.core.interfaces.security.TokensManager;
18 * 18 *
19 * @author 70744416353 19 * @author 70744416353
20 */ 20 */
21 -@Dependent 21 +@ApplicationScoped
22 public class TokensManagerImpl implements TokensManager { 22 public class TokensManagerImpl implements TokensManager {
23 23
24 - private static ConcurrentHashMap<String, DemoisellePrincipal> repo = new ConcurrentHashMap<>(); 24 + private ConcurrentHashMap<String, DemoisellePrincipal> repo = new ConcurrentHashMap<>();
25 25
26 @Inject 26 @Inject
27 private Logger logger; 27 private Logger logger;
@@ -56,7 +56,7 @@ public class TokensManagerImpl implements TokensManager { @@ -56,7 +56,7 @@ public class TokensManagerImpl implements TokensManager {
56 56
57 @Override 57 @Override
58 public boolean validate() { 58 public boolean validate() {
59 - return getUser() != null && getUser().getId() != null; 59 + return getUser() != null;
60 } 60 }
61 61
62 } 62 }
demoiselle-security/src/main/java/org/demoiselle/jee/security/impl/SecurityContextImpl.java
  Diff comments   View file @e4eb0b6
@@ -6,6 +6,7 @@ @@ -6,6 +6,7 @@
6 */ 6 */
7 package org.demoiselle.jee.security.impl; 7 package org.demoiselle.jee.security.impl;
8 8
  9 +import javax.enterprise.context.Dependent;
9 import javax.enterprise.context.RequestScoped; 10 import javax.enterprise.context.RequestScoped;
10 import javax.inject.Inject; 11 import javax.inject.Inject;
11 import org.demoiselle.jee.core.interfaces.security.DemoisellePrincipal; 12 import org.demoiselle.jee.core.interfaces.security.DemoisellePrincipal;
demoiselle-security/src/main/java/org/demoiselle/jee/security/interceptor/RequiredPermissionInterceptor.java
  Diff comments   View file @e4eb0b6
@@ -76,7 +76,6 @@ public class RequiredPermissionInterceptor implements Serializable { @@ -76,7 +76,6 @@ public class RequiredPermissionInterceptor implements Serializable {
76 } 76 }
77 77
78 if (!securityContext.hasPermission(resource, operation)) { 78 if (!securityContext.hasPermission(resource, operation)) {
79 - logger.severe(bundle.doesNotHavePermission(operation, resource));  
80 throw new DemoiselleSecurityException(bundle.doesNotHavePermission(operation, resource), UNAUTHORIZED.getStatusCode()); 79 throw new DemoiselleSecurityException(bundle.doesNotHavePermission(operation, resource), UNAUTHORIZED.getStatusCode());
81 } 80 }
82 81
demoiselle-security/src/main/java/org/demoiselle/jee/security/interceptor/RequiredRoleInterceptor.java
  Diff comments   View file @e4eb0b6
@@ -83,7 +83,6 @@ public class RequiredRoleInterceptor implements Serializable { @@ -83,7 +83,6 @@ public class RequiredRoleInterceptor implements Serializable {
83 } 83 }
84 84
85 if (userRoles.isEmpty()) { 85 if (userRoles.isEmpty()) {
86 - logger.severe(bundle.doesNotHaveRole(roles.toString()));  
87 throw new DemoiselleSecurityException(bundle.doesNotHaveRole(roles.toString()), UNAUTHORIZED.getStatusCode()); 86 throw new DemoiselleSecurityException(bundle.doesNotHaveRole(roles.toString()), UNAUTHORIZED.getStatusCode());
88 } 87 }
89 88