* Authorization: :
*
*
* The signed request hash is comprised of the session token + : + the relative url + , + the Http method + , + Date + , + nonce
* This string is then Sha-256 encoded and then Base64 encoded
*
* An example:
*
* Example:
* 9fbc6f9a-af1b-4767-a492-c8462fd2a4d9:user/2e2ce9e8-798e-42b6-9326-fd2e56aef7aa/cards,POST,2012-06-30T12:00:00+01:00,34e321a7c4
*
*
*
* This will be SHA-256 hashed and then Base64 encoded to produce:
*
*
* HR/3DJp8RCGo50Wu+/3cr7ibdoNXKg1eYMt3HO5QoP4=
*
*
* Authorization: 2e2ce9e8-798e-42b6-9326-fd2e56aef7aa:HR/3DJp8RCGo50Wu+/3cr7ibdoNXKg1eYMt3HO5QoP4=
*
* @author: Iain Porter
*/
public class RequestSigningAuthorizationService implements AuthorizationService {
Logger LOG = LoggerFactory.getLogger(RequestSigningAuthorizationService.class);
/**
* If the nonce already exists in the cache the difference between its timestamp and the current time will be
* greater than this value
*/
private static final int NONCE_CHECK_TOLERANCE_IN_MILLIS = 20;
/**
* Maximum Number of Nonce values in the cache
* The capacity will never be reached as long as the number of requests is below this value within the time range specified by
* ApplicationConfig.getSessionDateOffsetInMinutes()
*/
private static final int NONCE_CACHE_SIZE = 10000;
/**
* A an expiry cache that evicts nonce values after a configurable time period
*/
private LoadingCache
* Example:
* 9fbc6f9a-af1b-4767-a492-c8462fd2a4d9:user/2e2ce9e8-798e-42b6-9326-fd2e56aef7aa,GET,2012-06-30T12:00:00+01:00,34e321a7c4
*
*
*
* This will be SHA-256 hashed and then Base64 encoded to produce:
*
*
* HR/3DJp8RCGo50Wu+/3cr7ibdoNXKg1eYMt3HO5QoP4=
*
*
* @param user should have a session token that will validate the request signature
* @param authorizationRequest the request containing all the details needed to authorize the request
* @param hashedToken the token to match against
* @return true if the token is authorized
*/
private boolean isAuthorized(User user, AuthorizationRequestContext authorizationRequest, String hashedToken) {
Assert.notNull(user);
Assert.notNull(authorizationRequest.getAuthorizationToken());
String unEncodedString = composeUnEncodedRequest(authorizationRequest);
AuthorizationToken authorizationToken = user.getAuthorizationToken();
String userTokenHash = encodeAuthToken(authorizationToken.getToken(), unEncodedString);
if (hashedToken.equals(userTokenHash)) {
return true;
}
LOG.error("Hash check failed for hashed token: {} for the following request: {} for user: {}",
new Object[]{authorizationRequest.getAuthorizationToken(), unEncodedString, user.getId()});
return false;
}
/**
* Encode the token by prefixing it with the User's Session Token
*
* @param token
* @return encoded token
*/
private String encodeAuthToken(String token, String unencodedRequest) {
byte[] digest = DigestUtils.sha256(token + ":" + unencodedRequest);
return new String(Base64.encodeBase64(digest));
}
/**
* The recipe to compose a signed request
*
* @param authRequest
* @return the string value to hash
*/
private String composeUnEncodedRequest(AuthorizationRequestContext authRequest) {
StringBuilder sb = new StringBuilder();
sb.append(authRequest.getRequestUrl());
sb.append(',');
sb.append(authRequest.getHttpMethod().toUpperCase());
sb.append(',');
sb.append(authRequest.getRequestDateString());
sb.append(',').append(authRequest.getNonceToken());
return sb.toString();
}
/**
* Ensure that the date of the request falls within the configured range
* @param requestDateString
*/
private void validateRequestDate(String requestDateString) {
Date date = DateUtil.getDateFromIso8061DateString(requestDateString);
DateTime now = new DateTime();
DateTime offset = new DateTime(date);
if (!(offset.isAfter(now.minusMinutes(config.getSessionDateOffsetInMinutes())) &&
offset.isBefore(now.plusMinutes(config.getSessionDateOffsetInMinutes())))) {
LOG.error("Date in header is out of range: {}", requestDateString);
throw new AuthorizationException("Date in header is out of range: " + requestDateString);
}
}
/**
* The nonce value sent by the client and used in the request signature should be unique across the system
* Nonce values will only be considered unique within the time limits of the cache.
* The value will be protected if the cache expiry time is within the limits of the request date range.
* If the date in the request is stale then the nonce value wil be irrelevant
*
* Note that the caching strategy will not work in a cluster. A distributed cache will be needed.
*
* @param nonceValue
*/
private void validateNonce(String nonceValue) {
Nonce nonce = nonceCache.getUnchecked(nonceValue);
Duration tolerance = new Duration(nonce.timestamp, new DateTime());
if (tolerance.isLongerThan(Duration.millis(NONCE_CHECK_TOLERANCE_IN_MILLIS))) {
LOG.error("Nonce value was not unique: {}", nonceValue);
throw new AuthorizationException("Nonce value is not unique");
}
}
private static class Nonce {
private DateTime timestamp;
private String nonceValue;
Nonce(DateTime time, String nonce) {
this.timestamp = time;
this.nonceValue = nonce;
}
}
}
================================================
FILE: src/main/java/com/porterhead/rest/authorization/impl/SecurityContextImpl.java
================================================
package com.porterhead.rest.authorization.impl;
import com.porterhead.rest.authorization.exception.InvalidAuthorizationHeaderException;
import com.porterhead.rest.user.api.ExternalUser;
import com.porterhead.rest.user.domain.Role;
import javax.ws.rs.core.SecurityContext;
import java.security.Principal;
/**
* Implementation of {@link javax.ws.rs.core.SecurityContext}
*
* User: porter
* Date: 16/03/2012
* Time: 16:13
*/
public class SecurityContextImpl implements SecurityContext {
private final ExternalUser user;
public SecurityContextImpl(ExternalUser user) {
this.user = user;
}
public Principal getUserPrincipal() {
return user;
}
public boolean isUserInRole(String role) {
if(role.equalsIgnoreCase(Role.anonymous.name())) {
return true;
}
if(user == null) {
throw new InvalidAuthorizationHeaderException();
}
return user.getRole().equalsIgnoreCase(role);
}
public boolean isSecure() {
return false;
}
public String getAuthenticationScheme() {
return SecurityContext.BASIC_AUTH;
}
}
================================================
FILE: src/main/java/com/porterhead/rest/authorization/impl/SessionTokenAuthorizationService.java
================================================
package com.porterhead.rest.authorization.impl;
import com.porterhead.rest.authorization.AuthorizationRequestContext;
import com.porterhead.rest.authorization.AuthorizationService;
import com.porterhead.rest.user.UserRepository;
import com.porterhead.rest.user.api.ExternalUser;
import com.porterhead.rest.user.domain.AuthorizationToken;
import com.porterhead.rest.user.domain.User;
import com.porterhead.rest.user.exception.AuthorizationException;
import java.util.Date;
/**
*
* Simple authorization service that requires a session token in the Authorization header
* This is then matched to a user
*
* @version 1.0
* @author: Iain Porter
* @since 29/01/2013
*/
public class SessionTokenAuthorizationService implements AuthorizationService {
/**
* directly access user objects
*/
private final UserRepository userRepository;
public SessionTokenAuthorizationService(UserRepository repository) {
this.userRepository = repository;
}
public ExternalUser authorize(AuthorizationRequestContext securityContext) {
String token = securityContext.getAuthorizationToken();
ExternalUser externalUser = null;
if(token == null) {
return externalUser;
}
User user = userRepository.findBySession(token);
if(user == null) {
throw new AuthorizationException("Session token not valid");
}
AuthorizationToken authorizationToken = user.getAuthorizationToken();
if (authorizationToken.getToken().equals(token)) {
externalUser = new ExternalUser(user);
}
return externalUser;
}
}
================================================
FILE: src/main/java/com/porterhead/rest/config/ApplicationConfig.java
================================================
package com.porterhead.rest.config;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.PropertySource;
import org.springframework.core.env.Environment;
/**
* User: porter
* Date: 17/05/2012
* Time: 19:07
*/
@Configuration
@PropertySource({"classpath:/properties/app.properties"})
public class ApplicationConfig {
private final static String HOSTNAME_PROPERTY = "hostNameUrl";
private final static String SECURITY_AUTHORIZATION_REQUIRE_SIGNED_REQUESTS = "security.authorization.requireSignedRequests";
private final static String AUTHORIZATION_EXPIRY_DURATION = "authorization.timeToLive.inSeconds";
private final static String SESSION_DATE_OFFSET_IN_MINUTES = "session.date.offset.inMinutes";
private final static String TOKEN_EMAIL_REGISTRATION_DURATION = "token.emailRegistration.timeToLive.inMinutes";
private final static String TOKEN_EMAIL_VERIFICATION_DURATION = "token.emailVerification.timeToLive.inMinutes";
private final static String TOKEN_LOST_PASSWORD_DURATION = "token.lostPassword.timeToLive.inMinutes";
private final static String EMAIL_SERVICES_FROM_ADDRESS = "email.services.fromAddress";
private final static String EMAIL_SERVICES_REPLYTO_ADDRESS = "email.services.replyTo";
private final static String EMAIL_SERVICES_VERIFICATION_EMAIL_SUBJECT_TEXT = "email.services.emailVerificationSubjectText";
private final static String EMAIL_SERVICES_REGISTRATION_EMAIL_SUBJECT_TEXT = "email.services.emailRegistrationSubjectText";
private final static String EMAIL_SERVICES_LOST_PASSWORD_SUBJECT_TEXT = "email.services.lostPasswordSubjectText";
@Autowired
protected Environment environment;
public String getHostNameUrl() {
return environment.getProperty(HOSTNAME_PROPERTY);
}
public String getFacebookClientId() {
return environment.getProperty("facebook.clientId");
}
public String getFacebookClientSecret() {
return environment.getProperty("facebook.clientSecret");
}
public int getAuthorizationExpiryTimeInSeconds() {
return Integer.parseInt(environment.getProperty(AUTHORIZATION_EXPIRY_DURATION));
}
public int getSessionDateOffsetInMinutes() {
return Integer.parseInt(environment.getProperty(SESSION_DATE_OFFSET_IN_MINUTES));
}
public int getEmailRegistrationTokenExpiryTimeInMinutes() {
return Integer.parseInt(environment.getProperty(TOKEN_EMAIL_REGISTRATION_DURATION));
}
public int getEmailVerificationTokenExpiryTimeInMinutes() {
return Integer.parseInt(environment.getProperty(TOKEN_EMAIL_VERIFICATION_DURATION));
}
public int getLostPasswordTokenExpiryTimeInMinutes() {
return Integer.parseInt(environment.getProperty(TOKEN_LOST_PASSWORD_DURATION));
}
public String getEmailVerificationSubjectText() {
return environment.getProperty(EMAIL_SERVICES_VERIFICATION_EMAIL_SUBJECT_TEXT);
}
public String getEmailRegistrationSubjectText() {
return environment.getProperty(EMAIL_SERVICES_REGISTRATION_EMAIL_SUBJECT_TEXT);
}
public String getLostPasswordSubjectText() {
return environment.getProperty(EMAIL_SERVICES_LOST_PASSWORD_SUBJECT_TEXT);
}
public String getEmailFromAddress() {
return environment.getProperty(EMAIL_SERVICES_FROM_ADDRESS);
}
public String getEmailReplyToAddress() {
return environment.getProperty(EMAIL_SERVICES_REPLYTO_ADDRESS);
}
public Boolean requireSignedRequests() {
return environment.getProperty(SECURITY_AUTHORIZATION_REQUIRE_SIGNED_REQUESTS).equalsIgnoreCase("true");
}
}
================================================
FILE: src/main/java/com/porterhead/rest/config/ApplicationDevConfig.java
================================================
package com.porterhead.rest.config;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Profile;
import org.springframework.context.annotation.PropertySource;
import org.springframework.security.crypto.encrypt.Encryptors;
import org.springframework.security.crypto.encrypt.TextEncryptor;
/**
* @version 1.0
* @author: Iain Porter iain.porter@porterhead.com
* @since 21/09/2012
*/
@Configuration
@Profile(value={"dev", "local"})
@PropertySource({"classpath:/properties/dev-app.properties"})
public class ApplicationDevConfig {
@Bean
public TextEncryptor textEncryptor() {
return Encryptors.noOpText();
}
}
================================================
FILE: src/main/java/com/porterhead/rest/config/ApplicationProductionConfig.java
================================================
package com.porterhead.rest.config;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Profile;
import org.springframework.context.annotation.PropertySource;
import org.springframework.core.env.Environment;
import org.springframework.security.crypto.encrypt.Encryptors;
import org.springframework.security.crypto.encrypt.TextEncryptor;
/**
* @version 1.0
* @author: Iain Porter iain.porter@porterhead.com
* @since 21/09/2012
*/
@Configuration
@Profile(value="production")
@PropertySource({"classpath:/properties/production-app.properties"})
public class ApplicationProductionConfig {
@Autowired
Environment environment;
@Bean
public TextEncryptor textEncryptor() {
return Encryptors.queryableText(environment.getProperty("security.encryptPassword"),
environment.getProperty("security.encryptSalt"));
}
}
================================================
FILE: src/main/java/com/porterhead/rest/config/ApplicationStagingConfig.java
================================================
package com.porterhead.rest.config;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Profile;
import org.springframework.context.annotation.PropertySource;
import org.springframework.core.env.Environment;
import org.springframework.security.crypto.encrypt.Encryptors;
import org.springframework.security.crypto.encrypt.TextEncryptor;
/**
*
* @version 1.0
* @author: Iain Porter iain.porter@porterhead.com
* @since 21/09/2012
*/
@Configuration
@Profile(value="staging")
@PropertySource({"classpath:/properties/staging-app.properties"})
public class ApplicationStagingConfig {
@Autowired
Environment environment;
@Bean
public TextEncryptor textEncryptor() {
return Encryptors.queryableText(environment.getProperty("security.encryptPassword"),
environment.getProperty("security.encryptSalt"));
}
}
================================================
FILE: src/main/java/com/porterhead/rest/exception/ApplicationRuntimeException.java
================================================
package com.porterhead.rest.exception;
public class ApplicationRuntimeException extends BaseWebApplicationException {
public ApplicationRuntimeException(String applicationMessage) {
super(500, "50002", "Internal System error", applicationMessage);
}
}
================================================
FILE: src/main/java/com/porterhead/rest/exception/BaseWebApplicationException.java
================================================
package com.porterhead.rest.exception;
import com.porterhead.rest.api.ErrorResponse;
import javax.ws.rs.WebApplicationException;
import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.Response;
/**
* @version 1.0
* @author: Iain Porter iain.porter@porterhead.com
* @since 19/10/2012
*/
public abstract class BaseWebApplicationException extends WebApplicationException {
private final int status;
private final String errorMessage;
private final String errorCode;
private final String developerMessage;
public BaseWebApplicationException(int httpStatus, String errorCode, String errorMessage, String developerMessage) {
this.status = httpStatus;
this.errorMessage = errorMessage;
this.errorCode = errorCode;
this.developerMessage = developerMessage;
}
@Override
public Response getResponse() {
return Response.status(status).type(MediaType.APPLICATION_JSON_TYPE).entity(getErrorResponse()).build();
}
public ErrorResponse getErrorResponse() {
ErrorResponse response = new ErrorResponse();
response.setErrorCode(errorCode);
response.setApplicationMessage(developerMessage);
response.setConsumerMessage(errorMessage);
return response;
}
}
================================================
FILE: src/main/java/com/porterhead/rest/exception/NotFoundException.java
================================================
package com.porterhead.rest.exception;
import javax.ws.rs.WebApplicationException;
/**
* User: porter
* Date: 03/05/2012
* Time: 12:27
*/
public class NotFoundException extends WebApplicationException {
public NotFoundException() {
super(404);
}
}
================================================
FILE: src/main/java/com/porterhead/rest/exception/ValidationException.java
================================================
package com.porterhead.rest.exception;
import com.porterhead.rest.api.ErrorResponse;
import com.porterhead.rest.api.ValidationError;
import javax.validation.ConstraintViolation;
import javax.ws.rs.WebApplicationException;
import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.Response;
import java.util.ArrayList;
import java.util.List;
import java.util.Set;
/**
* User: porter
* Date: 03/05/2012
* Time: 21:43
*/
public class ValidationException extends WebApplicationException {
private final int status = 400;
private String errorMessage;
private String developerMessage;
private List
*
com.sun.jersey.spi.container.ResourceFilters
com.porterhead.com.porterhead.rest.filter.ResourceFilterFactory
*
*
*
* @author: Iain Porter
*/
@Component
@Provider
public class ResourceFilterFactory extends RolesAllowedResourceFilterFactory {
@Autowired
private SecurityContextFilter securityContextFilter;
@Override
public List
* /user/1883c578-76be-47fb-a5c1-7bbea3bf7fd0 using uuid as the identifier
*
* /user/jsmith using the username as the identifier
*
*
*
* @return Object unique identifier for the object
*/
public Object getIdentifier() {
return getUuid().toString();
}
public int getVersion() {
return version;
}
public Date getTimeCreated() {
return timeCreated;
}
}
================================================
FILE: src/main/java/com/porterhead/rest/resource/GenericExceptionMapper.java
================================================
package com.porterhead.rest.resource;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import javax.ws.rs.WebApplicationException;
import javax.ws.rs.core.Response;
import javax.ws.rs.ext.ExceptionMapper;
import javax.ws.rs.ext.Provider;
/**
* User: porter
* Date: 22/03/2012
* Time: 15:56
*/
@Provider
public class GenericExceptionMapper implements ExceptionMapper
| ||||||
|
| ||||||