org.apache.activemq.shiro.ShiroPlugin Maven / Gradle / Ivy
/**
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.apache.activemq.shiro;
import org.apache.activemq.ConfigurationException;
import org.apache.activemq.broker.Broker;
import org.apache.activemq.broker.BrokerPluginSupport;
import org.apache.activemq.shiro.authc.AuthenticationFilter;
import org.apache.activemq.shiro.authc.AuthenticationPolicy;
import org.apache.activemq.shiro.authc.DefaultAuthenticationPolicy;
import org.apache.activemq.shiro.authz.AuthorizationFilter;
import org.apache.activemq.shiro.env.IniEnvironment;
import org.apache.activemq.shiro.subject.ConnectionSubjectFactory;
import org.apache.activemq.shiro.subject.DefaultConnectionSubjectFactory;
import org.apache.activemq.shiro.subject.SubjectFilter;
import org.apache.shiro.config.Ini;
import org.apache.shiro.env.Environment;
import org.apache.shiro.mgt.SecurityManager;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
/**
* @since 5.10.0
*/
public class ShiroPlugin extends BrokerPluginSupport {
private static final Logger LOG = LoggerFactory.getLogger(ShiroPlugin.class);
private volatile boolean enabled = true;
private Broker broker; //the downstream broker after any/all Shiro-specific broker filters
private SecurityManager securityManager;
private Environment environment;
private IniEnvironment iniEnvironment; //only used if the above environment instance is not explicitly configured
private SubjectFilter subjectFilter;
private AuthenticationFilter authenticationFilter;
private AuthorizationFilter authorizationFilter;
public ShiroPlugin() {
//Default if this.environment is not configured. See the ensureEnvironment() method below.
iniEnvironment = new IniEnvironment();
authorizationFilter = new AuthorizationFilter();
// we want to share one AuthenticationPolicy instance across both the AuthenticationFilter and the
// ConnectionSubjectFactory:
AuthenticationPolicy authcPolicy = new DefaultAuthenticationPolicy();
authenticationFilter = new AuthenticationFilter();
authenticationFilter.setAuthenticationPolicy(authcPolicy);
authenticationFilter.setNext(authorizationFilter);
subjectFilter = new SubjectFilter();
DefaultConnectionSubjectFactory subjectFactory = new DefaultConnectionSubjectFactory();
subjectFactory.setAuthenticationPolicy(authcPolicy);
subjectFilter.setConnectionSubjectFactory(subjectFactory);
subjectFilter.setNext(authenticationFilter);
}
public SubjectFilter getSubjectFilter() {
return subjectFilter;
}
public void setSubjectFilter(SubjectFilter subjectFilter) {
this.subjectFilter = subjectFilter;
this.subjectFilter.setNext(this.authenticationFilter);
}
public AuthenticationFilter getAuthenticationFilter() {
return authenticationFilter;
}
public void setAuthenticationFilter(AuthenticationFilter authenticationFilter) {
this.authenticationFilter = authenticationFilter;
this.authenticationFilter.setNext(this.authorizationFilter);
this.subjectFilter.setNext(authenticationFilter);
}
public AuthorizationFilter getAuthorizationFilter() {
return authorizationFilter;
}
public void setAuthorizationFilter(AuthorizationFilter authorizationFilter) {
this.authorizationFilter = authorizationFilter;
this.authorizationFilter.setNext(this.broker);
this.authenticationFilter.setNext(authorizationFilter);
}
public void setEnabled(boolean enabled) {
this.enabled = enabled;
if (isInstalled()) {
//we're running, so apply the changes now:
applyEnabled(enabled);
}
}
public boolean isEnabled() {
if (isInstalled()) {
return getNext() == this.subjectFilter;
}
return enabled;
}
private void applyEnabled(boolean enabled) {
if (enabled) {
//ensure the SubjectFilter and downstream filters are used:
super.setNext(this.subjectFilter);
} else {
//Shiro is not enabled, restore the original downstream broker:
super.setNext(this.broker);
}
}
public Environment getEnvironment() {
return environment;
}
public void setEnvironment(Environment environment) {
this.environment = environment;
}
public SecurityManager getSecurityManager() {
return securityManager;
}
public void setSecurityManager(SecurityManager securityManager) {
this.securityManager = securityManager;
}
public void setIni(Ini ini) {
this.iniEnvironment.setIni(ini);
}
public void setIniConfig(String iniConfig) {
this.iniEnvironment.setIniConfig(iniConfig);
}
public void setIniResourcePath(String resourcePath) {
this.iniEnvironment.setIniResourcePath(resourcePath);
}
// ===============================================================
// Authentication Configuration
// ===============================================================
public void setAuthenticationEnabled(boolean authenticationEnabled) {
this.authenticationFilter.setEnabled(authenticationEnabled);
}
public boolean isAuthenticationEnabled() {
return this.authenticationFilter.isEnabled();
}
public AuthenticationPolicy getAuthenticationPolicy() {
return authenticationFilter.getAuthenticationPolicy();
}
public void setAuthenticationPolicy(AuthenticationPolicy authenticationPolicy) {
authenticationFilter.setAuthenticationPolicy(authenticationPolicy);
//also set it on the ConnectionSubjectFactory:
ConnectionSubjectFactory factory = subjectFilter.getConnectionSubjectFactory();
if (factory instanceof DefaultConnectionSubjectFactory) {
((DefaultConnectionSubjectFactory) factory).setAuthenticationPolicy(authenticationPolicy);
}
}
// ===============================================================
// Authorization Configuration
// ===============================================================
public void setAuthorizationEnabled(boolean authorizationEnabled) {
this.authorizationFilter.setEnabled(authorizationEnabled);
}
public boolean isAuthorizationEnabled() {
return this.authorizationFilter.isEnabled();
}
private Environment ensureEnvironment() throws ConfigurationException {
if (this.environment != null) {
return this.environment;
}
//this.environment is null - set it:
if (this.securityManager != null) {
this.environment = new Environment() {
@Override
public SecurityManager getSecurityManager() {
return ShiroPlugin.this.securityManager;
}
};
return this.environment;
}
this.iniEnvironment.init(); //will automatically catch any config errors and throw.
this.environment = iniEnvironment;
return this.iniEnvironment;
}
@Override
public Broker installPlugin(Broker broker) throws Exception {
Environment environment = ensureEnvironment();
this.authorizationFilter.setEnvironment(environment);
this.authenticationFilter.setEnvironment(environment);
this.subjectFilter.setEnvironment(environment);
this.broker = broker;
this.authorizationFilter.setNext(broker);
this.authenticationFilter.setNext(this.authorizationFilter);
this.subjectFilter.setNext(this.authenticationFilter);
Broker next = this.subjectFilter;
if (!this.enabled) {
//not enabled at startup - default to the original broker:
next = broker;
}
setNext(next);
return this;
}
private boolean isInstalled() {
return getNext() != null;
}
}