Module io.helidon.security.providers.idcs.mapper

Package io.helidon.security.providers.idcs.mapper

Class IdcsRoleMapperRxProviderBase

java.lang.Object

io.helidon.security.providers.idcs.mapper.IdcsRoleMapperRxProviderBase

All Implemented Interfaces:

SecurityProvider, SubjectMappingProvider

Direct Known Subclasses:

IdcsMtRoleMapperRxProvider, IdcsRoleMapperRxProvider

public abstract class IdcsRoleMapperRxProviderBase
extends Object
implements SubjectMappingProvider

Common functionality for IDCS role mapping using reactive WebClient.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
protected static class	IdcsRoleMapperRxProviderBase.AppTokenRx	Reactive token for app access to IDCS.
static class	IdcsRoleMapperRxProviderBase.Builder<B extends IdcsRoleMapperRxProviderBase.Builder<B>>	Fluent API builder for IdcsRoleMapperRxProviderBase.

Field Summary

Fields

Modifier and Type	Field	Description
protected static String	ACCESS_TOKEN_KEY	Json key for token to be retrieved from IDCS response when requesting application token.
static String	IDCS_SUBJECT_TYPE_CLIENT	Client subject type used when requesting roles from IDCS.
static String	IDCS_SUBJECT_TYPE_USER	User subject type used when requesting roles from IDCS.
protected static String	PARENT_CONTEXT_CLIENT_PROPERTY	Property sent with JAX-RS requests to override parent span context in outbound calls.
protected static String	ROLE_APPROLE	Json key for app roles to be retrieved from IDCS response.
protected static String	ROLE_GROUP	Json key for group roles to be retrieved from IDCS response.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	IdcsRoleMapperRxProviderBase(IdcsRoleMapperRxProviderBase.Builder<?> builder)	Configures the needed fields from the provided builder.

Method Summary

Modifier and Type	Method	Description
protected Subject	buildSubject(Subject originalSubject, List<? extends Grant> grants)	Updates original subject with the list of grants.
protected String	defaultIdcsSubjectType()	Default subject type to use when requesting data from IDCS.
protected abstract Single<Subject>	enhance(ProviderRequest request, AuthenticationResponse previousResponse, Subject subject)	Enhance subject with IDCS roles, reactive.
Single<AuthenticationResponse>	map(ProviderRequest authenticatedRequest, AuthenticationResponse previousResponse)	Map grants from authenticated request (e.g.
protected OidcConfig	oidcConfig()	Access to OidcConfig so the field is not duplicated by classes that extend this provider.
protected Single<List<? extends Grant>>	processRoleRequest(WebClientRequestBuilder request, Object entity, String subjectName)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface io.helidon.security.spi.SecurityProvider

supportedAnnotations, supportedAttributes, supportedConfigKeys, supportedCustomObjects

Field Detail

IDCS_SUBJECT_TYPE_USER

public static final String IDCS_SUBJECT_TYPE_USER

User subject type used when requesting roles from IDCS. An attempt is made to obtain it from JWT claim sub_type. If not defined, default is used as configured in IdcsRoleMapperRxProviderBase.Builder.

See Also:

Constant Field Values

IDCS_SUBJECT_TYPE_CLIENT

public static final String IDCS_SUBJECT_TYPE_CLIENT

Client subject type used when requesting roles from IDCS. An attempt is made to obtain it from JWT claim sub_type. If not defined, default is used as configured in IdcsRoleMapperRxProviderBase.Builder.

See Also:

Constant Field Values

ROLE_GROUP

protected static final String ROLE_GROUP

Json key for group roles to be retrieved from IDCS response.

See Also:

Constant Field Values

ROLE_APPROLE

protected static final String ROLE_APPROLE

Json key for app roles to be retrieved from IDCS response.

See Also:

Constant Field Values

ACCESS_TOKEN_KEY

protected static final String ACCESS_TOKEN_KEY

Json key for token to be retrieved from IDCS response when requesting application token.

See Also:

Constant Field Values

PARENT_CONTEXT_CLIENT_PROPERTY

protected static final String PARENT_CONTEXT_CLIENT_PROPERTY

Property sent with JAX-RS requests to override parent span context in outbound calls. We cannot use the constant declared in ClientTracingFilter, as it is not a required dependency.

See Also:

Constant Field Values

Constructor Detail

IdcsRoleMapperRxProviderBase

protected IdcsRoleMapperRxProviderBase(IdcsRoleMapperRxProviderBase.Builder<?> builder)

Configures the needed fields from the provided builder.

Parameters:

builder - builder with oidcConfig and other needed fields.

Method Detail

map

public Single<AuthenticationResponse> map(ProviderRequest authenticatedRequest,
                                          AuthenticationResponse previousResponse)

Description copied from interface: SubjectMappingProvider

Map grants from authenticated request (e.g. one or both of ProviderRequest.subject() or ProviderRequest.service() returns a non-empty value) to a new authentication response. The provider can change/add/remove grants (such as groups, scopes, permissions) or change the subject to a different one. This method is only invoked after a successful authentication.

Specified by:

map in interface SubjectMappingProvider

Parameters:

authenticatedRequest - request to get user and service subjects from

previousResponse - response from previous authentication or subject mapping provider

Returns:

a new authentication response with updated user and/or service subjects

enhance

protected abstract Single<Subject> enhance(ProviderRequest request,
                                           AuthenticationResponse previousResponse,
                                           Subject subject)

Enhance subject with IDCS roles, reactive.

Parameters:

request - provider request

previousResponse - authenticated response

subject - subject to enhance

Returns:

future with enhanced subject

buildSubject

protected Subject buildSubject(Subject originalSubject,
                               List<? extends Grant> grants)

Updates original subject with the list of grants.

Parameters:

originalSubject - as was created by authentication provider

grants - grants added by this role mapper

Returns:

new subject

processRoleRequest

protected Single<List<? extends Grant>> processRoleRequest(WebClientRequestBuilder request,
                                                           Object entity,
                                                           String subjectName)

oidcConfig

protected OidcConfig oidcConfig()

Access to OidcConfig so the field is not duplicated by classes that extend this provider.

Returns:

open ID Connect configuration (also used to configure access to IDCS)

defaultIdcsSubjectType

protected String defaultIdcsSubjectType()

Default subject type to use when requesting data from IDCS.

Returns:

configured default subject type or IDCS_SUBJECT_TYPE_USER