I'm using Picketlink (2.6.0.Final) with JPA (using Postgresql) for persistence. I have also implemented an initializer with the following basis:
@Singleton
@Startup
public class Initialiser {
@Inject
private PartitionManager partitionManager;
// Create users
@PostConstruct
public void createUsers()
{
try {
createUser("admin", new String[]{RoleConstants.BASIC});
} catch (Exception ex ) {} // Ignore error
try {
createUser("paul", new String[]{RoleConstants.BASIC, RoleConstants.IS_ADMIN});
} catch (Exception ex ) {} // Ignore error
}
private void createUser(String loginName, String[] roles)
{
User user = new User(loginName);
IdentityManager identityManager = this.partitionManager.createIdentityManager();
identityManager.add(user);
identityManager.updateCredential(user, new Password(loginName + "Test"));
for (String role: roles) {
Role xrole = new Role(role);
identityManager.add(xrole);
RelationshipManager relationshipManager = this.partitionManager.createRelationshipManager();
grantRole(relationshipManager, user, xrole);
}
}
}
After deploying my war into Wildfly, I indeed see my users being created in the configured postgresql database - in the accounttypeentity table. And I can query for and find these user accounts using the ordinary JPA approach (via the IdentityQuery lookups).
Problem:
I'm using PL to secure my Restful API (implemented using JAX-RS), and they way I've done this? Decorating each endpoint with a custom annotation that is meant to check if the caller of the endpoint has a login session, and whether the affiliated user account has the necessary roles (each endpoint passes the required roles as part of the annotation).
Now, the issue is, even when I have a user logged in - identity.isLoggedIn() == true, and even when this user is one of those i created at initialization with the required roles, a call to check if this user has any of the roles required fails! The essential code is:
hasRole(relationshipManager, user, getRole(identityManager, role)
And the entire custom annotation definition is:
@ApplicationScoped
public class CustomAuthorizer {
Logger log = Logger.getLogger(CustomAuthorizer.class);
@Inject
Identity identity;
@Inject
IdentityManager identityManager;
@Inject
RelationshipManager relationshipManager;
/**
* This method is used to check if classes and methods annotated with {@link BasicRolesAllowed} can perform
* the operation or not
*
* @param identity The Identity bean, representing the currently authenticated user
* @param identityManager The IdentityManager provides methods for checking a user's roles
* @return true if the user can execute the method or class
* @throws Exception
*/
@Secures
@BasicRolesAllowed
public boolean hasBasicRolesCheck(InvocationContext invocationContext) throws Exception {
log.error("** Checking roles...");
BasicRolesAllowed basicRolesAllowed = getAnnotation(invocationContext,BasicRolesAllowed.class);
String[] requiredRoles = basicRolesAllowed.value();// get these from annotation
Identity identity = getIdentity();
if((requiredRoles.length > 0) && (!getIdentity().isLoggedIn()))
{
log.error("** User Not Logged In: can't pass role checking...");
return false;
}
boolean isAuthorized = true;
User user = (User) getIdentity().getAccount();
for (String role : requiredRoles) {
isAuthorized = isAuthorized && hasRole(relationshipManager, user, getRole(identityManager, role));
log.info(String.format("User:%s | Role: %s | Has?: %s", user, role, isAuthorized));
}
return isAuthorized;
}
private <T extends Annotation> T getAnnotation(InvocationContext invocationContext, Class<T> annotationType) {
Class unproxiedClass = getUnproxiedClass(invocationContext.getTarget().getClass());
T annotation = (T) unproxiedClass.getAnnotation(annotationType);
Method invocationContextMethod = invocationContext.getMethod();
if (annotation == null) {
annotation = invocationContextMethod.getAnnotation(annotationType);
}
if (annotation == null) {
throw new IllegalArgumentException("No annotation [" + annotationType + " found in type [" + unproxiedClass + "] or method [" + invocationContextMethod + ".");
}
return annotation;
}
private Identity getIdentity() {
return this.identity;
}
}
So, I shall cheat a bit and pose 3 questions (in one):
- How do I actually confirm that picketlink is persisting the roles I assign to the users I create?
- Where in the database (or elsewhere) are these assigned roles stored so I can confirm?
- If I'm checking user roles the wrong way (see my code), how should I rectify this?
