io.quarkus.elytron.security.deployment

Class SecurityDeploymentProcessor

java.lang.Object

io.quarkus.elytron.security.deployment.SecurityDeploymentProcessor

class SecurityDeploymentProcessor
extends Object

The build time process for the security aspects of the deployment. This creates BuildSteps for integration with the Elytron security services. This supports the Elytron LegacyPropertiesSecurityRealm and SimpleMapBackedSecurityRealm realm implementations. Others could be added by creating an extension that produces a SecurityRealmBuildItem for the realm. Additional authentication mechanisms can be added by producing AuthConfigBuildItems and including the associated ServletExtension implementations to register the io.undertow.security.api.AuthenticationMechanismFactory. TODO: The handling of the configuration to SecurityRealm instance creation/loading is clumsy to not being able to have a config object annotated with @ConfigGroup inherit from another object with MP config annotated properties. TODO: What additional features would be needed for Keycloak adaptor integration

Field Summary

Fields

Modifier and Type	Field and Description
(package private) SecurityConfig	security

Constructor Summary

Constructors

Constructor and Description
SecurityDeploymentProcessor()

Method Summary

Modifier and Type	Method and Description
(package private) void	addIdentityManager(SecurityTemplate template, BuildProducer<ServletExtensionBuildItem> extension, SecurityDomainBuildItem securityDomain, List<IdentityManagerBuildItem> identityManagers, List<AuthConfigBuildItem> authConfigs) Create the deployment SecurityDomain using the SecurityRealm and AuthConfig build items that have been created.
(package private) void	addLoginConfig(SecurityTemplate template, List<AuthConfigBuildItem> authConfigs, BuildProducer<ServletExtensionBuildItem> extension) Produces a ServletExtension to configure Undertow AuthConfigBuildItem produced during the build
(package private) SecurityDomainBuildItem	build(SecurityTemplate template, BuildProducer<ServletExtensionBuildItem> extension, List<SecurityRealmBuildItem> realms) Create the deployment SecurityDomain using the SecurityRealm and AuthConfig build items that have been created.
(package private) AuthConfigBuildItem	configureFileRealmAuthConfig(SecurityTemplate template, BuildProducer<SubstrateResourceBuildItem> resources, BuildProducer<SecurityRealmBuildItem> securityRealm, BuildProducer<PasswordRealmBuildItem> passwordRealm) Check to see if a PropertiesRealmConfig was specified and enabled and create a LegacyPropertiesSecurityRealm runtime value to process the user/roles properties files.
(package private) void	configureIdentityManager(SecurityTemplate template, SecurityDomainBuildItem securityDomain, BuildProducer<IdentityManagerBuildItem> identityManagerProducer, List<PasswordRealmBuildItem> passwordRealm) If a password based realm was created, install the security extension ElytronIdentityManager
(package private) AuthConfigBuildItem	configureMPRealmConfig(SecurityTemplate template, BuildProducer<SecurityRealmBuildItem> securityRealm, BuildProducer<PasswordRealmBuildItem> passwordRealm) Check to see if the a MPRealmConfig was specified and enabled and create a SimpleMapBackedSecurityRealm runtime value.
(package private) FeatureBuildItem	feature() Register this extension as a MP-JWT feature
(package private) void	loadRealm(SecurityTemplate template, List<SecurityRealmBuildItem> realms) For each SecurityRealm, load it's runtime state.
(package private) void	services(BuildProducer<ReflectiveClassBuildItem> classes) Register the Elytron-provided password factory SPI implementation

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

security

SecurityConfig security

Constructor Detail

SecurityDeploymentProcessor

SecurityDeploymentProcessor()

Method Detail

feature

FeatureBuildItem feature()

Register this extension as a MP-JWT feature

Returns:

services

void services(BuildProducer<ReflectiveClassBuildItem> classes)

Register the Elytron-provided password factory SPI implementation

Parameters:

classes - producer factory for ReflectiveClassBuildItems

configureFileRealmAuthConfig

AuthConfigBuildItem configureFileRealmAuthConfig(SecurityTemplate template,
                                                 BuildProducer<SubstrateResourceBuildItem> resources,
                                                 BuildProducer<SecurityRealmBuildItem> securityRealm,
                                                 BuildProducer<PasswordRealmBuildItem> passwordRealm)
                                          throws Exception

Check to see if a PropertiesRealmConfig was specified and enabled and create a LegacyPropertiesSecurityRealm runtime value to process the user/roles properties files. This also registers the names of the user/roles properties files to include the build artifact.

Parameters:

template - - runtime security template

resources - - SubstrateResourceBuildItem used to register the realm user/roles properties files names.

securityRealm - - the producer factory for the SecurityRealmBuildItem

Returns:

the AuthConfigBuildItem for the realm authentication mechanism if there was an enabled PropertiesRealmConfig, null otherwise

Throws:

Exception - - on any failure

configureMPRealmConfig

AuthConfigBuildItem configureMPRealmConfig(SecurityTemplate template,
                                           BuildProducer<SecurityRealmBuildItem> securityRealm,
                                           BuildProducer<PasswordRealmBuildItem> passwordRealm)
                                    throws Exception

Check to see if the a MPRealmConfig was specified and enabled and create a SimpleMapBackedSecurityRealm runtime value.

Parameters:

template - - runtime security template

securityRealm - - the producer factory for the SecurityRealmBuildItem

Returns:

the AuthConfigBuildItem for the realm authentication mechanism if there was an enabled MPRealmConfig, null otherwise

Throws:

Exception - - on any failure

build

SecurityDomainBuildItem build(SecurityTemplate template,
                              BuildProducer<ServletExtensionBuildItem> extension,
                              List<SecurityRealmBuildItem> realms)
                       throws Exception

Create the deployment SecurityDomain using the SecurityRealm and AuthConfig build items that have been created.

Parameters:

template - - the runtime template class used to access runtime behaviors

extension - - the ServletExtensionBuildItem producer used to add the Undertow identity manager and auth config

realms - - the previously created SecurityRealm runtime values

Returns:

the SecurityDomain runtime value build item

Throws:

Exception

configureIdentityManager

void configureIdentityManager(SecurityTemplate template,
                              SecurityDomainBuildItem securityDomain,
                              BuildProducer<IdentityManagerBuildItem> identityManagerProducer,
                              List<PasswordRealmBuildItem> passwordRealm)

If a password based realm was created, install the security extension ElytronIdentityManager

Parameters:

template - - runtime template

securityDomain - - configured SecurityDomain

identityManagerProducer - - producer factory for IdentityManagerBuildItem

addIdentityManager

void addIdentityManager(SecurityTemplate template,
                        BuildProducer<ServletExtensionBuildItem> extension,
                        SecurityDomainBuildItem securityDomain,
                        List<IdentityManagerBuildItem> identityManagers,
                        List<AuthConfigBuildItem> authConfigs)

Create the deployment SecurityDomain using the SecurityRealm and AuthConfig build items that have been created.

Parameters:

template - - the runtime template class used to access runtime behaviors

extension - - the ServletExtensionBuildItem producer used to add the Undertow identity manager and auth config

authConfigs - - the authentication method information that has been registered

Throws:

Exception

addLoginConfig

void addLoginConfig(SecurityTemplate template,
                    List<AuthConfigBuildItem> authConfigs,
                    BuildProducer<ServletExtensionBuildItem> extension)

Produces a ServletExtension to configure Undertow AuthConfigBuildItem produced during the build

Parameters:

template - - the runtime template class used to access runtime behaviors

extension - - the ServletExtensionBuildItem producer used to add the Undertow auth config

authConfigs - - the authentication method information that has been registered

loadRealm

void loadRealm(SecurityTemplate template,
               List<SecurityRealmBuildItem> realms)
        throws Exception

For each SecurityRealm, load it's runtime state. This is currently a little strange due to how the AuthConfig is downcast to the type of SecurityRealm configuration instance.

Parameters:

template - - the runtime template class used to access runtime behaviors

realms - - the previously created SecurityRealm runtime values

Throws:

Exception