TOMEE-4682 TomEESecurityContext.authenticate() should delegate to Htt…

examples/pom.xml

@@ -206,6 +206,8 @@
     <module>security-tomcat-user-identitystore</module>
     <module>security-custom-identitystore</module>
     <module>security-openid</module>
+    <module>security-passkey-2fa</module>
+    <module>security-passkey-2fa-programmatic</module>
 
   </modules>
   <profiles>

examples/security-passkey-2fa-programmatic/pom.xml

@@ -0,0 +1,117 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+    Licensed to the Apache Software Foundation (ASF) under one or more
+    contributor license agreements.  See the NOTICE file distributed with
+    this work for additional information regarding copyright ownership.
+    The ASF licenses this file to You under the Apache License, Version 2.0
+    (the "License"); you may not use this file except in compliance with
+    the License.  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>org.superbiz</groupId>
+  <artifactId>security-passkey-2fa-programmatic</artifactId>
+  <version>11.0.0-SNAPSHOT</version>
+  <packaging>war</packaging>
+
+  <name>TomEE :: Examples :: Jakarta Security Passkey 2FA (programmatic SecurityContext.authenticate)</name>
+
+  <properties>
+    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+    <version.tomee>11.0.0-SNAPSHOT</version.tomee>
+    <!--
+      https://github.com/webauthn4j/webauthn4j
+      Pinned to the 0.30.x line: it uses Jackson 2.x, matching the Jackson on
+      TomEE's classpath. WebAuthn4J 0.31+ moved to Jackson 3 (tools.jackson),
+      which clashes with the server's Jackson 2 at runtime.
+    -->
+    <version.webauthn4j>0.30.3.RELEASE</version.webauthn4j>
+  </properties>
+
+  <dependencies>
+
+    <dependency>
+      <groupId>org.apache.tomee</groupId>
+      <artifactId>jakartaee-api</artifactId>
+      <version>11.0.0-M1</version>
+      <scope>provided</scope>
+    </dependency>
+
+    <dependency>
+      <groupId>com.webauthn4j</groupId>
+      <artifactId>webauthn4j-core</artifactId>
+      <version>${version.webauthn4j}</version>
+    </dependency>
+
+    <dependency>
+      <groupId>junit</groupId>
+      <artifactId>junit</artifactId>
+      <version>4.13.2</version>
+      <scope>test</scope>
+    </dependency>
+
+    <dependency>
+      <groupId>com.webauthn4j</groupId>
+      <artifactId>webauthn4j-test</artifactId>
+      <version>${version.webauthn4j}</version>
+      <scope>test</scope>
+    </dependency>
+
+    <dependency>
+      <groupId>org.apache.tomee.bom</groupId>
+      <artifactId>tomee-microprofile</artifactId>
+      <version>${version.tomee}</version>
+      <scope>test</scope>
+    </dependency>
+  </dependencies>
+
+  <build>
+    <finalName>passkey</finalName>
+    <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-compiler-plugin</artifactId>
+        <version>3.14.1</version>
+        <configuration>
+          <source>17</source>
+          <target>17</target>
+          <release>17</release>
+        </configuration>
+      </plugin>
+
+      <!--
+        Run the browser demo with:  mvn tomee:run
+        then open http://localhost:8080/passkey-programmatic/
+      -->
+      <plugin>
+        <groupId>org.apache.tomee.maven</groupId>
+        <artifactId>tomee-maven-plugin</artifactId>
+        <version>${version.tomee}</version>
+        <configuration>
+          <tomeeClassifier>microprofile</tomeeClassifier>
+          <context>passkey-programmatic</context>
+        </configuration>
+      </plugin>
+    </plugins>
+  </build>
+
+  <distributionManagement>
+    <repository>
+      <id>localhost</id>
+      <url>file://${basedir}/target/repo/</url>
+    </repository>
+    <snapshotRepository>
+      <id>localhost</id>
+      <url>file://${basedir}/target/snapshot-repo/</url>
+    </snapshotRepository>
+  </distributionManagement>
+</project>

examples/security-passkey-2fa-programmatic/src/main/java/org/superbiz/passkey/CredentialStore.java

@@ -0,0 +1,90 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.superbiz.passkey;
+
+import com.webauthn4j.credential.CredentialRecord;
+import jakarta.enterprise.context.ApplicationScoped;
+
+import java.util.ArrayList;
+import java.util.Base64;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.concurrent.ConcurrentHashMap;
+
+@ApplicationScoped
+public class CredentialStore {
+
+    public static final class Entry {
+        private final String username;
+        private final byte[] credentialId;
+        private CredentialRecord record;
+
+        private Entry(final String username, final byte[] credentialId, final CredentialRecord record) {
+            this.username = username;
+            this.credentialId = credentialId;
+            this.record = record;
+        }
+
+        public String getUsername() {
+            return username;
+        }
+
+        public byte[] getCredentialId() {
+            return credentialId;
+        }
+
+        public CredentialRecord getRecord() {
+            return record;
+        }
+    }
+
+    private final Map<String, Entry> byCredentialId = new ConcurrentHashMap<>();
+
+    public void save(final String username, final byte[] credentialId, final CredentialRecord record) {
+        byCredentialId.put(key(credentialId), new Entry(username, credentialId, record));
+    }
+
+    public Optional<Entry> find(final byte[] credentialId) {
+        return Optional.ofNullable(byCredentialId.get(key(credentialId)));
+    }
+
+    public List<byte[]> credentialIds(final String username) {
+        final List<byte[]> ids = new ArrayList<>();
+        for (final Entry entry : byCredentialId.values()) {
+            if (entry.username.equals(username)) {
+                ids.add(entry.credentialId);
+            }
+        }
+        return ids;
+    }
+
+    public boolean hasCredentials(final String username) {
+        return !credentialIds(username).isEmpty();
+    }
+
+    public void updateRecord(final byte[] credentialId, final CredentialRecord updated) {
+        final Entry entry = byCredentialId.get(key(credentialId));
+        if (entry != null) {
+            entry.record = updated;
+        }
+    }
+
+    private static String key(final byte[] credentialId) {
+        return Base64.getUrlEncoder().withoutPadding().encodeToString(credentialId);
+    }
+}

examples/security-passkey-2fa-programmatic/src/main/java/org/superbiz/passkey/Http.java

@@ -0,0 +1,45 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.superbiz.passkey;
+
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+
+public class Http {
+
+    private Http() {
+    }
+
+    public static String body(final HttpServletRequest request) throws IOException {
+        return new String(request.getInputStream().readAllBytes(), StandardCharsets.UTF_8);
+    }
+
+    public static void json(final HttpServletResponse response, final String json) throws IOException {
+        response.setStatus(HttpServletResponse.SC_OK);
+        response.setContentType("application/json;charset=UTF-8");
+        response.getWriter().write(json);
+    }
+
+    public static void error(final HttpServletResponse response, final int status, final String message) throws IOException {
+        response.setStatus(status);
+        response.setContentType("application/json;charset=UTF-8");
+        response.getWriter().write("{\"error\":\"" + message.replace("\"", "'") + "\"}");
+    }
+}

examples/security-passkey-2fa-programmatic/src/main/java/org/superbiz/passkey/PasskeyAuthenticationMechanism.java

@@ -0,0 +1,49 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.superbiz.passkey;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.security.enterprise.AuthenticationException;
+import jakarta.security.enterprise.AuthenticationStatus;
+import jakarta.security.enterprise.authentication.mechanism.http.AutoApplySession;
+import jakarta.security.enterprise.authentication.mechanism.http.HttpAuthenticationMechanism;
+import jakarta.security.enterprise.authentication.mechanism.http.HttpMessageContext;
+import jakarta.security.enterprise.credential.Credential;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+
+@ApplicationScoped
+@AutoApplySession
+public class PasskeyAuthenticationMechanism implements HttpAuthenticationMechanism {
+
+    @Override
+    public AuthenticationStatus validateRequest(final HttpServletRequest request,
+                                                final HttpServletResponse response,
+                                                final HttpMessageContext httpMessageContext)
+            throws AuthenticationException {
+
+        final Credential credential = httpMessageContext.getAuthParameters().getCredential();
+
+        if (credential instanceof PasskeyCredential passkey) {
+            return httpMessageContext.notifyContainerAboutLogin(passkey.getCallerName(),
+                                                                passkey.getGroups());
+        }
+
+        return httpMessageContext.doNothing();
+    }
+}

examples/security-passkey-2fa-programmatic/src/main/java/org/superbiz/passkey/PasskeyCredential.java

@@ -0,0 +1,40 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.superbiz.passkey;
+
+import jakarta.security.enterprise.credential.Credential;
+
+import java.util.Set;
+
+public class PasskeyCredential implements Credential {
+
+    private final String callerName;
+    private final Set<String> groups;
+
+    public PasskeyCredential(final String callerName, final Set<String> groups) {
+        this.callerName = callerName;
+        this.groups = groups;
+    }
+
+    public String getCallerName() {
+        return callerName;
+    }
+
+    public Set<String> getGroups() {
+        return groups;
+    }
+}