flowable 绕过idm自带的身份验证

简介: flowable 绕过idm自带的身份验证
package org.flowable.ui.common.security;
import org.fh.util.Jurisdiction;
import org.flowable.common.engine.api.FlowableIllegalStateException;
import org.flowable.idm.api.User;
import org.flowable.ui.common.model.RemoteUser;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import java.util.ArrayList;
import java.util.List;
/**
 * 说明:重构流程编辑器获取用户信息
 * 作者:FH Admin
 * from:www.fhadmin.cn
 */
public class SecurityUtils {
  private static User assumeUser;
  private static SecurityScopeProvider securityScopeProvider = new FlowableSecurityScopeProvider();
  private SecurityUtils() {
  }
  /**
   * Get the login of the current user.
   */
  public static String getCurrentUserId() {
    User user = getCurrentUserObject();
    if (user != null) {
      return user.getId();
    }
    return null;
  }
  /**
   * @return the {@link User} object associated with the current logged in user.
   */
  public static User getCurrentUserObject() {
    if (assumeUser != null) {
      return assumeUser;
    }
    RemoteUser user = new RemoteUser();
    user.setId(Jurisdiction.getUsername());
    user.setDisplayName(Jurisdiction.getName());
    user.setFirstName(Jurisdiction.getName());
    user.setLastName(Jurisdiction.getName());
    user.setEmail("admin@flowable.com");
    user.setPassword("123456");
    List<String> pris = new ArrayList<>();
    pris.add(DefaultPrivileges.ACCESS_MODELER);
    pris.add(DefaultPrivileges.ACCESS_IDM);
    pris.add(DefaultPrivileges.ACCESS_ADMIN);
    pris.add(DefaultPrivileges.ACCESS_TASK);
    pris.add(DefaultPrivileges.ACCESS_REST_API);
    user.setPrivileges(pris);
    return user;
  }
    public static void setSecurityScopeProvider(SecurityScopeProvider securityScopeProvider) {
        SecurityUtils.securityScopeProvider = securityScopeProvider;
    }
    public static SecurityScope getCurrentSecurityScope() {
        SecurityContext securityContext = SecurityContextHolder.getContext();
        if (securityContext != null && securityContext.getAuthentication() != null) {
            return getSecurityScope(securityContext.getAuthentication());
        }
        return null;
    }
    public static SecurityScope getSecurityScope(Authentication authentication) {
        return securityScopeProvider.getSecurityScope(authentication);
    }
    public static SecurityScope getAuthenticatedSecurityScope() {
        SecurityScope currentSecurityScope = getCurrentSecurityScope();
        if (currentSecurityScope != null) {
            return currentSecurityScope;
        }
        throw new FlowableIllegalStateException("User is not authenticated");
    }
  public static void assumeUser(User user) {
    assumeUser = user;
  }
  public static void clearAssumeUser() {
    assumeUser = null;
  }
}

 

目录
相关文章
|
10天前
|
安全 数据安全/隐私保护
Burp Suite暴力破解表单账密步骤
Burp Suite暴力破解表单账密步骤
20 0
|
2月前
|
Android开发
【Azure 环境】移动应用 SSO 登录AAD, MSAL的配置为Webview模式时登录页面无法加载
【Azure 环境】移动应用 SSO 登录AAD, MSAL的配置为Webview模式时登录页面无法加载
|
5月前
|
安全 Java 网络架构
CVE-2024-27198可RCE身份验证绕过JetBrains TeamCity
CVE-2024-27198可RCE身份验证绕过JetBrains TeamCity
103 0
|
Shell
绕过360/某绒添加管理用户CS插件
绕过360/某绒添加管理用户CS插件
102 0
Yii2.0如何防止CSRF攻击?具体步骤是怎样的?
Yii2.0如何防止CSRF攻击?具体步骤是怎样的?
136 0
|
Web App开发 安全
移动和桌面端OAuth2.0安全分析和CodeVerifier机制
桌面端和移动端是在App中内嵌浏览器辅助完成OAuth2.0整个流程 流程如图所示 ![image.png](http://ata2-img.cn-hangzhou.img-pub.aliyun-inc.com/e313c8b086b254807908639b2acbafff.png) OAuth2.0 Web端 1)返回authCode到指定Web redirectUri(此ur
1655 0
|
Web App开发 Go 前端开发