I haven't worked on using oAuth with SOAP since it is mostly used for REST but i believe you can send the authorization token "Bearer {oAuth Token} in the SOAP header to get the token from your client and validate at your end if it is a valid token or not.
In your custom class you need to extended this OOB Class AuthenticationFilter and use it methods to validate the token and allow the user to access the API.
Validating if it is an oAuth Request:
You can use the OOB API(Blue Highlighted) from the extended class to validate if it is an oAuth token based request or not. Below example is extracting it from httpRequest but in your case it will from SOAP Header. The token needs to be sent by the client like below format in the header:
Read my comment in read below.
public boolean isAuthRequest(HttpServletRequest httpRequest)
{
boolean isBearerAuth = false;
//Instead of using getAuthHeader OOB method which takes httpRequest you need to get it from your SOAP request and set it as a string
String authHeader = getAuthHeader(httpRequest);
isBearerAuth = AuthenticationUtil.isBearerAuth(authHeader);
return isBearerAuth;
}
Once you have the token you need check if it is valid or not.
public Map<String,Object> bearerAuthenticate(HttpServletRequest httpRequest)
{
log.debug("Inside bearerAuthenticate");
boolean success = false;
Map<String,Object> result = new HashMap<String,Object>();
AuthenticationResult.Reason reason = AuthenticationResult.Reason.UNSPECIFIED;
result.put("success", success);
//Instead of using getAuthHeader OOB method which takes httpRequest you need to get it from your SOAP request and set it as a string
String authHeader = getAuthHeader(httpRequest);
OAuthAccessToken token = null;
try
{
log.debug("Creating context for MyContext");
ctx = SailPointFactory.createContext("MyContext"); //Create a new context if not available else use the available context
OAuthTokenValidator validator = new OAuthTokenValidator(ctx);
token = validator.authenticate(authHeader);
if (null != token)
{
String proxyUser = token.getIdentityId();
Identity user = ctx.getObjectByName(Identity.class, proxyUser);
OAuthClientService oAuthClientSvc = new OAuthClientService(ctx);
OAuthClient client = oAuthClientSvc.getClient(token.getClientId());
log.debug("Proxy Identity: "+user+"Client name: "+client.getName());
if(user != null) {
result.put("success", true);
ctx.setUserName(user.getName());
LoginBean.writeIdentitySession(new HttpSessionStorage(session), user);
Auditor.log("login", user.getName());
result.put("apiClient", client.getName());
}else {
result.put("success", false);
result.put("reason", "Unable to resolve proxy user");
}
}
}
catch (OAuthTokenExpiredException e)
{
reason = AuthenticationResult.Reason.OAUTH_TOKEN_EXPIRED;
result.put("success", false);
result.put("reason", reason.toString());
log.error("OAuth Token Expired: "+reason.toString());
}
catch (GeneralException localGeneralException) {
result.put("success", false);
result.put("reason", localGeneralException.getMessage());
log.error("Local general Exp occured: "+localGeneralException);
}catch (GeneralSecurityException e)
{
result.put("success", false);
result.put("reason", e.getMessage());
log.error("Unable to authenticate using Bearer Authentication: ", e);
}
return result;
}
I hope this helps!
