Check whether this security context belongs to the privileged SIBServerSubject
or not.

@param subject
@param destinationUuid
@param discriminatorName
@param operation
@return
484068
public boolean isSIBServerSubject()
   {
     if (tc.isEntryEnabled()) 
       SibTr.entry(tc, "isSIBServerSubject"); 
       
     boolean ispriv = false;
      
     // If the context is userid or alternate user based then it cannot be the
     // privileged SIBServerSubject, so we only need to check the Subject and
     // msg based contexts.     
     if(isSubjectBased())
     {     
       if(authorisationUtils != null)
       {
         ispriv = authorisationUtils.isSIBServerSubject(subject);
       }        
     }
     else if(isMsgBased())
     {     
       if(authorisationUtils != null)
       {
         ispriv = authorisationUtils.sentBySIBServer(msg);
       }             
     }

     if (tc.isEntryEnabled())
       SibTr.exit(tc, "isSIBServerSubject", new Boolean(ispriv));

     return ispriv; 
   }
741751
public boolean checkDestinationAccess(
    SecurityContext secContext,
    OperationType operation) 
  {
    if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
      SibTr.entry(
        tc,
        "checkDestinationAccess",
        new Object[] { secContext, operation });

    boolean allow = false;

    // This style of access check is against a bus only.
    if(accessChecker.checkForeignBusAccess(secContext,
                              getName(),
                              operation))
    {
      allow = true;
    }
       
    if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
      SibTr.exit(tc, "checkDestinationAccess", Boolean.valueOf(allow));

    return allow; 
  }
1100256
private void validateSubject(final Resource subject) {
        final String subjectURI = subject.getURI();
        // blank nodes are okay
        if (!subject.isAnon()) {
            // hash URIs with the same base as the topic are okay
            final int hashIndex = subjectURI.lastIndexOf("#");
            if (!(hashIndex > 0 && topic.getURI().equals(subjectURI.substring(0, hashIndex)))) {
                // the topic itself is okay
                if (!topic.equals(subject.asNode())) {
                    // it's a bad subject, but it could still be in-domain
                    if (idTranslator.inDomain(subject)) {
                        LOGGER.error("{} is not in the topic of this RDF, which is {}.", subject, topic);
                        throw new IncorrectTripleSubjectException(subject +
                                " is not in the topic of this RDF, which is " + topic);
                    }
                    // it's not even in the right domain!
                    LOGGER.error("subject ({}) is not in repository domain.", subject);
                    throw new OutOfDomainSubjectException(subject.asNode());
                }
            }
        }
    }
2147
public static boolean isAuthenticatingAtPublicWorkstation(final RequestContext ctx) {
        if (ctx.getFlowScope().contains(PUBLIC_WORKSTATION_ATTRIBUTE)) {
            LOGGER.debug("Public workstation flag detected. SSO session will be considered renewed.");
            return true;
        }
        return false;
    }
264965
private void checkDestinationAccess(DestinationHandler destination,
                                        SecurityContext secContext) throws SIDiscriminatorSyntaxException, SINotAuthorizedException
    {
        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
            SibTr.entry(
                        tc,
                        "checkDestinationAccess",
                        new Object[] { destination, secContext });

        // Check authority to access the destination
        if (!destination.
                        checkDestinationAccess(secContext,
                                               OperationType.SEND))
        {
            if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
                SibTr.exit(tc, "checkDestinationAccess", "not authorized to produce to this destination");

            // Get the username
            String userName = secContext.getUserName(true);

            // Build the message for the Exception and the Notification
            String nlsMessage =
                            nls_cwsik.getFormattedMessage("DELIVERY_ERROR_SIRC_18", // USER_NOT_AUTH_SEND_ERROR_CWSIP0306
                                                          new Object[] { destination.getName(),
                                                                        userName },
                                                          null);

            // Fire a Notification if Eventing is enabled
            _messageProcessor.
                            getAccessChecker().
                            fireDestinationAccessNotAuthorizedEvent(destination.getName(),
                                                                    userName,
                                                                    OperationType.SEND,
                                                                    nlsMessage);

            // Thrown if user denied access to destination
            SIMPNotAuthorizedException e = new SIMPNotAuthorizedException(nlsMessage);

            e.setExceptionReason(SIRCConstants.SIRC0018_USER_NOT_AUTH_SEND_ERROR);
            e.setExceptionInserts(new String[] { destination.getName(),
                                                secContext.getUserName(true) });
            throw e;
        }

        // Check authority to produce to discriminator
        if (!destination.
                        checkDiscriminatorAccess(secContext,
                                                 OperationType.SEND))
        {
            if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
                SibTr.exit(tc, "checkDestinationAccess", "not authorized to produce to this discriminator");

            // Write an audit record if access is denied
            SibTr.audit(tc, nls_cwsik.getFormattedMessage(
                                                          "DELIVERY_ERROR_SIRC_20", // USER_NOT_AUTH_SEND_ERROR_CWSIP0308
                                                          new Object[] { destination.getName(),
                                                                        secContext.getDiscriminator(),
                                                                        secContext.getUserName(true) },
                                                          null));

            // Thrown if user denied access to discriminator
            SIMPNotAuthorizedException e = new SIMPNotAuthorizedException(
                            nls_cwsik.getFormattedMessage(
                                                          "DELIVERY_ERROR_SIRC_20", // USER_NOT_AUTH_SEND_ERROR_CWSIP0308
                                                          new Object[] { destination.getName(),
                                                                        secContext.getDiscriminator(),
                                                                        secContext.getUserName(true) },
                                                          null));

            e.setExceptionReason(SIRCConstants.SIRC0020_USER_NOT_AUTH_SEND_ERROR);
            e.setExceptionInserts(new String[] { destination.getName(),
                                                secContext.getDiscriminator(),
                                                secContext.getUserName(true) });
            throw e;
        }

        if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
            SibTr.exit(tc, "checkDestinationAccess");
    }
445457
public boolean destinationExists(String destinationName)
  {
    if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled()) 
      SibTr.entry(tc, "destinationExists", destinationName);

    boolean returnVal = false;
    
    try
    {
      returnVal = 
        destinationManager.destinationExists(destinationName, 
                                             messageProcessor.getMessagingEngineBus());
    }
    catch (SIMPNullParameterException e)
    {
      // No FFDC code needed
    }
     
    if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled()) 
      SibTr.exit(tc, "destinationExists", new Boolean(returnVal));
      
    return returnVal;
  }
1248815
@Override
    @FFDCIgnore(Exception.class)
    public Subject getUnauthenticatedSubject() {
        if (unauthenticatedSubject == null) {
            CredentialsService cs = credentialsServiceRef.getService();
            String unauthenticatedUserid = cs.getUnauthenticatedUserid();
            try {
                Subject subject = new Subject();
                Hashtable<String, Object> hashtable = new Hashtable<String, Object>();
                hashtable.put(AttributeNameConstants.WSCREDENTIAL_SECURITYNAME, unauthenticatedUserid);
                hashtable.put(AttributeNameConstants.WSCREDENTIAL_UNIQUEID,
                              AccessIdUtil.createAccessId(AccessIdUtil.TYPE_USER, getUserRegistryRealm(), unauthenticatedUserid));
                subject.getPublicCredentials().add(hashtable);
                SecurityService securityService = securityServiceRef.getService();
                AuthenticationService authenticationService = securityService.getAuthenticationService();
                Subject tempUnauthenticatedSubject = authenticationService.authenticate(JaasLoginConfigConstants.SYSTEM_UNAUTHENTICATED, subject);
                tempUnauthenticatedSubject.setReadOnly();
                synchronized (unauthenticatedSubjectLock) {
                    if (unauthenticatedSubject == null) {
                        unauthenticatedSubject = tempUnauthenticatedSubject;
                    }
                }
            } catch (Exception e) {
                if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                    Tr.debug(tc, "Internal error creating UNAUTHENTICATED subject.", e);
                }
            }
        }
        return unauthenticatedSubject;
    }
861670
protected final boolean isValidBearerSubjectConfirmationData(final SubjectConfirmationData data,
                                                                 final SAML2MessageContext context) {
        if (data == null) {
            logger.debug("SubjectConfirmationData cannot be null for Bearer confirmation");
            return false;
        }

        // TODO Validate inResponseTo

        if (data.getNotBefore() != null) {
            logger.debug("SubjectConfirmationData notBefore must be null for Bearer confirmation");
            return false;
        }

        if (data.getNotOnOrAfter() == null) {
            logger.debug("SubjectConfirmationData notOnOrAfter cannot be null for Bearer confirmation");
            return false;
        }

        if (data.getNotOnOrAfter().plusSeconds(acceptedSkew).isBeforeNow()) {
            logger.debug("SubjectConfirmationData notOnOrAfter is too old");
            return false;
        }

        try {
            if (data.getRecipient() == null) {
                logger.debug("SubjectConfirmationData recipient cannot be null for Bearer confirmation");
                return false;
            } else {
                final Endpoint endpoint = context.getSAMLEndpointContext().getEndpoint();
                if (endpoint == null) {
                    logger.warn("No endpoint was found in the SAML endpoint context");
                    return false;
                }

                final URI recipientUri = new URI(data.getRecipient());
                final URI appEndpointUri = new URI(endpoint.getLocation());
                if (!SAML2Utils.urisEqualAfterPortNormalization(recipientUri, appEndpointUri)) {
                    logger.debug("SubjectConfirmationData recipient {} does not match SP assertion consumer URL, found. "
                        + "SP ACS URL from context: {}", recipientUri, appEndpointUri);
                    return false;
                }
            }
        } catch (URISyntaxException use) {
            logger.error("Unable to check SubjectConfirmationData recipient, a URI has invalid syntax.", use);
            return false;
        }

        return true;
    }
552412
private void initializeSecurityManager(SubjectAwareDescriptor subjectAware)
  {
    String cfg = subjectAware.getConfiguration();

    if (cfg.length() > 0)
    {
      Factory<SecurityManager> factory = new IniSecurityManagerFactory(cfg);
      SecurityManager securityManager = factory.getInstance();

      SecurityUtils.setSecurityManager(securityManager);
    }

    String username = subjectAware.getUsername();

    if ((username != null) && (username.length() > 0))
    {
      UsernamePasswordToken token = new UsernamePasswordToken(username,
                                      subjectAware.getPassword());

      SecurityUtils.getSubject().login(token);
    }
  }
545255
private String resolveSubjectToDatastream(String subject) throws ServerException{
        String pidURI = PID.toURI(m_obj.getPid());
        if (subject.startsWith(pidURI)) {
            if (subject.length() == pidURI.length()) {
                return "RELS-EXT";
            }
            if (subject.charAt(pidURI.length()) == '/') {
                return "RELS-INT";
            }
        }
        throw new GeneralException("Cannot determine which relationship datastream to update for subject " + subject + ".  Relationship subjects must be the URI of the object or the URI of a datastream within the object.");
    }
114620
public OvhReverseDelegation ip_delegation_target_GET(String ip, String target) throws IOException {
		String qPath = "/ip/{ip}/delegation/{target}";
		StringBuilder sb = path(qPath, ip, target);
		String resp = exec(qPath, "GET", sb.toString(), null);
		return convertTo(resp, OvhReverseDelegation.class);
	}
456928
public boolean isValidSubject(X500Principal subject) {

        if (subject == null) {
            throw new IllegalArgumentException();
        }

        String subjectDN = CertificateUtil.toGlobusID(subject);

        if ((this.allowedDNs == null) || (this.allowedDNs.size() < 1)) {
            return false;
        }

        int size = this.allowedDNs.size();
        for (int i = 0; i < size; i++) {
            Pattern pattern = allowedDNs.get(i);
            Matcher matcher = pattern.matcher(subjectDN);
            boolean valid = matcher.matches();
            if (valid) {
                return true;
            }
        }

        return false;
    }
153857
public OvhChangeIpStatus serviceName_canLicenseBeMovedTo_GET(String serviceName, String destinationIp) throws IOException {
		String qPath = "/license/virtuozzo/{serviceName}/canLicenseBeMovedTo";
		StringBuilder sb = path(qPath, serviceName);
		query(sb, "destinationIp", destinationIp);
		String resp = exec(qPath, "GET", sb.toString(), null);
		return convertTo(resp, OvhChangeIpStatus.class);
	}
578918
private static String resolveIdentity(ResourceAddress address, Subject subject) {
        IdentityResolver resolver = address.getOption(IDENTITY_RESOLVER);
        ResourceAddress transport = address.getTransport();
        if (resolver != null) {
            return resolver.resolve(subject);
        }
        if (transport != null) {
            return resolveIdentity(transport, subject);
        }
        return null;
    }
629861
@Override
	public boolean isSubjectValid(Subject subject) {
		// TODO Auto-generated method stub
		String encodedjwt = getJwtSSOToken(subject);
		JwtSsoTokenUtils tokenUtil = getJwtSsoTokenConsumerUtils();
		if (tokenUtil != null && encodedjwt != null) {
			return tokenUtil.isJwtValid(encodedjwt);
		}
		return false;
	}
134702
@Override
    public boolean checkAliasAccess(Subject authenticatedSubject, String destination, String aliasDestination, int destinationType, String operationType,
                                    boolean logWarning) throws MessagingAuthorizationException {
        SibTr.entry(tc, CLASS_NAME + "checkAliasAccess", new Object[] { authenticatedSubject, aliasDestination, operationType });

        String busName = null;
        String messagingEngine = null;
        String[] roles = null;
        
        if (auditManager != null) {
            if (auditManager.getJMSBusName() != null)
                busName = auditManager.getJMSBusName();
            if (auditManager.getJMSMessagingEngine() != null)
                messagingEngine = auditManager.getJMSMessagingEngine();
        }

        roles = new String[] {MessagingSecurityConstants.OPERATION_TYPE_RECEIVE};
        if (operationType.equalsIgnoreCase(MessagingSecurityConstants.OPERATION_TYPE_BROWSE)) {
            if (checkAliasAccess(authenticatedSubject, destination, aliasDestination, destinationType, MessagingSecurityConstants.OPERATION_TYPE_RECEIVE, false)) {
                return true;
            }
        }
        String destinationName = destination + ":" + aliasDestination;

        checkIfUserIsAuthenticated(authenticatedSubject);
        String userName = null;
        String user = authenticatedSubject.getPrincipals().iterator().next().getName();
        try {
            userName = MessagingSecurityUtility.getUniqueUserName(authenticatedSubject);
        } catch (MessagingSecurityException e) {
            if (auditManager != null && auditManager.getJMSConversationMetaData() != null) {
                ConversationMetaData cmd = (ConversationMetaData) auditManager.getJMSConversationMetaData();

                Audit.audit(Audit.EventID.SECURITY_JMS_AUTHZ_01, user, cmd.getRemoteAddress().getHostAddress(), new Integer(cmd.getRemotePort()).toString(),
                            cmd.getChainName(), busName, messagingEngine, destinationName, operationType, roles, "aliasDestination",
                            Integer.valueOf("201"));
            } else {
                Audit.audit(Audit.EventID.SECURITY_JMS_AUTHZ_01, user, null, null, null, busName, messagingEngine, destinationName, operationType, 
                            roles, "aliasDestination", Integer.valueOf("201"));
            }

            throw new MessagingAuthorizationException(Tr.formatMessage(tc, "USER_NOT_AUTHORIZED_MSE1010", userName, operationType, aliasDestination), e);
        }
        Permission permission = null;
        if (destinationType == MessagingSecurityConstants.DESTINATION_TYPE_QUEUE) {
            Map<String, QueuePermission> destinationPermission = messagingSecurityService.getQueuePermissions();
            permission = destinationPermission.get(destination);
        } else if (destinationType == MessagingSecurityConstants.DESTINATION_TYPE_TOPICSPACE) {
            Map<String, TopicPermission> destinationPermission = messagingSecurityService.getTopicPermissions();
            permission = destinationPermission.get(destination);
        }
        boolean result = checkPermission(permission, operationType, userName);
        if (!result) {
            if (auditManager != null && auditManager.getJMSConversationMetaData() != null) {
                ConversationMetaData cmd = (ConversationMetaData) auditManager.getJMSConversationMetaData();

                Audit.audit(Audit.EventID.SECURITY_JMS_AUTHZ_01, user, cmd.getRemoteAddress().getHostAddress(), new Integer(cmd.getRemotePort()).toString(),
                            cmd.getChainName(), busName, messagingEngine, destinationName, operationType, roles, "aliasDestination",
                            Integer.valueOf("201"));
            } else {
                Audit.audit(Audit.EventID.SECURITY_JMS_AUTHZ_01, user, null, null, null, busName, messagingEngine, destinationName, operationType, 
                            roles, "aliasDestination", Integer.valueOf("201"));
            }
            if (logWarning) {
                SibTr.debug(tc, "USER_NOT_AUTHORIZED_MSE1010",
                            new Object[] { userName, operationType, aliasDestination });
                throw new MessagingAuthorizationException(Tr.formatMessage(tc, "USER_NOT_AUTHORIZED_MSE1010", userName, operationType, aliasDestination));               
            }

        } else {
            if (auditManager != null && auditManager.getJMSConversationMetaData() != null) {
                ConversationMetaData cmd = (ConversationMetaData) auditManager.getJMSConversationMetaData();

                Audit.audit(Audit.EventID.SECURITY_JMS_AUTHZ_01, user, cmd.getRemoteAddress().getHostAddress(), new Integer(cmd.getRemotePort()).toString(),
                            cmd.getChainName(), busName, messagingEngine, destinationName, operationType, roles, "aliasDestination",
                            Integer.valueOf("200"));
            } else {
                Audit.audit(Audit.EventID.SECURITY_JMS_AUTHZ_01, user, null, null, null, busName, messagingEngine, destinationName, operationType, 
                            roles, "aliasDestination", Integer.valueOf("200"));
            }

 
        }
        SibTr.exit(tc, CLASS_NAME + "checkAliasAccess", result);
        return result;
    }
1175409
private void loginHadoopUser(Subject subject) {
        Class<?> ugi = null;
        try {
            ugi = Class.forName("org.apache.hadoop.security.UserGroupInformation");
        } catch (ClassNotFoundException e) {
            LOG.info("Hadoop was not found on the class path");
            return;
        }
        try {
            Method isSecEnabled = ugi.getMethod("isSecurityEnabled");
            if (!((Boolean) isSecEnabled.invoke(null))) {
                LOG.warn("Hadoop is on the classpath but not configured for " + "security, if you want security you need to be sure that "
                        + "hadoop.security.authentication=kerberos in core-site.xml " + "in your jar");
                return;
            }

            try {
                Method login = ugi.getMethod("loginUserFromSubject", Subject.class);
                login.invoke(null, subject);
            } catch (NoSuchMethodException me) {
                // The version of Hadoop does not have the needed client changes.
                // So don't look now, but do something really ugly to work around it.
                // This is because we are reaching into the hidden bits of Hadoop security, and it works for now, but may stop at any point in time.

                // We are just trying to do the following
                // Configuration conf = new Configuration();
                // HadoopKerberosName.setConfiguration(conf);
                // subject.getPrincipals().add(new User(tgt.getClient().toString(), AuthenticationMethod.KERBEROS, null));
                String name = getTGT(subject).getClient().toString();

                LOG.warn("The Hadoop client does not have loginUserFromSubject, Trying to hack around it. This may not work...");
                Class<?> confClass = Class.forName("org.apache.hadoop.conf.Configuration");
                Constructor confCons = confClass.getConstructor();
                Object conf = confCons.newInstance();
                Class<?> hknClass = Class.forName("org.apache.hadoop.security.HadoopKerberosName");
                Method hknSetConf = hknClass.getMethod("setConfiguration", confClass);
                hknSetConf.invoke(null, conf);

                Class<?> authMethodClass = Class.forName("org.apache.hadoop.security.UserGroupInformation$AuthenticationMethod");
                Object kerbAuthMethod = null;
                for (Object authMethod : authMethodClass.getEnumConstants()) {
                    if ("KERBEROS".equals(authMethod.toString())) {
                        kerbAuthMethod = authMethod;
                        break;
                    }
                }

                Class<?> userClass = Class.forName("org.apache.hadoop.security.User");
                Constructor userCons = userClass.getConstructor(String.class, authMethodClass, LoginContext.class);
                userCons.setAccessible(true);
                Object user = userCons.newInstance(name, kerbAuthMethod, null);
                subject.getPrincipals().add((Principal) user);
            }
        } catch (Exception e) {
            LOG.warn("Something went wrong while trying to initialize Hadoop through reflection. This version of hadoop may not be compatible.", e);
        }
    }