[java-identity-provider COMMIT] /trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/spnego/impl/SPNEGOAuthnC...

[noreply at shibboleth.net]

Author: scantor
Date: Tue Oct 20 23:27:32 2015
New Revision: 7843

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7843&view=rev
Log:
IDP-111 - cleaned up controller, error handling very TBD

Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/spnego/impl/SPNEGOAuthnController.java

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/spnego/impl/SPNEGOAuthnController.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/spnego/impl/SPNEGOAuthnController.java?rev=7843&r1=7842&r2=7843&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/spnego/impl/SPNEGOAuthnController.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/spnego/impl/SPNEGOAuthnController.java	Tue Oct 20 23:27:32 2015
@@ -27,6 +27,7 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import net.shibboleth.idp.authn.AuthnEventIds;
 import net.shibboleth.idp.authn.ExternalAuthentication;
 import net.shibboleth.idp.authn.ExternalAuthenticationException;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
@@ -42,7 +43,6 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.http.HttpHeaders;
-import org.springframework.http.HttpStatus;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.RequestHeader;
@@ -61,10 +61,12 @@
 @Controller
 @RequestMapping("/Authn/SPNEGO")
 public class SPNEGOAuthnController {
-    /**
-     * Error message indicating that SPNEGO is not supported by the client or is not available for other reasons.
-     */
-    public static final String ERROR_SPNEGO_NOT_AVAILABLE = "SPNEGONotAvailable";
+    
+    /** Event ID indicating that SPNEGO is not supported by the client or is not available for other reasons. */
+    @Nonnull @NotEmpty public static final String SPNEGO_NOT_AVAILABLE = "SPNEGONotAvailable";
+
+    /** Event ID indicating that NTLM was attempted by the client. */
+    @Nonnull @NotEmpty public static final String NTLM_UNSUPPORTED = "NTLMUnsupported";
 
     /** Class logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(SPNEGOAuthnController.class);
@@ -75,269 +77,278 @@
      * @param conversationKey the SWF conversation key
      * @param httpRequest the HTTP request
      * @param httpResponse the HTTPÂ response
-     * @return the view name
-     * @throws ExternalAuthenticationException
-     * @throws IOException
+     * 
+     * @return the response view
+     * @throws IOException 
+     * @throws ExternalAuthenticationException 
      */
     @RequestMapping(value = "/{conversationKey}", method = RequestMethod.GET)
-    public ModelAndView startSPNEGO(@PathVariable String conversationKey, @Nonnull HttpServletRequest httpRequest,
-            @Nonnull HttpServletResponse httpResponse) throws ExternalAuthenticationException, IOException {
-        ProfileRequestContext prc = null;
-        try {
-            String key = ExternalAuthentication.startExternalAuthentication(httpRequest);
-            Constraint.isTrue(key.equals(conversationKey), "Conversation key mismatch");
-            prc = ExternalAuthentication.getProfileRequestContext(key, httpRequest);
-        } catch (final ExternalAuthenticationException e) {
-            log.error("Exception while getting ProfileRequestContext", e);
-            finishWithException(conversationKey, httpRequest, httpResponse, e);
+    @Nullable public ModelAndView startSPNEGO(@PathVariable @Nonnull @NotEmpty final String conversationKey,
+            @Nonnull final HttpServletRequest httpRequest, @Nonnull final HttpServletResponse httpResponse)
+                    throws ExternalAuthenticationException, IOException {
+        
+        final String key = ExternalAuthentication.startExternalAuthentication(httpRequest);
+        Constraint.isTrue(key.equals(conversationKey), "Conversation key mismatch");
+        final ProfileRequestContext prc = ExternalAuthentication.getProfileRequestContext(key, httpRequest);
+
+        final SPNEGOContext spnegoCtx = getSPNEGOContext(prc);
+        if (spnegoCtx == null || spnegoCtx.getKerberosSettings() == null) {
+            log.error("Kerberos settings not found in profile request context");
+            finishWithError(conversationKey, httpRequest, httpResponse, AuthnEventIds.INVALID_AUTHN_CTX);
             return null;
         }
-        if (getKerberosSettingsFromContext(prc) == null) {
-            log.error("Kerberos settings not found in profile");
-            finishWithError(conversationKey, httpRequest, httpResponse, ERROR_SPNEGO_NOT_AVAILABLE);
+        
+        // Start the SPNEGO exchange.
+        log.trace("SPNEGO negotiation started, answering request with 401 (WWW-Authenticate: Negotiate)");

[... 465 lines stripped ...]