[java-identity-provider COMMIT] in /trunk: idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractUsernamePassw...

[noreply at shibboleth.net]

Author: scantor
Date: Wed Oct 12 19:24:04 2016
New Revision: 8488

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8488&view=rev
Log:
IDP-156 - Create an authn lock-out stage

https://issues.shibboleth.net/jira/browse/IDP-156

Lockout interface and incoporation into password login logic.

Added:
    trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AccountLockoutManager.java   (with props)
Modified:
    trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractUsernamePasswordValidationAction.java
    trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthnEventIds.java
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstJAAS.java
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstKerberos.java
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstLDAP.java
    trunk/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml
    trunk/idp-distribution/src/main/resources/doc/CREDITS.txt

Modified: trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractUsernamePasswordValidationAction.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractUsernamePasswordValidationAction.java?rev=8488&r1=8487&r2=8488&view=diff
==============================================================================
--- trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractUsernamePasswordValidationAction.java	(original)
+++ trunk/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractUsernamePasswordValidationAction.java	Wed Oct 12 19:24:04 2016
@@ -39,9 +39,12 @@
  * {@link net.shibboleth.idp.authn.AuthenticationResult} based on that identity by invoking
  * a subclass method.
  *  
+ * <p>Lockout behavior can be enabled by injecting an {@link AccountLockoutManager}</p>
+ *  
  * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
  * @event {@link AuthnEventIds#INVALID_CREDENTIALS}
  * @event {@link AuthnEventIds#NO_CREDENTIALS}
+ * @event {@link AuthnEventIds#ACCOUNT_LOCKED}
  * @post If AuthenticationContext.getSubcontext(UsernamePasswordContext.class) != null, then
  * an {@link net.shibboleth.idp.authn.AuthenticationResult} is saved to the {@link AuthenticationContext} on a
  * successful login. On a failed login, the
@@ -65,6 +68,9 @@
     /** A regular expression to apply for acceptance testing. */
     @Nullable private Pattern matchExpression;
     
+    /** Optional lockout management interface. */
+    @Nullable private AccountLockoutManager lockoutManager;
+    
     /** UsernamePasswordContext containing the credentials to validate. */
     @Nullable private UsernamePasswordContext upContext;
     
@@ -131,6 +137,26 @@
         ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
         
         matchExpression = expression;
+    }
+    
+    /**
+     * Get an account lockout management component.
+     * 
+     * @return lockout manager
+     */
+    @Nullable public AccountLockoutManager getLockoutManager() {
+        return lockoutManager;
+    }
+    
+    /**
+     * Set an account lockout management component.
+     * 
+     * @param manager lockout manager
+     */
+    public void setLockoutManager(@Nullable final AccountLockoutManager manager) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        
+        lockoutManager = manager;
     }
     
     /**
@@ -164,7 +190,7 @@
             return false;
         } else if (upContext.getPassword() == null) {
             log.info("{} No password available within UsernamePasswordContext", getLogPrefix());
-            handleError(profileRequestContext, authenticationContext, "InvalidCredentials",
+            handleError(profileRequestContext, authenticationContext, AuthnEventIds.INVALID_CREDENTIALS,
                     AuthnEventIds.INVALID_CREDENTIALS);
             recordFailure();
             return false;
@@ -172,8 +198,17 @@
         
         if (matchExpression != null && !matchExpression.matcher(upContext.getUsername()).matches()) {
             log.debug("{} Username '{}' did not match expression", getLogPrefix(), upContext.getUsername());
-            handleError(profileRequestContext, authenticationContext, "InvalidCredentials",
+            handleError(profileRequestContext, authenticationContext, AuthnEventIds.INVALID_CREDENTIALS,
                     AuthnEventIds.INVALID_CREDENTIALS);
+            recordFailure();
+            return false;
+        }
+        
+        if (lockoutManager != null && lockoutManager.check(profileRequestContext)) {
+            log.info("{} Account for '{}' is locked out, aborting authentication", getLogPrefix(), 
+                    upContext.getUsername());
+            handleError(profileRequestContext, authenticationContext, AuthnEventIds.ACCOUNT_LOCKED,
+                    AuthnEventIds.ACCOUNT_LOCKED);
             recordFailure();

[... 232 lines stripped ...]