[java-identity-provider] branch master updated: IDP-1391 - Add a service layer for password validators.
Scott Cantor
cantor.2 at osu.edu
Tue Aug 13 15:27:41 EDT 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=fcbb846db41edde4e770170c6553f68d10fb0ad2
The following commit(s) were added to refs/heads/master by this push:
new fcbb846 IDP-1391 - Add a service layer for password validators.
fcbb846 is described below
commit fcbb846db41edde4e770170c6553f68d10fb0ad2
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Aug 13 15:27:38 2019 -0400
IDP-1391 - Add a service layer for password validators.
https://issues.shibboleth.net/jira/browse/IDP-1391
https://issues.shibboleth.net/jira/browse/IDP-1216
Move username transforming into validators.
Also addresses IDP-1216 with second slot in context.
---
.../idp/authn/context/UsernamePasswordContext.java | 37 +++++++++++++++++++---
.../authn/impl/HTPasswdCredentialValidator.java | 13 ++++----
.../idp/authn/impl/JAASCredentialValidator.java | 12 +++----
.../authn/impl/KerberosCredentialValidator.java | 20 ++++++------
.../idp/authn/impl/LDAPCredentialValidator.java | 4 +--
.../resources/conf/authn/password-authn-config.xml | 2 +-
.../system/flows/authn/password-authn-beans.xml | 16 ++++------
7 files changed, 65 insertions(+), 39 deletions(-)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/UsernamePasswordContext.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/UsernamePasswordContext.java
index ff81acf..817030e 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/UsernamePasswordContext.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/UsernamePasswordContext.java
@@ -31,11 +31,14 @@ import org.opensaml.messaging.context.BaseContext;
*/
public final class UsernamePasswordContext extends BaseContext {
- /** The username. */
- private String username;
+ /** The original username. */
+ @Nullable private String username;
+ /** The transformed username. */
+ @Nullable private String transformedUsername;
+
/** The password associated with the username. */
- private String password;
+ @Nullable private String password;
/**
* Gets the username.
@@ -47,7 +50,7 @@ public final class UsernamePasswordContext extends BaseContext {
}
/**
- * Sets the username.
+ * Sets the username and resets the transformed version to be identical.
*
* @param name the username
*
@@ -55,10 +58,36 @@ public final class UsernamePasswordContext extends BaseContext {
*/
@Nonnull public UsernamePasswordContext setUsername(@Nullable final String name) {
username = name;
+ transformedUsername = name;
return this;
}
/**
+ * Gets the transformed username after undergoing some kind of reformatting or normalization.
+ *
+ * @return the transformed username
+ *
+ * @since 4.0.0
+ */
+ @Nullable public String getTransformedUsername() {
+ return transformedUsername;
+ }
+
+ /**
+ * Sets the username and resets the transformed version to be identical.
+ *
+ * @param name the username
+ *
+ * @return this context
+ *
+ * @since 4.0.0
+ */
+ @Nonnull public UsernamePasswordContext setTransformedUsername(@Nullable final String name) {
+ transformedUsername = name;
+ return this;
+ }
+
+ /**
* Gets the password associated with the username.
*
* @return password associated with the username
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/HTPasswdCredentialValidator.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/HTPasswdCredentialValidator.java
index d1ecf48..a13aaa6 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/HTPasswdCredentialValidator.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/HTPasswdCredentialValidator.java
@@ -132,11 +132,11 @@ public class HTPasswdCredentialValidator extends AbstractUsernamePasswordCredent
@Nullable final WarningHandler warningHandler,
@Nullable final ErrorHandler errorHandler) throws Exception {
+ final String username = usernamePasswordContext.getTransformedUsername();
- final String passwd = credentialMap.get(usernamePasswordContext.getUsername());
+ final String passwd = credentialMap.get(username);
if (passwd == null) {
- log.debug("{} Username '{}' not found in password resource", getLogPrefix(),
- usernamePasswordContext.getUsername());
+ log.debug("{} Username '{}' not found in password resource", getLogPrefix(), username);
final LoginException e = new LoginException(AuthnEventIds.UNKNOWN_USERNAME);
if (errorHandler != null) {
errorHandler.handleError(profileRequestContext, authenticationContext, e,
@@ -145,16 +145,15 @@ public class HTPasswdCredentialValidator extends AbstractUsernamePasswordCredent
throw e;
}
- log.debug("{} Attempting to authenticate user '{}' ", getLogPrefix(),
- usernamePasswordContext.getUsername());
+ log.debug("{} Attempting to authenticate user '{}' ", getLogPrefix(), username);
if (authenticate(usernamePasswordContext, passwd)) {
- log.info("{} Login by '{}' succeeded", getLogPrefix(), usernamePasswordContext.getUsername());
+ log.info("{} Login by '{}' succeeded", getLogPrefix(), username);
return populateSubject(new Subject(), usernamePasswordContext);
}
- log.info("{} Login by '{}' failed", getLogPrefix(), usernamePasswordContext.getUsername());
+ log.info("{} Login by '{}' failed", getLogPrefix(), username);
final LoginException e = new LoginException(AuthnEventIds.INVALID_CREDENTIALS);
if (errorHandler != null) {
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/JAASCredentialValidator.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/JAASCredentialValidator.java
index 99b749b..2bbb55a 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/JAASCredentialValidator.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/JAASCredentialValidator.java
@@ -210,14 +210,14 @@ public class JAASCredentialValidator extends AbstractUsernamePasswordCredentialV
try {
log.debug("{} Attempting to authenticate user '{}' via '{}'", getLogPrefix(),
- usernamePasswordContext.getUsername(), currentLoginConfigName);
+ usernamePasswordContext.getTransformedUsername(), currentLoginConfigName);
final Subject subject = authenticate(currentLoginConfigName, usernamePasswordContext);
log.info("{} Login by '{}' via '{}' succeeded", getLogPrefix(),
- usernamePasswordContext.getUsername(), currentLoginConfigName);
+ usernamePasswordContext.getTransformedUsername(), currentLoginConfigName);
return populateSubject(subject, loginConfig.getSecond(), usernamePasswordContext);
} catch (final LoginException e){
- log.info("{} Login by '{}' via '{}' failed", getLogPrefix(), usernamePasswordContext.getUsername(),
- currentLoginConfigName, e);
+ log.info("{} Login by '{}' via '{}' failed", getLogPrefix(),
+ usernamePasswordContext.getTransformedUsername(), currentLoginConfigName, e);
if (errorHandler != null) {
errorHandler.handleError(profileRequestContext, authenticationContext, e,
AuthnEventIds.INVALID_CREDENTIALS);
@@ -225,7 +225,7 @@ public class JAASCredentialValidator extends AbstractUsernamePasswordCredentialV
caughtException = e;
} catch (final Exception e) {
log.warn("{} Login by '{}' via '{}' produced exception", getLogPrefix(),
- usernamePasswordContext.getUsername(), currentLoginConfigName, e);
+ usernamePasswordContext.getTransformedUsername(), currentLoginConfigName, e);
if (errorHandler != null) {
errorHandler.handleError(profileRequestContext, authenticationContext, e,
AuthnEventIds.AUTHN_EXCEPTION);
@@ -332,7 +332,7 @@ public class JAASCredentialValidator extends AbstractUsernamePasswordCredentialV
for (final Callback cb : callbacks) {
if (cb instanceof NameCallback) {
final NameCallback ncb = (NameCallback) cb;
- ncb.setName(context.getUsername());
+ ncb.setName(context.getTransformedUsername());
} else if (cb instanceof PasswordCallback) {
final PasswordCallback pcb = (PasswordCallback) cb;
pcb.setPassword(context.getPassword().toCharArray());
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/KerberosCredentialValidator.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/KerberosCredentialValidator.java
index ca6b46d..1179595 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/KerberosCredentialValidator.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/KerberosCredentialValidator.java
@@ -201,29 +201,31 @@ public class KerberosCredentialValidator extends AbstractUsernamePasswordCredent
// We don't call logout, since that would destroy the contents of the Subject.
if (servicePrincipal != null) {
- log.debug("{} TGT acquired for {}, " +
+ log.debug("{} TGT acquired for '{}', " +
"attempting to verify authenticity of TGT using service principal {}",
- getLogPrefix(), usernamePasswordContext.getUsername(), servicePrincipal);
+ getLogPrefix(), usernamePasswordContext.getTransformedUsername(), servicePrincipal);
verifyKDC(subject);
}
- log.info("{} Login by '{}' succeeded", getLogPrefix(), usernamePasswordContext.getUsername());
+ log.info("{} Login by '{}' succeeded", getLogPrefix(),
+ usernamePasswordContext.getTransformedUsername());
return populateSubject(subject, usernamePasswordContext);
} catch (final InstantiationException | IllegalAccessException | ClassNotFoundException e) {
log.error("{} Unable to instantiate JAAS module for Kerberos", getLogPrefix(), e);
throw e;
} catch (final LoginException e) {
- log.info("{} Login by {} failed", getLogPrefix(), usernamePasswordContext.getUsername(), e);
+ log.info("{} Login by '{}' failed", getLogPrefix(), usernamePasswordContext.getTransformedUsername(),
+ e);
eventToSignal = AuthnEventIds.INVALID_CREDENTIALS;
throw e;
} catch(final GSSException e) {
- log.warn("{} Login by {} failed during GSS context establishment to verify KDC", getLogPrefix(),
- usernamePasswordContext.getUsername(), e);
+ log.warn("{} Login by '{}' failed during GSS context establishment to verify KDC", getLogPrefix(),
+ usernamePasswordContext.getTransformedUsername(), e);
eventToSignal = AuthnEventIds.INVALID_CREDENTIALS;
throw e;
} catch (final Exception e) {
- log.warn("{} Login by {} produced unknown exception", getLogPrefix(),
- usernamePasswordContext.getUsername(), e);
+ log.warn("{} Login by '{}' produced unknown exception", getLogPrefix(),
+ usernamePasswordContext.getTransformedUsername(), e);
throw e;
}
} catch (final Exception e) {
@@ -357,7 +359,7 @@ public class KerberosCredentialValidator extends AbstractUsernamePasswordCredent
for (final Callback cb : callbacks) {
if (cb instanceof NameCallback) {
final NameCallback ncb = (NameCallback) cb;
- ncb.setName(context.getUsername());
+ ncb.setName(context.getTransformedUsername());
} else if (cb instanceof PasswordCallback) {
final PasswordCallback pcb = (PasswordCallback) cb;
pcb.setPassword(context.getPassword().toCharArray());
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/LDAPCredentialValidator.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/LDAPCredentialValidator.java
index 1af9ee5..2562079 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/LDAPCredentialValidator.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/LDAPCredentialValidator.java
@@ -123,7 +123,7 @@ public class LDAPCredentialValidator extends AbstractUsernamePasswordCredentialV
@Nullable final WarningHandler warningHandler,
@Nullable final ErrorHandler errorHandler) throws Exception {
- final String username = usernamePasswordContext.getUsername();
+ final String username = usernamePasswordContext.getTransformedUsername();
String eventToSignal = AuthnEventIds.INVALID_CREDENTIALS;
@@ -204,7 +204,7 @@ public class LDAPCredentialValidator extends AbstractUsernamePasswordCredentialV
final Subject subject = new Subject();
subject.getPrincipals().add(
- new LdapPrincipal(usernamePasswordContext.getUsername(), ldapResponse.getLdapEntry()));
+ new LdapPrincipal(usernamePasswordContext.getTransformedUsername(), ldapResponse.getLdapEntry()));
return super.populateSubject(subject, usernamePasswordContext);
}
diff --git a/idp-conf/src/main/resources/conf/authn/password-authn-config.xml b/idp-conf/src/main/resources/conf/authn/password-authn-config.xml
index bfde882..502e73e 100644
--- a/idp-conf/src/main/resources/conf/authn/password-authn-config.xml
+++ b/idp-conf/src/main/resources/conf/authn/password-authn-config.xml
@@ -33,7 +33,7 @@
<!-- Apply any regular expression replacement pairs to username before validation. -->
<util:list id="shibboleth.authn.Password.Transforms">
<!--
- <bean parent="shibboleth.Pair" p:first="^(.+)@example\.edu$" p:second="$1" />
+ <bean parent="shibboleth.Pair" p:first="^(.+)@example\.org$" p:second="$1" />
-->
</util:list>
diff --git a/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml b/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml
index 00533d1..83bcae9 100644
--- a/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml
@@ -24,11 +24,7 @@
<bean id="ExtractUsernamePasswordFromBasicAuth"
class="net.shibboleth.idp.authn.impl.ExtractUsernamePasswordFromBasicAuth" scope="prototype"
- p:httpServletRequest-ref="shibboleth.HttpServletRequest"
- p:lowercase-ref="shibboleth.authn.Password.Lowercase"
- p:uppercase-ref="shibboleth.authn.Password.Uppercase"
- p:trim-ref="shibboleth.authn.Password.Trim"
- p:transforms-ref="shibboleth.authn.Password.Transforms" />
+ p:httpServletRequest-ref="shibboleth.HttpServletRequest" />
<bean id="PreserveAuthenticationFlowState"
class="net.shibboleth.idp.authn.impl.PreserveAuthenticationFlowState" scope="prototype"
@@ -40,11 +36,7 @@
p:httpServletRequest-ref="shibboleth.HttpServletRequest"
p:usernameFieldName-ref="shibboleth.authn.Password.UsernameFieldName"
p:passwordFieldName-ref="shibboleth.authn.Password.PasswordFieldName"
- p:SSOBypassFieldName-ref="shibboleth.authn.Password.SSOBypassFieldName"
- p:lowercase-ref="shibboleth.authn.Password.Lowercase"
- p:uppercase-ref="shibboleth.authn.Password.Uppercase"
- p:trim-ref="shibboleth.authn.Password.Trim"
- p:transforms-ref="shibboleth.authn.Password.Transforms" />
+ p:SSOBypassFieldName-ref="shibboleth.authn.Password.SSOBypassFieldName" />
<bean id="PopulateSubjectCanonicalizationContext"
class="net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext" scope="prototype"
@@ -68,6 +60,10 @@
<bean id="shibboleth.CredentialValidator" abstract="true"
p:savePasswordToCredentialSet="#{getObject('shibboleth.authn.Password.RetainAsPrivateCredential') ?: false}"
p:removeContextAfterValidation="#{getObject('shibboleth.authn.Password.RemoveAfterValidation') ?: true}"
+ p:lowercase-ref="shibboleth.authn.Password.Lowercase"
+ p:uppercase-ref="shibboleth.authn.Password.Uppercase"
+ p:trim-ref="shibboleth.authn.Password.Trim"
+ p:transforms-ref="shibboleth.authn.Password.Transforms"
p:matchExpression="#{getObject('shibboleth.authn.Password.matchExpression')}" />
<!-- New validator(s) that didn't exist in prior versions. -->
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list