[java-identity-provider] branch master updated: IDP-1641 - Extend LDAP CredentialValidator with password construction

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=6732f4c5c80edce3bad4389b0869c750869b6f33

The following commit(s) were added to refs/heads/master by this push:
       new  6732f4c5c IDP-1641 - Extend LDAP CredentialValidator with password construction
6732f4c5c is described below

commit 6732f4c5c80edce3bad4389b0869c750869b6f33
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jul 16 08:54:13 2020 -0400

    IDP-1641 - Extend LDAP CredentialValidator with password construction
    
    https://issues.shibboleth.net/jira/browse/IDP-1641
---
 .../idp/authn/impl/LDAPCredentialValidator.java    | 24 +++++++++--
 .../authn/impl/LDAPCredentialValidatorTest.java    | 46 ++++++++++++++++++++++
 2 files changed, 67 insertions(+), 3 deletions(-)

diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/LDAPCredentialValidator.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/LDAPCredentialValidator.java
index 493decd0a..51f6c91aa 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/LDAPCredentialValidator.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/LDAPCredentialValidator.java
@@ -17,6 +17,8 @@
 
 package net.shibboleth.idp.authn.impl;
 
+import java.util.function.Function;
+
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 import javax.security.auth.Subject;
@@ -64,6 +66,9 @@ public class LDAPCredentialValidator extends AbstractUsernamePasswordCredentialV
     /** Attributes to return from authentication. */
     @Nullable private String[] returnAttributes;
     
+    /** Optional strategy for obtaining/transforming the password. */
+    @Nullable private Function<ProfileRequestContext,char[]> passwordLookupStrategy;
+    
     /**
      * Returns the authenticator.
      * 
@@ -103,6 +108,17 @@ public class LDAPCredentialValidator extends AbstractUsernamePasswordCredentialV
 
         returnAttributes = attributes;
     }
+    
+    /**
+     * Set a strategy function to produce the password to bind with.
+     * 
+     * @param strategy strategy function
+     */
+    public void setPasswordLookupStrategy(@Nullable final Function<ProfileRequestContext,char[]> strategy) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        
+        passwordLookupStrategy = strategy;
+    }
 
     /** {@inheritDoc} */
     @Override
@@ -136,9 +152,11 @@ public class LDAPCredentialValidator extends AbstractUsernamePasswordCredentialV
             log.debug("{} Attempting to authenticate user {}", getLogPrefix(), username);
             final VelocityContext context = new VelocityContext();
             context.put("usernamePasswordContext", usernamePasswordContext);
-            final AuthenticationRequest request =
-                    new AuthenticationRequest(new User(username, context),
-                            new Credential(usernamePasswordContext.getPassword()), returnAttributes);
+            final char[] password = passwordLookupStrategy != null ?
+                    passwordLookupStrategy.apply(profileRequestContext) :
+                        usernamePasswordContext.getPassword().toCharArray();
+            final AuthenticationRequest request = new AuthenticationRequest(
+                    new User(username, context), new Credential(password), returnAttributes);
             final AuthenticationResponse response = authenticator.authenticate(request);
             log.trace("{} Authentication response {}", getLogPrefix(), response);
             if (response.getResult()) {
diff --git a/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/LDAPCredentialValidatorTest.java b/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/LDAPCredentialValidatorTest.java
index 528eb41e8..a4d66146f 100644
--- a/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/LDAPCredentialValidatorTest.java
+++ b/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/LDAPCredentialValidatorTest.java
@@ -23,6 +23,7 @@ import java.util.Collection;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
+import java.util.function.Function;
 import java.util.regex.Pattern;
 
 import net.shibboleth.idp.authn.AuthenticationResult;
@@ -49,6 +50,7 @@ import org.ldaptive.auth.SearchDnResolver;
 import org.ldaptive.auth.ext.PasswordPolicyAccountState;
 import org.ldaptive.control.PasswordPolicyControl;
 import org.ldaptive.jaas.LdapPrincipal;
+import org.opensaml.profile.context.ProfileRequestContext;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.webflow.execution.Event;
 import org.testng.Assert;
@@ -492,6 +494,50 @@ public class LDAPCredentialValidatorTest extends BaseAuthenticationContextTest {
         Assert.assertNotNull(lp.getLdapEntry());
     }
 
+    @Test public void testComputedAndAuthorized() throws Exception {
+        ((MockHttpServletRequest) action.getHttpServletRequest()).addParameter("username", "PETER_THE_PRINCIPAL");
+        ((MockHttpServletRequest) action.getHttpServletRequest()).addParameter("password", "change");
+
+        AuthenticationContext ac = prc.getSubcontext(AuthenticationContext.class);
+        ac.setAttemptedFlow(authenticationFlows.get(0));
+        
+        validator.setAuthenticator(authenticator);
+        validator.setPasswordLookupStrategy(
+                new Function<ProfileRequestContext,char[]>() {
+                    public char[] apply(final ProfileRequestContext input) {
+                        return (input.getSubcontext(
+                                AuthenticationContext.class).getSubcontext(
+                                        UsernamePasswordContext.class).getPassword() + "it").toCharArray();
+                    }
+                });
+        validator.initialize();
+        
+        action.initialize();
+
+        doExtract();
+
+        final Event event = action.execute(src);
+        ActionTestingSupport.assertProceedEvent(event);
+        
+        AuthenticationErrorContext aec = ac.getSubcontext(AuthenticationErrorContext.class);
+        Assert.assertNull(aec);
+
+        AuthenticationResult result = ac.getAuthenticationResult();
+        Assert.assertNotNull(result);
+        LDAPResponseContext lrc = ac.getSubcontext(LDAPResponseContext.class);
+        Assert.assertNotNull(lrc.getAuthenticationResponse());
+        Assert.assertEquals(lrc.getAuthenticationResponse().getAuthenticationResultCode(),
+                AuthenticationResultCode.AUTHENTICATION_HANDLER_SUCCESS);
+
+        UsernamePrincipal up = result.getSubject().getPrincipals(UsernamePrincipal.class).iterator().next();
+        Assert.assertNotNull(up);
+        Assert.assertEquals(up.getName(), "PETER_THE_PRINCIPAL");
+        LdapPrincipal lp = result.getSubject().getPrincipals(LdapPrincipal.class).iterator().next();
+        Assert.assertNotNull(lp);
+        Assert.assertEquals(lp.getName(), "PETER_THE_PRINCIPAL");
+        Assert.assertNotNull(lp.getLdapEntry());
+    }
+
     @Test public void testDefaultFilterSyntax() throws Exception {
         TemplateSearchDnResolver testResolver = new TemplateSearchDnResolver(new DefaultConnectionFactory("ldap://localhost:10389"),
                 VelocityEngine.newVelocityEngine(), "(uid={user})");

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.