[java-identity-provider] branch main updated: IDP-2131 Conform LDAP exception messages

[Daniel Fisher]

This is an automated email from the git hooks/post-receive script.

dfisher pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=65412590224e63bc6259fccf2138eb6cdf179a12

The following commit(s) were added to refs/heads/main by this push:
     new 654125902 IDP-2131 Conform LDAP exception messages
654125902 is described below

commit 65412590224e63bc6259fccf2138eb6cdf179a12
Author: Daniel Fisher <dfisher at vt.edu>
AuthorDate: Wed Jun 21 19:42:17 2023 -0400

    IDP-2131 Conform LDAP exception messages
    
    https://shibboleth.atlassian.net/browse/IDP-2131
    
    Include LDAP result code when signaling AUTHN_EXCEPTION.
    Add unit test to check LDAP result code from exception.
---
 .../idp/authn/impl/LDAPCredentialValidator.java    |  6 +++-
 .../authn/impl/LDAPCredentialValidatorTest.java    | 40 ++++++++++++++++++++--
 2 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/LDAPCredentialValidator.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/LDAPCredentialValidator.java
index 90793c136..51008d3bd 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/LDAPCredentialValidator.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/LDAPCredentialValidator.java
@@ -200,14 +200,18 @@ public class LDAPCredentialValidator extends AbstractUsernamePasswordCredentialV
             final AccountState state = response.getAccountState();
             eventToSignal = AuthnEventIds.ACCOUNT_ERROR;
             authException = new LdapException(
+                response.getResultCode(),
                 String.format("%s:%s:%s", state.getError(), response.getResultCode(), response.getDiagnosticMessage()));
         } else if (response.getResultCode() == ResultCode.INVALID_CREDENTIALS) {
             eventToSignal = AuthnEventIds.INVALID_CREDENTIALS;
             authException = new LdapException(
+                response.getResultCode(),
                 String.format("%s:%s", response.getResultCode(), response.getDiagnosticMessage()));
         } else {
             eventToSignal = AuthnEventIds.AUTHN_EXCEPTION;
-            authException = new LdapException(response);
+            authException = new LdapException(
+                response.getResultCode(),
+                String.format("%s:%s", response.getResultCode(), response.getDiagnosticMessage()));
         }
 
         log.info("{} Login by '{}' failed", getLogPrefix(), username, authException);
diff --git a/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/LDAPCredentialValidatorTest.java b/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/LDAPCredentialValidatorTest.java
index e4f6ed23e..0d436c553 100644
--- a/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/LDAPCredentialValidatorTest.java
+++ b/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/LDAPCredentialValidatorTest.java
@@ -31,6 +31,7 @@ import org.ldaptive.auth.AccountState;
 import org.ldaptive.auth.AuthenticationResponse;
 import org.ldaptive.auth.AuthenticationResultCode;
 import org.ldaptive.auth.Authenticator;
+import org.ldaptive.auth.FormatDnResolver;
 import org.ldaptive.auth.SearchDnResolver;
 import org.ldaptive.auth.SimpleBindAuthenticationHandler;
 import org.ldaptive.auth.ext.PasswordPolicyAccountState;
@@ -130,7 +131,7 @@ public class LDAPCredentialValidatorTest extends BaseAuthenticationContextTest {
         action.setValidators(CollectionSupport.singletonList(validator));
 
         final Map<String, Collection<String>> mappings = new HashMap<>();
-        mappings.put("UnknownUsername", CollectionSupport.singleton("DN_RESOLUTION_FAILURE"));
+        mappings.put("UnknownUsername", CollectionSupport.listOf("DN_RESOLUTION_FAILURE", "INVALID_DN_SYNTAX"));
         mappings.put("InvalidPassword", CollectionSupport.singleton("INVALID_CREDENTIALS"));
         mappings.put("ExpiringPassword", CollectionSupport.singleton("ACCOUNT_WARNING"));
         mappings.put("ExpiredPassword", CollectionSupport.listOf("PASSWORD_EXPIRED", "CHANGE_AFTER_RESET"));
@@ -204,7 +205,7 @@ public class LDAPCredentialValidatorTest extends BaseAuthenticationContextTest {
         ActionTestingSupport.assertEvent(event, AuthnEventIds.REQUEST_UNSUPPORTED);
     }
 
-    @Test public void testBadConfig() throws ComponentInitializationException {
+    @Test public void testBadConfigInvalidDnResolver() throws ComponentInitializationException {
         getMockHttpServletRequest(action).addParameter("username", "foo");
         getMockHttpServletRequest(action).addParameter("password", "changeit");
 
@@ -235,7 +236,7 @@ public class LDAPCredentialValidatorTest extends BaseAuthenticationContextTest {
         Assert.assertTrue(aec.isClassifiedError("UnknownUsername"));
     }
 
-    @Test public void testBadConfig2() throws ComponentInitializationException {
+    @Test public void testBadConfigUnknownHost() throws ComponentInitializationException {
         getMockHttpServletRequest(action).addParameter("username", "PETER_THE_PRINCIPAL");
         getMockHttpServletRequest(action).addParameter("password", "bar");
 
@@ -294,6 +295,39 @@ public class LDAPCredentialValidatorTest extends BaseAuthenticationContextTest {
         Assert.assertTrue(aec.isClassifiedError("UnknownUsername"));
     }
 
+    @Test public void testBadUsernameAuthnException() throws ComponentInitializationException {
+        getMockHttpServletRequest(action).addParameter("username", "foo");
+        getMockHttpServletRequest(action).addParameter("password", "bar");
+
+        AuthenticationContext ac = prc.getSubcontext(AuthenticationContext.class);
+        assert ac != null;
+        ac.setAttemptedFlow(authenticationFlows.get(0));
+
+        final Authenticator directBindAuthenticator = new Authenticator(
+          new FormatDnResolver("cn=%s,ou,dc=shibboleth,dc=net"), authHandler);
+        validator.setAuthenticator(directBindAuthenticator);
+        validator.initialize();
+
+        action.initialize();
+
+        doExtract();
+
+        final Event event = action.execute(src);
+        Assert.assertNull(ac.getAuthenticationResult());
+        LDAPResponseContext lrc = ac.getSubcontext(LDAPResponseContext.class);
+        assert lrc != null;
+        final AuthenticationResponse lar = lrc.getAuthenticationResponse();
+        assert lar != null;
+        Assert.assertEquals(lar.getAuthenticationResultCode(),
+          AuthenticationResultCode.AUTHENTICATION_HANDLER_FAILURE);
+
+        AuthenticationErrorContext aec = ac.getSubcontext(AuthenticationErrorContext.class);
+        assert aec != null;
+        ActionTestingSupport.assertEvent(event, "UnknownUsername");
+        Assert.assertEquals(aec.getClassifiedErrors().size(), 1);
+        Assert.assertTrue(aec.isClassifiedError("UnknownUsername"));
+    }
+
     @Test public void testEmptyPassword() throws ComponentInitializationException {
         getMockHttpServletRequest(action).addParameter("username", "PETER_THE_PRINCIPAL");
         getMockHttpServletRequest(action).addParameter("password", "");

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.