Nemcio/SCM-Manager
1
0
Fork 0
mirror of https://github.com/scm-manager/scm-manager.git synced 2025-11-10 15:35:49 +01:00
Code Issues Packages Projects Releases Activity

implement LoginAttemptHandler for scm-manager 2

Browse Source
This commit is contained in:
Sebastian Sdorra
2017-01-15 20:27:06 +01:00
parent cbc6dad0fe
commit df6d9dacf8
12 changed files with 494 additions and 118 deletions
Download Patch File Download Diff File Expand all files Collapse all files

119
scm-core/src/main/java/sonia/scm/security/DAORealmHelper.java
View File

@@ -44,6 +44,7 @@ import org.apache.shiro.authc.DisabledAccountException;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authc.credential.CredentialsMatcher;
import org.apache.shiro.subject.SimplePrincipalCollection;
import org.slf4j.Logger;
@@ -70,21 +71,29 @@ public final class DAORealmHelper
/**
* the logger for DAORealmHelper
*/
private static final Logger logger =
LoggerFactory.getLogger(DAORealmHelper.class);
private static final Logger LOG = LoggerFactory.getLogger(DAORealmHelper.class);
private final LoginAttemptHandler loginAttemptHandler;
private final UserDAO userDAO;
private final GroupDAO groupDAO;
private final String realm;
//~--- constructors ---------------------------------------------------------
/**
* Constructs ...
* Constructs a new instance. Consider to use {@link DAORealmHelperFactory} which
* handles dependency injection.
*
*
* @param realm
* @param userDAO
* @param groupDAO
* @param loginAttemptHandler login attempt handler for wrapping credentials matcher
* @param userDAO user dao
* @param groupDAO group dao
* @param realm name of realm
*/
public DAORealmHelper(String realm, UserDAO userDAO, GroupDAO groupDAO)
{
public DAORealmHelper(LoginAttemptHandler loginAttemptHandler, UserDAO userDAO, GroupDAO groupDAO, String realm) {
this.loginAttemptHandler = loginAttemptHandler;
this.realm = realm;
this.userDAO = userDAO;
this.groupDAO = groupDAO;
@@ -92,6 +101,17 @@ public final class DAORealmHelper
//~--- get methods ----------------------------------------------------------
/**
* Wraps credentials matcher and applies login attempt policies.
*
* @param credentialsMatcher credentials matcher to wrap
*
* @return wrapped credentials matcher
*/
public CredentialsMatcher wrapCredentialsMatcher(CredentialsMatcher credentialsMatcher) {
return new RetryLimitPasswordMatcher(loginAttemptHandler, credentialsMatcher);
}
/**
* Method description
*
@@ -102,11 +122,8 @@ public final class DAORealmHelper
*
* @throws AuthenticationException
*/
public AuthenticationInfo getAuthenticationInfo(AuthenticationToken token)
throws AuthenticationException
{
checkArgument(token instanceof UsernamePasswordToken, "%s is required",
UsernamePasswordToken.class);
public AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
checkArgument(token instanceof UsernamePasswordToken, "%s is required", UsernamePasswordToken.class);
UsernamePasswordToken upt = (UsernamePasswordToken) token;
String principal = upt.getUsername();
@@ -123,31 +140,18 @@ public final class DAORealmHelper
*
* @return
*/
public AuthenticationInfo getAuthenticationInfo(String principal,
String credentials)
{
public AuthenticationInfo getAuthenticationInfo(String principal, String credentials) {
checkArgument(!Strings.isNullOrEmpty(principal), "username is required");
logger.debug("try to authenticate {}", principal);
LOG.debug("try to authenticate {}", principal);
User user = userDAO.get(principal);
if (user == null)
{
//J-
throw new UnknownAccountException(
String.format("unknown account %s", principal)
);
//J+
if (user == null) {
throw new UnknownAccountException(String.format("unknown account %s", principal));
}
if (!user.isActive())
{
//J-
throw new DisabledAccountException(
String.format("account %s is disabled", principal)
);
//J+
if (!user.isActive()) {
throw new DisabledAccountException(String.format("account %s is disabled", principal));
}
SimplePrincipalCollection collection = new SimplePrincipalCollection();
@@ -158,8 +162,7 @@ public final class DAORealmHelper
String creds = credentials;
if (credentials == null)
{
if (credentials == null) {
creds = user.getPassword();
}
@@ -168,36 +171,44 @@ public final class DAORealmHelper
//~--- methods --------------------------------------------------------------
private GroupNames collectGroups(String principal)
{
private GroupNames collectGroups(String principal) {
Builder<String> builder = ImmutableSet.builder();
builder.add(GroupNames.AUTHENTICATED);
for (Group group : groupDAO.getAll())
{
if (group.isMember(principal))
{
for (Group group : groupDAO.getAll()) {
if (group.isMember(principal)) {
builder.add(group.getName());
}
}
GroupNames groups = new GroupNames(builder.build());
logger.debug("collected following groups for principal {}: {}", principal,
groups);
LOG.debug("collected following groups for principal {}: {}", principal, groups);
return groups;
}
//~--- fields ---------------------------------------------------------------
private static class RetryLimitPasswordMatcher implements CredentialsMatcher {
/** Field description */
private final GroupDAO groupDAO;
private final LoginAttemptHandler loginAttemptHandler;
private final CredentialsMatcher credentialsMatcher;
/** Field description */
private final String realm;
/** Field description */
private final UserDAO userDAO;
private RetryLimitPasswordMatcher(LoginAttemptHandler loginAttemptHandler, CredentialsMatcher credentialsMatcher) {
this.loginAttemptHandler = loginAttemptHandler;
this.credentialsMatcher = credentialsMatcher;
}
@Override
public boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) {
loginAttemptHandler.beforeAuthentication(token);
boolean result = credentialsMatcher.doCredentialsMatch(token, info);
if ( result ) {
loginAttemptHandler.onSuccessfulAuthentication(token, info);
} else {
loginAttemptHandler.onUnsuccessfulAuthentication(token, info);
}
return result;
}
}
}

7
scm-core/src/main/java/sonia/scm/security/DAORealmHelperFactory.java
View File

@@ -42,17 +42,20 @@ import sonia.scm.user.UserDAO;
*/
public final class DAORealmHelperFactory {
private final LoginAttemptHandler loginAttemptHandler;
private final UserDAO userDAO;
private final GroupDAO groupDAO;
/**
* Constructs a new instance.
*
* @param loginAttemptHandler login attempt handler
* @param userDAO user dao
* @param groupDAO group dao
*/
@Inject
public DAORealmHelperFactory(UserDAO userDAO, GroupDAO groupDAO) {
public DAORealmHelperFactory(LoginAttemptHandler loginAttemptHandler, UserDAO userDAO, GroupDAO groupDAO) {
this.loginAttemptHandler = loginAttemptHandler;
this.userDAO = userDAO;
this.groupDAO = groupDAO;
}
@@ -65,7 +68,7 @@ public final class DAORealmHelperFactory {
* @return new {@link DAORealmHelper} instance.
*/
public DAORealmHelper create(String realm) {
return new DAORealmHelper(realm, userDAO, groupDAO);
return new DAORealmHelper(loginAttemptHandler, userDAO, groupDAO, realm);
}
}

77
scm-core/src/main/java/sonia/scm/security/LoginAttemptHandler.java Normal file
View File

@@ -0,0 +1,77 @@
/**
* Copyright (c) 2014, Sebastian Sdorra
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
* 3. Neither the name of SCM-Manager; nor the names of its
* contributors may be used to endorse or promote products derived from this
* software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
* ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
* http://bitbucket.org/sdorra/scm-manager
*
*/
package sonia.scm.security;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
/**
* Login attempt handler.
*
* @author Sebastian Sdorra
* @since 1.34
*/
public interface LoginAttemptHandler
{
/**
* This method is called before the authentication procedure is invoked.
*
* @param token authentication token
*
* @throws AuthenticationException
*/
public void beforeAuthentication(AuthenticationToken token) throws AuthenticationException;
/**
* Handle successful authentication.
*
* @param token authentication token
* @param info successful authentication result
*
* @throws AuthenticationException
*/
public void onSuccessfulAuthentication(AuthenticationToken token, AuthenticationInfo info)
throws AuthenticationException;
/**
* Handle unsuccessful authentication.
*
*
* @param token authentication token
* @param info unsuccessful authentication result
*
* @throws AuthenticationException
*/
public void onUnsuccessfulAuthentication(AuthenticationToken token, AuthenticationInfo info)
throws AuthenticationException;
}