Examples with UsernamePassword com.thoughtworks.go.server.newsecurity.models.UsernamePassword used on opensource projects

Example 1 with UsernamePassword

use of com.thoughtworks.go.server.newsecurity.models.UsernamePassword in project gocd by gocd.

the class AuthenticationController method performLogin.

@RequestMapping(value = "/auth/security_check", method = RequestMethod.POST)
public RedirectView performLogin(@RequestParam("j_username") String username, @RequestParam("j_password") String password, HttpServletRequest request) {
    if (securityIsDisabledOrAlreadyLoggedIn(request)) {
        return new RedirectView("/pipelines", true);
    }
    LOGGER.debug("Requesting authentication for form auth.");
    try {
        SavedRequest savedRequest = SessionUtils.savedRequest(request);
        final AuthenticationToken<UsernamePassword> authenticationToken = passwordBasedPluginAuthenticationProvider.authenticate(new UsernamePassword(username, password), null);
        if (authenticationToken == null) {
            return badAuthentication(request, BAD_CREDENTIALS_MSG);
        } else {
            SessionUtils.setAuthenticationTokenAfterRecreatingSession(authenticationToken, request);
        }
        String redirectUrl = savedRequest == null ? "/go/pipelines" : savedRequest.getRedirectUrl();
        return new RedirectView(redirectUrl, false);
    } catch (AuthenticationException e) {
        LOGGER.error("Failed to authenticate user: {} ", username, e);
        return badAuthentication(request, e.getMessage());
    } catch (Exception e) {
        return unknownAuthenticationError(request);
    }
}

Example 2 with UsernamePassword

use of com.thoughtworks.go.server.newsecurity.models.UsernamePassword in project gocd by gocd.

the class AbstractBasicAuthenticationFilter method doFilterInternal.

@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws IOException, ServletException {
    try {
        if (isPreviouslyAuthenticated(request)) {
            LOGGER.debug("Request is already authenticated.");
            filterChain.doFilter(request, response);
            return;
        }
        final UsernamePassword credential = BasicAuthHeaderExtractor.extractBasicAuthenticationCredentials(request.getHeader("Authorization"));
        if (credential != null) {
            LOGGER.debug("[Basic Authentication] Authorization header found for user '{}'", credential.getUsername());
        }
        if (securityService.isSecurityEnabled()) {
            LOGGER.debug("Security is enabled.");
            filterWhenSecurityEnabled(request, response, filterChain, credential);
        } else {
            LOGGER.debug("Security is disabled.");
            filterWhenSecurityDisabled(request, response, filterChain, credential);
        }
    } catch (AuthenticationException e) {
        onAuthenticationFailure(request, response, e.getMessage());
    }
}

Example 3 with UsernamePassword

use of com.thoughtworks.go.server.newsecurity.models.UsernamePassword in project gocd by gocd.

the class BasicAuthHeaderExtractor method extractBasicAuthenticationCredentials.

public static UsernamePassword extractBasicAuthenticationCredentials(String authorizationHeader) {
    if (isBlank(authorizationHeader)) {
        return null;
    }
    final Matcher matcher = BASIC_AUTH_EXTRACTOR_PATTERN.matcher(authorizationHeader);
    if (matcher.matches()) {
        final String encodedCredentials = matcher.group(1);
        final byte[] decode = Base64.getDecoder().decode(encodedCredentials);
        String decodedCredentials = new String(decode, StandardCharsets.UTF_8);
        final int indexOfSeparator = decodedCredentials.indexOf(':');
        if (indexOfSeparator == -1) {
            throw new BadCredentialsException("Invalid basic authentication credentials specified in request.");
        }
        final String username = decodedCredentials.substring(0, indexOfSeparator);
        final String password = decodedCredentials.substring(indexOfSeparator + 1);
        return new UsernamePassword(username, password);
    }
    return null;
}

Example 4 with UsernamePassword

use of com.thoughtworks.go.server.newsecurity.models.UsernamePassword in project gocd by gocd.

the class DashBoardControllerTest method shouldResolveDashboardViewNonStandbyServer.

@Test
void shouldResolveDashboardViewNonStandbyServer() {
    when(authToken.isValid()).thenReturn(true);
    when(authToken.toUsernamePassword()).thenReturn(new UsernamePassword(USERNAME, PASSWORD));
    when(addOnConfiguration.isServerInStandby()).thenReturn(false);
    when(railsAssetsService.getAssetPath("application.css")).thenReturn("application.css");
    when(railsAssetsService.getAssetPath("patterns/application.css")).thenReturn("patterns/application.css");
    when(railsAssetsService.getAssetPath("application.js")).thenReturn("application.js");
    when(railsAssetsService.getAssetPath("cruise.ico")).thenReturn("cruise.ico");
    Map<String, String> expectedModelMap = new HashMap<>();
    expectedModelMap.put("REPLACED_BY_GO:application.css", "application.css");
    expectedModelMap.put("REPLACED_BY_GO:patterns/application.css", "patterns/application.css");
    expectedModelMap.put("REPLACED_BY_GO:application.js", "application.js");
    expectedModelMap.put("REPLACED_BY_GO:cruise.ico", "cruise.ico");
    String template = "<html></html>";
    when(viewResolver.resolveView("error", expectedModelMap)).thenReturn(template);
    HttpServletRequest request = HttpRequestBuilder.GET("").withBasicAuth(USERNAME, PASSWORD).build();
    String view = controller.dashboard(request, null);
    assertThat(view).isEqualTo(template);
}

Example 5 with UsernamePassword

use of com.thoughtworks.go.server.newsecurity.models.UsernamePassword in project gocd by gocd.

the class DashBoardControllerTest method shouldErrorWhenStandbyNotAddedAsOAuthClient.

@Test
void shouldErrorWhenStandbyNotAddedAsOAuthClient() {
    when(authToken.isValid()).thenReturn(true);
    when(authToken.toUsernamePassword()).thenReturn(new UsernamePassword(USERNAME, PASSWORD));
    when(authToken.forHttp()).thenReturn(CREDENTIALS);
    when(addOnConfiguration.isServerInStandby()).thenReturn(true);
    HttpServletRequest request = HttpRequestBuilder.GET("").withBasicAuth(USERNAME, PASSWORD).build();
    MockHttpServletResponse response = new MockHttpServletResponse();
    String dashboardData = controller.dashboardData(request, response);
    MockHttpServletResponseAssert.assertThat(response).hasStatus(200);
    JsonFluentAssert.assertThatJson(dashboardData).isEqualTo("{\"syncErrors\":[\"Unable to connect to primary, please check that the business-continuity-token file is identical on primary and secondary, and that this server can connect to the primary server.\"],\"setupStatus\":\"incomplete\", \"userName\": \"bob\"}");
}