Examples with UsernamePassword com.thoughtworks.go.server.newsecurity.models.UsernamePassword used on opensource projects

Example 6 with UsernamePassword

use of com.thoughtworks.go.server.newsecurity.models.UsernamePassword in project gocd by gocd.

the class InvalidateAuthenticationOnSecurityConfigChangeFilterTest method shouldInvalidateAuthenticationTokenIfRoleConfigHasChanged.

@Test
void shouldInvalidateAuthenticationTokenIfRoleConfigHasChanged() throws IOException, ServletException {
    request = HttpRequestBuilder.GET("/").withRequestedSessionIdFromSession().build();
    final AuthenticationToken<UsernamePassword> authenticationToken = setupAuthentication();
    SessionUtils.setAuthenticationTokenAfterRecreatingSession(authenticationToken, request);
    final HttpSession originalSession = request.getSession(false);
    assertThat(SessionUtils.getAuthenticationToken(request).isAuthenticated(clock, systemEnvironment)).isTrue();
    filter.doFilter(request, response, filterChain);
    clock.addSeconds(1);
    filter.onPluginRoleChange();
    response.reset();
    filter.doFilter(request, response, filterChain);
    assertThat(SessionUtils.getAuthenticationToken(request).isAuthenticated(clock, systemEnvironment)).isFalse();
    assertThat(request.getSession(false)).isSameAs(originalSession);
    assertThat(request.getSession(false).getAttribute(SECURITY_CONFIG_LAST_CHANGE)).isEqualTo(clock.currentTimeMillis());
    verify(cacheService, times(1)).invalidateCache();
}

Example 7 with UsernamePassword

use of com.thoughtworks.go.server.newsecurity.models.UsernamePassword in project gocd by gocd.

the class ThreadLocalUserFilterTest method shouldSetUserToThreadLocalWhenFilterIsCalledAndRemoveUserFromThreadLocalOnceRequestIsCompleted.

@Test
void shouldSetUserToThreadLocalWhenFilterIsCalledAndRemoveUserFromThreadLocalOnceRequestIsCompleted() throws ServletException, IOException {
    final MockHttpServletRequest request = new MockHttpServletRequest();
    final MockHttpServletResponse response = new MockHttpServletResponse();
    final AuthenticationToken<UsernamePassword> authenticationToken = SessionUtilsHelper.createUsernamePasswordAuthentication("bob", "p@ssw0rd", 0L);
    SessionUtils.setAuthenticationTokenAfterRecreatingSession(authenticationToken, request);
    final GoUserPrinciple[] currentUserInFilter = { null };
    final FilterChain filterChain = new MockFilterChain(mock(Servlet.class), spy(new OncePerRequestFilter() {

        @Override
        protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
            currentUserInFilter[0] = SessionUtils.getCurrentUser();
        }
    }));
    new ThreadLocalUserFilter().doFilter(request, response, filterChain);
    assertThat(currentUserInFilter[0]).isNotNull();
    assertThat(SessionUtils.getCurrentUser().getUsername()).isEqualTo("anonymous");
    assertThat(SessionUtils.getCurrentUser().getAuthorities()).containsExactly(GoAuthority.ROLE_ANONYMOUS.asAuthority());
}

Example 8 with UsernamePassword

use of com.thoughtworks.go.server.newsecurity.models.UsernamePassword in project gocd by gocd.

the class AuthenticationController method performLogin.

@RequestMapping(value = "/auth/security_check", method = RequestMethod.POST)
public RedirectView performLogin(@RequestParam("j_username") String username, @RequestParam("j_password") String password, HttpServletRequest request) {
    if (securityIsDisabledOrAlreadyLoggedIn(request)) {
        return new RedirectView("/pipelines", true);
    }
    LOGGER.debug("Requesting authentication for form auth.");
    try {
        SavedRequest savedRequest = SessionUtils.savedRequest(request);
        final AuthenticationToken<UsernamePassword> authenticationToken = passwordBasedPluginAuthenticationProvider.authenticate(new UsernamePassword(username, password), null);
        if (authenticationToken == null) {
            return badAuthentication(request, BAD_CREDENTIALS_MSG);
        } else {
            SessionUtils.setAuthenticationTokenAfterRecreatingSession(authenticationToken, request);
        }
        String redirectUrl = savedRequest == null ? "/go/pipelines" : savedRequest.getRedirectUrl();
        return new RedirectView(redirectUrl, false);
    } catch (AuthenticationException e) {
        LOGGER.error("Failed to authenticate user: {} ", username, e);
        return badAuthentication(request, e.getMessage());
    } catch (Exception e) {
        return unknownAuthenticationError(request);
    }
}

Example 9 with UsernamePassword

use of com.thoughtworks.go.server.newsecurity.models.UsernamePassword in project gocd by gocd.

the class AbstractBasicAuthenticationFilter method doFilterInternal.

@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws IOException, ServletException {
    try {
        if (isPreviouslyAuthenticated(request)) {
            LOGGER.debug("Request is already authenticated.");
            filterChain.doFilter(request, response);
            return;
        }
        final UsernamePassword credential = BasicAuthHeaderExtractor.extractBasicAuthenticationCredentials(request.getHeader("Authorization"));
        if (credential != null) {
            LOGGER.debug("[Basic Authentication] Authorization header found for user '{}'", credential.getUsername());
        }
        if (securityService.isSecurityEnabled()) {
            LOGGER.debug("Security is enabled.");
            filterWhenSecurityEnabled(request, response, filterChain, credential);
        } else {
            LOGGER.debug("Security is disabled.");
            filterWhenSecurityDisabled(request, response, filterChain, credential);
        }
    } catch (AuthenticationException e) {
        onAuthenticationFailure(request, response, e.getMessage());
    }
}

Example 10 with UsernamePassword

use of com.thoughtworks.go.server.newsecurity.models.UsernamePassword in project gocd by gocd.

the class BasicAuthHeaderExtractor method extractBasicAuthenticationCredentials.

public static UsernamePassword extractBasicAuthenticationCredentials(String authorizationHeader) {
    if (isBlank(authorizationHeader)) {
        return null;
    }
    final Matcher matcher = BASIC_AUTH_EXTRACTOR_PATTERN.matcher(authorizationHeader);
    if (matcher.matches()) {
        final String encodedCredentials = matcher.group(1);
        final byte[] decode = Base64.getDecoder().decode(encodedCredentials);
        String decodedCredentials = new String(decode, StandardCharsets.UTF_8);
        final int indexOfSeparator = decodedCredentials.indexOf(':');
        if (indexOfSeparator == -1) {
            throw new BadCredentialsException("Invalid basic authentication credentials specified in request.");
        }
        final String username = decodedCredentials.substring(0, indexOfSeparator);
        final String password = decodedCredentials.substring(indexOfSeparator + 1);
        return new UsernamePassword(username, password);
    }
    return null;
}