Examples with Authentication org.apache.jackrabbit.oak.spi.security.authentication.Authentication used on opensource projects

Example 16 with Authentication

use of org.apache.jackrabbit.oak.spi.security.authentication.Authentication in project jackrabbit-oak by apache.

the class PasswordExpiryHistoryTest method testAuthenticatePasswordExpiredAndValidationFailure.

@Test
public void testAuthenticatePasswordExpiredAndValidationFailure() throws Exception {
    User user = getTestUser();
    Authentication a = new UserAuthentication(getUserConfiguration(), root, userId);
    // set password last modified to beginning of epoch
    root.getTree(user.getPath()).getChild(UserConstants.REP_PWD).setProperty(UserConstants.REP_PASSWORD_LAST_MODIFIED, 0);
    root.commit();
    try {
        a.authenticate(new SimpleCredentials(userId, userId.toCharArray()));
        fail("Credentials should be expired");
    } catch (CredentialExpiredException e) {
        // success, credentials are expired
        // try to change password to the same one, this should fail due pw history
        SimpleCredentials pwChangeCreds = new SimpleCredentials(userId, userId.toCharArray());
        try {
            pwChangeCreds.setAttribute(UserConstants.CREDENTIALS_ATTRIBUTE_NEWPASSWORD, "2");
            a.authenticate(pwChangeCreds);
            fail("User password changed in spite of expected validation failure");
        } catch (CredentialExpiredException c) {
            // success, pw found in history
            assertNull(pwChangeCreds.getAttribute(PasswordHistoryException.class.getSimpleName()));
        }
    }
}

Example 17 with Authentication

use of org.apache.jackrabbit.oak.spi.security.authentication.Authentication in project jackrabbit-oak by apache.

the class PasswordExpiryHistoryTest method testAuthenticatePasswordExpiredAndSame.

@Test
public void testAuthenticatePasswordExpiredAndSame() throws Exception {
    User user = getTestUser();
    Authentication a = new UserAuthentication(getUserConfiguration(), root, userId);
    // set password last modified to beginning of epoch
    root.getTree(user.getPath()).getChild(UserConstants.REP_PWD).setProperty(UserConstants.REP_PASSWORD_LAST_MODIFIED, 0);
    root.commit();
    try {
        a.authenticate(new SimpleCredentials(userId, userId.toCharArray()));
        fail("Credentials should be expired");
    } catch (CredentialExpiredException e) {
        // success, credentials are expired
        // try to change password to the same one, this should fail due pw history
        SimpleCredentials pwChangeCreds = new SimpleCredentials(userId, userId.toCharArray());
        try {
            pwChangeCreds.setAttribute(UserConstants.CREDENTIALS_ATTRIBUTE_NEWPASSWORD, user.getID());
            a.authenticate(pwChangeCreds);
            fail("User password changed in spite of enabled pw history");
        } catch (CredentialExpiredException c) {
            // success, pw found in history
            Object attr = pwChangeCreds.getAttribute(PasswordHistoryException.class.getSimpleName());
            assertEquals("credentials should contain pw change failure reason", "New password is identical to the current password.", attr);
        }
    }
}

Example 18 with Authentication

use of org.apache.jackrabbit.oak.spi.security.authentication.Authentication in project jackrabbit-oak by apache.

the class PasswordExpiryTest method testAuthenticateBeforePasswordExpired.

@Test
public void testAuthenticateBeforePasswordExpired() throws Exception {
    Authentication a = new UserAuthentication(getUserConfiguration(), root, userId);
    // set password last modified to beginning of epoch
    root.getTree(getTestUser().getPath()).getChild(UserConstants.REP_PWD).setProperty(UserConstants.REP_PASSWORD_LAST_MODIFIED, 0);
    root.commit();
    try {
        a.authenticate(new SimpleCredentials(userId, "wrong".toCharArray()));
    } catch (CredentialExpiredException e) {
        fail("Login should fail before expiry");
    } catch (LoginException e) {
    // success - userId/pw mismatch takes precedence over expiry
    }
}

Example 19 with Authentication

use of org.apache.jackrabbit.oak.spi.security.authentication.Authentication in project jackrabbit-oak by apache.

the class LoginModuleImpl method login.

// --------------------------------------------------------< LoginModule >---
@Override
public boolean login() throws LoginException {
    credentials = getCredentials();
    // check if we have a pre authenticated login from a previous login module
    PreAuthenticatedLogin preAuthLogin = getSharedPreAuthLogin();
    String loginName = getLoginId(preAuthLogin);
    Authentication authentication = getUserAuthentication(loginName);
    if (authentication != null) {
        if (preAuthLogin != null) {
            success = authentication.authenticate(PreAuthenticatedLogin.PRE_AUTHENTICATED);
        } else {
            success = authentication.authenticate(credentials);
        }
        if (success) {
            log.debug("Adding Credentials to shared state.");
            // noinspection unchecked
            sharedState.put(SHARED_KEY_CREDENTIALS, credentials);
            log.debug("Adding login name to shared state.");
            // noinspection unchecked
            sharedState.put(SHARED_KEY_LOGIN_NAME, loginName);
            userId = authentication.getUserId();
            if (userId == null) {
                userId = loginName;
            }
            principal = authentication.getUserPrincipal();
        }
    } else {
        // ensure that we don't commit (OAK-2998, OAK-3032)
        credentials = null;
        userId = null;
    }
    return success;
}