Examples with AuthenticationException org.apache.shiro.authc.AuthenticationException used on opensource projects

Example 16 with AuthenticationException

use of org.apache.shiro.authc.AuthenticationException in project killbill by killbill.

the class TenantFilter method doFilter.

@Override
public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain) throws IOException, ServletException {
    // Lookup tenant information in the headers
    String apiKey = null;
    String apiSecret = null;
    if (request instanceof HttpServletRequest) {
        final HttpServletRequest httpServletRequest = (HttpServletRequest) request;
        apiKey = httpServletRequest.getHeader(JaxrsResource.HDR_API_KEY);
        apiSecret = httpServletRequest.getHeader(JaxrsResource.HDR_API_SECRET);
    }
    // Multi-tenancy is enabled if this filter is installed, we can't continue without credentials
    if (apiKey == null || apiSecret == null) {
        final String errorMessage = String.format("Make sure to set the %s and %s headers", JaxrsResource.HDR_API_KEY, JaxrsResource.HDR_API_SECRET);
        handleAuthenticationError(errorMessage, chain, request, response);
        return;
    }
    // Verify the apiKey/apiSecret combo
    final AuthenticationToken token = new UsernamePasswordToken(apiKey, apiSecret);
    try {
        modularRealmAuthenticator.authenticate(token);
    } catch (final AuthenticationException e) {
        final String errorMessage = e.getLocalizedMessage();
        handleAuthenticationError(errorMessage, chain, request, response);
        return;
    }
    try {
        // Load the tenant in the request object (apiKey is unique across tenants)
        final Tenant tenant = tenantUserApi.getTenantByApiKey(apiKey);
        request.setAttribute(TENANT, tenant);
        // Create a dummy context, to set the MDC very early for LoggingFilter
        context.createContext(request);
        chain.doFilter(request, response);
    } catch (final TenantApiException e) {
        // Should never happen since Shiro validated the credentials?
        log.error("Couldn't find the tenant? - should never happen!", e);
    }
}

Example 17 with AuthenticationException

use of org.apache.shiro.authc.AuthenticationException in project graylog2-server by Graylog2.

the class LdapUserAuthenticator method doGetAuthenticationInfo.

@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authtoken) throws AuthenticationException {
    // safe, we only handle this type
    final UsernamePasswordToken token = (UsernamePasswordToken) authtoken;
    final LdapSettings ldapSettings = ldapSettingsService.load();
    if (ldapSettings == null || !ldapSettings.isEnabled()) {
        LOG.trace("LDAP is disabled, skipping");
        return null;
    }
    final LdapConnectionConfig config = new LdapConnectionConfig();
    config.setLdapHost(ldapSettings.getUri().getHost());
    config.setLdapPort(ldapSettings.getUri().getPort());
    config.setUseSsl(ldapSettings.getUri().getScheme().startsWith("ldaps"));
    config.setUseTls(ldapSettings.isUseStartTls());
    if (ldapSettings.isTrustAllCertificates()) {
        config.setTrustManagers(new TrustAllX509TrustManager());
    }
    config.setName(ldapSettings.getSystemUserName());
    config.setCredentials(ldapSettings.getSystemPassword());
    final String principal = (String) token.getPrincipal();
    final char[] tokenPassword = firstNonNull(token.getPassword(), new char[0]);
    final String password = String.valueOf(tokenPassword);
    // do not try to look a token up in LDAP if there is no principal or password
    if (isNullOrEmpty(principal) || isNullOrEmpty(password)) {
        LOG.debug("Principal or password were empty. Not trying to look up a token in LDAP.");
        return null;
    }
    try (final LdapNetworkConnection connection = ldapConnector.connect(config)) {
        if (null == connection) {
            LOG.error("Couldn't connect to LDAP directory");
            return null;
        }
        final LdapEntry userEntry = ldapConnector.search(connection, ldapSettings.getSearchBase(), ldapSettings.getSearchPattern(), ldapSettings.getDisplayNameAttribute(), principal, ldapSettings.isActiveDirectory(), ldapSettings.getGroupSearchBase(), ldapSettings.getGroupIdAttribute(), ldapSettings.getGroupSearchPattern());
        if (userEntry == null) {
            LOG.debug("User {} not found in LDAP", principal);
            return null;
        }
        // needs to use the DN of the entry, not the parameter for the lookup filter we used to find the entry!
        final boolean authenticated = ldapConnector.authenticate(connection, userEntry.getDn(), password);
        if (!authenticated) {
            LOG.info("Invalid credentials for user {} (DN {})", principal, userEntry.getDn());
            return null;
        }
        // user found and authenticated, sync the user entry with mongodb
        final User user = syncFromLdapEntry(userEntry, ldapSettings, principal);
        if (user == null) {
            // in case there was an error reading, creating or modifying the user in mongodb, we do not authenticate the user.
            LOG.error("Unable to sync LDAP user {} (DN {})", userEntry.getBindPrincipal(), userEntry.getDn());
            return null;
        }
        return new SimpleAccount(principal, null, "ldap realm");
    } catch (LdapException e) {
        LOG.error("LDAP error", e);
    } catch (CursorException e) {
        LOG.error("Unable to read LDAP entry", e);
    } catch (Exception e) {
        LOG.error("Error during LDAP user account sync. Cannot log in user {}", principal, e);
    }
    // Return null by default to ensure a login failure if anything goes wrong.
    return null;
}

Example 18 with AuthenticationException

use of org.apache.shiro.authc.AuthenticationException in project bamboobsc by billchen198318.

the class GreenStepBaseAuthorizingRealm method doGetAuthenticationInfo.

/**
	 * 認證
	 */
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
    GreenStepBaseUsernamePasswordToken token = (GreenStepBaseUsernamePasswordToken) authenticationToken;
    String account = token.getUsername();
    AccountVO accountObj = new AccountVO();
    accountObj.setAccount(account);
    try {
        DefaultResult<AccountVO> result = accountService.findByUK(accountObj);
        if (result.getValue() == null) {
            return null;
        }
        accountObj = result.getValue();
        return new SimpleAuthenticationInfo(accountObj.getAccount(), accountObj.getPassword(), this.getName());
    } catch (ServiceException e) {
        e.printStackTrace();
    } catch (Exception e) {
        e.printStackTrace();
    }
    return null;
}

Example 19 with AuthenticationException

use of org.apache.shiro.authc.AuthenticationException in project ddf by codice.

the class AbstractStsRealm method renewSecurityToken.

/**
     * Renew a security token (SAML assertion) from the STS.
     *
     * @param securityToken The token being renewed.
     * @return security token (SAML assertion)
     */
protected SecurityToken renewSecurityToken(SecurityToken securityToken) {
    SecurityToken token = null;
    String stsAddress = getAddress();
    try {
        LOGGER.debug("Renewing security token from STS at: {}.", stsAddress);
        if (securityToken != null) {
            LOGGER.debug("Telling the STS to renew a security token on behalf of the auth token");
            STSClient stsClient = configureStsClient();
            stsClient.setWsdlLocation(stsAddress);
            stsClient.setTokenType(getAssertionType());
            stsClient.setKeyType(getKeyType());
            stsClient.setKeySize(Integer.parseInt(getKeySize()));
            stsClient.setAllowRenewing(true);
            token = stsClient.renewSecurityToken(securityToken);
            LOGGER.debug("Finished renewing security token.");
        }
    } catch (Exception e) {
        String msg = "Error renewing the security token from STS at: " + stsAddress + ".";
        LOGGER.debug(msg, e);
        throw new AuthenticationException(msg, e);
    }
    return token;
}

Example 20 with AuthenticationException

use of org.apache.shiro.authc.AuthenticationException in project ddf by codice.

the class AbstractStsRealm method doGetAuthenticationInfo.

/**
     * Perform authentication based on the supplied token.
     */
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) {
    String method = "doGetAuthenticationInfo(    AuthenticationToken token )";
    Object credential;
    if (token instanceof SAMLAuthenticationToken) {
        credential = token.getCredentials();
    } else if (token instanceof BaseAuthenticationToken) {
        credential = ((BaseAuthenticationToken) token).getCredentialsAsXMLString();
    } else {
        credential = token.getCredentials().toString();
    }
    if (credential == null) {
        String msg = "Unable to authenticate credential.  A NULL credential was provided in the supplied authentication token. This may be due to an error with the SSO server that created the token.";
        LOGGER.info(msg);
        throw new AuthenticationException(msg);
    } else {
        //removed the credentials from the log message for now, I don't think we should be dumping user/pass into log
        LOGGER.debug("Received credentials.");
    }
    SecurityToken securityToken;
    if (token instanceof SAMLAuthenticationToken && credential instanceof SecurityToken) {
        securityToken = renewSecurityToken((SecurityToken) credential);
    } else {
        securityToken = requestSecurityToken(credential);
    }
    LOGGER.debug("Creating token authentication information with SAML.");
    SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo();
    SimplePrincipalCollection principals = new SimplePrincipalCollection();
    SecurityAssertion assertion = new SecurityAssertionImpl(securityToken);
    principals.add(assertion.getPrincipal(), NAME);
    principals.add(assertion, NAME);
    simpleAuthenticationInfo.setPrincipals(principals);
    simpleAuthenticationInfo.setCredentials(credential);
    return simpleAuthenticationInfo;
}