Examples with DefaultAuthenticationHandlerExecutionResult org.apereo.cas.authentication.DefaultAuthenticationHandlerExecutionResult used on opensource projects

Example 16 with DefaultAuthenticationHandlerExecutionResult

use of org.apereo.cas.authentication.DefaultAuthenticationHandlerExecutionResult in project cas by apereo.

the class X509CredentialsAuthenticationHandler method doAuthentication.

@Override
protected AuthenticationHandlerExecutionResult doAuthentication(final Credential credential) throws GeneralSecurityException {
    final X509CertificateCredential x509Credential = (X509CertificateCredential) credential;
    final X509Certificate[] certificates = x509Credential.getCertificates();
    X509Certificate clientCert = null;
    boolean hasTrustedIssuer = false;
    for (int i = certificates.length - 1; i >= 0; i--) {
        final X509Certificate certificate = certificates[i];
        LOGGER.debug("Evaluating [{}]", CertUtils.toString(certificate));
        validate(certificate);
        if (!hasTrustedIssuer) {
            hasTrustedIssuer = isCertificateFromTrustedIssuer(certificate);
        }
        // getBasicConstraints returns pathLenConstraints which is generally
        // >=0 when this is a CA cert and -1 when it's not
        final int pathLength = certificate.getBasicConstraints();
        if (pathLength < 0) {
            LOGGER.debug("Found valid client certificate");
            clientCert = certificate;
        } else {
            LOGGER.debug("Found valid CA certificate");
        }
    }
    if (hasTrustedIssuer && clientCert != null) {
        x509Credential.setCertificate(clientCert);
        return new DefaultAuthenticationHandlerExecutionResult(this, x509Credential, this.principalFactory.createPrincipal(x509Credential.getId()));
    }
    LOGGER.warn("Either client certificate could not be determined, or a trusted issuer could not be located");
    throw new FailedLoginException();
}