Examples with AuthProviderTimeoutException org.neo4j.graphdb.security.AuthProviderTimeoutException used on opensource projects

Example 1 with AuthProviderTimeoutException

use of org.neo4j.graphdb.security.AuthProviderTimeoutException in project neo4j by neo4j.

the class LdapRealm method doGetAuthorizationInfo.

@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
    try {
        AuthorizationInfo info = super.doGetAuthorizationInfo(principals);
        securityLog.debug(withRealm("Queried for authorization info for user '%s'", principals.getPrimaryPrincipal()));
        return info;
    } catch (AuthorizationException e) {
        securityLog.error(withRealm("Failed to get authorization info: '%s' caused by '%s'", e.getMessage(), e.getCause().getMessage()));
        if (isAuthorizationExceptionAnLdapReadTimeout(e)) {
            throw new AuthProviderTimeoutException(LDAP_READ_TIMEOUT_CLIENT_MESSAGE, e);
        }
        throw new AuthProviderFailedException(LDAP_AUTHORIZATION_FAILURE_CLIENT_MESSAGE, e);
    }
}

Example 2 with AuthProviderTimeoutException

use of org.neo4j.graphdb.security.AuthProviderTimeoutException in project neo4j by neo4j.

the class MultiRealmAuthManager method login.

@Override
public EnterpriseSecurityContext login(Map<String, Object> authToken) throws InvalidAuthTokenException {
    EnterpriseSecurityContext securityContext;
    ShiroAuthToken token = new ShiroAuthToken(authToken);
    assertValidScheme(token);
    try {
        securityContext = new StandardEnterpriseSecurityContext(this, (ShiroSubject) securityManager.login(null, token));
        if (logSuccessfulLogin) {
            securityLog.info(securityContext, "logged in");
        }
    } catch (UnsupportedTokenException e) {
        securityLog.error("Unknown user failed to log in: %s", e.getMessage());
        Throwable cause = e.getCause();
        if (cause != null && cause instanceof InvalidAuthTokenException) {
            throw new InvalidAuthTokenException(cause.getMessage() + ": " + token);
        }
        throw invalidToken(": " + token);
    } catch (ExcessiveAttemptsException e) {
        // NOTE: We only get this with single (internal) realm authentication
        securityContext = new StandardEnterpriseSecurityContext(this, new ShiroSubject(securityManager, AuthenticationResult.TOO_MANY_ATTEMPTS));
        securityLog.error("[%s]: failed to log in: too many failed attempts", escape(token.getPrincipal().toString()));
    } catch (AuthenticationException e) {
        if (e.getCause() != null && e.getCause() instanceof AuthProviderTimeoutException) {
            securityLog.error("[%s]: failed to log in: auth server timeout", escape(token.getPrincipal().toString()));
            throw new AuthProviderTimeoutException(e.getCause().getMessage(), e.getCause());
        }
        securityContext = new StandardEnterpriseSecurityContext(this, new ShiroSubject(securityManager, AuthenticationResult.FAILURE));
        securityLog.error("[%s]: failed to log in: invalid principal or credentials", escape(token.getPrincipal().toString()));
    }
    return securityContext;
}

Example 3 with AuthProviderTimeoutException

use of org.neo4j.graphdb.security.AuthProviderTimeoutException in project neo4j by neo4j.

the class LdapRealm method queryForAuthenticationInfo.

@Override
protected AuthenticationInfo queryForAuthenticationInfo(AuthenticationToken token, LdapContextFactory ldapContextFactory) throws NamingException {
    if (authenticationEnabled) {
        String serverString = server((JndiLdapContextFactory) ldapContextFactory);
        try {
            AuthenticationInfo info = useStartTls ? queryForAuthenticationInfoUsingStartTls(token, ldapContextFactory) : super.queryForAuthenticationInfo(token, ldapContextFactory);
            securityLog.debug(withRealm("Authenticated user '%s' against %s", token.getPrincipal(), serverString));
            return info;
        } catch (Exception e) {
            securityLog.error(withRealm("Failed to authenticate user '%s' against %s: %s", token.getPrincipal(), serverString, e.getMessage()));
            if (isExceptionAnLdapConnectionTimeout(e)) {
                securityLog.error(withRealm("LDAP connection to %s timed out.", serverString));
                throw new AuthProviderTimeoutException(LDAP_CONNECTION_TIMEOUT_CLIENT_MESSAGE, e);
            } else if (isExceptionAnLdapReadTimeout(e)) {
                securityLog.error(withRealm("LDAP response from %s timed out.", serverString));
                throw new AuthProviderTimeoutException(LDAP_READ_TIMEOUT_CLIENT_MESSAGE, e);
            }
            // This exception will be caught and rethrown by Shiro, and then by us, so we do not need to wrap it here
            throw e;
        }
    } else {
        return null;
    }
}

Example 4 with AuthProviderTimeoutException

use of org.neo4j.graphdb.security.AuthProviderTimeoutException in project neo4j by neo4j.

the class AuthorizationEnabledFilter method doFilter.

@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
    validateRequestType(servletRequest);
    validateResponseType(servletResponse);
    final HttpServletRequest request = (HttpServletRequest) servletRequest;
    final HttpServletResponse response = (HttpServletResponse) servletResponse;
    final String path = request.getContextPath() + (request.getPathInfo() == null ? "" : request.getPathInfo());
    if (request.getMethod().equals("OPTIONS") || whitelisted(path)) {
        // NOTE: If starting transactions with access mode on whitelisted uris should be possible we need to
        //       wrap servletRequest in an AuthorizedRequestWarpper here
        filterChain.doFilter(servletRequest, servletResponse);
        return;
    }
    final String header = request.getHeader(HttpHeaders.AUTHORIZATION);
    if (header == null) {
        requestAuthentication(request, noHeader).accept(response);
        return;
    }
    final String[] usernameAndPassword = extractCredential(header);
    if (usernameAndPassword == null) {
        badHeader.accept(response);
        return;
    }
    final String username = usernameAndPassword[0];
    final String password = usernameAndPassword[1];
    try {
        SecurityContext securityContext = authenticate(username, password);
        switch(securityContext.subject().getAuthenticationResult()) {
            case PASSWORD_CHANGE_REQUIRED:
                if (!PASSWORD_CHANGE_WHITELIST.matcher(path).matches()) {
                    passwordChangeRequired(username, baseURL(request)).accept(response);
                    return;
                }
            // fall through
            case SUCCESS:
                try {
                    filterChain.doFilter(new AuthorizedRequestWrapper(BASIC_AUTH, username, request, securityContext), servletResponse);
                } catch (AuthorizationViolationException e) {
                    unauthorizedAccess(e.getMessage()).accept(response);
                }
                return;
            case TOO_MANY_ATTEMPTS:
                tooManyAttempts.accept(response);
                return;
            default:
                log.warn("Failed authentication attempt for '%s' from %s", username, request.getRemoteAddr());
                requestAuthentication(request, invalidCredential).accept(response);
        }
    } catch (InvalidAuthTokenException e) {
        requestAuthentication(request, invalidAuthToken(e.getMessage())).accept(response);
    } catch (AuthProviderTimeoutException e) {
        authProviderTimeout.accept(response);
    } catch (AuthProviderFailedException e) {
        authProviderFailed.accept(response);
    }
}