Examples with DigestCredentials org.pac4j.http.credentials.DigestCredentials used on opensource projects

Example 6 with DigestCredentials

use of org.pac4j.http.credentials.DigestCredentials in project pac4j by pac4j.

the class DirectDigestAuthClientTests method testAuthentication.

@Test
public void testAuthentication() {
    final DirectDigestAuthClient client = new DirectDigestAuthClient(new SimpleTestDigestAuthenticator());
    client.setRealm(REALM);
    final MockWebContext context = MockWebContext.create();
    context.addRequestHeader(AUTHORIZATION_HEADER, DIGEST_AUTHORIZATION_HEADER_VALUE);
    context.setRequestMethod(HTTP_METHOD.GET.name());
    final DigestCredentials credentials = client.getCredentials(context);
    final CommonProfile profile = client.getUserProfile(credentials, context);
    String ha1 = CredentialUtil.encryptMD5(USERNAME + ":" + REALM + ":" + PASSWORD);
    String serverDigest1 = credentials.calculateServerDigest(true, ha1);
    String serverDigest2 = credentials.calculateServerDigest(false, PASSWORD);
    assertEquals(DIGEST_RESPONSE, serverDigest1);
    assertEquals(DIGEST_RESPONSE, serverDigest2);
    assertEquals(USERNAME, profile.getId());
}

Example 7 with DigestCredentials

use of org.pac4j.http.credentials.DigestCredentials in project pac4j by pac4j.

the class DirectDigestAuthClient method retrieveCredentials.

/**
 * Per RFC 2617
 * If a server receives a request for an access-protected object, and an
 * acceptable Authorization header is not sent, the server responds with
 * a "401 Unauthorized" status code, and a WWW-Authenticate header
 */
@Override
protected DigestCredentials retrieveCredentials(final WebContext context) {
    DigestCredentials credentials = super.retrieveCredentials(context);
    if (credentials == null) {
        String nonce = calculateNonce();
        context.setResponseHeader(HttpConstants.AUTHENTICATE_HEADER, "Digest realm=\"" + realm + "\", qop=\"auth\", nonce=\"" + nonce + "\"");
        throw HttpAction.unauthorized(context);
    }
    return credentials;
}

Example 8 with DigestCredentials

use of org.pac4j.http.credentials.DigestCredentials in project cas by apereo.

the class DigestAuthenticationAction method constructCredentialsFromRequest.

@Override
protected Credential constructCredentialsFromRequest(final RequestContext requestContext) {
    try {
        val request = WebUtils.getHttpServletRequestFromExternalWebflowContext(requestContext);
        val response = WebUtils.getHttpServletResponseFromExternalWebflowContext(requestContext);
        val extractor = new DigestAuthExtractor();
        val webContext = new JEEContext(request, response);
        val credentialsResult = extractor.extract(webContext, JEESessionStore.INSTANCE);
        if (credentialsResult.isEmpty()) {
            response.addHeader(HttpConstants.AUTHENTICATE_HEADER, DigestAuthenticationUtils.createAuthenticateHeader(this.realm, this.authenticationMethod, this.nonce));
            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
            return null;
        }
        val credentials = (DigestCredentials) credentialsResult.get();
        LOGGER.debug("Received digest authentication request from credentials [{}] ", credentials);
        val credential = this.credentialRetriever.findCredential(credentials.getUsername(), this.realm);
        LOGGER.trace("Digest credential password on record for [{}] is [{}]", credentials.getUsername(), credential);
        val serverResponse = credentials.calculateServerDigest(true, credential);
        LOGGER.trace("Server digest calculated for [{}] is [{}]", credentials.getUsername(), serverResponse);
        val clientResponse = credentials.getToken();
        if (!serverResponse.equals(clientResponse)) {
            LOGGER.trace("Server digest [{}] does not mach [{}]", serverResponse, clientResponse);
            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
            return null;
        }
        return new DigestCredential(credentials.getUsername(), this.realm, credentials.getToken());
    } catch (final Exception e) {
        LoggingUtils.error(LOGGER, e);
    }
    return null;
}