Examples with BadCredentialsException org.springframework.security.authentication.BadCredentialsException used on opensource projects

Example 76 with BadCredentialsException

use of org.springframework.security.authentication.BadCredentialsException in project spring-security by spring-projects.

the class BasicAuthenticationFilterTests method doFilterWhenTokenAndFilterCharsetMatchDefaultThenAuthenticated.

@Test
public void doFilterWhenTokenAndFilterCharsetMatchDefaultThenAuthenticated() throws Exception {
    SecurityContextHolder.clearContext();
    UsernamePasswordAuthenticationToken rodRequest = new UsernamePasswordAuthenticationToken("rod", "äöü");
    rodRequest.setDetails(new WebAuthenticationDetails(new MockHttpServletRequest()));
    Authentication rod = new UsernamePasswordAuthenticationToken("rod", "äöü", AuthorityUtils.createAuthorityList("ROLE_1"));
    this.manager = mock(AuthenticationManager.class);
    given(this.manager.authenticate(rodRequest)).willReturn(rod);
    given(this.manager.authenticate(not(eq(rodRequest)))).willThrow(new BadCredentialsException(""));
    this.filter = new BasicAuthenticationFilter(this.manager, new BasicAuthenticationEntryPoint());
    String token = "rod:äöü";
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.addHeader("Authorization", "Basic " + new String(Base64.encodeBase64(token.getBytes(StandardCharsets.UTF_8))));
    request.setServletPath("/some_file.html");
    MockHttpServletResponse response = new MockHttpServletResponse();
    // Test
    assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
    FilterChain chain = mock(FilterChain.class);
    this.filter.doFilter(request, response, chain);
    assertThat(response.getStatus()).isEqualTo(HttpServletResponse.SC_OK);
    verify(chain).doFilter(any(ServletRequest.class), any(ServletResponse.class));
    assertThat(SecurityContextHolder.getContext().getAuthentication().getName()).isEqualTo("rod");
    assertThat(SecurityContextHolder.getContext().getAuthentication().getCredentials()).isEqualTo("äöü");
}

Example 77 with BadCredentialsException

use of org.springframework.security.authentication.BadCredentialsException in project spring-security by spring-projects.

the class BasicAuthenticationFilterTests method setUp.

@BeforeEach
public void setUp() {
    SecurityContextHolder.clearContext();
    UsernamePasswordAuthenticationToken rodRequest = new UsernamePasswordAuthenticationToken("rod", "koala");
    rodRequest.setDetails(new WebAuthenticationDetails(new MockHttpServletRequest()));
    Authentication rod = new UsernamePasswordAuthenticationToken("rod", "koala", AuthorityUtils.createAuthorityList("ROLE_1"));
    this.manager = mock(AuthenticationManager.class);
    given(this.manager.authenticate(rodRequest)).willReturn(rod);
    given(this.manager.authenticate(not(eq(rodRequest)))).willThrow(new BadCredentialsException(""));
    this.filter = new BasicAuthenticationFilter(this.manager, new BasicAuthenticationEntryPoint());
}

Example 78 with BadCredentialsException

use of org.springframework.security.authentication.BadCredentialsException in project spring-security by spring-projects.

the class BasicAuthenticationFilterTests method doFilterWhenTokenAndFilterCharsetDoNotMatchThenUnauthorized.

@Test
public void doFilterWhenTokenAndFilterCharsetDoNotMatchThenUnauthorized() throws Exception {
    SecurityContextHolder.clearContext();
    UsernamePasswordAuthenticationToken rodRequest = new UsernamePasswordAuthenticationToken("rod", "äöü");
    rodRequest.setDetails(new WebAuthenticationDetails(new MockHttpServletRequest()));
    Authentication rod = new UsernamePasswordAuthenticationToken("rod", "äöü", AuthorityUtils.createAuthorityList("ROLE_1"));
    this.manager = mock(AuthenticationManager.class);
    given(this.manager.authenticate(rodRequest)).willReturn(rod);
    given(this.manager.authenticate(not(eq(rodRequest)))).willThrow(new BadCredentialsException(""));
    this.filter = new BasicAuthenticationFilter(this.manager, new BasicAuthenticationEntryPoint());
    this.filter.setCredentialsCharset("ISO-8859-1");
    String token = "rod:äöü";
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.addHeader("Authorization", "Basic " + new String(Base64.encodeBase64(token.getBytes(StandardCharsets.UTF_8))));
    request.setServletPath("/some_file.html");
    MockHttpServletResponse response = new MockHttpServletResponse();
    // Test
    assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
    FilterChain chain = mock(FilterChain.class);
    this.filter.doFilter(request, response, chain);
    assertThat(response.getStatus()).isEqualTo(HttpServletResponse.SC_UNAUTHORIZED);
    verify(chain, never()).doFilter(any(ServletRequest.class), any(ServletResponse.class));
    assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
}

Example 79 with BadCredentialsException

use of org.springframework.security.authentication.BadCredentialsException in project spring-boot by spring-projects.

the class AuthenticationAuditListenerTests method testDetailsAreIncludedInAuditEvent.

@Test
void testDetailsAreIncludedInAuditEvent() {
    Object details = new Object();
    UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken("user", "password");
    authentication.setDetails(details);
    AuditApplicationEvent event = handleAuthenticationEvent(new AuthenticationFailureExpiredEvent(authentication, new BadCredentialsException("Bad user")));
    assertThat(event.getAuditEvent().getType()).isEqualTo(AuthenticationAuditListener.AUTHENTICATION_FAILURE);
    assertThat(event.getAuditEvent().getData()).containsEntry("details", details);
}

Example 80 with BadCredentialsException

use of org.springframework.security.authentication.BadCredentialsException in project midpoint by Evolveum.

the class AuthenticationEvaluatorImpl method authenticate.

@Override
public UsernamePasswordAuthenticationToken authenticate(ConnectionEnvironment connEnv, T authnCtx) throws BadCredentialsException, AuthenticationCredentialsNotFoundException, DisabledException, LockedException, CredentialsExpiredException, AuthenticationServiceException, AccessDeniedException, UsernameNotFoundException {
    checkEnteredCredentials(connEnv, authnCtx);
    MidPointPrincipal principal = getAndCheckPrincipal(connEnv, authnCtx.getUsername(), authnCtx.getPrincipalType(), authnCtx.isSupportActivationByChannel());
    FocusType focusType = principal.getFocus();
    CredentialsType credentials = focusType.getCredentials();
    CredentialPolicyType credentialsPolicy = getCredentialsPolicy(principal, authnCtx);
    if (checkCredentials(principal, authnCtx, connEnv)) {
        if (AuthenticationEvaluatorUtil.checkRequiredAssignment(focusType.getAssignment(), authnCtx.getRequireAssignments())) {
            recordAuthenticationBehavior(principal.getUsername(), principal, connEnv, null, authnCtx.getPrincipalType(), true);
            recordPasswordAuthenticationSuccess(principal, connEnv, getCredential(credentials), false);
            return new UsernamePasswordAuthenticationToken(principal, authnCtx.getEnteredCredential(), principal.getAuthorities());
        } else {
            recordAuthenticationBehavior(principal.getUsername(), principal, connEnv, "not contains required assignment", authnCtx.getPrincipalType(), false);
            recordPasswordAuthenticationFailure(principal, connEnv, getCredential(credentials), credentialsPolicy, "not contains required assignment", false);
            throw new InternalAuthenticationServiceException("web.security.flexAuth.invalid.required.assignment");
        }
    } else {
        recordAuthenticationBehavior(principal.getUsername(), principal, connEnv, "password mismatch", authnCtx.getPrincipalType(), false);
        recordPasswordAuthenticationFailure(principal, connEnv, getCredential(credentials), credentialsPolicy, "password mismatch", false);
        throw new BadCredentialsException("web.security.provider.invalid.credentials");
    }
}