Examples with BadCredentialsException org.springframework.security.authentication.BadCredentialsException used on opensource projects

Example 96 with BadCredentialsException

use of org.springframework.security.authentication.BadCredentialsException in project spring-security by spring-projects.

the class CasAuthenticationProvider method authenticateNow.

private CasAuthenticationToken authenticateNow(final Authentication authentication) throws AuthenticationException {
    try {
        final Assertion assertion = this.ticketValidator.validate(authentication.getCredentials().toString(), getServiceUrl(authentication));
        final UserDetails userDetails = loadUserByAssertion(assertion);
        userDetailsChecker.check(userDetails);
        return new CasAuthenticationToken(this.key, userDetails, authentication.getCredentials(), authoritiesMapper.mapAuthorities(userDetails.getAuthorities()), userDetails, assertion);
    } catch (final TicketValidationException e) {
        throw new BadCredentialsException(e.getMessage(), e);
    }
}

Example 97 with BadCredentialsException

use of org.springframework.security.authentication.BadCredentialsException in project spring-security by spring-projects.

the class RemoteAuthenticationManagerImplTests method testFailedAuthenticationReturnsRemoteAuthenticationException.

// ~ Methods
// ========================================================================================================
@Test(expected = RemoteAuthenticationException.class)
public void testFailedAuthenticationReturnsRemoteAuthenticationException() {
    RemoteAuthenticationManagerImpl manager = new RemoteAuthenticationManagerImpl();
    AuthenticationManager am = mock(AuthenticationManager.class);
    when(am.authenticate(any(Authentication.class))).thenThrow(new BadCredentialsException(""));
    manager.setAuthenticationManager(am);
    manager.attemptAuthentication("rod", "password");
}

Example 98 with BadCredentialsException

use of org.springframework.security.authentication.BadCredentialsException in project spring-security by spring-projects.

the class BindAuthenticatorTests method testAuthenticationWithInvalidUserNameFails.

@Test
public void testAuthenticationWithInvalidUserNameFails() {
    this.authenticator.setUserDnPatterns(new String[] { "uid={0},ou=people" });
    try {
        this.authenticator.authenticate(new UsernamePasswordAuthenticationToken("nonexistentsuser", "password"));
        fail("Shouldn't be able to bind with invalid username");
    } catch (BadCredentialsException expected) {
    }
}

Example 99 with BadCredentialsException

use of org.springframework.security.authentication.BadCredentialsException in project spring-security by spring-projects.

the class DigestAuthenticationFilter method doFilter.

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
    HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) res;
    String header = request.getHeader("Authorization");
    if (header == null || !header.startsWith("Digest ")) {
        chain.doFilter(request, response);
        return;
    }
    if (logger.isDebugEnabled()) {
        logger.debug("Digest Authorization header received from user agent: " + header);
    }
    DigestData digestAuth = new DigestData(header);
    try {
        digestAuth.validateAndDecode(this.authenticationEntryPoint.getKey(), this.authenticationEntryPoint.getRealmName());
    } catch (BadCredentialsException e) {
        fail(request, response, e);
        return;
    }
    // Lookup password for presented username
    // NB: DAO-provided password MUST be clear text - not encoded/salted
    // (unless this instance's passwordAlreadyEncoded property is 'false')
    boolean cacheWasUsed = true;
    UserDetails user = this.userCache.getUserFromCache(digestAuth.getUsername());
    String serverDigestMd5;
    try {
        if (user == null) {
            cacheWasUsed = false;
            user = this.userDetailsService.loadUserByUsername(digestAuth.getUsername());
            if (user == null) {
                throw new AuthenticationServiceException("AuthenticationDao returned null, which is an interface contract violation");
            }
            this.userCache.putUserInCache(user);
        }
        serverDigestMd5 = digestAuth.calculateServerDigest(user.getPassword(), request.getMethod());
        // If digest is incorrect, try refreshing from backend and recomputing
        if (!serverDigestMd5.equals(digestAuth.getResponse()) && cacheWasUsed) {
            if (logger.isDebugEnabled()) {
                logger.debug("Digest comparison failure; trying to refresh user from DAO in case password had changed");
            }
            user = this.userDetailsService.loadUserByUsername(digestAuth.getUsername());
            this.userCache.putUserInCache(user);
            serverDigestMd5 = digestAuth.calculateServerDigest(user.getPassword(), request.getMethod());
        }
    } catch (UsernameNotFoundException notFound) {
        fail(request, response, new BadCredentialsException(this.messages.getMessage("DigestAuthenticationFilter.usernameNotFound", new Object[] { digestAuth.getUsername() }, "Username {0} not found")));
        return;
    }
    // If digest is still incorrect, definitely reject authentication attempt
    if (!serverDigestMd5.equals(digestAuth.getResponse())) {
        if (logger.isDebugEnabled()) {
            logger.debug("Expected response: '" + serverDigestMd5 + "' but received: '" + digestAuth.getResponse() + "'; is AuthenticationDao returning clear text passwords?");
        }
        fail(request, response, new BadCredentialsException(this.messages.getMessage("DigestAuthenticationFilter.incorrectResponse", "Incorrect response")));
        return;
    }
    // but the request was otherwise appearing to be valid
    if (digestAuth.isNonceExpired()) {
        fail(request, response, new NonceExpiredException(this.messages.getMessage("DigestAuthenticationFilter.nonceExpired", "Nonce has expired/timed out")));
        return;
    }
    if (logger.isDebugEnabled()) {
        logger.debug("Authentication success for user: '" + digestAuth.getUsername() + "' with response: '" + digestAuth.getResponse() + "'");
    }
    Authentication authentication = createSuccessfulAuthentication(request, user);
    SecurityContext context = SecurityContextHolder.createEmptyContext();
    context.setAuthentication(authentication);
    SecurityContextHolder.setContext(context);
    chain.doFilter(request, response);
}

Example 100 with BadCredentialsException

use of org.springframework.security.authentication.BadCredentialsException in project opennms by OpenNMS.

the class SecurityAuthenticationEventOnmsEventBuilderTest method testAuthenticationFailureEvent.

public void testAuthenticationFailureEvent() throws Exception {
    String userName = "bar";
    String ip = "1.2.3.4";
    String sessionId = "it tastes just like our regular coffee";
    HttpServletRequest request = createMock(HttpServletRequest.class);
    HttpSession session = createMock(HttpSession.class);
    expect(request.getRemoteAddr()).andReturn(ip);
    expect(request.getSession(false)).andReturn(session);
    expect(session.getId()).andReturn(sessionId);
    replay(request, session);
    WebAuthenticationDetails details = new WebAuthenticationDetails(request);
    verify(request, session);
    org.springframework.security.core.Authentication authentication = new TestingDetailsAuthenticationToken(userName, "cheesiness", new GrantedAuthority[0], details);
    AuthenticationFailureBadCredentialsEvent authEvent = new AuthenticationFailureBadCredentialsEvent(authentication, new BadCredentialsException("you are bad!"));
    SecurityAuthenticationEventOnmsEventBuilder builder = new SecurityAuthenticationEventOnmsEventBuilder();
    builder.setEventProxy(m_eventProxy);
    builder.afterPropertiesSet();
    EventBuilder eventBuilder = new EventBuilder(SecurityAuthenticationEventOnmsEventBuilder.FAILURE_UEI, "OpenNMS.WebUI");
    eventBuilder.addParam("user", userName);
    eventBuilder.addParam("ip", ip);
    eventBuilder.addParam("exceptionName", authEvent.getException().getClass().getSimpleName());
    eventBuilder.addParam("exceptionMessage", authEvent.getException().getMessage());
    m_eventProxy.send(EventEquals.eqEvent(eventBuilder.getEvent()));
    m_mocks.replayAll();
    builder.onApplicationEvent(authEvent);
    m_mocks.verifyAll();
}