Examples with CredentialsExpiredException org.springframework.security.authentication.CredentialsExpiredException used on opensource projects

Example 1 with CredentialsExpiredException

use of org.springframework.security.authentication.CredentialsExpiredException in project spring-security by spring-projects.

the class DaoAuthenticationProviderTests method testAuthenticateFailsIfCredentialsExpired.

@Test
public void testAuthenticateFailsIfCredentialsExpired() {
    UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("peter", "opal");
    DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
    provider.setUserDetailsService(new MockAuthenticationDaoUserPeterCredentialsExpired());
    provider.setUserCache(new MockUserCache());
    try {
        provider.authenticate(token);
        fail("Should have thrown CredentialsExpiredException");
    } catch (CredentialsExpiredException expected) {
    }
    // Check that wrong password causes BadCredentialsException, rather than
    // CredentialsExpiredException
    token = new UsernamePasswordAuthenticationToken("peter", "wrong_password");
    try {
        provider.authenticate(token);
        fail("Should have thrown BadCredentialsException");
    } catch (BadCredentialsException expected) {
    }
}

Example 2 with CredentialsExpiredException

use of org.springframework.security.authentication.CredentialsExpiredException in project spring-security by spring-projects.

the class DelegatingAuthenticationFailureHandlerTests method handleByMappedHandlerWithSuperType.

@Test
public void handleByMappedHandlerWithSuperType() throws Exception {
    handlers.put(BadCredentialsException.class, handler1);
    // super type of
    handlers.put(AccountStatusException.class, handler2);
    // CredentialsExpiredException
    handler = new DelegatingAuthenticationFailureHandler(handlers, defaultHandler);
    AuthenticationException exception = new CredentialsExpiredException("");
    handler.onAuthenticationFailure(request, response, exception);
    verifyZeroInteractions(handler1, defaultHandler);
    verify(handler2).onAuthenticationFailure(request, response, exception);
}

Example 3 with CredentialsExpiredException

use of org.springframework.security.authentication.CredentialsExpiredException in project midpoint by Evolveum.

the class TestAbstractAuthenticationEvaluator method test210UserGuybrushPasswordLoginGoodPasswordExpired.

@Test
public void test210UserGuybrushPasswordLoginGoodPasswordExpired() throws Exception {
    final String TEST_NAME = "test210UserGuybrushPasswordLoginGoodPasswordExpired";
    TestUtil.displayTestTile(TEST_NAME);
    // GIVEN
    clock.overrideDuration("P2D");
    ConnectionEnvironment connEnv = createConnectionEnvironment();
    XMLGregorianCalendar startTs = clock.currentTimeXMLGregorianCalendar();
    try {
        // WHEN
        TestUtil.displayWhen(TEST_NAME);
        getAuthenticationEvaluator().authenticate(connEnv, getAuthenticationContext(USER_GUYBRUSH_USERNAME, getGoodPasswordGuybrush()));
        AssertJUnit.fail("Unexpected success");
    } catch (CredentialsExpiredException e) {
        // This is expected
        // THEN
        TestUtil.displayThen(TEST_NAME);
        display("expected exception", e);
        assertExpiredException(e, USER_GUYBRUSH_USERNAME);
    }
    XMLGregorianCalendar endTs = clock.currentTimeXMLGregorianCalendar();
    PrismObject<UserType> userAfter = getUser(USER_GUYBRUSH_OID);
    display("user after", userAfter);
    assertFailedLogins(userAfter, 0);
}

Example 4 with CredentialsExpiredException

use of org.springframework.security.authentication.CredentialsExpiredException in project midpoint by Evolveum.

the class AuthenticationEvaluatorImpl method checkPasswordValidityAndAge.

private <P extends CredentialPolicyType> void checkPasswordValidityAndAge(ConnectionEnvironment connEnv, @NotNull MidPointPrincipal principal, C credentials, P passwordCredentialsPolicy) {
    if (credentials == null) {
        recordAuthenticationFailure(principal, connEnv, "no stored credential value");
        throw new AuthenticationCredentialsNotFoundException("web.security.provider.credential.bad");
    }
    validateCredentialNotNull(connEnv, principal, credentials);
    if (passwordCredentialsPolicy == null) {
        return;
    }
    Duration maxAge = passwordCredentialsPolicy.getMaxAge();
    if (maxAge != null) {
        MetadataType credentialMetedata = credentials.getMetadata();
        XMLGregorianCalendar changeTimestamp = MiscSchemaUtil.getChangeTimestamp(credentialMetedata);
        if (changeTimestamp != null) {
            XMLGregorianCalendar passwordValidUntil = XmlTypeConverter.addDuration(changeTimestamp, maxAge);
            if (clock.isPast(passwordValidUntil)) {
                recordAuthenticationFailure(principal, connEnv, "password expired");
                throw new CredentialsExpiredException("web.security.provider.password.bad");
            }
        }
    }
}

Example 5 with CredentialsExpiredException

use of org.springframework.security.authentication.CredentialsExpiredException in project midpoint by Evolveum.

the class MidpointRestAuthenticator method handleRequest.

public void handleRequest(AuthorizationPolicy policy, Message m, ContainerRequestContext requestCtx) {
    if (policy == null) {
        RestServiceUtil.createAbortMessage(requestCtx);
        return;
    }
    T authenticationContext = createAuthenticationContext(policy, requestCtx);
    if (authenticationContext == null) {
        return;
    }
    String enteredUsername = authenticationContext.getUsername();
    if (enteredUsername == null) {
        RestServiceUtil.createAbortMessage(requestCtx);
        return;
    }
    LOGGER.trace("Authenticating username '{}' to REST service", enteredUsername);
    // We need to create task before attempting authentication. Task ID is also a session ID.
    Task task = taskManager.createTaskInstance(ModelRestService.OPERATION_REST_SERVICE);
    task.setChannel(SchemaConstants.CHANNEL_REST_URI);
    ConnectionEnvironment connEnv = ConnectionEnvironment.create(SchemaConstants.CHANNEL_REST_URI);
    connEnv.setSessionIdOverride(task.getTaskIdentifier());
    UsernamePasswordAuthenticationToken token;
    try {
        token = getAuthenticationEvaluator().authenticate(connEnv, authenticationContext);
    } catch (UsernameNotFoundException | BadCredentialsException e) {
        LOGGER.trace("Exception while authenticating username '{}' to REST service: {}", enteredUsername, e.getMessage(), e);
        requestCtx.abortWith(Response.status(Status.UNAUTHORIZED).header("WWW-Authenticate", "Basic authentication failed. Cannot authenticate user.").build());
        return;
    } catch (DisabledException | LockedException | CredentialsExpiredException | AccessDeniedException | AuthenticationCredentialsNotFoundException | AuthenticationServiceException e) {
        LOGGER.trace("Exception while authenticating username '{}' to REST service: {}", enteredUsername, e.getMessage(), e);
        requestCtx.abortWith(Response.status(Status.FORBIDDEN).build());
        return;
    }
    UserType user = ((MidPointPrincipal) token.getPrincipal()).getUser();
    task.setOwner(user.asPrismObject());
    //  m.put(RestServiceUtil.MESSAGE_PROPERTY_TASK_NAME, task);
    if (!authorizeUser(user, null, enteredUsername, connEnv, requestCtx)) {
        return;
    }
    String oid = requestCtx.getHeaderString("Switch-To-Principal");
    OperationResult result = task.getResult();
    if (StringUtils.isNotBlank(oid)) {
        try {
            PrismObject<UserType> authorizedUser = model.getObject(UserType.class, oid, null, task, result);
            task.setOwner(authorizedUser);
            if (!authorizeUser(AuthorizationConstants.AUTZ_REST_PROXY_URL, user, authorizedUser, enteredUsername, connEnv, requestCtx)) {
                return;
            }
            if (!authorizeUser(authorizedUser.asObjectable(), null, authorizedUser.getName().getOrig(), connEnv, requestCtx)) {
                return;
            }
        } catch (ObjectNotFoundException | SchemaException | SecurityViolationException | CommunicationException | ConfigurationException | ExpressionEvaluationException e) {
            LOGGER.trace("Exception while authenticating user identified with '{}' to REST service: {}", oid, e.getMessage(), e);
            requestCtx.abortWith(Response.status(Status.UNAUTHORIZED).header("WWW-Authenticate", "Proxy Authentication failed. Cannot authenticate user.").build());
            return;
        }
    }
    m.put(RestServiceUtil.MESSAGE_PROPERTY_TASK_NAME, task);
    LOGGER.trace("Authorized to use REST service ({})", user);
}