You are viewing a plain text version of this content. The canonical link for it is here.
Posted to oak-commits@jackrabbit.apache.org by an...@apache.org on 2020/01/24 16:45:11 UTC
svn commit: r1873106 - in /jackrabbit/oak/branches/1.10: ./
oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/
oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/
Author: angela
Date: Fri Jan 24 16:45:10 2020
New Revision: 1873106
URL: http://svn.apache.org/viewvc?rev=1873106&view=rev
Log:
OAK-8870 : UserAuthentication.authenticate should remove pw attribute (backporting rev. 1873103)
Modified:
jackrabbit/oak/branches/1.10/ (props changed)
jackrabbit/oak/branches/1.10/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserAuthentication.java
jackrabbit/oak/branches/1.10/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/PasswordExpiryAndForceInitialChangeTest.java
jackrabbit/oak/branches/1.10/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/PasswordExpiryHistoryTest.java
jackrabbit/oak/branches/1.10/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ResetExpiredPasswordTest.java
Propchange: jackrabbit/oak/branches/1.10/
------------------------------------------------------------------------------
Merged /jackrabbit/oak/trunk:r1873103
Modified: jackrabbit/oak/branches/1.10/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserAuthentication.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.10/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserAuthentication.java?rev=1873106&r1=1873105&r2=1873106&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.10/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserAuthentication.java (original)
+++ jackrabbit/oak/branches/1.10/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserAuthentication.java Fri Jan 24 16:45:10 2020
@@ -153,6 +153,8 @@ class UserAuthentication implements Auth
principal = user.getPrincipal();
} catch (RepositoryException e) {
throw new LoginException(e.getMessage());
+ } finally {
+ removeNewPwAttribute(credentials);
}
return success;
}
@@ -215,6 +217,12 @@ class UserAuthentication implements Auth
return false;
}
+ private static void removeNewPwAttribute(@NotNull Credentials credentials) {
+ if (credentials instanceof SimpleCredentials) {
+ ((SimpleCredentials) credentials).removeAttribute(CREDENTIALS_ATTRIBUTE_NEWPASSWORD);
+ }
+ }
+
private boolean impersonate(AuthInfo info, User user) {
try {
if (user.getID().equals(info.getUserID())) {
Modified: jackrabbit/oak/branches/1.10/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/PasswordExpiryAndForceInitialChangeTest.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.10/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/PasswordExpiryAndForceInitialChangeTest.java?rev=1873106&r1=1873105&r2=1873106&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.10/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/PasswordExpiryAndForceInitialChangeTest.java (original)
+++ jackrabbit/oak/branches/1.10/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/PasswordExpiryAndForceInitialChangeTest.java Fri Jan 24 16:45:10 2020
@@ -32,7 +32,9 @@ import org.apache.jackrabbit.oak.spi.sec
import org.junit.Before;
import org.junit.Test;
+import static org.apache.jackrabbit.oak.spi.security.user.UserConstants.CREDENTIALS_ATTRIBUTE_NEWPASSWORD;
import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNull;
import static org.junit.Assert.assertTrue;
import static org.junit.Assert.fail;
@@ -101,4 +103,16 @@ public class PasswordExpiryAndForceIniti
// during user creation pw last modified is set, thus it shouldn't expire
a.authenticate(new SimpleCredentials(userId, userId.toCharArray()));
}
+
+ @Test
+ public void testAuthenticateWithNewPasswordAttribute() throws Exception {
+ Authentication a = new UserAuthentication(getUserConfiguration(), root, userId);
+ SimpleCredentials sc = new SimpleCredentials(userId, userId.toCharArray());
+ sc.setAttribute(CREDENTIALS_ATTRIBUTE_NEWPASSWORD, "SureChangedMyPassword!");
+ try {
+ assertTrue(a.authenticate(sc));
+ } finally {
+ assertNull(sc.getAttribute(CREDENTIALS_ATTRIBUTE_NEWPASSWORD));
+ }
+ }
}
Modified: jackrabbit/oak/branches/1.10/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/PasswordExpiryHistoryTest.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.10/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/PasswordExpiryHistoryTest.java?rev=1873106&r1=1873105&r2=1873106&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.10/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/PasswordExpiryHistoryTest.java (original)
+++ jackrabbit/oak/branches/1.10/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/PasswordExpiryHistoryTest.java Fri Jan 24 16:45:10 2020
@@ -36,6 +36,7 @@ import javax.jcr.SimpleCredentials;
import javax.security.auth.login.CredentialExpiredException;
import java.util.List;
+import static org.apache.jackrabbit.oak.spi.security.user.UserConstants.CREDENTIALS_ATTRIBUTE_NEWPASSWORD;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNull;
import static org.junit.Assert.fail;
@@ -103,6 +104,8 @@ public class PasswordExpiryHistoryTest e
"credentials should contain pw change failure reason",
"New password is identical to the current password.",
attr);
+ } finally {
+ assertNull(pwChangeCreds.getAttribute(CREDENTIALS_ATTRIBUTE_NEWPASSWORD));
}
}
}
@@ -134,6 +137,8 @@ public class PasswordExpiryHistoryTest e
"credentials should contain pw change failure reason",
"New password was found in password history.",
attr);
+ } finally {
+ assertNull(pwChangeCreds.getAttribute(CREDENTIALS_ATTRIBUTE_NEWPASSWORD));
}
}
}
@@ -160,6 +165,8 @@ public class PasswordExpiryHistoryTest e
} catch (CredentialExpiredException c) {
// success, pw found in history
assertNull(pwChangeCreds.getAttribute(PasswordHistoryException.class.getSimpleName()));
+ } finally {
+ assertNull(pwChangeCreds.getAttribute(CREDENTIALS_ATTRIBUTE_NEWPASSWORD));
}
}
}
Modified: jackrabbit/oak/branches/1.10/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ResetExpiredPasswordTest.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.10/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ResetExpiredPasswordTest.java?rev=1873106&r1=1873105&r2=1873106&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.10/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ResetExpiredPasswordTest.java (original)
+++ jackrabbit/oak/branches/1.10/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/ResetExpiredPasswordTest.java Fri Jan 24 16:45:10 2020
@@ -30,10 +30,13 @@ import org.apache.jackrabbit.oak.spi.sec
import org.apache.jackrabbit.oak.spi.security.user.UserConfiguration;
import org.apache.jackrabbit.oak.spi.security.user.UserConstants;
import org.apache.jackrabbit.oak.spi.security.user.util.PasswordUtil;
+import org.jetbrains.annotations.Nullable;
import org.junit.Before;
import org.junit.Test;
import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
import static org.junit.Assert.assertTrue;
import static org.junit.Assert.fail;
@@ -43,6 +46,7 @@ import static org.junit.Assert.fail;
public class ResetExpiredPasswordTest extends AbstractSecurityTest implements UserConstants {
private String userId;
+ private SimpleCredentials creds;
@Before
public void before() throws Exception {
@@ -63,13 +67,18 @@ public class ResetExpiredPasswordTest ex
}
private void authenticate(String expiredPw, Object newPw) throws LoginException {
- SimpleCredentials creds = new SimpleCredentials(userId, expiredPw.toCharArray());
+ creds = new SimpleCredentials(userId, expiredPw.toCharArray());
creds.setAttribute(UserConstants.CREDENTIALS_ATTRIBUTE_NEWPASSWORD, newPw);
Authentication a = new UserAuthentication(getUserConfiguration(), root, userId);
a.authenticate(creds);
}
+ private static void assertCredentials(@Nullable SimpleCredentials sc) {
+ assertNotNull(sc);
+ assertNull(sc.getAttribute(CREDENTIALS_ATTRIBUTE_NEWPASSWORD));
+ }
+
@Test
public void testPasswordChangePersisted() throws Exception {
authenticate(userId, "newPw");
@@ -78,11 +87,13 @@ public class ResetExpiredPasswordTest ex
Root rootBasedOnSeparateSession = login(getAdminCredentials()).getLatestRoot();
Tree userTree = rootBasedOnSeparateSession.getTree(getTestUser().getPath());
assertTrue(PasswordUtil.isSame(userTree.getProperty(UserConstants.REP_PASSWORD).getValue(Type.STRING), "newPw"));
+ assertCredentials(creds);
}
@Test
public void testAuthenticatePasswordExpiredThenChanged() throws Exception {
authenticate(userId, userId);
+ assertCredentials(creds);
}
@Test
@@ -96,6 +107,7 @@ public class ResetExpiredPasswordTest ex
Tree userTree = root.getTree(getTestUser().getPath());
assertTrue(PasswordUtil.isSame(userTree.getProperty(UserConstants.REP_PASSWORD).getValue(Type.STRING), userId));
assertEquals(0, userTree.getChild(UserConstants.REP_PWD).getProperty(UserConstants.REP_PASSWORD_LAST_MODIFIED).getValue(Type.LONG).longValue());
+ assertCredentials(creds);
}
}
@@ -110,6 +122,7 @@ public class ResetExpiredPasswordTest ex
Tree userTree = root.getTree(getTestUser().getPath());
assertTrue(PasswordUtil.isSame(userTree.getProperty(UserConstants.REP_PASSWORD).getValue(Type.STRING), userId));
assertEquals(0, userTree.getChild(UserConstants.REP_PWD).getProperty(UserConstants.REP_PASSWORD_LAST_MODIFIED).getValue(Type.LONG).longValue());
+ assertCredentials(creds);
}
}
}