svn commit: r900646 - /incubator/cassandra/trunk/src/java/org/apache/cassandra/auth/SimpleAuthenticator.java

[ee...@apache.org]

Author: eevans
Date: Tue Jan 19 02:11:54 2010
New Revision: 900646

URL: http://svn.apache.org/viewvc?rev=900646&view=rev
Log:
don't mistakenly trap {authentic,authoriz}ation exceptions

Patch by eevans

Modified:
    incubator/cassandra/trunk/src/java/org/apache/cassandra/auth/SimpleAuthenticator.java

Modified: incubator/cassandra/trunk/src/java/org/apache/cassandra/auth/SimpleAuthenticator.java
URL: http://svn.apache.org/viewvc/incubator/cassandra/trunk/src/java/org/apache/cassandra/auth/SimpleAuthenticator.java?rev=900646&r1=900645&r2=900646&view=diff
==============================================================================
--- incubator/cassandra/trunk/src/java/org/apache/cassandra/auth/SimpleAuthenticator.java (original)
+++ incubator/cassandra/trunk/src/java/org/apache/cassandra/auth/SimpleAuthenticator.java Tue Jan 19 02:11:54 2010
@@ -52,6 +52,8 @@
         String password = authRequest.getCredentials().get(PASSWORD_KEY);
         if (null == password) throw new AuthenticationException("Authentication request was missing the required key '" + PASSWORD_KEY + "'");
 
+        boolean authenticated = false;
+
         try
         {
             FileInputStream in = new FileInputStream(pfilename);
@@ -61,7 +63,6 @@
 
             // note we keep the message here and for the wrong password exactly the same to prevent attackers from guessing what users are valid
             if (null == props.getProperty(username)) throw new AuthenticationException(authenticationErrorMessage(mode, username));
-            boolean authenticated = false;
             switch (mode)
             {
                 case PLAIN:
@@ -71,8 +72,6 @@
                     authenticated = MessageDigest.isEqual(password.getBytes(), MessageDigest.getInstance("MD5").digest(props.getProperty(username).getBytes()));
                     break;
             }
-
-            if (!authenticated) throw new AuthenticationException(authenticationErrorMessage(mode, username));
         }
         catch (NoSuchAlgorithmException e)
         {
@@ -88,9 +87,11 @@
         }
         catch (Exception e)
         {
-            throw new RuntimeException("Unexpected authentication problem: " + e.getMessage());
+            throw new RuntimeException("Unexpected authentication problem", e);
         }
 
+        if (!authenticated) throw new AuthenticationException(authenticationErrorMessage(mode, username));
+
         // if we're here, the authentication succeeded. Now let's see if the user is authorized for this keyspace.
 
         String afilename = System.getProperty(AUTHORIZATION_FILENAME_PROPERTY);
@@ -112,8 +113,6 @@
             {
                 if (allow.equals(username)) authorized = true;
             }
-
-            if (!authorized) throw new AuthorizationException(authorizationErrorMessage(keyspace, username));
         }
         catch (FileNotFoundException e)
         {
@@ -125,8 +124,10 @@
         }
         catch (Exception e)
         {
-            throw new RuntimeException("Unexpected authorization problem: " + e.getMessage());
+            throw new RuntimeException("Unexpected authorization problem", e);
         }
+
+        if (!authorized) throw new AuthorizationException(authorizationErrorMessage(keyspace, username));
     }
 
     static String authorizationErrorMessage(String keyspace, String username)