You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jetspeed-dev@portals.apache.org by at...@apache.org on 2008/09/23 17:57:19 UTC
svn commit: r698208 - in
/portals/jetspeed-2/portal/branches/security-refactoring:
components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/
components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/
components/jet...
Author: ate
Date: Tue Sep 23 08:57:18 2008
New Revision: 698208
URL: http://svn.apache.org/viewvc?rev=698208&view=rev
Log:
Reimplementation of the PasswordCredentialInterceptors using the new security API, now invoked and managed through teh UserPasswordCredentialPolicyManager
Modified:
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/UserManagerImpl.java
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/AlgorithmUpgradeCredentialPasswordEncoder.java
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/PasswordCredentialInterceptor.java
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/UserPasswordCredentialPolicyManager.java
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/AbstractPasswordCredentialInterceptorImpl.java
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/AlgorithmUpgradePBEPasswordService.java
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/EncodePasswordOnFirstLoadInterceptor.java
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/PasswordCredentialImpl.java
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/PasswordCredentialInterceptorsProxy.java
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/PasswordHistoryInterceptor.java
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/UserPasswordCredentialManagerImpl.java
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/UserPasswordCredentialPolicyManagerImpl.java
portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/ValidatePasswordOnLoadInterceptor.java
portals/jetspeed-2/portal/branches/security-refactoring/jetspeed-portal-resources/src/main/resources/assembly/security-spi.xml
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/UserManagerImpl.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/UserManagerImpl.java?rev=698208&r1=698207&r2=698208&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/UserManagerImpl.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/impl/UserManagerImpl.java Tue Sep 23 08:57:18 2008
@@ -176,7 +176,12 @@
public User getUser(String username) throws SecurityException
{
- return (User) getPrincipal(username);
+ User user = (User)getPrincipal(username);
+ if (null == user)
+ {
+ throw new SecurityException(SecurityException.PRINCIPAL_DOES_NOT_EXIST.createScoped(JetspeedPrincipalType.USER, username));
+ }
+ return user;
}
public List<String> getUserNames(String nameFilter) throws SecurityException
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/AlgorithmUpgradeCredentialPasswordEncoder.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/AlgorithmUpgradeCredentialPasswordEncoder.java?rev=698208&r1=698207&r2=698208&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/AlgorithmUpgradeCredentialPasswordEncoder.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/AlgorithmUpgradeCredentialPasswordEncoder.java Tue Sep 23 08:57:18 2008
@@ -38,7 +38,7 @@
*/
public interface AlgorithmUpgradeCredentialPasswordEncoder extends CredentialPasswordEncoder
{
- String encode(PasswordCredential credential) throws SecurityException;
- void recodeIfNeeded(PasswordCredential credential) throws SecurityException;
+ String encode(PasswordCredential credential, String clearTextPassword) throws SecurityException;
+ void recodeIfNeeded(PasswordCredential credential, String clearTextPassword) throws SecurityException;
boolean usesOldEncodingAlgorithm(PasswordCredential credential);
}
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/PasswordCredentialInterceptor.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/PasswordCredentialInterceptor.java?rev=698208&r1=698207&r2=698208&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/PasswordCredentialInterceptor.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/PasswordCredentialInterceptor.java Tue Sep 23 08:57:18 2008
@@ -84,7 +84,7 @@
/**
* <p>
- * Invoked when a new unencoded password value is to be set for a user by the user itself.</p>
+ * Invoked when a new password value is to be set for a user.</p>
* <p>
* The new raw, possibly encoded, password value is <em>not</em> yet set on the provided credential when this callback is invoked but provided as parameter.
* This allows custom history maintenance and/or auditing to be performed.</p>
@@ -94,8 +94,9 @@
* A thrown SecurityException is passed on to the set password requestor.</p>
*
* @param credential the credential of the user
- * @param password
+ * @param password
+ * @param authenticated
* @throws SecurityException
*/
- void beforeSetPassword(PasswordCredential credential, char[] password) throws SecurityException;
+ void beforeSetPassword(PasswordCredential credential, String password, boolean authenticated) throws SecurityException;
}
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/UserPasswordCredentialPolicyManager.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/UserPasswordCredentialPolicyManager.java?rev=698208&r1=698207&r2=698208&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/UserPasswordCredentialPolicyManager.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/UserPasswordCredentialPolicyManager.java Tue Sep 23 08:57:18 2008
@@ -30,7 +30,7 @@
{
CredentialPasswordEncoder getCredentialPasswordEncoder();
CredentialPasswordValidator getCredentialPasswordValidator();
- void onLoad(PasswordCredential credential, String userName) throws SecurityException;
+ boolean onLoad(PasswordCredential credential, String userName) throws SecurityException;
boolean authenticate(PasswordCredential credential, String userName, String password) throws SecurityException;
void onStore(PasswordCredential credential) throws SecurityException;
}
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/AbstractPasswordCredentialInterceptorImpl.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/AbstractPasswordCredentialInterceptorImpl.java?rev=698208&r1=698207&r2=698208&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/AbstractPasswordCredentialInterceptorImpl.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/AbstractPasswordCredentialInterceptorImpl.java Tue Sep 23 08:57:18 2008
@@ -47,7 +47,7 @@
{
}
- public void beforeSetPassword(PasswordCredential credential, char[] password) throws SecurityException
+ public void beforeSetPassword(PasswordCredential credential, String password, boolean authenticated) throws SecurityException
{
}
}
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/AlgorithmUpgradePBEPasswordService.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/AlgorithmUpgradePBEPasswordService.java?rev=698208&r1=698207&r2=698208&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/AlgorithmUpgradePBEPasswordService.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/AlgorithmUpgradePBEPasswordService.java Tue Sep 23 08:57:18 2008
@@ -58,11 +58,11 @@
return usesOldEncodingAlgorithm(credential.isEnabled(), credential.getLastAuthenticationDate(), credential.getPreviousAuthenticationDate());
}
- public String encode(PasswordCredential credential) throws SecurityException
+ public String encode(PasswordCredential credential, String clearTextPassword) throws SecurityException
{
if ( usesOldEncodingAlgorithm(credential.isEnabled(), credential.getLastAuthenticationDate(), credential.getPreviousAuthenticationDate()))
{
- return oldEncoder.encode(credential.getUserName(), credential.getNewPassword());
+ return oldEncoder.encode(credential.getUserName(), clearTextPassword);
}
else
{
@@ -70,11 +70,11 @@
}
}
- public void recodeIfNeeded(PasswordCredential credential) throws SecurityException
+ public void recodeIfNeeded(PasswordCredential credential, String clearTextPassword) throws SecurityException
{
if ( usesOldEncodingAlgorithm(credential.isEnabled(), credential.getLastAuthenticationDate(), credential.getPreviousAuthenticationDate()))
{
- credential.setPassword(encode(credential.getUserName(), credential.getNewPassword()), true);
+ credential.setPassword(encode(credential.getUserName(), clearTextPassword), true);
}
}
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/EncodePasswordOnFirstLoadInterceptor.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/EncodePasswordOnFirstLoadInterceptor.java?rev=698208&r1=698207&r2=698208&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/EncodePasswordOnFirstLoadInterceptor.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/EncodePasswordOnFirstLoadInterceptor.java Tue Sep 23 08:57:18 2008
@@ -44,9 +44,10 @@
public boolean afterLoad(String userName, PasswordCredential credential, CredentialPasswordEncoder encoder, CredentialPasswordValidator validator) throws SecurityException
{
boolean updated = false;
- if (!credential.isEncoded() && encoder != null )
+ if (credential.getPassword() != null && !credential.isEncoded() && encoder != null )
{
- credential.setPassword(encoder.encode(userName,new String(credential.getPassword())), true);
+ credential.setPassword(encoder.encode(userName,credential.getPassword()), true);
+ credential.clearNewPasswordSet();
if ( encoder instanceof AlgorithmUpgradePasswordEncodingService)
{
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/PasswordCredentialImpl.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/PasswordCredentialImpl.java?rev=698208&r1=698207&r2=698208&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/PasswordCredentialImpl.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/PasswordCredentialImpl.java Tue Sep 23 08:57:18 2008
@@ -36,12 +36,19 @@
{
private static final long serialVersionUID = -4975305752376365096L;
+ private boolean persistent;
+
@SuppressWarnings("unused")
private Long principalId;
private User user;
private String userName;
+
+ /**
+ * The saved current "raw" password value
+ */
+ private String currentPassword;
/** The "raw" password value */
private String password;
@@ -118,6 +125,16 @@
this.password = password;
}
+ public void synchronize(PasswordCredential pwc)
+ {
+ throw new UnsupportedOperationException();
+ }
+
+ public boolean isNew()
+ {
+ return !persistent;
+ }
+
private void checkUpdatePassword()
{
if (!updateAllowed)
@@ -165,13 +182,13 @@
{
return type;
}
-
+
/**
* @return The password.
*/
public String getPassword()
{
- return password != null ? password : null;
+ return currentPassword != null ? currentPassword : password;
}
public void setPassword(String password, boolean encoded)
@@ -179,6 +196,10 @@
checkUpdatePassword();
if (password != null && (this.password == null || encoded != this.encoded || !password.equals(this.password)))
{
+ if (!newPasswordSet && currentPassword == null)
+ {
+ currentPassword = password;
+ }
this.password = password;
this.encoded = encoded;
oldPassword = null;
@@ -192,21 +213,36 @@
checkUpdatePassword();
if (newPassword != null && (oldPassword == null || !newPassword.equals(oldPassword)))
{
+ if (!newPasswordSet && currentPassword == null)
+ {
+ currentPassword = password;
+ }
this.newPassword = newPassword;
this.oldPassword = oldPassword;
- password = null;
- encoded = false;
newPasswordSet = true;
}
}
public void clearNewPasswordSet()
{
+ currentPassword = null;
oldPassword = null;
newPassword = null;
newPasswordSet = false;
}
+ public void revertNewPasswordSet()
+ {
+ if (newPasswordSet)
+ {
+ newPassword = currentPassword;
+ currentPassword = null;
+ oldPassword = null;
+ newPassword = null;
+ newPasswordSet = false;
+ }
+ }
+
public String getOldPassword()
{
return oldPassword;
@@ -273,6 +309,10 @@
{
checkUpdateState();
this.enabled = enabled;
+ if (enabled)
+ {
+ setAuthenticationFailures(0);
+ }
}
public boolean isExpired()
@@ -305,6 +345,14 @@
{
checkUpdateState();
this.expirationDate = expirationDate;
+ if (expirationDate != null && new Date(new java.util.Date().getTime()).after(expirationDate))
+ {
+ setExpired(true);
+ }
+ else
+ {
+ setExpired(false);
+ }
}
public Timestamp getPreviousAuthenticationDate()
@@ -345,14 +393,17 @@
//
public void afterDelete(PersistenceBroker arg0) throws PersistenceBrokerException
{
+ persistent = false;
}
public void afterInsert(PersistenceBroker arg0) throws PersistenceBrokerException
{
+ persistent = true;
}
public void afterLookup(PersistenceBroker arg0) throws PersistenceBrokerException
{
+ persistent = true;
}
public void afterUpdate(PersistenceBroker arg0) throws PersistenceBrokerException
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/PasswordCredentialInterceptorsProxy.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/PasswordCredentialInterceptorsProxy.java?rev=698208&r1=698207&r2=698208&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/PasswordCredentialInterceptorsProxy.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/PasswordCredentialInterceptorsProxy.java Tue Sep 23 08:57:18 2008
@@ -82,13 +82,13 @@
}
}
- public void beforeSetPassword(PasswordCredential credential, char[] password) throws SecurityException
+ public void beforeSetPassword(PasswordCredential credential, String password, boolean authenticated) throws SecurityException
{
for (int i = 0; i < interceptors.length; i++)
{
if (interceptors[i] != null)
{
- interceptors[i].beforeSetPassword(credential, password);
+ interceptors[i].beforeSetPassword(credential, password, authenticated);
}
}
}
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/PasswordHistoryInterceptor.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/PasswordHistoryInterceptor.java?rev=698208&r1=698207&r2=698208&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/PasswordHistoryInterceptor.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/PasswordHistoryInterceptor.java Tue Sep 23 08:57:18 2008
@@ -59,7 +59,7 @@
this.historySize = historySize;
}
- public void beforeSetPassword(PasswordCredential credential, String password) throws SecurityException
+ public void beforeSetPassword(PasswordCredential credential, String password, boolean authenticated) throws SecurityException
{
/* TODO
Collection internalCredentials = internalUser.getCredentials();
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/UserPasswordCredentialManagerImpl.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/UserPasswordCredentialManagerImpl.java?rev=698208&r1=698207&r2=698208&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/UserPasswordCredentialManagerImpl.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/UserPasswordCredentialManagerImpl.java Tue Sep 23 08:57:18 2008
@@ -49,7 +49,7 @@
public PasswordCredential getPasswordCredential(User user) throws SecurityException
{
PasswordCredential credential = upcsm.getPasswordCredential(user);
- if (upcpm != null)
+ if (!credential.isNew() && upcpm != null)
{
upcpm.onLoad(credential, user.getName());
}
@@ -68,23 +68,49 @@
public PasswordCredential getAuthenticatedPasswordCredential(String userName, String password) throws SecurityException
{
PasswordCredential credential = upcam.getPasswordCredential(userName);
- if (upcpm != null)
+ if (credential == null)
{
- upcpm.onLoad(credential, userName);
- upcpm.authenticate(credential, userName, password);
- }
- else if (password == null)
- {
- throw new SecurityException(SecurityException.PASSWORD_REQUIRED);
- }
- else if (credential.getPassword() == null || !password.equals(new String(credential.getPassword())))
- {
- throw new SecurityException(SecurityException.INVALID_PASSWORD);
+ throw new SecurityException(SecurityException.PRINCIPAL_DOES_NOT_EXIST.createScoped(JetspeedPrincipalType.USER, userName));
}
- if (!credential.isEnabled() || credential.isExpired())
+
+ if (upcpm != null)
{
- throw new SecurityException(SecurityException.PRINCIPAL_DOES_NOT_EXIST.createScoped(JetspeedPrincipalType.USER, userName));
+ if (upcpm.onLoad(credential, userName))
+ {
+ upcsm.storePasswordCredential(credential);
+ }
+ if (credential.isEnabled() && !credential.isExpired())
+ {
+ if (upcpm.authenticate(credential, userName, password))
+ {
+ upcsm.storePasswordCredential(credential);
+ }
+ if (!credential.isEnabled() || credential.isExpired())
+ {
+ throw new SecurityException(SecurityException.PRINCIPAL_DOES_NOT_EXIST.createScoped(JetspeedPrincipalType.USER, userName));
+ }
+ else if (credential.getAuthenticationFailures() != 0)
+ {
+ throw new SecurityException(SecurityException.INVALID_PASSWORD);
+ }
+ }
+ }
+ else
+ {
+ if (password == null)
+ {
+ throw new SecurityException(SecurityException.PASSWORD_REQUIRED);
+ }
+ else if (credential.getPassword() == null || !password.equals(new String(credential.getPassword())))
+ {
+ throw new SecurityException(SecurityException.INVALID_PASSWORD);
+ }
+ if (!credential.isEnabled() || credential.isExpired())
+ {
+ throw new SecurityException(SecurityException.PRINCIPAL_DOES_NOT_EXIST.createScoped(JetspeedPrincipalType.USER, userName));
+ }
}
+
try
{
upcam.loadPasswordCredentialUser(credential);
@@ -93,6 +119,7 @@
{
throw new SecurityException(SecurityException.PRINCIPAL_DOES_NOT_EXIST.createScoped(JetspeedPrincipalType.USER, userName), e);
}
+
if (credential.getUser() == null || !credential.getUser().isEnabled())
{
throw new SecurityException(SecurityException.PRINCIPAL_DOES_NOT_EXIST.createScoped(JetspeedPrincipalType.USER, userName));
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/UserPasswordCredentialPolicyManagerImpl.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/UserPasswordCredentialPolicyManagerImpl.java?rev=698208&r1=698207&r2=698208&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/UserPasswordCredentialPolicyManagerImpl.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/UserPasswordCredentialPolicyManagerImpl.java Tue Sep 23 08:57:18 2008
@@ -17,12 +17,16 @@
package org.apache.jetspeed.security.spi.impl;
+import java.sql.Timestamp;
+import java.util.Date;
import java.util.List;
import org.apache.jetspeed.security.CredentialPasswordEncoder;
import org.apache.jetspeed.security.CredentialPasswordValidator;
+import org.apache.jetspeed.security.InvalidPasswordException;
import org.apache.jetspeed.security.PasswordCredential;
import org.apache.jetspeed.security.SecurityException;
+import org.apache.jetspeed.security.spi.AlgorithmUpgradeCredentialPasswordEncoder;
import org.apache.jetspeed.security.spi.PasswordCredentialInterceptor;
import org.apache.jetspeed.security.spi.UserPasswordCredentialPolicyManager;
@@ -45,10 +49,14 @@
{
this.encoder = encoder;
this.validator = validator;
- //Remove the following comment and check, if interceptors are null or not
- //if(interceptors !=null){
- // this.interceptors = (PasswordCredentialInterceptor[]) interceptors.toArray(new PasswordCredentialInterceptor[interceptors.size()]);
- //}
+ if(interceptors !=null)
+ {
+ this.interceptors = (PasswordCredentialInterceptor[]) interceptors.toArray(new PasswordCredentialInterceptor[interceptors.size()]);
+ }
+ else
+ {
+ this.interceptors = new PasswordCredentialInterceptor[0];
+ }
}
public CredentialPasswordEncoder getCredentialPasswordEncoder()
@@ -61,19 +69,148 @@
return validator;
}
- public void onLoad(PasswordCredential credential, String userName)
+ public boolean onLoad(PasswordCredential credential, String userName) throws SecurityException
{
- // TODO Auto-generated method stub
+ boolean update = false;
+ for (PasswordCredentialInterceptor pci : interceptors)
+ {
+ if (pci.afterLoad(userName, credential, encoder, validator))
+ {
+ update = true;
+ }
+ }
+ return update;
}
public boolean authenticate(PasswordCredential credential, String userName, String password) throws SecurityException
{
- // TODO Auto-generated method stub
- return true;
- }
-
- public void onStore(PasswordCredential credential)
- {
- // TODO Auto-generated method stub
+ String encodedPassword = password;
+ boolean authenticated = false;
+ if (encoder != null && credential.isEncoded())
+ {
+ if (encoder instanceof AlgorithmUpgradeCredentialPasswordEncoder)
+ {
+ encodedPassword = ((AlgorithmUpgradeCredentialPasswordEncoder)encoder).encode(credential, password);
+ }
+ else
+ {
+ encodedPassword = encoder.encode(userName, password);
+ }
+ authenticated = credential.getPassword().equals(encodedPassword);
+ }
+ boolean update = false;
+
+ for (PasswordCredentialInterceptor pci : interceptors)
+ {
+ if (pci.afterAuthenticated(credential, authenticated))
+ {
+ update = true;
+ }
+ }
+ if (update && (!credential.isEnabled() || credential.isExpired()))
+ {
+ authenticated = false;
+ }
+
+ if (authenticated)
+ {
+ credential.setAuthenticationFailures(0);
+ if (encoder != null && encoder instanceof AlgorithmUpgradeCredentialPasswordEncoder)
+ {
+ ((AlgorithmUpgradeCredentialPasswordEncoder)encoder).recodeIfNeeded(credential, password);
+ credential.clearNewPasswordSet();
+ }
+ credential.setPreviousAuthenticationDate(credential.getLastAuthenticationDate());
+ credential.setLastAuthenticationDate(new Timestamp(new Date().getTime()));
+ update = true;
+ }
+
+ return update;
+ }
+
+ public void onStore(PasswordCredential credential) throws SecurityException
+ {
+ if (credential.isNewPasswordSet())
+ {
+ String newPassword = null;
+ boolean authenticated = false;
+ if (credential.getNewPassword() != null)
+ {
+ if (credential.getOldPassword() != null)
+ {
+ authenticated = true;
+ String validatingOldPassword = credential.getOldPassword();
+ if (credential.isEncoded() && encoder != null)
+ {
+ if (encoder instanceof AlgorithmUpgradeCredentialPasswordEncoder)
+ {
+ validatingOldPassword = ((AlgorithmUpgradeCredentialPasswordEncoder)encoder).encode(credential, validatingOldPassword);
+ }
+ else
+ {
+ validatingOldPassword = encoder.encode(credential.getUserName(), validatingOldPassword);
+ }
+ }
+ if (credential.getPassword() == null || !credential.getPassword().equals(validatingOldPassword))
+ {
+ throw new InvalidPasswordException();
+ }
+ }
+ if (validator != null)
+ {
+ validator.validate(credential.getNewPassword());
+ }
+ newPassword = credential.getNewPassword();
+ if (encoder != null)
+ {
+ newPassword = encoder.encode(credential.getUserName(), newPassword);
+ }
+
+ }
+ else
+ {
+ newPassword = credential.getPassword();
+ if (encoder != null && !credential.isEncoded())
+ {
+ newPassword = encoder.encode(credential.getUserName(), newPassword);
+ }
+ }
+
+ if (!credential.isNew())
+ {
+ credential.revertNewPasswordSet();
+ for (PasswordCredentialInterceptor pci : interceptors)
+ {
+ pci.beforeSetPassword(credential, newPassword, authenticated);
+ }
+ credential.setUpdateRequired(false);
+ }
+ credential.setPassword(newPassword, encoder != null);
+ credential.clearNewPasswordSet();
+ if (!authenticated)
+ {
+ if (encoder != null && encoder instanceof AlgorithmUpgradeCredentialPasswordEncoder)
+ {
+ // set current time in previous auth date, and clear last authentication date
+ // !!! While this might be a bit strange logic, it is *required* for the AlgorithmUpgradePBEPasswordEncodingService
+ // to be able to distinguise password changes from other changes
+ credential.setPreviousAuthenticationDate(new Timestamp(new Date().getTime()));
+ credential.setLastAuthenticationDate(null);
+ }
+ }
+ else
+ {
+ // authenticated password change (by user itself)
+ credential.setPreviousAuthenticationDate(credential.getLastAuthenticationDate());
+ credential.setLastAuthenticationDate(new Timestamp(new Date().getTime()));
+ }
+ }
+ if (credential.isNew())
+ {
+ for (PasswordCredentialInterceptor pci : interceptors)
+ {
+ pci.beforeCreate(credential);
+ }
+ }
}
}
Modified: portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/ValidatePasswordOnLoadInterceptor.java
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/ValidatePasswordOnLoadInterceptor.java?rev=698208&r1=698207&r2=698208&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/ValidatePasswordOnLoadInterceptor.java (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/components/jetspeed-security/src/main/java/org/apache/jetspeed/security/spi/impl/ValidatePasswordOnLoadInterceptor.java Tue Sep 23 08:57:18 2008
@@ -45,11 +45,11 @@
public boolean afterLoad(String userName, PasswordCredential credential, CredentialPasswordEncoder encoder, CredentialPasswordValidator validator) throws SecurityException
{
boolean updated = false;
- if (!credential.isEncoded() && validator != null )
+ if (credential.getPassword() != null && !credential.isEncoded() && validator != null )
{
try
{
- validator.validate(new String(credential.getPassword()));
+ validator.validate(credential.getPassword());
}
catch (SecurityException e)
{
Modified: portals/jetspeed-2/portal/branches/security-refactoring/jetspeed-portal-resources/src/main/resources/assembly/security-spi.xml
URL: http://svn.apache.org/viewvc/portals/jetspeed-2/portal/branches/security-refactoring/jetspeed-portal-resources/src/main/resources/assembly/security-spi.xml?rev=698208&r1=698207&r2=698208&view=diff
==============================================================================
--- portals/jetspeed-2/portal/branches/security-refactoring/jetspeed-portal-resources/src/main/resources/assembly/security-spi.xml (original)
+++ portals/jetspeed-2/portal/branches/security-refactoring/jetspeed-portal-resources/src/main/resources/assembly/security-spi.xml Tue Sep 23 08:57:18 2008
@@ -43,7 +43,12 @@
<constructor-arg index="0" ref="org.apache.jetspeed.security.CredentialPasswordEncoder" />
<constructor-arg index="1" ref="org.apache.jetspeed.security.CredentialPasswordValidator" />
<constructor-arg index="2">
- <value>null</value>
+ <list>
+ <!-- enforce an invalid preset password value in the persisent store is required to be changed -->
+ <bean class="org.apache.jetspeed.security.spi.impl.ValidatePasswordOnLoadInterceptor" />
+ <!-- ensure preset cleartext passwords in the persistent store will be encoded on first use -->
+ <bean class="org.apache.jetspeed.security.spi.impl.EncodePasswordOnFirstLoadInterceptor" />
+ </list>
</constructor-arg>
</bean>
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-dev-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-dev-help@portals.apache.org