DrishtiAuthenticationProvider implements AuthenticationProvider { @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { DrishtiUser user = getDrishtiUser(authentication); if (user == null) { throw new BadCredentialsException(USER_NOT_FOUND); } String credentials = (String) authentication.getCredentials(); String hashedCredentials = passwordEncoder.encodePassword(credentials, user.getSalt()); if (!user.getPassword().equals(hashedCredentials)) { throw new BadCredentialsException(USER_NOT_FOUND); } if (!user.isActive()) { throw new BadCredentialsException(USER_NOT_ACTIVATED); } return new UsernamePasswordAuthenticationToken(authentication.getName(), credentials, getRolesAsAuthorities(user)); } @Autowired  DrishtiAuthenticationProvider(AllDrishtiUsers allDrishtiUsers, @Qualifier("shaPasswordEncoder") PasswordEncoder passwordEncoder); @Override Authentication authenticate(Authentication authentication); @Override boolean supports(Class<?> authentication); DrishtiUser getDrishtiUser(Authentication authentication); DrishtiUser getDrishtiUser(String username); static final String USER_NOT_FOUND; static final String USER_NOT_ACTIVATED; static final String INTERNAL_ERROR; }
@Test public void shouldAuthenticateValidUser() throws Exception { when(allDrishtiUsers.findByUsername("user 1")).thenReturn(new DrishtiUser("user 1", "hashed password 1", "salt", asList("ROLE_USER", "ROLE_ADMIN"), true)); when(passwordEncoder.encodePassword("password 1", "salt")).thenReturn("hashed password 1"); Authentication authentication = authenticationProvider.authenticate(new UsernamePasswordAuthenticationToken("user 1", "password 1")); assertEquals(new UsernamePasswordAuthenticationToken("user 1", "password 1", asList(new SimpleGrantedAuthority("ROLE_USER"), new SimpleGrantedAuthority("ROLE_ADMIN"))), authentication); }
@Test public void shouldNotAuthenticateUserWithWrongUsername() throws Exception { when(allDrishtiUsers.findByUsername("user 1")).thenReturn(null); exception.expect(BadCredentialsException.class); exception.expectMessage("The username or password you entered is incorrect. Please enter the correct credentials."); authenticationProvider.authenticate(new UsernamePasswordAuthenticationToken("user 1", "password 1")); }
@Test public void shouldNotAuthenticateUserWithWrongPassword() throws Exception { when(allDrishtiUsers.findByUsername("user 1")).thenReturn(new DrishtiUser("user 1", "correct password", "salt", asList("ROLE_USER"), true)); exception.expect(BadCredentialsException.class); exception.expectMessage("The username or password you entered is incorrect. Please enter the correct credentials."); authenticationProvider.authenticate(new UsernamePasswordAuthenticationToken("user 1", "wrong password")); }
@Test public void shouldNotAuthenticateInactiveUser() throws Exception { when(allDrishtiUsers.findByUsername("user 1")).thenReturn(new DrishtiUser("user 1", "hashed password 1", "salt", asList("ROLE_USER"), false)); when(passwordEncoder.encodePassword("password 1", "salt")).thenReturn("hashed password 1"); exception.expect(BadCredentialsException.class); exception.expectMessage("The user has been registered but not activated. Please contact your local administrator."); authenticationProvider.authenticate(new UsernamePasswordAuthenticationToken("user 1", "password 1")); }