UserAuthentication implements Authentication, UserConstants { @Override public boolean authenticate(@Nullable Credentials credentials) throws LoginException { if (credentials == null || loginId == null) { return false; } boolean success = false; try { User user = getValidUser(config.getUserManager(root, NamePathMapper.DEFAULT), loginId); if (user == null) { return false; } if (credentials instanceof SimpleCredentials) { SimpleCredentials creds = (SimpleCredentials) credentials; Credentials userCreds = user.getCredentials(); if (loginId.equals(creds.getUserID()) && userCreds instanceof CredentialsImpl) { success = PasswordUtil.isSame(((CredentialsImpl) userCreds).getPasswordHash(), creds.getPassword()); } checkSuccess(success, "UserId/Password mismatch."); if (isPasswordExpired(user) && !changePassword(user, creds)) { throw new CredentialExpiredException("User password has expired"); } } else if (credentials instanceof ImpersonationCredentials) { ImpersonationCredentials ipCreds = (ImpersonationCredentials) credentials; AuthInfo info = ipCreds.getImpersonatorInfo(); success = equalUserId(ipCreds, loginId) && impersonate(info, user); checkSuccess(success, "Impersonation not allowed."); } else { success = (credentials instanceof GuestCredentials) || credentials == PreAuthenticatedLogin.PRE_AUTHENTICATED; } userId = user.getID(); principal = user.getPrincipal(); } catch (RepositoryException e) { throw new LoginException(e.getMessage()); } finally { removeNewPwAttribute(credentials); } return success; } UserAuthentication(@NotNull UserConfiguration config, @NotNull Root root, @Nullable String loginId); @Override boolean authenticate(@Nullable Credentials credentials); @Nullable @Override String getUserId(); @Nullable @Override Principal getUserPrincipal(); static final String PARAM_PASSWORD_EXPIRY_FOR_ADMIN; }
@Test public void testAuthenticateWithoutUserId() throws Exception { authentication = new UserAuthentication(getUserConfiguration(), root, null); assertFalse(authentication.authenticate(new SimpleCredentials(userId, userId.toCharArray()))); }
@Test public void testAuthenticateInvalidCredentials() throws Exception { List<Credentials> invalid = new ArrayList<>(); invalid.add(new TokenCredentials("token")); invalid.add(new Credentials() {}); for (Credentials creds : invalid) { assertFalse(authentication.authenticate(creds)); } }
@Test public void testAuthenticateInvalidSimpleCredentials() { List<Credentials> invalid = new ArrayList<>(); invalid.add(new SimpleCredentials(userId, "wrongPw".toCharArray())); invalid.add(new SimpleCredentials(userId, "".toCharArray())); invalid.add(new SimpleCredentials("unknownUser", "pw".toCharArray())); for (Credentials creds : invalid) { try { authentication.authenticate(creds); fail("LoginException expected"); } catch (LoginException e) { assertTrue(e instanceof FailedLoginException); } } }
@Test(expected = FailedLoginException.class) public void testAuthenticateIdMismatch() throws Exception { authentication.authenticate(new SimpleCredentials("unknownUser", "pw".toCharArray())); }
@Test public void testAuthenticateSimpleCredentials() throws Exception { assertTrue(authentication.authenticate(new SimpleCredentials(userId, userId.toCharArray()))); }
@Test public void testAuthenticateImpersonationCredentials() throws Exception { SimpleCredentials sc = new SimpleCredentials(userId, new char[0]); assertTrue(authentication.authenticate(new ImpersonationCredentials(sc, adminSession.getAuthInfo()))); }
@Test public void testAuthenticateImpersonationCredentials2() throws Exception { SimpleCredentials sc = new SimpleCredentials(userId, new char[0]); assertTrue(authentication.authenticate(new ImpersonationCredentials(sc, mockAuthInfo(userId)))); }
@Test public void testAuthenticateGuestCredentials() throws Exception { UserAuthentication ua = new UserAuthentication(getUserConfiguration(), root, getUserConfiguration().getParameters().getConfigValue(UserConstants.PARAM_ANONYMOUS_ID, UserConstants.DEFAULT_ANONYMOUS_ID)); assertTrue(ua.authenticate(new GuestCredentials())); }
@Test public void testAuthenticatePreAuthCredentials() throws Exception { assertTrue(authentication.authenticate(PreAuthenticatedLogin.PRE_AUTHENTICATED)); }
@Test(expected = LoginException.class) public void testAuthenticateWithFailingUserLookup() throws Exception { UserManager um = mock(UserManager.class, withSettings().defaultAnswer(new ThrowsException(new RepositoryException()))); UserConfiguration uc = when(mock(UserConfiguration.class).getUserManager(any(Root.class), any(NamePathMapper.class))).thenReturn(um).getMock(); UserAuthentication ua = new UserAuthentication(uc, root, userId); ua.authenticate(new SimpleCredentials(userId, userId.toCharArray())); }