@Test(expected = AuthenticationServiceException.class) public void attemptAuthentication_test_with_wrong_port() { mockHttpServletRequest.setMethod("GET"); when(authenticationManager.authenticate(captor.capture())).thenReturn(null); target.attemptAuthentication(mockHttpServletRequest, mockHttpServletResponse); }
@Override public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) { if (postOnly && !HttpMethod.POST.matches(request.getMethod())) { throw new AuthenticationServiceException( "Authentication method not supported: " + request.getMethod()); } String credentialId = obtainCredentialId(request); if(StringUtils.isEmpty(credentialId)){ String username = obtainUsername(request); String password = obtainPassword(request); if (username == null) { username = ""; } if (password == null) { password = ""; } username = username.trim(); UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken( username, password); setDetails(request, authRequest); return this.getAuthenticationManager().authenticate(authRequest); } else { String clientDataJSON = obtainClientDataJSON(request); String authenticatorData = obtainAuthenticatorData(request); String signature = obtainSignatureData(request); String clientExtensionsJSON = obtainClientExtensionsJSON(request); byte[] rawId = Base64Utils.decodeFromUrlSafeString(credentialId); byte[] rawClientData = Base64Utils.decodeFromUrlSafeString(clientDataJSON); byte[] rawAuthenticatorData = Base64Utils.decodeFromUrlSafeString(authenticatorData); byte[] signatureBytes = Base64Utils.decodeFromUrlSafeString(signature); ServerProperty serverProperty = serverPropertyProvider.provide(request); WebAuthnAuthenticationRequest webAuthnAuthenticationRequest = new WebAuthnAuthenticationRequest( rawId, rawClientData, rawAuthenticatorData, signatureBytes, clientExtensionsJSON ); WebAuthnAuthenticationParameters webAuthnAuthenticationParameters = new WebAuthnAuthenticationParameters( serverProperty, userVerificationStrategy.isUserVerificationRequired(), true ); AbstractAuthenticationToken authenticationToken = new WebAuthnAssertionAuthenticationToken(webAuthnAuthenticationRequest, webAuthnAuthenticationParameters, authorities); setDetails(request, authenticationToken); return this.getAuthenticationManager().authenticate(authenticationToken); } }
WebAuthnProcessingFilter extends UsernamePasswordAuthenticationFilter { @Override public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) { if (postOnly && !HttpMethod.POST.matches(request.getMethod())) { throw new AuthenticationServiceException( "Authentication method not supported: " + request.getMethod()); } String credentialId = obtainCredentialId(request); if(StringUtils.isEmpty(credentialId)){ String username = obtainUsername(request); String password = obtainPassword(request); if (username == null) { username = ""; } if (password == null) { password = ""; } username = username.trim(); UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken( username, password); setDetails(request, authRequest); return this.getAuthenticationManager().authenticate(authRequest); } else { String clientDataJSON = obtainClientDataJSON(request); String authenticatorData = obtainAuthenticatorData(request); String signature = obtainSignatureData(request); String clientExtensionsJSON = obtainClientExtensionsJSON(request); byte[] rawId = Base64Utils.decodeFromUrlSafeString(credentialId); byte[] rawClientData = Base64Utils.decodeFromUrlSafeString(clientDataJSON); byte[] rawAuthenticatorData = Base64Utils.decodeFromUrlSafeString(authenticatorData); byte[] signatureBytes = Base64Utils.decodeFromUrlSafeString(signature); ServerProperty serverProperty = serverPropertyProvider.provide(request); WebAuthnAuthenticationRequest webAuthnAuthenticationRequest = new WebAuthnAuthenticationRequest( rawId, rawClientData, rawAuthenticatorData, signatureBytes, clientExtensionsJSON ); WebAuthnAuthenticationParameters webAuthnAuthenticationParameters = new WebAuthnAuthenticationParameters( serverProperty, userVerificationStrategy.isUserVerificationRequired(), true ); AbstractAuthenticationToken authenticationToken = new WebAuthnAssertionAuthenticationToken(webAuthnAuthenticationRequest, webAuthnAuthenticationParameters, authorities); setDetails(request, authenticationToken); return this.getAuthenticationManager().authenticate(authenticationToken); } } }
WebAuthnProcessingFilter extends UsernamePasswordAuthenticationFilter { @Override public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) { if (postOnly && !HttpMethod.POST.matches(request.getMethod())) { throw new AuthenticationServiceException( "Authentication method not supported: " + request.getMethod()); } String credentialId = obtainCredentialId(request); if(StringUtils.isEmpty(credentialId)){ String username = obtainUsername(request); String password = obtainPassword(request); if (username == null) { username = ""; } if (password == null) { password = ""; } username = username.trim(); UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken( username, password); setDetails(request, authRequest); return this.getAuthenticationManager().authenticate(authRequest); } else { String clientDataJSON = obtainClientDataJSON(request); String authenticatorData = obtainAuthenticatorData(request); String signature = obtainSignatureData(request); String clientExtensionsJSON = obtainClientExtensionsJSON(request); byte[] rawId = Base64Utils.decodeFromUrlSafeString(credentialId); byte[] rawClientData = Base64Utils.decodeFromUrlSafeString(clientDataJSON); byte[] rawAuthenticatorData = Base64Utils.decodeFromUrlSafeString(authenticatorData); byte[] signatureBytes = Base64Utils.decodeFromUrlSafeString(signature); ServerProperty serverProperty = serverPropertyProvider.provide(request); WebAuthnAuthenticationRequest webAuthnAuthenticationRequest = new WebAuthnAuthenticationRequest( rawId, rawClientData, rawAuthenticatorData, signatureBytes, clientExtensionsJSON ); WebAuthnAuthenticationParameters webAuthnAuthenticationParameters = new WebAuthnAuthenticationParameters( serverProperty, userVerificationStrategy.isUserVerificationRequired(), true ); AbstractAuthenticationToken authenticationToken = new WebAuthnAssertionAuthenticationToken(webAuthnAuthenticationRequest, webAuthnAuthenticationParameters, authorities); setDetails(request, authenticationToken); return this.getAuthenticationManager().authenticate(authenticationToken); } } WebAuthnProcessingFilter();  WebAuthnProcessingFilter(List<GrantedAuthority> authorities, ServerPropertyProvider serverPropertyProvider); }
WebAuthnProcessingFilter extends UsernamePasswordAuthenticationFilter { @Override public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) { if (postOnly && !HttpMethod.POST.matches(request.getMethod())) { throw new AuthenticationServiceException( "Authentication method not supported: " + request.getMethod()); } String credentialId = obtainCredentialId(request); if(StringUtils.isEmpty(credentialId)){ String username = obtainUsername(request); String password = obtainPassword(request); if (username == null) { username = ""; } if (password == null) { password = ""; } username = username.trim(); UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken( username, password); setDetails(request, authRequest); return this.getAuthenticationManager().authenticate(authRequest); } else { String clientDataJSON = obtainClientDataJSON(request); String authenticatorData = obtainAuthenticatorData(request); String signature = obtainSignatureData(request); String clientExtensionsJSON = obtainClientExtensionsJSON(request); byte[] rawId = Base64Utils.decodeFromUrlSafeString(credentialId); byte[] rawClientData = Base64Utils.decodeFromUrlSafeString(clientDataJSON); byte[] rawAuthenticatorData = Base64Utils.decodeFromUrlSafeString(authenticatorData); byte[] signatureBytes = Base64Utils.decodeFromUrlSafeString(signature); ServerProperty serverProperty = serverPropertyProvider.provide(request); WebAuthnAuthenticationRequest webAuthnAuthenticationRequest = new WebAuthnAuthenticationRequest( rawId, rawClientData, rawAuthenticatorData, signatureBytes, clientExtensionsJSON ); WebAuthnAuthenticationParameters webAuthnAuthenticationParameters = new WebAuthnAuthenticationParameters( serverProperty, userVerificationStrategy.isUserVerificationRequired(), true ); AbstractAuthenticationToken authenticationToken = new WebAuthnAssertionAuthenticationToken(webAuthnAuthenticationRequest, webAuthnAuthenticationParameters, authorities); setDetails(request, authenticationToken); return this.getAuthenticationManager().authenticate(authenticationToken); } } WebAuthnProcessingFilter();  WebAuthnProcessingFilter(List<GrantedAuthority> authorities, ServerPropertyProvider serverPropertyProvider); @Override Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response); @Override void setPostOnly(boolean postOnly); String getCredentialIdParameter(); void setCredentialIdParameter(String credentialIdParameter); String getClientDataJSONParameter(); void setClientDataJSONParameter(String clientDataJSONParameter); String getAuthenticatorDataParameter(); void setAuthenticatorDataParameter(String authenticatorDataParameter); String getSignatureParameter(); void setSignatureParameter(String signatureParameter); String getClientExtensionsJSONParameter(); void setClientExtensionsJSONParameter(String clientExtensionsJSONParameter); ServerPropertyProvider getServerPropertyProvider(); void setServerPropertyProvider(ServerPropertyProvider serverPropertyProvider); }
WebAuthnProcessingFilter extends UsernamePasswordAuthenticationFilter { @Override public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) { if (postOnly && !HttpMethod.POST.matches(request.getMethod())) { throw new AuthenticationServiceException( "Authentication method not supported: " + request.getMethod()); } String credentialId = obtainCredentialId(request); if(StringUtils.isEmpty(credentialId)){ String username = obtainUsername(request); String password = obtainPassword(request); if (username == null) { username = ""; } if (password == null) { password = ""; } username = username.trim(); UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken( username, password); setDetails(request, authRequest); return this.getAuthenticationManager().authenticate(authRequest); } else { String clientDataJSON = obtainClientDataJSON(request); String authenticatorData = obtainAuthenticatorData(request); String signature = obtainSignatureData(request); String clientExtensionsJSON = obtainClientExtensionsJSON(request); byte[] rawId = Base64Utils.decodeFromUrlSafeString(credentialId); byte[] rawClientData = Base64Utils.decodeFromUrlSafeString(clientDataJSON); byte[] rawAuthenticatorData = Base64Utils.decodeFromUrlSafeString(authenticatorData); byte[] signatureBytes = Base64Utils.decodeFromUrlSafeString(signature); ServerProperty serverProperty = serverPropertyProvider.provide(request); WebAuthnAuthenticationRequest webAuthnAuthenticationRequest = new WebAuthnAuthenticationRequest( rawId, rawClientData, rawAuthenticatorData, signatureBytes, clientExtensionsJSON ); WebAuthnAuthenticationParameters webAuthnAuthenticationParameters = new WebAuthnAuthenticationParameters( serverProperty, userVerificationStrategy.isUserVerificationRequired(), true ); AbstractAuthenticationToken authenticationToken = new WebAuthnAssertionAuthenticationToken(webAuthnAuthenticationRequest, webAuthnAuthenticationParameters, authorities); setDetails(request, authenticationToken); return this.getAuthenticationManager().authenticate(authenticationToken); } } WebAuthnProcessingFilter();  WebAuthnProcessingFilter(List<GrantedAuthority> authorities, ServerPropertyProvider serverPropertyProvider); @Override Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response); @Override void setPostOnly(boolean postOnly); String getCredentialIdParameter(); void setCredentialIdParameter(String credentialIdParameter); String getClientDataJSONParameter(); void setClientDataJSONParameter(String clientDataJSONParameter); String getAuthenticatorDataParameter(); void setAuthenticatorDataParameter(String authenticatorDataParameter); String getSignatureParameter(); void setSignatureParameter(String signatureParameter); String getClientExtensionsJSONParameter(); void setClientExtensionsJSONParameter(String clientExtensionsJSONParameter); ServerPropertyProvider getServerPropertyProvider(); void setServerPropertyProvider(ServerPropertyProvider serverPropertyProvider); static final String SPRING_SECURITY_FORM_CREDENTIAL_ID_KEY; static final String SPRING_SECURITY_FORM_CLIENT_DATA_JSON_KEY; static final String SPRING_SECURITY_FORM_AUTHENTICATOR_DATA_KEY; static final String SPRING_SECURITY_FORM_SIGNATURE_KEY; static final String SPRING_SECURITY_FORM_CLIENT_EXTENSIONS_JSON_KEY; }