org.xdi.oxauth.service.AuthenticationService クラス

org.xdi.oxauth.service.AuthenticationService 連携図

公開メンバ関数
boolean	authenticate (String userName, String password)
boolean	authenticate (String keyValue, String password, String primaryKey, String localPrimaryKey)
boolean	authenticate (GluuLdapConfiguration ldapAuthConfig, PersistenceEntryManager ldapAuthEntryManager, String keyValue, String password, String primaryKey, String localPrimaryKey)
boolean	authenticate (String userName)
SessionId	configureSessionUser (SessionId sessionId, Map< String, String > sessionIdAttributes)
SessionId	configureEventUser ()
void	configureEventUser (SessionId sessionId)
void	quietLogin (String userName)
User	getAuthenticatedUser ()
String	getAuthenticatedUserId ()
Client	configureSessionClient ()
void	configureSessionClient (Client client)
void	onSuccessfulLogin (SessionId sessionUser)
User	getUserOrRemoveSession (SessionId p_sessionId)
String	parametersAsString () throws UnsupportedEncodingException
Map< String, String >	getParametersMap (List< String > extraParameters)
boolean	isParameterExists (String p_name)

非公開メンバ関数
void	setAuthenticatedUserSessionAttribute (String userName, boolean authenticated)
boolean	localAuthenticate (String userName, String password)
boolean	externalAuthenticate (String keyValue, String password)
User	getUserByAttribute (PersistenceEntryManager ldapAuthEntryManager, String baseDn, String attributeName, String attributeValue)
boolean	checkUserStatus (User user)
void	updateLastLogonUserTime (User user)
HttpServletRequest	getHttpRequest ()
void	configureAuthenticatedUser (User user)

非公開変数類
Logger	log
AppConfiguration	appConfiguration
Identity	identity
Credentials	credentials
List< GluuLdapConfiguration >	ldapAuthConfigs
PersistenceEntryManager	ldapEntryManager
List< PersistenceEntryManager >	ldapAuthEntryManagers
UserService	userService
ClientService	clientService
SessionIdService	sessionIdService
ExternalAuthenticationService	externalAuthenticationService
MetricService	metricService
ExternalContext	externalContext
FacesService	facesService
RequestParameterService	requestParameterService
AuthenticationProtectionService	authenticationProtectionService

静的非公開変数類
static final String	EVENT_CONTEXT_AUTHENTICATED_USER = "authenticatedUser"

詳解

Authentication service methods

著者

Yuriy Movchan

Javier Rojas Blum

バージョン

November 23, 2017

関数詳解

authenticate() [1/4]

boolean org.xdi.oxauth.service.AuthenticationService.authenticate ( String  userName, String  password  )

inline

Authenticate user.

引数

userName	The username.
password	The user's password.

戻り値

true if success, otherwise false.

                                                                  {
        log.debug("Authenticating user with LDAP: username: '{}', credentials: '{}'", userName, System.identityHashCode(credentials));

        boolean authenticated = false;

        com.codahale.metrics.Timer.Context timerContext = metricService.getTimer(MetricType.OXAUTH_USER_AUTHENTICATION_RATE).time();
        try {
            if ((this.ldapAuthConfigs == null) || (this.ldapAuthConfigs.size() == 0)) {
                authenticated = localAuthenticate(userName, password);
            } else {
                authenticated = externalAuthenticate(userName, password);
            }
        } finally {
            timerContext.stop();
        }

        String userId = userName;
        if ((identity.getUser() != null) && StringHelper.isNotEmpty(identity.getUser().getUserId())) {
            userId = identity.getUser().getUserId();
        }
        setAuthenticatedUserSessionAttribute(userId, authenticated);

        MetricType metricType;
        if (authenticated) {
            metricType = MetricType.OXAUTH_USER_AUTHENTICATION_SUCCESS;
        } else {
            metricType = MetricType.OXAUTH_USER_AUTHENTICATION_FAILURES;
        }

        metricService.incCounter(metricType);

        if (authenticationProtectionService.isEnabled()) {
            authenticationProtectionService.storeAttempt(userName, authenticated);
            authenticationProtectionService.doDelayIfNeeded(userName);
        }

        return authenticated;
    }

authenticate() [2/4]

boolean org.xdi.oxauth.service.AuthenticationService.authenticate ( String  keyValue, String  password, String  primaryKey, String  localPrimaryKey  )

inline

                                                                                                             {
        if (this.ldapAuthConfigs == null) {
            return authenticate(null, ldapEntryManager, keyValue, password, primaryKey, localPrimaryKey);
        }

        boolean authenticated = false;

        com.codahale.metrics.Timer.Context timerContext = metricService.getTimer(MetricType.OXAUTH_USER_AUTHENTICATION_RATE).time();
        try {
            for (int i = 0; i < this.ldapAuthConfigs.size(); i++) {
                GluuLdapConfiguration ldapAuthConfig = this.ldapAuthConfigs.get(i);
                PersistenceEntryManager ldapAuthEntryManager = this.ldapAuthEntryManagers.get(i);

                authenticated = authenticate(ldapAuthConfig, ldapAuthEntryManager, keyValue, password, primaryKey, localPrimaryKey);
                if (authenticated) {
                    break;
                }
            }
        } finally {
            timerContext.stop();
        }

        MetricType metricType;
        if (authenticated) {
            metricType = MetricType.OXAUTH_USER_AUTHENTICATION_SUCCESS;
        } else {
            metricType = MetricType.OXAUTH_USER_AUTHENTICATION_FAILURES;
        }

        metricService.incCounter(metricType);

        
        if (authenticationProtectionService.isEnabled()) {
            authenticationProtectionService.storeAttempt(keyValue, authenticated);
            authenticationProtectionService.doDelayIfNeeded(keyValue);
        }

        return authenticated;
    }

authenticate() [3/4]

boolean org.xdi.oxauth.service.AuthenticationService.authenticate ( GluuLdapConfiguration  ldapAuthConfig, PersistenceEntryManager  ldapAuthEntryManager, String  keyValue, String  password, String  primaryKey, String  localPrimaryKey  )

inline

                                                                                                                                                                                                 {
        log.debug("Attempting to find userDN by primary key: '{}' and key value: '{}', credentials: '{}'", primaryKey, keyValue, System.identityHashCode(credentials));

        try {
            List<?> baseDNs;
            if (ldapAuthConfig == null) {
                baseDNs = Arrays.asList(userService.getDnForUser(null));
            } else {
                baseDNs = ldapAuthConfig.getBaseDNs();
            }

            if (baseDNs != null && !baseDNs.isEmpty()) {
                for (Object baseDnProperty : baseDNs) {
                    String baseDn;
                    if (baseDnProperty instanceof SimpleProperty) {
                        baseDn = ((SimpleProperty) baseDnProperty).getValue();
                    } else {
                        baseDn = baseDnProperty.toString();
                    }

                    User user = getUserByAttribute(ldapAuthEntryManager, baseDn, primaryKey, keyValue);
                    if (user != null) {
                        String userDn = user.getDn();
                        log.debug("Attempting to authenticate userDN: {}", userDn);
                        if (ldapAuthEntryManager.authenticate(userDn, password)) {
                            log.debug("User authenticated: {}", userDn);

                            log.debug("Attempting to find userDN by local primary key: {}", localPrimaryKey);
                            User localUser = userService.getUserByAttribute(localPrimaryKey, keyValue);
                            if (localUser != null) {
                                if (!checkUserStatus(localUser)) {
                                    return false;
                                }

                                configureAuthenticatedUser(localUser);
                                updateLastLogonUserTime(localUser);

                                log.trace("authenticate_external: credentials: '{}', credentials.userName: '{}', authenticatedUser.userId: '{}'", System.identityHashCode(credentials), credentials.getUsername(), getAuthenticatedUserId());

                                return true;
                            }
                        }
                    }
                }
            } else {
                log.error("There are no baseDns specified in authentication configuration.");
            }
        } catch (Exception e) {
            log.error(e.getMessage());
        }

        return false;
    }

authenticate() [4/4]

boolean org.xdi.oxauth.service.AuthenticationService.authenticate ( String  userName )

inline

                                                 {
        log.debug("Authenticating user with LDAP: username: '{}', credentials: '{}'", userName, System.identityHashCode(credentials));

        boolean authenticated = false;

        com.codahale.metrics.Timer.Context timerContext = metricService.getTimer(MetricType.OXAUTH_USER_AUTHENTICATION_RATE).time();
        try {
            User user = userService.getUser(userName);
            if ((user != null) && checkUserStatus(user)) {
                credentials.setUsername(user.getUserId());
                configureAuthenticatedUser(user);
                updateLastLogonUserTime(user);

                log.trace("Authenticate: credentials: '{}', credentials.userName: '{}', authenticatedUser.userId: '{}'", System.identityHashCode(credentials), credentials.getUsername(), getAuthenticatedUserId());

                authenticated = true;
            }
        } finally {
            timerContext.stop();
        }

        setAuthenticatedUserSessionAttribute(userName, authenticated);

        MetricType metricType;
        if (authenticated) {
            metricType = MetricType.OXAUTH_USER_AUTHENTICATION_SUCCESS;
        } else {
            metricType = MetricType.OXAUTH_USER_AUTHENTICATION_FAILURES;
        }

        metricService.incCounter(metricType);

        if (authenticationProtectionService.isEnabled()) {
            authenticationProtectionService.storeAttempt(userName, authenticated);
            authenticationProtectionService.doDelayIfNeeded(userName);
        }

        return authenticated;
    }

checkUserStatus()

boolean org.xdi.oxauth.service.AuthenticationService.checkUserStatus ( User  user )

inlineprivate

                                               {
        CustomAttribute userStatus = userService.getCustomAttribute(user, "gluuStatus");

        if ((userStatus != null) && GluuStatus.ACTIVE.equals(GluuStatus.getByValue(userStatus.getValue()))) {
            return true;
        }

        log.warn("User '{}' was disabled", user.getUserId());
        return false;
    }

configureAuthenticatedUser()

void org.xdi.oxauth.service.AuthenticationService.configureAuthenticatedUser ( User  user )

inlineprivate

                                                       {
        identity.setUser(user);
    }

configureEventUser() [1/2]

SessionId org.xdi.oxauth.service.AuthenticationService.configureEventUser ( )

inline

                                          {
        User user = getAuthenticatedUser();
        if (user == null) {
            return null;
        }

        log.debug("ConfigureEventUser: username: '{}', credentials: '{}'", user.getUserId(), System.identityHashCode(credentials));

        SessionId sessionId = sessionIdService.generateAuthenticatedSessionId(getHttpRequest(), user.getDn());

        identity.setSessionId(sessionId);

        return sessionId;
    }

configureEventUser() [2/2]

void org.xdi.oxauth.service.AuthenticationService.configureEventUser ( SessionId  sessionId )

inline

                                                        {
        sessionIdService.updateSessionId(sessionId);

        identity.setSessionId(sessionId);
    }

configureSessionClient() [1/2]

Client org.xdi.oxauth.service.AuthenticationService.configureSessionClient ( )

inline

                                           {
        String clientInum = credentials.getUsername();
        log.debug("ConfigureSessionClient: username: '{}', credentials: '{}'", clientInum, System.identityHashCode(credentials));

        Client client = clientService.getClient(clientInum);
        configureSessionClient(client);
        return client;
    }

configureSessionClient() [2/2]

void org.xdi.oxauth.service.AuthenticationService.configureSessionClient ( Client  client )

inline

                                                      {
        SessionClient sessionClient = new SessionClient();
        sessionClient.setClient(client);

        identity.setSessionClient(sessionClient);

        clientService.updatAccessTime(client, true);
    }

configureSessionUser()

SessionId org.xdi.oxauth.service.AuthenticationService.configureSessionUser ( SessionId  sessionId, Map< String, String >  sessionIdAttributes  )

inline

                                                                                                        {
        log.trace("configureSessionUser: credentials: '{}', sessionId: '{}', credentials.userName: '{}', authenticatedUser.userId: '{}'", System.identityHashCode(credentials), sessionId, credentials.getUsername(), getAuthenticatedUserId());

        User user = getAuthenticatedUser();

        SessionId newSessionId;
        if (sessionId == null) {
            newSessionId = sessionIdService.generateAuthenticatedSessionId(getHttpRequest(), user.getDn(), sessionIdAttributes);
        } else {
            // TODO: Remove after 2.4.5
            String sessionAuthUser = sessionIdAttributes.get(Constants.AUTHENTICATED_USER);
            log.trace("configureSessionUser sessionId: '{}', sessionId.auth_user: '{}'", sessionId, sessionAuthUser);

            newSessionId = sessionIdService.setSessionIdStateAuthenticated(getHttpRequest(), sessionId, user.getDn());
        }

        identity.setSessionId(sessionId);

        return newSessionId;
    }

externalAuthenticate()

boolean org.xdi.oxauth.service.AuthenticationService.externalAuthenticate ( String  keyValue, String  password  )

inlineprivate

                                                                           {
        for (int i = 0; i < this.ldapAuthConfigs.size(); i++) {
            GluuLdapConfiguration ldapAuthConfig = this.ldapAuthConfigs.get(i);
            PersistenceEntryManager ldapAuthEntryManager = this.ldapAuthEntryManagers.get(i);

            String primaryKey = "uid";
            if (StringHelper.isNotEmpty(ldapAuthConfig.getPrimaryKey())) {
                primaryKey = ldapAuthConfig.getPrimaryKey();
            }

            String localPrimaryKey = "uid";
            if (StringHelper.isNotEmpty(ldapAuthConfig.getLocalPrimaryKey())) {
                localPrimaryKey = ldapAuthConfig.getLocalPrimaryKey();
            }

            boolean authenticated = authenticate(ldapAuthConfig, ldapAuthEntryManager, keyValue, password, primaryKey, localPrimaryKey);
            if (authenticated) {
                return authenticated;
            }
        }

        return false;
    }

getAuthenticatedUser()

User org.xdi.oxauth.service.AuthenticationService.getAuthenticatedUser ( )

inline

                                       {
        if (identity.getUser() != null) {
            return identity.getUser();
        } else {
            SessionId sessionId = sessionIdService.getSessionId();
            if (sessionId != null) {
                Map<String, String> sessionIdAttributes = sessionId.getSessionAttributes();
                String userId = sessionIdAttributes.get(Constants.AUTHENTICATED_USER);
                if (StringHelper.isNotEmpty(userId)) {
                    User user = userService.getUser(userId);
                    identity.setUser(user);

                    return user;
                }
            }
        }

        return null;
    }

getAuthenticatedUserId()

String org.xdi.oxauth.service.AuthenticationService.getAuthenticatedUserId ( )

inline

                                           {
        User authenticatedUser = getAuthenticatedUser();
        if (authenticatedUser != null) {
            return authenticatedUser.getUserId();
        }

        return null;
    }

getHttpRequest()

HttpServletRequest org.xdi.oxauth.service.AuthenticationService.getHttpRequest ( )

inlineprivate

                                                {
        if (externalContext == null) {
            return null;
        }
        return (HttpServletRequest) externalContext.getRequest();
    }

getParametersMap()

Map<String, String> org.xdi.oxauth.service.AuthenticationService.getParametersMap ( List< String >  extraParameters )

inline

                                                                              {
        final Map<String, String> parameterMap = new HashMap<String, String>(externalContext
                .getRequestParameterMap());

        return requestParameterService.getParametersMap(extraParameters, parameterMap);
    }

getUserByAttribute()

User org.xdi.oxauth.service.AuthenticationService.getUserByAttribute ( PersistenceEntryManager  ldapAuthEntryManager, String  baseDn, String  attributeName, String  attributeValue  )

inlineprivate

                                                                                                                                              {
        log.debug("Getting user information from LDAP: attributeName = '{}', attributeValue = '{}'", attributeName, attributeValue);

        if (StringHelper.isEmpty(attributeValue)) {
            return null;
        }

        SimpleUser sampleUser = new SimpleUser();
        sampleUser.setDn(baseDn);

        List<CustomAttribute> customAttributes = new ArrayList<CustomAttribute>();
        customAttributes.add(new CustomAttribute(attributeName, attributeValue));

        sampleUser.setCustomAttributes(customAttributes);

        log.debug("Searching user by attributes: '{}', baseDn: '{}'", customAttributes, baseDn);
        List<User> entries = ldapAuthEntryManager.findEntries(sampleUser, 1);
        log.debug("Found '{}' entries", entries.size());

        if (entries.size() > 0) {
            SimpleUser foundUser = entries.get(0);

            return ldapAuthEntryManager.find(User.class, foundUser.getDn());
        } else {
            return null;
        }
    }

getUserOrRemoveSession()

User org.xdi.oxauth.service.AuthenticationService.getUserOrRemoveSession ( SessionId  p_sessionId )

inline

                                                              {
        if (p_sessionId != null) {
            try {
                if (StringUtils.isNotBlank(p_sessionId.getUserDn())) {
                    final User user = userService.getUserByDn(p_sessionId.getUserDn());
                    if (user != null) {
                        return user;
                    } else { // if there is no user than session is invalid
                        sessionIdService.remove(p_sessionId);
                    }
                } else { // if there is no user than session is invalid
                    sessionIdService.remove(p_sessionId);
                }
            } catch (Exception e) {
                log.trace(e.getMessage(), e);
            }
        }
        return null;
    }

isParameterExists()

boolean org.xdi.oxauth.service.AuthenticationService.isParameterExists ( String  p_name )

inline

                                                    {
        return identity.isSetWorkingParameter(p_name);
    }

localAuthenticate()

boolean org.xdi.oxauth.service.AuthenticationService.localAuthenticate ( String  userName, String  password  )

inlineprivate

                                                                        {
        User user = userService.getUser(userName);
        if (user != null) {
            if (!checkUserStatus(user)) {
                return false;
            }

            // Use local LDAP server for user authentication
            boolean authenticated = ldapEntryManager.authenticate(user.getDn(), password);
            if (authenticated) {
                configureAuthenticatedUser(user);
                updateLastLogonUserTime(user);

                log.trace("Authenticate: credentials: '{}', credentials.userName: '{}', authenticatedUser.userId: '{}'", System.identityHashCode(credentials), credentials.getUsername(), getAuthenticatedUserId());
            }

            return authenticated;
        }

        return false;
    }

onSuccessfulLogin()

void org.xdi.oxauth.service.AuthenticationService.onSuccessfulLogin ( SessionId  sessionUser )

inline

                                                         {
        log.info("Attempting to redirect user: SessionUser: {}", sessionUser);

        if ((sessionUser == null) || StringUtils.isBlank(sessionUser.getUserDn())) {
            return;
        }

        User user = userService.getUserByDn(sessionUser.getUserDn());

        log.info("Attempting to redirect user: User: {}", user);

        if (user != null) {
            final Map<String, String> result = sessionUser.getSessionAttributes();
            Map<String, String> allowedParameters = requestParameterService.getAllowedParameters(result);

            result.put(SESSION_ID, sessionUser.getId());

            log.trace("Logged in successfully! User: {}, page: /authorize.xhtml, map: {}", user, allowedParameters);
            facesService.redirect("/authorize.xhtml", (Map) allowedParameters);
        }
    }

parametersAsString()

String org.xdi.oxauth.service.AuthenticationService.parametersAsString ( ) throws UnsupportedEncodingException

inline

                                                                           {
        final Map<String, String> parameterMap = getParametersMap(null);

        return requestParameterService.parametersAsString(parameterMap);
    }

quietLogin()

void org.xdi.oxauth.service.AuthenticationService.quietLogin ( String  userName )

inline

                                            {
        Principal principal = new SimplePrincipal(userName);
        identity.acceptExternallyAuthenticatedPrincipal(principal);
        identity.quietLogin();
    }

setAuthenticatedUserSessionAttribute()

void org.xdi.oxauth.service.AuthenticationService.setAuthenticatedUserSessionAttribute ( String  userName, boolean  authenticated  )

inlineprivate

                                                                                              {
        SessionId sessionId = sessionIdService.getSessionId();
        if (sessionId != null) {
            Map<String, String> sessionIdAttributes = sessionId.getSessionAttributes();
            if (authenticated) {
                sessionIdAttributes.put(Constants.AUTHENTICATED_USER, userName);
            }
            sessionIdService.updateSessionIdIfNeeded(sessionId, authenticated);
        }
    }

updateLastLogonUserTime()

void org.xdi.oxauth.service.AuthenticationService.updateLastLogonUserTime ( User  user )

inlineprivate

                                                    {
        if (!appConfiguration.getUpdateUserLastLogonTime()) {
            return;
        }

        CustomEntry customEntry = new CustomEntry();
        customEntry.setDn(user.getDn());

        List<String> personCustomObjectClassList = appConfiguration.getPersonCustomObjectClassList();
        if ((personCustomObjectClassList != null) && !personCustomObjectClassList.isEmpty()) {
            // Combine object classes from LDAP and configuration in one list
            Set<Object> customPersonCustomObjectClassList = new HashSet<Object>(personCustomObjectClassList);
            customPersonCustomObjectClassList.add("gluuPerson");
            customPersonCustomObjectClassList.addAll(Arrays.asList(user.getCustomObjectClasses()));

            customEntry.setCustomObjectClasses(customPersonCustomObjectClassList.toArray(new String[customPersonCustomObjectClassList.size()]));
        } else {
            customEntry.setCustomObjectClasses(UserService.USER_OBJECT_CLASSES);
        }

        Date now = new GregorianCalendar(TimeZone.getTimeZone("UTC")).getTime();
        String nowDateString = ldapEntryManager.encodeTime(now);
        CustomAttribute customAttribute = new CustomAttribute("oxLastLogonTime", nowDateString);
        customEntry.getCustomAttributes().add(customAttribute);

        try {
            ldapEntryManager.merge(customEntry);
        } catch (EntryPersistenceException epe) {
            log.error("Failed to update oxLastLogonTime of user '{}'", user.getUserId());
        }
    }

メンバ詳解

appConfiguration

AppConfiguration org.xdi.oxauth.service.AuthenticationService.appConfiguration

private

authenticationProtectionService

AuthenticationProtectionService org.xdi.oxauth.service.AuthenticationService.authenticationProtectionService

private

clientService

ClientService org.xdi.oxauth.service.AuthenticationService.clientService

private

credentials

Credentials org.xdi.oxauth.service.AuthenticationService.credentials

private

EVENT_CONTEXT_AUTHENTICATED_USER

final String org.xdi.oxauth.service.AuthenticationService.EVENT_CONTEXT_AUTHENTICATED_USER = "authenticatedUser"

staticprivate

externalAuthenticationService

ExternalAuthenticationService org.xdi.oxauth.service.AuthenticationService.externalAuthenticationService

private

externalContext

ExternalContext org.xdi.oxauth.service.AuthenticationService.externalContext

private

facesService

FacesService org.xdi.oxauth.service.AuthenticationService.facesService

private

identity

Identity org.xdi.oxauth.service.AuthenticationService.identity

private

ldapAuthConfigs

List<GluuLdapConfiguration> org.xdi.oxauth.service.AuthenticationService.ldapAuthConfigs

private

ldapAuthEntryManagers

List<PersistenceEntryManager> org.xdi.oxauth.service.AuthenticationService.ldapAuthEntryManagers

private

ldapEntryManager

PersistenceEntryManager org.xdi.oxauth.service.AuthenticationService.ldapEntryManager

private

log

Logger org.xdi.oxauth.service.AuthenticationService.log

private

metricService

MetricService org.xdi.oxauth.service.AuthenticationService.metricService

private

requestParameterService

RequestParameterService org.xdi.oxauth.service.AuthenticationService.requestParameterService

private

sessionIdService

SessionIdService org.xdi.oxauth.service.AuthenticationService.sessionIdService

private

userService

UserService org.xdi.oxauth.service.AuthenticationService.userService

private

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/OpenId/gluu/src/oxAuth/Server/src/main/java/org/xdi/oxauth/service/AuthenticationService.java