org.keycloak.authentication.authenticators.cli.CliUsernamePasswordAuthenticator クラス

org.keycloak.authentication.authenticators.cli.CliUsernamePasswordAuthenticator の継承関係図

org.keycloak.authentication.authenticators.cli.CliUsernamePasswordAuthenticator 連携図

公開メンバ関数
boolean	requiresUser ()
void	authenticate (AuthenticationFlowContext context)
void	action (AuthenticationFlowContext context)
boolean	configuredFor (KeycloakSession session, RealmModel realm, UserModel user)
void	setRequiredActions (KeycloakSession session, RealmModel realm, UserModel user)
void	close ()
boolean	invalidUser (AuthenticationFlowContext context, UserModel user)
boolean	enabledUser (AuthenticationFlowContext context, UserModel user)
boolean	validateUserAndPassword (AuthenticationFlowContext context, MultivaluedMap< String, String > inputData)
boolean	validatePassword (AuthenticationFlowContext context, UserModel user, MultivaluedMap< String, String > inputData)

静的公開変数類
static final String	REGISTRATION_FORM_ACTION = "registration_form"
static final String	ATTEMPTED_USERNAME = "ATTEMPTED_USERNAME"

限定公開メンバ関数
Response	invalidUser (AuthenticationFlowContext context)
Response	disabledUser (AuthenticationFlowContext context)
Response	temporarilyDisabledUser (AuthenticationFlowContext context)
Response	invalidCredentials (AuthenticationFlowContext context)
Response	setDuplicateUserChallenge (AuthenticationFlowContext context, String eventError, String loginFormError, AuthenticationFlowError authenticatorError)
void	runDefaultDummyHash (AuthenticationFlowContext context)
void	dummyHash (AuthenticationFlowContext context)

非公開メンバ関数
String	getHeader (AuthenticationFlowContext context)
URI	getCallbackUrl (AuthenticationFlowContext context)

詳解

著者

Bill Burke

バージョン

Revision

1

関数詳解

action()

void org.keycloak.authentication.authenticators.cli.CliUsernamePasswordAuthenticator.action ( AuthenticationFlowContext  context )

inline

org.keycloak.authentication.Authenticatorを実装しています。

                                                          {
        MultivaluedMap<String, String> formData = context.getHttpRequest().getDecodedFormParameters();
        if (!validateUserAndPassword(context, formData)) {
            return;
        }

        context.success();
    }

authenticate()

void org.keycloak.authentication.authenticators.cli.CliUsernamePasswordAuthenticator.authenticate ( AuthenticationFlowContext  context )

inline

org.keycloak.authentication.Authenticatorを実装しています。

                                                                {
        String header = getHeader(context);
        Response response  = context.form()
                .setStatus(Response.Status.UNAUTHORIZED)
                .setMediaType(MediaType.TEXT_PLAIN_TYPE)
                .setResponseHeader(HttpHeaders.WWW_AUTHENTICATE, header)
                .createForm("cli_splash.ftl");
        context.challenge(response);


    }

close()

void org.keycloak.authentication.authenticators.cli.CliUsernamePasswordAuthenticator.close ( )

inline

org.keycloak.provider.Providerを実装しています。

                        {

    }

configuredFor()

boolean org.keycloak.authentication.authenticators.cli.CliUsernamePasswordAuthenticator.configuredFor ( KeycloakSession  session, RealmModel  realm, UserModel  user  )

inline

org.keycloak.authentication.Authenticatorを実装しています。

                                                                                            {
        return true;
    }

disabledUser()

Response org.keycloak.authentication.authenticators.cli.CliUsernamePasswordAuthenticator.disabledUser ( AuthenticationFlowContext  context )

inlineprotected

                                                                       {
        String header = getHeader(context);
        Response response  = Response.status(401)
                .type(MediaType.TEXT_PLAIN_TYPE)
                .header(HttpHeaders.WWW_AUTHENTICATE, header)
                .entity("\n" + context.form().getMessage(Messages.ACCOUNT_DISABLED) + "\n")
                .build();
        return response;
    }

dummyHash()

void org.keycloak.authentication.authenticators.browser.AbstractUsernameFormAuthenticator.dummyHash ( AuthenticationFlowContext  context )

inlineprotectedinherited

                                                                {
        PasswordPolicy policy = context.getRealm().getPasswordPolicy();
        if (policy == null) {
            runDefaultDummyHash(context);
            return;
        } else {
            PasswordHashProvider hash = context.getSession().getProvider(PasswordHashProvider.class, policy.getHashAlgorithm());
            if (hash == null) {
                runDefaultDummyHash(context);
                return;

            } else {
                hash.encode("dummypassword", policy.getHashIterations());
            }
        }

    }

enabledUser()

boolean org.keycloak.authentication.authenticators.browser.AbstractUsernameFormAuthenticator.enabledUser ( AuthenticationFlowContext  context, UserModel  user  )

inlineinherited

                                                                                  {
        if (!user.isEnabled()) {
            context.getEvent().user(user);
            context.getEvent().error(Errors.USER_DISABLED);
            Response challengeResponse = disabledUser(context);
            // this is not a failure so don't call failureChallenge.
            //context.failureChallenge(AuthenticationFlowError.USER_DISABLED, challengeResponse);
            context.forceChallenge(challengeResponse);
            return false;
        }
        if (isTemporarilyDisabledByBruteForce(context, user)) return false;
        return true;
    }

getCallbackUrl()

URI org.keycloak.authentication.authenticators.cli.CliUsernamePasswordAuthenticator.getCallbackUrl ( AuthenticationFlowContext  context )

inlineprivate

                                                                  {
        return context.getActionUrl(context.generateAccessCode(), true);
    }

getHeader()

String org.keycloak.authentication.authenticators.cli.CliUsernamePasswordAuthenticator.getHeader ( AuthenticationFlowContext  context )

inlineprivate

                                                                {
        URI callback = getCallbackUrl(context);
        return "X-Text-Form-Challenge callback=\"" + callback + "\" param=\"username\" label=\"Username: \" mask=false param=\"password\" label=\"Password: \" mask=true";
    }

invalidCredentials()

Response org.keycloak.authentication.authenticators.cli.CliUsernamePasswordAuthenticator.invalidCredentials ( AuthenticationFlowContext  context )

inlineprotected

                                                                             {
        String header = getHeader(context);
        Response response  = Response.status(401)
                .type(MediaType.TEXT_PLAIN_TYPE)
                .header(HttpHeaders.WWW_AUTHENTICATE, header)
                .entity("\n" + context.form().getMessage(Messages.INVALID_USER) + "\n")
                .build();
        return response;
    }

invalidUser() [1/2]

Response org.keycloak.authentication.authenticators.cli.CliUsernamePasswordAuthenticator.invalidUser ( AuthenticationFlowContext  context )

inlineprotected

                                                                      {
        String header = getHeader(context);
        Response response  = Response.status(401)
                .type(MediaType.TEXT_PLAIN_TYPE)
                .header(HttpHeaders.WWW_AUTHENTICATE, header)
                .entity("\n" + context.form().getMessage(Messages.INVALID_USER) + "\n")
                .build();
        return response;
    }

invalidUser() [2/2]

boolean org.keycloak.authentication.authenticators.browser.AbstractUsernameFormAuthenticator.invalidUser ( AuthenticationFlowContext  context, UserModel  user  )

inlineinherited

                                                                                  {
        if (user == null) {
            dummyHash(context);
            context.getEvent().error(Errors.USER_NOT_FOUND);
            Response challengeResponse = invalidUser(context);
            context.failureChallenge(AuthenticationFlowError.INVALID_USER, challengeResponse);
            return true;
        }
        return false;
    }

requiresUser()

boolean org.keycloak.authentication.authenticators.cli.CliUsernamePasswordAuthenticator.requiresUser ( )

inline

org.keycloak.authentication.Authenticatorを実装しています。

                                  {
        return false;
    }

runDefaultDummyHash()

void org.keycloak.authentication.authenticators.browser.AbstractUsernameFormAuthenticator.runDefaultDummyHash ( AuthenticationFlowContext  context )

inlineprotectedinherited

                                                                          {
        PasswordHashProvider hash = context.getSession().getProvider(PasswordHashProvider.class, PasswordPolicy.HASH_ALGORITHM_DEFAULT);
        hash.encode("dummypassword", PasswordPolicy.HASH_ITERATIONS_DEFAULT);
    }

setDuplicateUserChallenge()

Response org.keycloak.authentication.authenticators.cli.CliUsernamePasswordAuthenticator.setDuplicateUserChallenge ( AuthenticationFlowContext  context, String  eventError, String  loginFormError, AuthenticationFlowError  authenticatorError  )

inlineprotected

                                                                                                                                                                          {
        context.getEvent().error(eventError);
        String header = getHeader(context);
        Response challengeResponse  = Response.status(401)
                .type(MediaType.TEXT_PLAIN_TYPE)
                .header(HttpHeaders.WWW_AUTHENTICATE, header)
                .entity("\n" + context.form().getMessage(loginFormError) + "\n")
                .build();

        context.failureChallenge(authenticatorError, challengeResponse);
        return challengeResponse;
    }

setRequiredActions()

void org.keycloak.authentication.authenticators.cli.CliUsernamePasswordAuthenticator.setRequiredActions ( KeycloakSession  session, RealmModel  realm, UserModel  user  )

inline

org.keycloak.authentication.Authenticatorを実装しています。

                                                                                              {
    }

temporarilyDisabledUser()

Response org.keycloak.authentication.authenticators.cli.CliUsernamePasswordAuthenticator.temporarilyDisabledUser ( AuthenticationFlowContext  context )

inlineprotected

                                                                                  {
        String header = getHeader(context);
        Response response  = Response.status(401)
                .type(MediaType.TEXT_PLAIN_TYPE)
                .header(HttpHeaders.WWW_AUTHENTICATE, header)
                .entity("\n" + context.form().getMessage(Messages.INVALID_USER) + "\n")
                .build();
        return response;
    }

validatePassword()

boolean org.keycloak.authentication.authenticators.browser.AbstractUsernameFormAuthenticator.validatePassword ( AuthenticationFlowContext  context, UserModel  user, MultivaluedMap< String, String >  inputData  )

inlineinherited

                                                                                                                                 {
        List<CredentialInput> credentials = new LinkedList<>();
        String password = inputData.getFirst(CredentialRepresentation.PASSWORD);
        credentials.add(UserCredentialModel.password(password));

        if (isTemporarilyDisabledByBruteForce(context, user)) return false;

        if (password != null && !password.isEmpty() && context.getSession().userCredentialManager().isValid(context.getRealm(), user, credentials)) {
            return true;
        } else {
            context.getEvent().user(user);
            context.getEvent().error(Errors.INVALID_USER_CREDENTIALS);
            Response challengeResponse = invalidCredentials(context);
            context.failureChallenge(AuthenticationFlowError.INVALID_CREDENTIALS, challengeResponse);
            context.clearUser();
            return false;
        }
    }

validateUserAndPassword()

boolean org.keycloak.authentication.authenticators.browser.AbstractUsernameFormAuthenticator.validateUserAndPassword ( AuthenticationFlowContext  context, MultivaluedMap< String, String >  inputData  )

inlineinherited

                                                                                                                        {
        String username = inputData.getFirst(AuthenticationManager.FORM_USERNAME);
        if (username == null) {
            context.getEvent().error(Errors.USER_NOT_FOUND);
            Response challengeResponse = invalidUser(context);
            context.failureChallenge(AuthenticationFlowError.INVALID_USER, challengeResponse);
            return false;
        }

        // remove leading and trailing whitespace
        username = username.trim();

        context.getEvent().detail(Details.USERNAME, username);
        context.getAuthenticationSession().setAuthNote(AbstractUsernameFormAuthenticator.ATTEMPTED_USERNAME, username);

        UserModel user = null;
        try {
            user = KeycloakModelUtils.findUserByNameOrEmail(context.getSession(), context.getRealm(), username);
        } catch (ModelDuplicateException mde) {
            ServicesLogger.LOGGER.modelDuplicateException(mde);

            // Could happen during federation import
            if (mde.getDuplicateFieldName() != null && mde.getDuplicateFieldName().equals(UserModel.EMAIL)) {
                setDuplicateUserChallenge(context, Errors.EMAIL_IN_USE, Messages.EMAIL_EXISTS, AuthenticationFlowError.INVALID_USER);
            } else {
                setDuplicateUserChallenge(context, Errors.USERNAME_IN_USE, Messages.USERNAME_EXISTS, AuthenticationFlowError.INVALID_USER);
            }

            return false;
        }

        if (invalidUser(context, user)) {
            return false;
        }

        if (!validatePassword(context, user, inputData)) {
            return false;
        }

        if (!enabledUser(context, user)) {
            return false;
        }

        String rememberMe = inputData.getFirst("rememberMe");
        boolean remember = rememberMe != null && rememberMe.equalsIgnoreCase("on");
        if (remember) {
            context.getAuthenticationSession().setAuthNote(Details.REMEMBER_ME, "true");
            context.getEvent().detail(Details.REMEMBER_ME, "true");
        } else {
            context.getAuthenticationSession().removeAuthNote(Details.REMEMBER_ME);
        }
        context.setUser(user);
        return true;
    }

メンバ詳解

ATTEMPTED_USERNAME

final String org.keycloak.authentication.authenticators.browser.AbstractUsernameFormAuthenticator.ATTEMPTED_USERNAME = "ATTEMPTED_USERNAME"

staticinherited

REGISTRATION_FORM_ACTION

final String org.keycloak.authentication.authenticators.browser.AbstractUsernameFormAuthenticator.REGISTRATION_FORM_ACTION = "registration_form"

staticinherited

---

このクラス詳解は次のファイルから抽出されました:

• D:/AppData/doxygen/keycloak/src/keycloak/src/main/java/org/keycloak/authentication/authenticators/cli/CliUsernamePasswordAuthenticator.java