Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added additionalAuthenticationChecks implementation to make sure password is rechecked if Ldap is used with a user cache.

This commit is contained in:
Luke Taylor 2006-05-22 23:37:54 +00:00
parent e30c3d7bd2
commit 3eaed3ad44
2 changed files with 30 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
core/src/main/java/org/acegisecurity/providers/ldap/LdapAuthenticationProvider.java
View File

@ -135,6 +135,12 @@ public class LdapAuthenticationProvider extends AbstractUserDetailsAuthenticatio
//~ Methods ================================================================ //~ Methods ================================================================
protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException { protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
if (!userDetails.getPassword().equals(authentication.getCredentials().toString())) {
throw new BadCredentialsException(messages.getMessage(
"AbstractUserDetailsAuthenticationProvider.badCredentials",
"Bad credentials"), userDetails);
}
} }
protected UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException { protected UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {

29
core/src/test/java/org/acegisecurity/providers/ldap/LdapAuthenticationProviderTests.java
View File

@ -6,7 +6,6 @@ import javax.naming.directory.BasicAttributes;
import org.acegisecurity.GrantedAuthority; import org.acegisecurity.GrantedAuthority;
import org.acegisecurity.GrantedAuthorityImpl; import org.acegisecurity.GrantedAuthorityImpl;
import org.acegisecurity.BadCredentialsException; import org.acegisecurity.BadCredentialsException;
import org.acegisecurity.ldap.*;
import org.acegisecurity.providers.UsernamePasswordAuthenticationToken; import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
import org.acegisecurity.userdetails.UserDetails; import org.acegisecurity.userdetails.UserDetails;
import org.acegisecurity.userdetails.ldap.LdapUserDetailsImpl; import org.acegisecurity.userdetails.ldap.LdapUserDetailsImpl;
@ -14,11 +13,13 @@ import org.acegisecurity.userdetails.ldap.LdapUserDetails;
import java.util.ArrayList; import java.util.ArrayList;
import junit.framework.TestCase;
/** /**
* @author Luke Taylor * @author Luke Taylor
* @version $Id$ * @version $Id$
*/ */
public class LdapAuthenticationProviderTests extends AbstractLdapServerTestCase { public class LdapAuthenticationProviderTests extends TestCase {
public LdapAuthenticationProviderTests(String string) { public LdapAuthenticationProviderTests(String string) {
super(string); super(string);
@ -34,8 +35,8 @@ public class LdapAuthenticationProviderTests extends AbstractLdapServerTestCase
assertNotNull(ldapProvider.getAuthoritiesPoulator()); assertNotNull(ldapProvider.getAuthoritiesPoulator());
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("bob","bobspassword"); UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken("bob","bobspassword");
UserDetails user = ldapProvider.retrieveUser("bob", token); UserDetails user = ldapProvider.retrieveUser("bob", authRequest);
assertEquals(2, user.getAuthorities().length); assertEquals(2, user.getAuthorities().length);
assertEquals("bobspassword", user.getPassword()); assertEquals("bobspassword", user.getPassword());
assertEquals("bob", user.getUsername()); assertEquals("bob", user.getUsername());
@ -47,7 +48,25 @@ public class LdapAuthenticationProviderTests extends AbstractLdapServerTestCase
assertTrue(authorities.contains("ROLE_FROM_ENTRY")); assertTrue(authorities.contains("ROLE_FROM_ENTRY"));
assertTrue(authorities.contains("ROLE_FROM_POPULATOR")); assertTrue(authorities.contains("ROLE_FROM_POPULATOR"));
ldapProvider.additionalAuthenticationChecks(user, token); ldapProvider.additionalAuthenticationChecks(user, authRequest);
}
public void testDifferentCacheValueCausesException() {
LdapAuthenticationProvider ldapProvider
= new LdapAuthenticationProvider(new MockAuthenticator(), new MockAuthoritiesPopulator());
UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken("bob","bobspassword");
// User is authenticated here
UserDetails user = ldapProvider.retrieveUser("bob", authRequest);
// Assume the user details object is cached...
// And a subsequent authentication request comes in on the cached data
authRequest = new UsernamePasswordAuthenticationToken("bob","wrongpassword");
try {
ldapProvider.additionalAuthenticationChecks(user, authRequest);
fail("Expected BadCredentialsException should have failed with wrong password");
} catch(BadCredentialsException expected) {
}
} }
public void testEmptyOrNullUserNameThrowsException() { public void testEmptyOrNullUserNameThrowsException() {