inteligr8/alfresco-community-repo
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-community-repo.git synced 2025-08-07 17:49:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merged HEAD-QA to HEAD (4.2) (including moving test classes into separate folders)

Browse Source 
51903 to 54309 


git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@54310 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
This commit is contained in:
Samuel Langlois
2013-08-20 17:17:31 +00:00
parent 0a36e2af67
commit ab4ca7177f
1576 changed files with 36419 additions and 8603 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
source/java/org/alfresco/repo/security/authentication/AuthenticationBootstrapTest.java
View File

@@ -1,50 +0,0 @@
/*
* Copyright (C) 2005-2010 Alfresco Software Limited.
*
* This file is part of Alfresco
*
* Alfresco is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Alfresco is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
*/
package org.alfresco.repo.security.authentication;
import org.alfresco.util.ApplicationContextHelper;
import junit.framework.TestCase;
/**
* Checks that no residual authentications are left over after bootstrap. It is important that
* this test run on its own and not part of a suite.
*
* @author Derek Hulley
* @since 3.0.1
*/
public class AuthenticationBootstrapTest extends TestCase
{
/**
* Creates the application context in the context of the test (not statically) and checks
* that no residual authentication is left hanging around.
*/
public void testBootstrap()
{
// Start the context
ApplicationContextHelper.getApplicationContext();
String user = AuthenticationUtil.getFullyAuthenticatedUser();
assertNull(
"Found user '" + user + "' still authenticated after bootstrap.\n" +
"Use AuthenticationUtil.runAs or AuthenticationUtil.pushAuthentication " +
"and AuthenticationUtil.popAuthentication to keep the thread clean of unwanted authentication tokens.",
user);
}
}

5
source/java/org/alfresco/repo/security/authentication/AuthenticationComponentImpl.java
View File

@@ -31,6 +31,7 @@ import net.sf.acegisecurity.providers.UsernamePasswordAuthenticationToken;
import org.alfresco.error.AlfrescoRuntimeException;
import org.alfresco.repo.security.authentication.ntlm.NLTMAuthenticator;
import org.alfresco.repo.tenant.TenantDisabledException;
import org.alfresco.repo.tenant.TenantUtil;
import org.alfresco.repo.tenant.TenantUtil.TenantRunAsWork;
import org.alfresco.repo.tenant.TenantContextHolder;
@@ -110,6 +111,10 @@ public class AuthenticationComponentImpl extends AbstractAuthenticationComponent
TenantContextHolder.setTenantDomain(tenantDomain);
}
catch (TenantDisabledException tde)
{
throw new AuthenticationException(tde.getMessage(), tde);
}
catch (net.sf.acegisecurity.AuthenticationException ae)
{
// This is a bit gross, I admit, but when LDAP is

1665
source/java/org/alfresco/repo/security/authentication/AuthenticationTest.java
View File

File diff suppressed because it is too large Load Diff

96
source/java/org/alfresco/repo/security/authentication/AuthorizationTest.java
View File

@@ -1,96 +0,0 @@
/*
* Copyright (C) 2005-2010 Alfresco Software Limited.
*
* This file is part of Alfresco
*
* Alfresco is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Alfresco is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
*/
package org.alfresco.repo.security.authentication;
import junit.framework.TestCase;
/**
* Test Authorization
*/
public class AuthorizationTest extends TestCase
{
private static String USER = "user";
private static String PASSWORD = "pass";
public void testInvalidAuthorization()
{
try
{
new Authorization(null);
fail();
}
catch(IllegalArgumentException e)
{
}
try
{
new Authorization("");
fail();
}
catch(IllegalArgumentException e)
{
}
}
public void testAuthorization()
{
Authorization auth1 = new Authorization(USER, PASSWORD);
assertUserPass(USER, PASSWORD, auth1);
Authorization auth2 = new Authorization("", PASSWORD);
assertTicket("", PASSWORD, auth2);
Authorization auth3 = new Authorization(null, PASSWORD);
assertTicket(null, PASSWORD, auth3);
Authorization auth4 = new Authorization(Authorization.TICKET_USERID, PASSWORD);
assertTicket(Authorization.TICKET_USERID, PASSWORD, auth4);
Authorization auth5 = new Authorization(Authorization.TICKET_USERID.toLowerCase(), PASSWORD);
assertTicket(Authorization.TICKET_USERID.toLowerCase(), PASSWORD, auth5);
}
public void testUserPass()
{
Authorization auth1 = new Authorization(USER + ":" + PASSWORD);
assertUserPass(USER, PASSWORD, auth1);
Authorization auth2 = new Authorization(":" + PASSWORD);
assertTicket("", PASSWORD, auth2);
Authorization auth3 = new Authorization(PASSWORD);
assertTicket(null, PASSWORD, auth3);
Authorization auth4 = new Authorization(Authorization.TICKET_USERID + ":" + PASSWORD);
assertTicket(Authorization.TICKET_USERID, PASSWORD, auth4);
Authorization auth5 = new Authorization(Authorization.TICKET_USERID.toLowerCase() + ":" + PASSWORD);
assertTicket(Authorization.TICKET_USERID.toLowerCase(), PASSWORD, auth5);
}
private void assertUserPass(String user, String pass, Authorization auth)
{
assertEquals(user, auth.getUserName());
assertEquals(pass, auth.getPassword());
assertFalse(auth.isTicket());
assertNull(auth.getTicket());
}
private void assertTicket(String user, String pass, Authorization auth)
{
assertEquals(user, auth.getUserName());
assertEquals(pass, auth.getPassword());
assertTrue(auth.isTicket());
assertEquals(pass, auth.getTicket());
}
}

701
source/java/org/alfresco/repo/security/authentication/ChainingAuthenticationServiceTest.java
View File

@@ -1,701 +0,0 @@
/*
* Copyright (C) 2005-2010 Alfresco Software Limited.
*
* This file is part of Alfresco
*
* Alfresco is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Alfresco is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
*/
package org.alfresco.repo.security.authentication;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.HashSet;
import junit.framework.TestCase;
import org.alfresco.error.AlfrescoRuntimeException;
import org.alfresco.repo.transaction.AlfrescoTransactionSupport;
import org.alfresco.repo.transaction.AlfrescoTransactionSupport.TxnReadState;
import org.alfresco.service.cmr.security.AuthenticationService;
public class ChainingAuthenticationServiceTest extends TestCase
{
private static final String EMPTY = "Empty";
private static final String FIVE_AND_MORE = "FiveAndMore";
private static final String FIVE = "Five";
private static final String LONELY_DISABLE = "LonelyDisable";
private static final String LONELY_ENABLED = "LonelyEnabled";
private static final String ALFRESCO = "Alfresco";
TestAuthenticationServiceImpl service1;
TestAuthenticationServiceImpl service2;
TestAuthenticationServiceImpl service3;
TestAuthenticationServiceImpl service4;
TestAuthenticationServiceImpl service5;
private TestAuthenticationServiceImpl service6;
public ChainingAuthenticationServiceTest()
{
super();
}
public ChainingAuthenticationServiceTest(String arg0)
{
super(arg0);
}
@Override
protected void setUp() throws Exception
{
if (AlfrescoTransactionSupport.getTransactionReadState() != TxnReadState.TXN_NONE)
{
throw new AlfrescoRuntimeException(
"A previous tests did not clean up transaction: " +
AlfrescoTransactionSupport.getTransactionId());
}
AuthenticationUtil authUtil = new AuthenticationUtil();
authUtil.setDefaultAdminUserName("admin");
authUtil.setDefaultGuestUserName("guest");
authUtil.afterPropertiesSet();
service1 = new TestAuthenticationServiceImpl(ALFRESCO, true, true, true, false);
service1.createAuthentication("andy", "andy".toCharArray());
HashMap<String, String> up = new HashMap<String, String>();
HashSet<String> disabled = new HashSet<String>();
up.put("lone", "lone");
service2 = new TestAuthenticationServiceImpl(LONELY_ENABLED, false, false, false, true, up, disabled);
up.clear();
disabled.clear();
up.put("ranger", "ranger");
disabled.add("ranger");
service3 = new TestAuthenticationServiceImpl(LONELY_DISABLE, false, false, false, false, up, disabled);
service4 = new TestAuthenticationServiceImpl(EMPTY, true, true, true, false);
up.clear();
disabled.clear();
up.put("A", "A");
up.put("B", "B");
up.put("C", "C");
up.put("D", "D");
up.put("E", "E");
service5 = new TestAuthenticationServiceImpl(FIVE, false, false, false, false, up, disabled);
up.clear();
disabled.clear();
up.put("A", "a");
up.put("B", "b");
up.put("C", "c");
up.put("D", "d");
up.put("E", "e");
up.put("F", "f");
up.put("G", "g");
up.put("H", "h");
up.put("I", "i");
up.put("J", "j");
up.put("K", "k");
service6 = new TestAuthenticationServiceImpl(FIVE_AND_MORE, false, false, false, false, up, disabled);
}
//
// Single service test
//
public void testServiceOne_Auth()
{
ChainingAuthenticationServiceImpl as = new ChainingAuthenticationServiceImpl();
ArrayList<AuthenticationService> ases = new ArrayList<AuthenticationService>();
ases.add(service1);
as.setAuthenticationServices(ases);
as.authenticate("andy", "andy".toCharArray());
assertEquals(as.getCurrentUserName(), "andy");
}
public void testServiceOne_AuthFail()
{
ChainingAuthenticationServiceImpl as = new ChainingAuthenticationServiceImpl();
ArrayList<AuthenticationService> ases = new ArrayList<AuthenticationService>();
ases.add(service1);
as.setAuthenticationServices(ases);
try
{
as.authenticate("andy", "woof".toCharArray());
fail();
}
catch (AuthenticationException e)
{
}
}
public void testServiceOne_GuestDenied()
{
ChainingAuthenticationServiceImpl as = new ChainingAuthenticationServiceImpl();
ArrayList<AuthenticationService> ases = new ArrayList<AuthenticationService>();
ases.add(service1);
as.setAuthenticationServices(ases);
try
{
as.authenticateAsGuest();
fail();
}
catch (AuthenticationException e)
{
}
}
public void testServiceTwo_GuestAllowed()
{
ChainingAuthenticationServiceImpl as = new ChainingAuthenticationServiceImpl();
ArrayList<AuthenticationService> ases = new ArrayList<AuthenticationService>();
ases.add(service2);
as.setAuthenticationServices(ases);
as.authenticateAsGuest();
assertEquals(as.getCurrentUserName(), AuthenticationUtil.getGuestUserName());
as.clearCurrentSecurityContext();
assertNull(as.getCurrentUserName());
}
public void testServiceOne_CRUD_Fails()
{
ChainingAuthenticationServiceImpl as = new ChainingAuthenticationServiceImpl();
ArrayList<AuthenticationService> ases = new ArrayList<AuthenticationService>();
ases.add(service1);
as.setAuthenticationServices(ases);
try
{
as.authenticate("bob", "bob".toCharArray());
fail();
}
catch (AuthenticationException e)
{
}
try
{
as.createAuthentication("bob", "bob".toCharArray());
fail();
}
catch (AuthenticationException e)
{
}
}
public void testServiceOne_CRUD()
{
ChainingAuthenticationServiceImpl as = new ChainingAuthenticationServiceImpl();
as.setMutableAuthenticationService(service1);
try
{
as.authenticate("bob", "bob".toCharArray());
fail();
}
catch (AuthenticationException e)
{
}
as.createAuthentication("bob", "bob".toCharArray());
as.authenticate("bob", "bob".toCharArray());
as.updateAuthentication("bob", "bob".toCharArray(), "carol".toCharArray());
try
{
as.authenticate("bob", "bob".toCharArray());
fail();
}
catch (AuthenticationException e)
{
}
as.authenticate("bob", "carol".toCharArray());
as.deleteAuthentication("bob");
try
{
as.authenticate("bob", "carol".toCharArray());
fail();
}
catch (AuthenticationException e)
{
}
}
public void testServiceOne_Enabled()
{
ChainingAuthenticationServiceImpl as = new ChainingAuthenticationServiceImpl();
as.setMutableAuthenticationService(service1);
assertTrue(as.getAuthenticationEnabled("andy"));
as.setAuthenticationEnabled("andy", false);
assertFalse(as.getAuthenticationEnabled("andy"));
as.setAuthenticationEnabled("andy", true);
assertTrue(as.getAuthenticationEnabled("andy"));
as.authenticate("andy", "andy".toCharArray());
as.setAuthenticationEnabled("andy", false);
assertFalse(as.getAuthenticationEnabled("andy"));
try
{
as.authenticate("andy", "andy".toCharArray());
fail();
}
catch (AuthenticationException e)
{
}
}
public void testServiceOneDomains()
{
ChainingAuthenticationServiceImpl as = new ChainingAuthenticationServiceImpl();
as.setMutableAuthenticationService(service1);
HashSet<String> testDomains = new HashSet<String>();
testDomains.add(ALFRESCO);
assertTrue(as.getDomains().equals(testDomains));
assertTrue(as.getDomainsThatAllowUserCreation().equals(testDomains));
assertTrue(as.getDomainsThatAllowUserDeletion().equals(testDomains));
assertTrue(as.getDomiansThatAllowUserPasswordChanges().equals(testDomains));
assertTrue(as.getDomains().equals(service1.getDomains()));
assertTrue(as.getDomainsThatAllowUserCreation().equals(service1.getDomainsThatAllowUserCreation()));
assertTrue(as.getDomainsThatAllowUserDeletion().equals(service1.getDomainsThatAllowUserDeletion()));
assertTrue(as.getDomiansThatAllowUserPasswordChanges()
.equals(service1.getDomiansThatAllowUserPasswordChanges()));
}
public void testServiceOneTickets()
{
ChainingAuthenticationServiceImpl as = new ChainingAuthenticationServiceImpl();
as.setMutableAuthenticationService(service1);
as.authenticate("andy", "andy".toCharArray());
String ticket = as.getCurrentTicket();
assertTrue(ticket == as.getCurrentTicket());
as.validate(ticket);
as.invalidateTicket(ticket);
try
{
as.validate(ticket);
fail();
}
catch (AuthenticationException e)
{
}
ticket = as.getCurrentTicket();
as.validate(ticket);
as.invalidateUserSession("andy");
try
{
as.validate(ticket);
fail();
}
catch (AuthenticationException e)
{
}
}
//
// Multi service tests
//
public void testAll_Auth()
{
ChainingAuthenticationServiceImpl as = new ChainingAuthenticationServiceImpl();
ArrayList<AuthenticationService> ases = new ArrayList<AuthenticationService>();
ases.add(service2);
ases.add(service3);
ases.add(service4);
ases.add(service5);
ases.add(service6);
as.setAuthenticationServices(ases);
as.setMutableAuthenticationService(service1);
as.authenticate("andy", "andy".toCharArray());
assertEquals(as.getCurrentUserName(), "andy");
as.authenticate("lone", "lone".toCharArray());
try
{
as.authenticate("ranger", "ranger".toCharArray());
fail();
}
catch (AuthenticationException e)
{
}
as.authenticate("A", "A".toCharArray());
as.authenticate("B", "B".toCharArray());
as.authenticate("C", "C".toCharArray());
as.authenticate("D", "D".toCharArray());
as.authenticate("E", "E".toCharArray());
as.authenticate("A", "a".toCharArray());
as.authenticate("B", "b".toCharArray());
as.authenticate("C", "c".toCharArray());
as.authenticate("D", "d".toCharArray());
as.authenticate("E", "e".toCharArray());
as.authenticate("F", "f".toCharArray());
as.authenticate("G", "g".toCharArray());
as.authenticate("H", "h".toCharArray());
as.authenticate("I", "i".toCharArray());
as.authenticate("J", "j".toCharArray());
as.authenticate("K", "k".toCharArray());
}
public void testAll_AuthOverLapReversed()
{
ChainingAuthenticationServiceImpl as = new ChainingAuthenticationServiceImpl();
ArrayList<AuthenticationService> ases = new ArrayList<AuthenticationService>();
ases.add(service2);
ases.add(service3);
ases.add(service4);
ases.add(service6);
ases.add(service5);
as.setAuthenticationServices(ases);
as.setMutableAuthenticationService(service1);
as.authenticate("andy", "andy".toCharArray());
assertEquals(as.getCurrentUserName(), "andy");
as.authenticate("lone", "lone".toCharArray());
try
{
as.authenticate("ranger", "ranger".toCharArray());
fail();
}
catch (AuthenticationException e)
{
}
try
{
as.authenticate("A", "B".toCharArray());
fail();
}
catch (AuthenticationException e)
{
}
as.authenticate("A", "A".toCharArray());
as.authenticate("B", "B".toCharArray());
as.authenticate("C", "C".toCharArray());
as.authenticate("D", "D".toCharArray());
as.authenticate("E", "E".toCharArray());
as.authenticate("A", "a".toCharArray());
as.authenticate("B", "b".toCharArray());
as.authenticate("C", "c".toCharArray());
as.authenticate("D", "d".toCharArray());
as.authenticate("E", "e".toCharArray());
as.authenticate("F", "f".toCharArray());
as.authenticate("G", "g".toCharArray());
as.authenticate("H", "h".toCharArray());
as.authenticate("I", "i".toCharArray());
as.authenticate("J", "j".toCharArray());
as.authenticate("K", "k".toCharArray());
}
public void testAll_MutAuth()
{
ChainingAuthenticationServiceImpl as = new ChainingAuthenticationServiceImpl();
ArrayList<AuthenticationService> ases = new ArrayList<AuthenticationService>();
ases.add(service2);
ases.add(service3);
ases.add(service4);
ases.add(service5);
ases.add(service6);
as.setAuthenticationServices(ases);
as.setMutableAuthenticationService(service1);
as.authenticate("andy", "andy".toCharArray());
assertEquals(as.getCurrentUserName(), "andy");
as.authenticate("lone", "lone".toCharArray());
try
{
as.authenticate("ranger", "ranger".toCharArray());
fail();
}
catch (AuthenticationException e)
{
}
as.authenticate("A", "A".toCharArray());
as.authenticate("B", "B".toCharArray());
as.authenticate("C", "C".toCharArray());
as.authenticate("D", "D".toCharArray());
as.authenticate("E", "E".toCharArray());
as.authenticate("A", "a".toCharArray());
as.authenticate("B", "b".toCharArray());
as.authenticate("C", "c".toCharArray());
as.authenticate("D", "d".toCharArray());
as.authenticate("E", "e".toCharArray());
as.authenticate("F", "f".toCharArray());
as.authenticate("G", "g".toCharArray());
as.authenticate("H", "h".toCharArray());
as.authenticate("I", "i".toCharArray());
as.authenticate("J", "j".toCharArray());
as.authenticate("K", "k".toCharArray());
as.createAuthentication("A", "woof".toCharArray());
as.authenticate("A", "woof".toCharArray());
as.updateAuthentication("A", "woof".toCharArray(), "bark".toCharArray());
as.authenticate("A", "bark".toCharArray());
as.setAuthentication("A", "tree".toCharArray());
as.authenticate("A", "tree".toCharArray());
as.deleteAuthentication("A");
as.authenticate("A", "A".toCharArray());
as.authenticate("A", "a".toCharArray());
try
{
as.authenticate("A", "woof".toCharArray());
fail();
}
catch (AuthenticationException e)
{
}
try
{
as.authenticate("A", "bark".toCharArray());
fail();
}
catch (AuthenticationException e)
{
}
try
{
as.authenticate("A", "tree".toCharArray());
fail();
}
catch (AuthenticationException e)
{
}
}
public void testAll_AuthEnabled()
{
ChainingAuthenticationServiceImpl as = new ChainingAuthenticationServiceImpl();
ArrayList<AuthenticationService> ases = new ArrayList<AuthenticationService>();
ases.add(service2);
ases.add(service3);
ases.add(service4);
ases.add(service5);
ases.add(service6);
as.setAuthenticationServices(ases);
as.setMutableAuthenticationService(service1);
assertTrue(as.getAuthenticationEnabled("andy"));
assertTrue(as.getAuthenticationEnabled("lone"));
assertFalse(as.getAuthenticationEnabled("ranger"));
assertTrue(as.getAuthenticationEnabled("A"));
assertTrue(as.getAuthenticationEnabled("B"));
assertTrue(as.getAuthenticationEnabled("C"));
assertTrue(as.getAuthenticationEnabled("D"));
assertTrue(as.getAuthenticationEnabled("E"));
assertTrue(as.getAuthenticationEnabled("F"));
assertTrue(as.getAuthenticationEnabled("G"));
assertTrue(as.getAuthenticationEnabled("H"));
assertTrue(as.getAuthenticationEnabled("I"));
assertTrue(as.getAuthenticationEnabled("J"));
assertTrue(as.getAuthenticationEnabled("K"));
as.setAuthenticationEnabled("andy", false);
assertFalse(as.getAuthenticationEnabled("andy"));
as.setAuthenticationEnabled("andy", true);
assertTrue(as.getAuthenticationEnabled("andy"));
as.setAuthenticationEnabled("andy", false);
try
{
as.authenticate("andy", "andy".toCharArray());
fail();
}
catch (AuthenticationException e)
{
}
}
public void testService_GuestDenied()
{
ChainingAuthenticationServiceImpl as = new ChainingAuthenticationServiceImpl();
ArrayList<AuthenticationService> ases = new ArrayList<AuthenticationService>();
ases.add(service1);
ases.add(service3);
ases.add(service4);
ases.add(service5);
ases.add(service6);
as.setAuthenticationServices(ases);
try
{
as.authenticateAsGuest();
fail();
}
catch (AuthenticationException e)
{
}
}
public void testService_GuestAllowed()
{
ChainingAuthenticationServiceImpl as = new ChainingAuthenticationServiceImpl();
ArrayList<AuthenticationService> ases = new ArrayList<AuthenticationService>();
ases.add(service1);
ases.add(service2);
ases.add(service3);
ases.add(service4);
ases.add(service5);
ases.add(service6);
as.setAuthenticationServices(ases);
as.authenticateAsGuest();
assertEquals(as.getCurrentUserName(), AuthenticationUtil.getGuestUserName());
as.clearCurrentSecurityContext();
assertNull(as.getCurrentUserName());
}
public void testService_NoGuestConfigured() throws Exception
{
ChainingAuthenticationServiceImpl as = new ChainingAuthenticationServiceImpl();
ArrayList<AuthenticationService> ases = new ArrayList<AuthenticationService>();
ases.add(service2);
as.setAuthenticationServices(ases);
assertNotNull(AuthenticationUtil.getGuestUserName());
as.authenticateAsGuest();
assertEquals(as.getCurrentUserName(), AuthenticationUtil.getGuestUserName());
as.clearCurrentSecurityContext();
assertNull(as.getCurrentUserName());
AuthenticationUtil authUtil = new AuthenticationUtil();
authUtil.setDefaultAdminUserName("admin");
authUtil.setDefaultGuestUserName(null);
authUtil.afterPropertiesSet();
try
{
as.authenticateAsGuest();
fail("Guest authentication should not be supported");
}
catch (AuthenticationException ae)
{
// expected
assertTrue(ae.getMessage().contains(AbstractAuthenticationService.GUEST_AUTHENTICATION_NOT_SUPPORTED));
}
assertNull(as.getCurrentUserName());
}
public void testService_Domains()
{
ChainingAuthenticationServiceImpl as = new ChainingAuthenticationServiceImpl();
ArrayList<AuthenticationService> ases = new ArrayList<AuthenticationService>();
ases.add(service2);
ases.add(service3);
ases.add(service4);
ases.add(service5);
ases.add(service6);
as.setAuthenticationServices(ases);
as.setMutableAuthenticationService(service1);
HashSet<String> testDomains = new HashSet<String>();
testDomains.add(ALFRESCO);
testDomains.add(LONELY_ENABLED);
testDomains.add(LONELY_DISABLE);
testDomains.add(EMPTY);
testDomains.add(FIVE);
testDomains.add(FIVE_AND_MORE);
HashSet<String> onlyAlfDomain = new HashSet<String>();
onlyAlfDomain.add(ALFRESCO);
assertTrue(as.getDomains().equals(testDomains));
assertTrue(as.getDomainsThatAllowUserCreation().equals(onlyAlfDomain));
assertTrue(as.getDomainsThatAllowUserDeletion().equals(onlyAlfDomain));
assertTrue(as.getDomiansThatAllowUserPasswordChanges().equals(onlyAlfDomain));
}
public void testServiceTickets()
{
ChainingAuthenticationServiceImpl as = new ChainingAuthenticationServiceImpl();
ArrayList<AuthenticationService> ases = new ArrayList<AuthenticationService>();
ases.add(service2);
ases.add(service3);
ases.add(service4);
ases.add(service5);
ases.add(service6);
as.setAuthenticationServices(ases);
as.setMutableAuthenticationService(service1);
as.authenticate("andy", "andy".toCharArray());
String ticket = as.getCurrentTicket();
assertTrue(ticket == as.getCurrentTicket());
as.validate(ticket);
as.invalidateTicket(ticket);
try
{
as.validate(ticket);
fail();
}
catch (AuthenticationException e)
{
}
ticket = as.getCurrentTicket();
as.validate(ticket);
as.invalidateUserSession("andy");
try
{
as.validate(ticket);
fail();
}
catch (AuthenticationException e)
{
}
}
}

89
source/java/org/alfresco/repo/security/authentication/NameBasedUserNameGeneratorTest.java
View File

@@ -1,89 +0,0 @@
/*
* Copyright (C) 2005-2010 Alfresco Software Limited.
*
* This file is part of Alfresco
*
* Alfresco is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Alfresco is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
*/
package org.alfresco.repo.security.authentication;
import junit.framework.TestCase;
public class NameBasedUserNameGeneratorTest extends TestCase
{
public void testGenerate()
{
NameBasedUserNameGenerator generator = new NameBasedUserNameGenerator();
generator.setUserNameLength(10);
generator.setNamePattern("%firstName%_%lastName%");
String firstName = "Buffy";
String lastName = "Summers";
String emailAddress = "buffy@sunnydale.com";
// should generate buffy_summers
String userName = generator.generateUserName(firstName, lastName, emailAddress, 0);
assertEquals("", (firstName + "_" + lastName).toLowerCase(), userName);
// should generate something different from above since seed > 0
userName = generator.generateUserName(firstName, lastName, emailAddress, 1);
assertEquals("", (firstName + "_" + lastName).toLowerCase().substring(0,7), userName.substring(0,7));
assertTrue("", !(firstName + "_" + lastName).toLowerCase().equals(userName));
// should generate buffy_summers@sunnydale.com
generator.setNamePattern("%emailAddress%");
userName = generator.generateUserName(firstName, lastName, emailAddress, 0);
assertEquals(emailAddress.toLowerCase(), userName);
// should generate buffy_s123
userName = generator.generateUserName(firstName, lastName, emailAddress, 1);
assertTrue("", !(emailAddress).toLowerCase().equals(userName));
// should generate summers.buffy
generator.setNamePattern("%lastName%.%firstName%");
userName = generator.generateUserName(firstName, lastName, emailAddress, 0);
assertEquals("", (lastName + "." + firstName).toLowerCase(), userName);
// should generate bsummers
generator.setNamePattern("%i%%lastName%");
userName = generator.generateUserName(firstName, lastName, emailAddress, 0);
assertEquals("", ("bsummers").toLowerCase(), userName);
}
public void testGenerateWhitespaceNames() throws Exception
{
NameBasedUserNameGenerator generator = new NameBasedUserNameGenerator();
generator.setUserNameLength(10);
generator.setNamePattern("%firstName%_%lastName%");
String lastName = "bar";
assertEquals("f_oo_bar", generator.generateUserName(" f oo ", lastName, "", 0));
assertEquals("f_o_o_bar", generator.generateUserName("f o o", lastName, "", 0));
assertEquals("f_o_o_bar", generator.generateUserName("f\to\t o", lastName, "", 0));
assertEquals("f_o_o_bar", generator.generateUserName("f\no \no", lastName, "", 0));
assertEquals("f_o_o_bar", generator.generateUserName("f\ro\r\no", lastName, "", 0));
}
public void testAccentedCharsInNames() throws Exception
{
NameBasedUserNameGenerator generator = new NameBasedUserNameGenerator();
generator.setUserNameLength(10);
generator.setNamePattern("%firstName%_%lastName%");
String firstName = "Çüéâäà çêëèï";
String lastName = "îìÄÅÉæÆô öòû";
String username = generator.generateUserName(firstName, lastName, "", 0);
assertEquals("cueaaa_ceeei_iiaaeo_oou", username);
}
}

8
source/java/org/alfresco/repo/security/authentication/RepositoryAuthenticationDao.java
View File

@@ -80,7 +80,7 @@ public class RepositoryAuthenticationDao implements MutableAuthenticationDao, In
private TransactionService transactionService;
// note: caches are tenant-aware (if using EhCacheAdapter shared cache)
// note: cache is tenant-aware (if using TransctionalCache impl)
private SimpleCache<String, NodeRef> singletonCache; // eg. for user folder nodeRef
private final String KEY_USERFOLDER_NODEREF = "key.userfolder.noderef";
@@ -294,7 +294,8 @@ public class RepositoryAuthenticationDao implements MutableAuthenticationDao, In
QName qnameAssocSystem = QName.createQName("sys", "system", namespacePrefixResolver);
QName qnameAssocUsers = QName.createQName("sys", "people", namespacePrefixResolver);
StoreRef userStoreRef = tenantService.getName(caseSensitiveUserName, new StoreRef(STOREREF_USERS.getProtocol(), STOREREF_USERS.getIdentifier()));
//StoreRef userStoreRef = tenantService.getName(caseSensitiveUserName, new StoreRef(STOREREF_USERS.getProtocol(), STOREREF_USERS.getIdentifier()));
StoreRef userStoreRef = new StoreRef(STOREREF_USERS.getProtocol(), STOREREF_USERS.getIdentifier());
// AR-527
NodeRef rootNode = nodeService.getRootNode(userStoreRef);
@@ -788,8 +789,9 @@ public class RepositoryAuthenticationDao implements MutableAuthenticationDao, In
}
}
static class CacheEntry
static class CacheEntry implements Serializable
{
private static final long serialVersionUID = 1L;
public NodeRef nodeRef;
public UserDetails userDetails;
public Date credentialExpiryDate;

490
source/java/org/alfresco/repo/security/authentication/TestAuthenticationServiceImpl.java
View File

@@ -1,490 +0,0 @@
/*
* Copyright (C) 2005-2010 Alfresco Software Limited.
*
* This file is part of Alfresco
*
* Alfresco is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Alfresco is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
*/
package org.alfresco.repo.security.authentication;
import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;
import net.sf.acegisecurity.Authentication;
import net.sf.acegisecurity.GrantedAuthority;
import net.sf.acegisecurity.GrantedAuthorityImpl;
import net.sf.acegisecurity.UserDetails;
import net.sf.acegisecurity.context.Context;
import net.sf.acegisecurity.context.ContextHolder;
import net.sf.acegisecurity.context.security.SecureContext;
import net.sf.acegisecurity.context.security.SecureContextImpl;
import net.sf.acegisecurity.providers.UsernamePasswordAuthenticationToken;
import net.sf.acegisecurity.providers.dao.User;
import org.alfresco.service.cmr.security.MutableAuthenticationService;
import org.alfresco.util.EqualsHelper;
import org.alfresco.util.GUID;
public class TestAuthenticationServiceImpl implements MutableAuthenticationService
{
private Map<String, String> userNamesAndPasswords = new HashMap<String, String>();
private Set<String> disabledUsers = new HashSet<String>();
private Map<String, String> userToTicket = new HashMap<String, String>();
String domain;
boolean allowCreate;
boolean allowDelete;
boolean allowUpdate;
boolean allowGuest;
public TestAuthenticationServiceImpl(String domain, boolean allowCreate, boolean allowDelete, boolean allowUpdate, boolean allowGuest)
{
super();
this.domain = domain;
this.allowCreate = allowCreate;
this.allowDelete = allowDelete;
this.allowUpdate = allowUpdate;
this.allowGuest = allowGuest;
}
public TestAuthenticationServiceImpl(String domain, boolean allowCreate, boolean allowDelete, boolean allowUpdate, boolean allowGuest,
Map<String, String> users, Set<String> disabled)
{
this(domain, allowCreate, allowDelete, allowUpdate, allowGuest);
if (users != null)
{
userNamesAndPasswords.putAll(users);
}
if (disabled != null)
{
disabledUsers.addAll(disabled);
}
}
public void createAuthentication(String userName, char[] password) throws AuthenticationException
{
if (!allowCreate)
{
throw new AuthenticationException("Create not allowed");
}
if (userNamesAndPasswords.containsKey(userName))
{
throw new AuthenticationException("User exists");
}
else
{
userNamesAndPasswords.put(userName, new String(password));
}
}
public void updateAuthentication(String userName, char[] oldPassword, char[] newPassword)
throws AuthenticationException
{
if (!allowUpdate)
{
throw new AuthenticationException("Update not allowed");
}
if (!userNamesAndPasswords.containsKey(userName))
{
throw new AuthenticationException("User does not exist");
}
else
{
if (userNamesAndPasswords.get(userName).equals(new String(oldPassword)))
{
userNamesAndPasswords.put(userName, new String(newPassword));
}
else
{
throw new AuthenticationException("Password does not match existing");
}
}
}
public void setAuthentication(String userName, char[] newPassword) throws AuthenticationException
{
if (!allowUpdate)
{
throw new AuthenticationException("Update not allowed");
}
if (!userNamesAndPasswords.containsKey(userName))
{
throw new AuthenticationException("User does not exist");
}
else
{
userNamesAndPasswords.put(userName, new String(newPassword));
}
}
public void deleteAuthentication(String userName) throws AuthenticationException
{
if (!allowDelete)
{
throw new AuthenticationException("Delete not allowed");
}
if (!userNamesAndPasswords.containsKey(userName))
{
throw new AuthenticationException("User does not exist");
}
else
{
userNamesAndPasswords.remove(userName);
}
}
public void setAuthenticationEnabled(String userName, boolean enabled) throws AuthenticationException
{
if (!allowUpdate)
{
throw new AuthenticationException("Update not allowed");
}
if (!userNamesAndPasswords.containsKey(userName))
{
throw new AuthenticationException("User does not exist");
}
else
{
if (enabled)
{
disabledUsers.remove(userName);
}
else
{
disabledUsers.add(userName);
}
}
}
public boolean getAuthenticationEnabled(String userName) throws AuthenticationException
{
if (!userNamesAndPasswords.containsKey(userName))
{
return false;
}
else
{
return !disabledUsers.contains(userName);
}
}
public void authenticate(String userName, char[] password) throws AuthenticationException
{
if (!userNamesAndPasswords.containsKey(userName))
{
throw new AuthenticationException("User does not exist");
}
else if (disabledUsers.contains(userName))
{
throw new AuthenticationException("User disabled0");
}
else
{
if (userNamesAndPasswords.get(userName).equals(new String(password)))
{
setCurrentUser(userName);
}
else
{
throw new AuthenticationException("Unknown user/password");
}
}
}
public void authenticateAsGuest() throws AuthenticationException
{
if (allowGuest)
{
setCurrentUser(AuthenticationUtil.getGuestUserName());
}
else
{
throw new AuthenticationException("Guest access denied");
}
}
public boolean guestUserAuthenticationAllowed()
{
return allowGuest;
}
public boolean authenticationExists(String userName)
{
return userNamesAndPasswords.containsKey(userName);
}
public boolean isAuthenticationMutable(String userName)
{
return authenticationExists(userName);
}
public boolean isAuthenticationCreationAllowed()
{
return allowCreate;
}
public String getCurrentUserName() throws AuthenticationException
{
Context context = ContextHolder.getContext();
if ((context == null) || !(context instanceof SecureContext))
{
return null;
}
return getUserName(((SecureContext) context).getAuthentication());
}
private String getUserName(Authentication authentication)
{
String username = authentication.getPrincipal().toString();
if (authentication.getPrincipal() instanceof UserDetails)
{
username = ((UserDetails) authentication.getPrincipal()).getUsername();
}
return username;
}
public void invalidateUserSession(String userName) throws AuthenticationException
{
userToTicket.remove(userName);
}
public void invalidateTicket(String ticket) throws AuthenticationException
{
String userToRemove = null;
for (String user : userToTicket.keySet())
{
String currentTicket = userToTicket.get(user);
if (EqualsHelper.nullSafeEquals(currentTicket, ticket))
{
userToRemove = user;
}
}
if (userToRemove != null)
{
userToTicket.remove(userToRemove);
}
}
public void validate(String ticket) throws AuthenticationException
{
String userToSet = null;
for (String user : userToTicket.keySet())
{
String currentTicket = userToTicket.get(user);
if (EqualsHelper.nullSafeEquals(currentTicket, ticket))
{
userToSet = user;
}
}
if (userToSet != null)
{
setCurrentUser(userToSet);
}
else
{
throw new AuthenticationException("Invalid ticket");
}
}
public String getCurrentTicket()
{
String currentUser = getCurrentUserName();
String ticket = userToTicket.get(currentUser);
if (ticket == null)
{
ticket = GUID.generate();
userToTicket.put(currentUser, ticket);
}
return ticket;
}
public String getNewTicket()
{
String currentUser = getCurrentUserName();
String ticket = userToTicket.get(currentUser);
if (ticket == null)
{
ticket = GUID.generate();
userToTicket.put(currentUser, ticket);
}
return ticket;
}
public void clearCurrentSecurityContext()
{
ContextHolder.setContext(null);
}
public boolean isCurrentUserTheSystemUser()
{
String userName = getCurrentUserName();
if ((userName != null) && userName.equals(SYSTEM_USER_NAME))
{
return true;
}
return false;
}
public Set<String> getDomains()
{
return Collections.singleton(domain);
}
public Set<String> getDomainsThatAllowUserCreation()
{
if (allowCreate)
{
return Collections.singleton(domain);
}
else
{
return Collections.<String> emptySet();
}
}
public Set<String> getDomainsThatAllowUserDeletion()
{
if (allowDelete)
{
return Collections.singleton(domain);
}
else
{
return Collections.<String> emptySet();
}
}
public Set<String> getDomiansThatAllowUserPasswordChanges()
{
if (allowUpdate)
{
return Collections.singleton(domain);
}
else
{
return Collections.<String> emptySet();
}
}
/**
* Explicitly set the current user to be authenticated.
*
* @param userName
* String
* @return Authentication
*/
public Authentication setCurrentUser(String userName) throws AuthenticationException
{
if (userName == null)
{
throw new AuthenticationException("Null user name");
}
try
{
UserDetails ud = null;
if (userName.equals(SYSTEM_USER_NAME))
{
GrantedAuthority[] gas = new GrantedAuthority[1];
gas[0] = new GrantedAuthorityImpl("ROLE_SYSTEM");
ud = new User(SYSTEM_USER_NAME, "", true, true, true, true, gas);
}
else if (userName.equalsIgnoreCase(AuthenticationUtil.getGuestUserName()))
{
GrantedAuthority[] gas = new GrantedAuthority[0];
ud = new User(AuthenticationUtil.getGuestUserName().toLowerCase(), "", true, true, true, true, gas);
}
else
{
ud = getUserDetails(userName);
}
UsernamePasswordAuthenticationToken auth = new UsernamePasswordAuthenticationToken(ud, "", ud
.getAuthorities());
auth.setDetails(ud);
auth.setAuthenticated(true);
return setCurrentAuthentication(auth);
}
catch (net.sf.acegisecurity.AuthenticationException ae)
{
throw new AuthenticationException(ae.getMessage(), ae);
}
}
/**
* Default implementation that makes an ACEGI object on the fly
*
* @param userName
* @return
*/
protected UserDetails getUserDetails(String userName)
{
GrantedAuthority[] gas = new GrantedAuthority[1];
gas[0] = new GrantedAuthorityImpl("ROLE_AUTHENTICATED");
UserDetails ud = new User(userName, "", true, true, true, true, gas);
return ud;
}
public Authentication setCurrentAuthentication(Authentication authentication)
{
Context context = ContextHolder.getContext();
SecureContext sc = null;
if ((context == null) || !(context instanceof SecureContext))
{
sc = new SecureContextImpl();
ContextHolder.setContext(sc);
}
else
{
sc = (SecureContext) context;
}
authentication.setAuthenticated(true);
sc.setAuthentication(authentication);
return authentication;
}
public Set<String> getDefaultAdministratorUserNames()
{
return Collections.singleton(AuthenticationUtil.getAdminUserName());
}
public Set<String> getDefaultGuestUserNames()
{
return Collections.singleton(AuthenticationUtil.getGuestUserName());
}
private static final String SYSTEM_USER_NAME = "System";
}

29
source/java/org/alfresco/repo/security/authentication/ldap/LDAPAuthenticationComponentImpl.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright (C) 2005-2010 Alfresco Software Limited.
* Copyright (C) 2005-2013 Alfresco Software Limited.
*
* This file is part of Alfresco
*
@@ -124,7 +124,13 @@ public class LDAPAuthenticationComponentImpl extends AbstractAuthenticationCompo
diagnostic.addStep(AuthenticationDiagnostic.STEP_KEY_LDAP_LOOKEDUP_USER, true, params);
}
else
// Otherwise, use the format, but disallow leading or trailing whitespace in the user ID as this can result in
// ghost users (MNT-2597)
{
if (!userName.equals(userName.trim()))
{
throw new AuthenticationException("Invalid user ID with leading or trailing whitespace");
}
// we are using a fixed name format,
userDN = String.format(
userNameFormat, new Object[]
@@ -191,4 +197,25 @@ public class LDAPAuthenticationComponentImpl extends AbstractAuthenticationCompo
{
return true;
}
private String id = "default";
/**
* Set the unique name of this ldap authentication component e.g. "managed,ldap1"
*
* @param id
*/
public void setId(String id)
{
this.id = id;
}
/**
* Get the unique name of this ldap authentication component e.g. "managed,ldap1";
* @return the unique name of this ldap authentication component
*/
String getId()
{
return id;
}
}

55
source/java/org/alfresco/repo/security/authentication/ldap/Monitor.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright (C) 2005-2012 Alfresco Software Limited.
* Copyright (C) 2013-2013 Alfresco Software Limited.
*
* This file is part of Alfresco
*
@@ -18,6 +18,7 @@
*/
package org.alfresco.repo.security.authentication.ldap;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;
@@ -33,6 +34,7 @@ import javax.management.openmbean.TabularType;
import org.alfresco.repo.security.authentication.AuthenticationException;
import org.alfresco.repo.security.authentication.AuthenticationStep;
import org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizerStatus;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
@@ -44,6 +46,8 @@ import org.apache.commons.logging.LogFactory;
public class Monitor
{
LDAPAuthenticationComponentImpl component;
ChainingUserRegistrySynchronizerStatus syncMonitor;
String id;
private static Log logger = LogFactory.getLog(Monitor.class);
@@ -52,11 +56,11 @@ public class Monitor
this.component = component;
}
public String getAuthenticatorType()
public void setChainingUserRegistrySynchronizerStatus(ChainingUserRegistrySynchronizerStatus syncStatus)
{
return "ldap";
this.syncMonitor = syncStatus;
}
/**
* test authenticate
*
@@ -138,4 +142,47 @@ public class Monitor
{
return component.getNumberSuccessfulAuthentications();
}
public String getSynchronizationStatus()
{
return syncMonitor.getSynchronizationStatus(getZone(component.getId()));
}
public Date getSynchronizationLastUserUpdateTime()
{
return syncMonitor.getSynchronizationLastUserUpdateTime(getZone(component.getId()));
}
public Date getSynchronizationLastGroupUpdateTime()
{
return syncMonitor.getSynchronizationLastGroupUpdateTime(getZone(component.getId()));
}
public String getSynchronizationLastError()
{
return syncMonitor.getSynchronizationLastError(getZone(component.getId()));
}
public String getSynchronizationSummary()
{
return syncMonitor.getSynchronizationSummary(getZone(component.getId()));
}
/**
* Get the zone for an ldap authentication component. e.g given [managed,ldap1] return ldap1
* @param id ths id of the subsystem
* @return the zone
*/
private String getZone(String id)
{
String s = id.replace("[", "");
String s2 = s.replace("]", "");
String[] ids = s2.split(",");
String x = ids[ids.length -1].trim();
return x;
}
}

239
source/java/org/alfresco/repo/security/authentication/ntlm/NTLMAuthenticationComponentImpl.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright (C) 2005-2010 Alfresco Software Limited.
* Copyright (C) 2005-2013 Alfresco Software Limited.
*
* This file is part of Alfresco
*
@@ -27,8 +27,6 @@ import java.util.Enumeration;
import java.util.Hashtable;
import java.util.StringTokenizer;
import javax.transaction.UserTransaction;
import net.sf.acegisecurity.Authentication;
import net.sf.acegisecurity.AuthenticationServiceException;
import net.sf.acegisecurity.BadCredentialsException;
@@ -48,6 +46,8 @@ import org.alfresco.jlan.smb.SMBStatus;
import org.alfresco.repo.security.authentication.AbstractAuthenticationComponent;
import org.alfresco.repo.security.authentication.AuthenticationException;
import org.alfresco.repo.security.authentication.NTLMMode;
import org.alfresco.repo.transaction.RetryingTransactionHelper;
import org.alfresco.repo.transaction.RetryingTransactionHelper.RetryingTransactionCallback;
import org.alfresco.service.cmr.security.NoSuchPersonException;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
@@ -65,7 +65,7 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
{
// Logging
private static final Log logger = LogFactory.getLog("org.alfresco.passthru.auth");
private static final Log logger = LogFactory.getLog(NTLMAuthenticationComponentImpl.class);
// Constants
//
@@ -389,7 +389,7 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
}
else
{
throw new AlfrescoRuntimeException("JCE provider class is not a valid Provider class");
throw new AlfrescoRuntimeException("JCE provider class is not a valid Provider class:" + providerClass);
}
}
catch (ClassNotFoundException ex)
@@ -418,7 +418,9 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
long sessTmoMilli = Long.parseLong(sessTmo) * 1000L;
if ( sessTmoMilli < MinimumSessionTimeout)
{
throw new AlfrescoRuntimeException("Authentication session timeout too low, " + sessTmo);
}
// Set the authentication session timeout value
@@ -441,57 +443,59 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
*/
public void setProtocolOrder(String protoOrder)
{
// Parse the protocol order list
StringTokenizer tokens = new StringTokenizer( protoOrder, ",");
int primaryProto = Protocol.None;
int secondaryProto = Protocol.None;
// Parse the protocol order list
StringTokenizer tokens = new StringTokenizer( protoOrder, ",");
int primaryProto = Protocol.None;
int secondaryProto = Protocol.None;
// There should only be one or two tokens
if ( tokens.countTokens() > 2)
throw new AlfrescoRuntimeException("Invalid protocol order list, " + protoOrder);
// Get the primary protocol
if ( tokens.hasMoreTokens())
{
// Parse the primary protocol
String primaryStr = tokens.nextToken();
if ( primaryStr.equalsIgnoreCase( "TCPIP"))
primaryProto = Protocol.NativeSMB;
else if ( primaryStr.equalsIgnoreCase( "NetBIOS"))
primaryProto = Protocol.TCPNetBIOS;
else
throw new AlfrescoRuntimeException("Invalid protocol type, " + primaryStr);
// Check if there is a secondary protocol, and validate
if ( tokens.hasMoreTokens())
{
// Parse the secondary protocol
String secondaryStr = tokens.nextToken();
if ( secondaryStr.equalsIgnoreCase( "TCPIP") && primaryProto != Protocol.NativeSMB)
secondaryProto = Protocol.NativeSMB;
else if ( secondaryStr.equalsIgnoreCase( "NetBIOS") && primaryProto != Protocol.TCPNetBIOS)
secondaryProto = Protocol.TCPNetBIOS;
else
throw new AlfrescoRuntimeException("Invalid secondary protocol, " + secondaryStr);
}
}
// Set the protocol order used for passthru authentication sessions
AuthSessionFactory.setProtocolOrder( primaryProto, secondaryProto);
// DEBUG
if (logger.isDebugEnabled())
logger.debug("Protocol order primary=" + Protocol.asString(primaryProto) + ", secondary=" + Protocol.asString(secondaryProto));
// There should only be one or two tokens
if ( tokens.countTokens() > 2)
throw new AlfrescoRuntimeException("Invalid protocol order list, " + protoOrder);
// Get the primary protocol
if ( tokens.hasMoreTokens())
{
// Parse the primary protocol
String primaryStr = tokens.nextToken();
if ( primaryStr.equalsIgnoreCase( "TCPIP"))
primaryProto = Protocol.NativeSMB;
else if ( primaryStr.equalsIgnoreCase( "NetBIOS"))
primaryProto = Protocol.TCPNetBIOS;
else
throw new AlfrescoRuntimeException("Invalid protocol type, " + primaryStr);
// Check if there is a secondary protocol, and validate
if ( tokens.hasMoreTokens())
{
// Parse the secondary protocol
String secondaryStr = tokens.nextToken();
if ( secondaryStr.equalsIgnoreCase( "TCPIP") && primaryProto != Protocol.NativeSMB)
secondaryProto = Protocol.NativeSMB;
else if ( secondaryStr.equalsIgnoreCase( "NetBIOS") && primaryProto != Protocol.TCPNetBIOS)
secondaryProto = Protocol.TCPNetBIOS;
else
throw new AlfrescoRuntimeException("Invalid secondary protocol, " + secondaryStr);
}
}
// Set the protocol order used for passthru authentication sessions
AuthSessionFactory.setProtocolOrder( primaryProto, secondaryProto);
// DEBUG
if (logger.isDebugEnabled())
{
logger.debug("Protocol order primary=" + Protocol.asString(primaryProto) + ", secondary=" + Protocol.asString(secondaryProto));
}
}
/**
@@ -516,7 +520,9 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
// Debug
if ( logger.isDebugEnabled())
{
logger.debug("Authenticate user=" + userName + " via local credentials");
}
// Create a local authentication token
@@ -525,6 +531,7 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
// Authenticate using the token
authenticate( authToken);
}
/**
@@ -539,7 +546,9 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
// DEBUG
if ( logger.isDebugEnabled())
{
logger.debug("Authenticate " + auth + " via token");
}
// Check if the token is for passthru authentication
@@ -572,15 +581,17 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
authSess = m_passthruServers.openSession();
// Check fi the passthru session is valid
if ( authSess == null)
{
// DEBUG
if ( logger.isDebugEnabled())
logger.debug( "Failed to open passthru session, or no valid passthru server available for " + ntlmToken);
throw new AuthenticationException("Failed to open session to passthru server");
{
logger.debug( "Failed to open passthru session, or no valid passthru server available for " + ntlmToken);
}
throw new AuthenticationException("authentication.err.connection.passthru.server");
}
// Authenticate using the credentials supplied
@@ -607,7 +618,7 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
{
// Unsupported authentication token
throw new AuthenticationException("Unsupported authentication token type");
throw new AuthenticationException("authentication.err.passthru.token.unsupported");
}
// Return the updated authentication token
@@ -643,6 +654,7 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
*
* @param ntlmToken NTLMLocalToken
* @param authSess AuthenticateSession
* @throws AutheticationException
*/
private void authenticateLocal(NTLMLocalToken ntlmToken, AuthenticateSession authSess)
{
@@ -680,7 +692,7 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
{
// Guest access not allowed
throw new AuthenticationException("Guest logons disabled");
throw new AuthenticationException("authentication.err.passthru.guest.notenabled");
}
}
else
@@ -705,25 +717,27 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
// Debug
if ( logger.isDebugEnabled())
{
logger.debug("Authenticated token=" + ntlmToken);
}
}
catch (NoSuchAlgorithmException ex)
{
// JCE provider does not have the required encryption/hashing algorithms
throw new AuthenticationServiceException("JCE provider error", ex);
throw new AuthenticationException("JCE provider error", ex);
}
catch (InvalidKeyException ex)
{
// Problem creating key during encryption
throw new AuthenticationServiceException("Invalid key error", ex);
throw new AuthenticationException("Invalid key error", ex);
}
catch (IOException ex)
{
// Error connecting to the authentication server
throw new AuthenticationServiceException("I/O error", ex);
throw new AuthenticationException("I/O error", ex);
}
catch (SMBException ex)
{
@@ -739,7 +753,7 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
authEx = new AuthenticationException("Logon failure");
break;
case SMBStatus.NTAccountDisabled:
authEx = new AuthenticationException("Account disabled");
authEx = new AuthenticationException("authentication.err.passthru.user.disabled");
break;
default:
authEx = new AuthenticationException("Logon failure");
@@ -749,7 +763,9 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
throw authEx;
}
else
{
throw new AuthenticationException("Logon failure");
}
}
}
@@ -757,6 +773,7 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
* Authenticate using passthru authentication with a client
*
* @param ntlmToken NTLMPassthruToken
* @throws AuthenticationExcepion
*/
private void authenticatePassthru(NTLMPassthruToken ntlmToken)
{
@@ -771,7 +788,9 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
// timed out
if ( ntlmToken.getChallenge() != null)
throw new CredentialsExpiredException("Authentication session expired");
{
throw new AuthenticationException("Authentication session expired");
}
// Open an authentication session for the new token and add to the active session list
@@ -780,7 +799,9 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
// Check if the session was opened to the passthru server
if ( authSess == null)
throw new AuthenticationServiceException("Failed to open passthru auth session");
{
throw new AuthenticationException("authentication.err.connection.passthru.server");
}
ntlmToken.setAuthenticationExpireTime(System.currentTimeMillis() + getSessionTimeout());
@@ -810,9 +831,7 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
logger.debug("Passthru stage 1 token " + ntlmToken);
}
else
{
UserTransaction tx = null;
{
try
{
// Stage two of the authentication, send the hashed password to the authentication server
@@ -848,7 +867,7 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
{
// Guest access not allowed
throw new BadCredentialsException("Guest logons disabled");
throw new AuthenticationException("authentication.err.passthru.guest.notenabled");
}
}
@@ -858,21 +877,26 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
// Wrap the service calls in a transaction
tx = getTransactionService().getUserTransaction( false);
tx.begin();
// Map the passthru username to an Alfresco person
RetryingTransactionHelper helper = getTransactionService().getRetryingTransactionHelper();
clearCurrentSecurityContext();
setCurrentUser( username);
final String currentUser = username;
helper.doInTransaction(new RetryingTransactionCallback<Void>()
{
public Void execute() throws AuthenticationException
{
clearCurrentSecurityContext();
setCurrentUser(currentUser);
return null;
}
});
}
catch (NoSuchPersonException ex)
{
// Check if authenticated users are allowed on as guest when there is no Alfresco person record
if ( m_allowAuthUserAsGuest == true)
{
// Check if authenticated users are allowed on as guest when there is no Alfresco person record
if ( m_allowAuthUserAsGuest == true)
{
// Set the guest authority
GrantedAuthority[] authorities = new GrantedAuthority[1];
@@ -883,28 +907,29 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
// DEBUG
if ( logger.isDebugEnabled())
{
logger.debug("Allow passthru authenticated user to logon as guest, user=" + ntlmToken.getName());
}
else
{
// Logon failure, no matching person record
throw new AuthenticationServiceException("Logon failure", ex);
}
}
}
else
{
// Logon failure, no matching person record
throw new AuthenticationException("authentication.err.passthru.user.notfound", ex);
}
}
catch (IOException ex)
{
// Error connecting to the authentication server
throw new AuthenticationServiceException("I/O error", ex);
throw new AuthenticationException("Unable to connect to the authentication server", ex);
}
catch (SMBException ex)
{
// Debug
if ( logger.isDebugEnabled())
{
logger.debug("Passthru exception, " + ex);
}
// Check the returned status code to determine why the logon failed and throw an appropriate exception
if ( ex.getErrorClass() == SMBStatus.NTErr)
@@ -917,7 +942,7 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
authEx = new AuthenticationException("Logon failure");
break;
case SMBStatus.NTAccountDisabled:
authEx = new AuthenticationException("Account disabled");
authEx = new AuthenticationException("authentication.err.passthru.user.disabled");
break;
default:
authEx = new AuthenticationException("Logon failure");
@@ -927,14 +952,10 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
throw authEx;
}
else
throw new BadCredentialsException("Logon failure");
}
catch (Exception ex)
{
// General error
throw new AuthenticationServiceException("General error", ex);
}
{
throw new AuthenticationException("Logon failure");
}
}
finally
{
// Make sure the authentication session is closed
@@ -953,21 +974,9 @@ public class NTLMAuthenticationComponentImpl extends AbstractAuthenticationCompo
}
catch (Exception ex)
{
logger.debug("unable to close session", ex);
}
}
// Commit or rollback the transaction, if active
if ( tx != null)
{
try
{
tx.commit();
}
catch ( Exception ex)
{
}
}
}
}
}
}

118
source/java/org/alfresco/repo/security/authentication/userModel.xml
View File

@@ -1,118 +0,0 @@
<model name="usr:usermodel" xmlns="http://www.alfresco.org/model/dictionary/1.0">
<description>Alfresco User Model</description>
<author>Alfresco</author>
<published>2010-01-27</published>
<version>0.3</version>
<imports>
<import uri="http://www.alfresco.org/model/dictionary/1.0" prefix="d"/>
<import uri="http://www.alfresco.org/model/system/1.0" prefix="sys"/>
</imports>
<namespaces>
<namespace uri="http://www.alfresco.org/model/user/1.0" prefix="usr"/>
</namespaces>
<constraints>
<constraint name="usr:userNameConstraint" type="org.alfresco.repo.dictionary.constraint.UserNameConstraint" />
</constraints>
<types>
<type name="usr:authority">
<title>Alfresco Authority Abstract Type</title>
<parent>sys:base</parent>
</type>
<type name="usr:user">
<title>Alfresco User Type</title>
<parent>usr:authority</parent>
<properties>
<!-- The tokenisation set here is ignored - it is fixed for this type -->
<!-- This is so you can not break person lookup -->
<property name="usr:username">
<type>d:text</type>
<constraints>
<constraint ref="usr:userNameConstraint" />
</constraints>
</property>
<property name="usr:password">
<type>d:text</type>
</property>
<property name="usr:password2">
<type>d:text</type>
</property>
<property name="usr:enabled">
<type>d:boolean</type>
</property>
<property name="usr:accountExpires">
<type>d:boolean</type>
</property>
<property name="usr:accountExpiryDate">
<type>d:datetime</type>
<index enabled="true">
<atomic>true</atomic>
<stored>false</stored>
<tokenised>both</tokenised>
</index>
</property>
<property name="usr:credentialsExpire">
<type>d:boolean</type>
</property>
<property name="usr:credentialsExpiryDate">
<type>d:datetime</type>
<index enabled="true">
<atomic>true</atomic>
<stored>false</stored>
<tokenised>both</tokenised>
</index>
</property>
<property name="usr:accountLocked">
<type>d:boolean</type>
</property>
<property name="usr:salt">
<type>d:text</type>
</property>
</properties>
</type>
<!-- Note this type is not used and was replaced by cm:authorityContainer -->
<!-- Retained here because old authority containers are left in place in upgraded repositories (after migration) -->
<type name="usr:authorityContainer">
<title>Deprecated Alfresco Authority Type - NOT USED</title>
<parent>usr:authority</parent>
<properties>
<!-- The tokenisation set here is ignored - it is fixed for this type -->
<!-- This is so you can not break group lookup -->
<property name="usr:authorityName">
<type>d:text</type>
</property>
<property name="usr:members">
<type>d:text</type>
<multiple>true</multiple>
</property>
<property name="usr:authorityDisplayName">
<type>d:text</type>
</property>
</properties>
<associations>
<child-association name="usr:member">
<source>
<mandatory>false</mandatory>
<many>true</many>
</source>
<target>
<class>usr:authority</class>
<mandatory>false</mandatory>
<many>true</many>
</target>
<duplicate>false</duplicate>
</child-association>
</associations>
</type>
</types>
</model>