Changeset 7539

Timestamp:

Nov 28, 2018, 4:02:32 PM (3 years ago)

Author:

Nicklas Nordborg

Message:

References #2131: Add support for installing multiple authentication managers

Added AuthenticationManager.vetoAuthenticatedUser() method. This will make it possible for authentication managers to cooperate and allow or deny users to login with more than one authentication method.

Location:

trunk/src/core/net/sf/basedb/core

Files:

• SessionControl.java (modified) (3 diffs)
• authentication/AuthenticationManager.java (modified) (2 diffs)

trunk/src/core/net/sf/basedb/core/SessionControl.java

@@ -451 +451 @@
       tx = HibernateUtil.newTransaction(session);
 
-      authUser = verifyUserExternal(session, loginRequest);
+      List<AuthenticationManager> externalManagers = new ArrayList<>();
+      authUser = verifyUserExternal(session, loginRequest, externalManagers);
       if (authUser == null)
       {
         // If no user was found, use internal authentication
         authUser = verifyUserInternal(session, loginRequest);
+      }
+      
+      // The login seems to be ok, but we need to let external manages to throw in a veto
+      user = HibernateUtil.loadData(session, UserData.class, authUser.getInternalId());
+      try
+      {
+        for (AuthenticationManager external : externalManagers)
+        {
+          external.vetoAuthenticatedUser(user, authUser);
+        }
+      }
+      catch (net.sf.basedb.core.authentication.AuthenticationException ex)
+      {
+        throw new LoginException(ex.getMessage(), ex);
       }
       
       // The login was ok so far... check device verification
       device = verifyDevice(session, loginRequest, authUser);
-      user = HibernateUtil.loadData(session, UserData.class, authUser.getInternalId());
       
       // A null value means that either device verification is disabled 
@@ -683 +697 @@
   */
   @SuppressWarnings("unchecked")
-  private AuthenticatedUser verifyUserExternal(org.hibernate.Session session, LoginRequest loginRequest)
+  private AuthenticatedUser verifyUserExternal(org.hibernate.Session session, LoginRequest loginRequest, List<AuthenticationManager> authManagers)
   {
     AuthenticationContext context = new AuthenticationContext(this, session, loginRequest);
@@ -694 +708 @@
     try
     {
-      // Load all installed authentication managers and iterate until 
-      // someone returns an info object or throws an exception
+      // Load all installed authentication managers 
+      // Call authenticate() until one returns an 'AuthenticatedUser' 
+      // All others are saved in the authManagers list for later calling vetoAuthenticatedUser()
+      // If some manager is throwing an exception the login fails
       for (AuthenticationManager auth : invoker)
       {
-        authUser = auth.authenticate();
-        if (authUser != null)
+        boolean add = true;
+        if (authUser == null)
         {
-          // Found a valid login
-          break;
+          authUser = auth.authenticate();
+          if (authUser != null) add = false;
         }
+        if (add) authManagers.add(auth);
       }
     }

trunk/src/core/net/sf/basedb/core/authentication/AuthenticationManager.java

@@ -23 +23 @@
 
 import net.sf.basedb.core.AuthenticationContext;
+import net.sf.basedb.core.data.UserData;
 import net.sf.basedb.util.extensions.Action;
 import net.sf.basedb.util.extensions.InvokationContext;
@@ -62 +63 @@
   public AuthenticatedUser authenticate();
   
+  /**
+    This method is called if there are multiple installed external authentication
+    managers and at least one of them accepted the user in the {@link #authenticate()}
+    method. If so, all other authentication managers will get a chance to throw in 
+    a veto. For example, an administrator account may be protected with a special
+    authentication manager (for example, YubiKey) while regular users by a simpler 
+    method (for example, OTP). If the administrator tries to login with the OTP method 
+    then the Yubikey authentication manager may veto this by throwing an 
+    {@link AuthenticationException} from this method.
+    
+    Note that this method is NOT called on the authentication manager that authenticated
+    a user by returning information from the {@link #authenticate()} method.
+    
+    To provide backwards compatibility with existing authentication managers this
+    method has a default implementation that doesn't do anything.
+    
+    @param user The user that is trying to login
+    @param auth Information about the authentication
+    @since 3.14
+  */
+  public default void vetoAuthenticatedUser(UserData user, AuthenticatedUser auth)
+  {}
   
 }