Changeset 2258

Timestamp:

Feb 28, 2014, 11:02:46 AM (9 years ago)

Author:

Nicklas Nordborg

Message:

References #580: Authenticate users using YubiKey? sticks

Store YubiKey? information as extended properties instead of in the 'externalid' field.

Check regular password before verifying the YubiKey? password.

Location:

extensions/net.sf.basedb.yubikey/trunk

Files:

• src/net/sf/basedb/yubikey/YubiKey.java (modified) (2 diffs)
• src/net/sf/basedb/yubikey/YubiKeyAuthenticationManager.java (modified) (8 diffs)
• yubikey-extended-properties.xml (added)

extensions/net.sf.basedb.yubikey/trunk/src/net/sf/basedb/yubikey/YubiKey.java

@@ -25 +25 @@
 import java.net.URL;
 import java.util.Properties;
+
+import com.yubico.client.v2.YubicoClient;
 
 import net.sf.basedb.core.ConfigurationException;
@@ -105 +107 @@
     return clientKey;
   }
+  
+  /**
+    Get a YubicoClient configured for verification of passwords.
+  */
+  public static YubicoClient getYubicoClient()
+  {
+    YubicoClient client = YubicoClient.getClient(getClientId());
+    client.setKey(getClientKey());
+    return client;
+  }
 }

extensions/net.sf.basedb.yubikey/trunk/src/net/sf/basedb/yubikey/YubiKeyAuthenticationManager.java

@@ -1 +1 @@
 package net.sf.basedb.yubikey;
 
+
+import java.util.List;
 
 import com.yubico.client.v2.YubicoClient;
@@ -7 +9 @@
 
 import net.sf.basedb.core.AuthenticationContext;
+import net.sf.basedb.core.Type;
 import net.sf.basedb.core.authentication.AuthenticatedUser;
 import net.sf.basedb.core.authentication.AuthenticationManager;
@@ -12 +15 @@
 import net.sf.basedb.core.authentication.LoginRequest;
 import net.sf.basedb.core.data.UserData;
+import net.sf.basedb.core.query.QueryParameter;
 
 /**
@@ -53 +57 @@
     if (user != null)
     {
-      String externalId = user.getExternalId();
-      if (externalId != null && externalId.startsWith("YubiKey:"))
+      String yubiKeyId = (String)user.getExtended("yubiKeyId");
+      if (yubiKeyId != null)
       {
         throw new LoginException("User '" + login + "' must login with YubiKey!");
@@ -65 +69 @@
     if (YubicoClient.isValidOTPFormat(login)) 
     {
-      // Find user in BASE with externalId=YubiKey:<public-id>
+      // Find user(s) in BASE with yubiKeyId=<public-id>
       String publicId = YubicoClient.getPublicId(login);
-      String externalId = "YubiKey:" + publicId;
-      user = context.getUserByExternalId(externalId);
-    
+      QueryParameter qp = new QueryParameter("ykId", false, Type.STRING, publicId);
+      List<UserData> users = context.findUsers("yubiKeyId=:ykId", qp);
+      
+      if (users.size() > 0)
+      {
+        // Check the password for each of the users in the list
+        // Normally, a single user is found, but theoretically it is
+        // possible to assign the same YubiKey yto multiple accounts if
+        // they have different password
+        RuntimeException loginFailed = null;
+        for (UserData u : users)
+        {
+          LoginRequest internal = new LoginRequest(u.getId(), request.getPassword());
+          try
+          {
+            context.verifyUserInternal(internal);
+            // If we get here, the password is ok and we break out of the loop
+            user = u;
+            break;
+          }
+          catch (RuntimeException ex)
+          {
+            // Save the first exception so we can re-throw it later if needed
+            if (loginFailed == null) loginFailed = ex;
+          }
+        }
+        // If no user with correct password was found we re-throw the first exception
+        if (user == null && loginFailed != null) 
+        {
+          throw loginFailed;
+        }
+      }
+      
       if (user != null)
       {
@@ -77 +111 @@
         try
         {
-          ybClient = YubicoClient.getClient(YubiKey.getClientId());
-          ybClient.setKey(YubiKey.getClientKey());
-          response = ybClient.verify(login);
+          YubicoClient client = YubiKey.getYubicoClient();
+          response = client.verify(login);
         }
         catch (Exception e)
@@ -87 +120 @@
         
         YubicoResponseStatus status = response.getStatus(); 
-        /*
-        System.out.println("status:" + response.getStatus());
-        System.out.println("H:" + response.getH());
-        System.out.println("Nonce:" + response.getNonce());
-        System.out.println("otp:" + response.getOtp());
-        //System.out.println("publicid:" + response.getPublicId());
-        System.out.println("sessioncounter:" + response.getSessioncounter());
-        System.out.println("sessionuse:" + response.getSessionuse());
-        System.out.println("Sl:" + response.getSl());
-        System.out.println("T:" + response.getT());
-        System.out.println("Timestamp:" + response.getTimestamp());
-        */
-
         if (status != YubicoResponseStatus.OK)
         {
@@ -114 +134 @@
         }
 
-        // YubiKey is valid -- verify password using internal authentication
-        LoginRequest internal = new LoginRequest(user.getLogin(), request.getPassword());
-        context.verifyUserInternal(internal);
+        // YubiKey is valid -- the user is allowed to access BASE!
         authInfo = new AuthenticatedUser(YubiKey.AUTHENTICATION_METHOD, user);
       }