Changeset 2511

Timestamp:

Jun 17, 2014, 11:45:44 AM (9 years ago)

Author:

Nicklas Nordborg

Message:

Fixes #609: Add support for ignoring YubiKey? login depending on client

Location:

extensions/net.sf.basedb.yubikey/trunk

Files:

• src/net/sf/basedb/yubikey/YubiKey.java (modified) (4 diffs)
• src/net/sf/basedb/yubikey/YubiKeyAuthenticationManagerFactory.java (modified) (1 diff)
• yubikey.properties (modified) (1 diff)

extensions/net.sf.basedb.yubikey/trunk/src/net/sf/basedb/yubikey/YubiKey.java

@@ -24 +24 @@
 import java.io.InputStream;
 import java.net.URL;
+import java.util.Arrays;
+import java.util.HashSet;
 import java.util.Properties;
+import java.util.Set;
 
 import com.yubico.client.v2.YubicoClient;
@@ -50 +53 @@
   private static Integer clientId;
   private static String clientKey;
+  private static Set<String> noYubiKeyLogin;
   
   /**
@@ -86 +90 @@
         throw new ConfigurationException("Missing configuration value: client-id or client-key");
       }
+      
+      String noYubiKey  = config.getProperty("no-yubikey");
+      if (noYubiKey != null)
+      {
+        noYubiKeyLogin = new HashSet<String>(Arrays.asList(noYubiKey.split("[\\s,]+")));
+      }
     }
     return config;
@@ -109 +119 @@
   
   /**
+    Check if YubiKey login has been disabled for the given client id. 
+    To disable a client, the id should be listed in no-yubikey setting
+    in yubikey.properties configuration file.
+    
+    @param clientId
+    @return TRUE if YubiKey is disabled, FALSE if no
+  */
+  public static boolean isYubiKeyDisabledForClient(String clientId)
+  {
+    return clientId != null && noYubiKeyLogin != null && noYubiKeyLogin.contains(clientId);
+  }
+  
+  /**
     Get a YubicoClient configured for verification of passwords.
   */

extensions/net.sf.basedb.yubikey/trunk/src/net/sf/basedb/yubikey/YubiKeyAuthenticationManagerFactory.java

@@ -26 +26 @@
 
   /**
-    @return Always true (if properly configured)
+    Checks if YubiKey has been properly configured and
+    if the currently used client application has been disabled for
+    use with YubiKey.
+    @return TRUE if YubiKey is enabled, FALSE otherwise
   */
   @Override
   public boolean prepareContext(InvokationContext<? super AuthenticationManager> context)
   {
-    return hasConfig;
+    String clientId = context.getClientContext().getSessionControl().getExternalClientId();
+    return hasConfig && !YubiKey.isYubiKeyDisabledForClient(clientId);
   }
 

extensions/net.sf.basedb.yubikey/trunk/yubikey.properties

@@ -13 +13 @@
 client-key  =
 
+## Comma- or whitespace separated list of application ids
+## that should NOT use YubiKey for login. For example,
+## it is recommended that YubiKey is disabled for the
+## FTP Server extension if that is installed
+# no-yubikey = net.sf.basedb.clients.ftp