001: /*
002: * Copyright 2007 The Kuali Foundation.
003: *
004: * Licensed under the Educational Community License, Version 1.0 (the "License");
005: * you may not use this file except in compliance with the License.
006: * You may obtain a copy of the License at
007: *
008: * http://www.opensource.org/licenses/ecl1.php
009: *
010: * Unless required by applicable law or agreed to in writing, software
011: * distributed under the License is distributed on an "AS IS" BASIS,
012: * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
013: * See the License for the specific language governing permissions and
014: * limitations under the License.
015: */
016: package org.kuali.cas.auth;
017:
018: import java.security.GeneralSecurityException;
019:
020: import org.apache.commons.lang.StringUtils;
021: import org.kuali.core.bo.user.AuthenticationUserId;
022: import org.kuali.core.bo.user.UniversalUser;
023: import org.kuali.core.exceptions.UserNotFoundException;
024: import org.kuali.core.service.EncryptionService;
025: import org.kuali.core.service.KualiConfigurationService;
026: import org.kuali.core.service.UniversalUserService;
027: import org.kuali.core.service.WebAuthenticationService;
028: import org.kuali.kfs.context.SpringContext;
029:
030: import edu.yale.its.tp.cas.auth.provider.WatchfulPasswordHandler;
031:
032: public class KualiPasswordHandler extends WatchfulPasswordHandler {
033: protected static org.apache.log4j.Logger LOG = org.apache.log4j.Logger
034: .getLogger(KualiPasswordHandler.class);
035:
036: /**
037: * Authenticates the given username/password pair, returning true on success and false on failure.
038: */
039: public boolean authenticate(javax.servlet.ServletRequest request,
040: String username, String password) {
041: if (super .authenticate(request, username, password) != false) {
042: try {
043: if (username != null && !username.trim().equals("")) {
044: // check the username and password against the db
045: // return true if they are there and have a valid password
046: // if ( LOG.isDebugEnabled() ) {
047: // LOG.debug( "Attempting login for user id: " + username + " and password hash: " +
048: // SpringContext.getBean(EncryptionService.class).hash( password.trim() ) );
049: // }
050: // obtain the universal user record
051: UniversalUser user = SpringContext.getBean(
052: UniversalUserService.class)
053: .getUniversalUser(
054: new AuthenticationUserId(username
055: .trim()));
056: // if ( LOG.isDebugEnabled() ) {
057: // LOG.debug( "Found user " + user.getPersonName() + " with password hash: " +
058: // user.getFinancialSystemsEncryptedPasswordText() );
059: // }
060: // check if the password needs to be checked (if in a production environment or password turned on explicitly)
061: if (SpringContext.getBean(
062: KualiConfigurationService.class)
063: .isProductionEnvironment()
064: || SpringContext.getBean(
065: WebAuthenticationService.class)
066: .isValidatePassword()) {
067: // if so, hash the passed in password and compare to the hash retrieved from the database
068: String hashedPassword = user
069: .getFinancialSystemsEncryptedPasswordText();
070: if (hashedPassword == null) {
071: hashedPassword = "";
072: }
073: hashedPassword = StringUtils.stripEnd(
074: hashedPassword,
075: EncryptionService.HASH_POST_PREFIX);
076: if (SpringContext.getBean(
077: EncryptionService.class).hash(
078: password.trim()).equals(hashedPassword)) {
079: return true; // password matched
080: }
081: } else {
082: LOG
083: .warn("WARNING: password checking is disabled - user "
084: + username
085: + " has been authenticated without a password.");
086: return true; // no need to check password - user's existence is enough
087: }
088: }
089: } catch (GeneralSecurityException ex) {
090: LOG.error("Error validating password", ex);
091: return false; // fail if the hash function fails
092: } catch (UserNotFoundException ex) {
093: LOG.info("User " + username
094: + " was not found in the UniversalUser table.");
095: return false; // fail if user does not exist
096: }
097:
098: }
099: LOG.warn("CAS base password handler failed authenication for "
100: + username + " based on number of attempts.");
101: return false; // fail if we get to this point
102: }
103: }
|