import org.ldaptive.auth.AuthenticationResponse; //导入依赖的package包/类
@Override
protected void handleWarning(
        final AccountState.Warning warning,
        final AuthenticationResponse response,
        final LdapPasswordPolicyConfiguration configuration,
        final List<MessageDescriptor> messages) {

    final LdapAttribute attribute = response.getLdapEntry().getAttribute(this.warningAttributeName);
    boolean matches = false;
    if (attribute != null) {
        logger.debug("Found warning attribute {} with value {}", attribute.getName(), attribute.getStringValue());
        matches = this.warningAttributeValue.equals(attribute.getStringValue());
    }
    logger.debug("matches={}, displayWarningOnMatch={}", matches, displayWarningOnMatch);
    if (displayWarningOnMatch == matches) {
        super.handleWarning(warning, response, configuration, messages);
    }
}
 

import org.ldaptive.auth.AuthenticationResponse; //导入依赖的package包/类
@Override
public List<MessageDescriptor> handle(final AuthenticationResponse response,
                                      final LdapPasswordPolicyConfiguration configuration)
        throws LoginException {

    if (!this.attributesToErrorMap.isEmpty() && response.getResult()) {
        LOGGER.debug("Handling policy based on pre-defined attributes");
        handlePolicyAttributes(response);
    }

    final AccountState state = response.getAccountState();
    if (state == null) {
        LOGGER.debug("Account state not defined. Returning empty list of messages.");
        return Collections.emptyList();
    }
    final List<MessageDescriptor> messages = new ArrayList<>();
    handleError(state.getError(), response, configuration, messages);
    handleWarning(state.getWarning(), response, configuration, messages);

    return messages;
}
 

import org.ldaptive.auth.AuthenticationResponse; //导入依赖的package包/类
@Override
protected void handleWarning(
        final AccountState.Warning warning,
        final AuthenticationResponse response,
        final LdapPasswordPolicyConfiguration configuration,
        final List<Message> messages) {

    final LdapAttribute attribute = response.getLdapEntry().getAttribute(this.warningAttributeName);
    boolean matches = false;
    if (attribute != null) {
        logger.debug("Found warning attribute {} with value {}", attribute.getName(), attribute.getStringValue());
        matches = this.warningAttributeValue.equals(attribute.getStringValue());
    }
    logger.debug("matches={}, displayWarningOnMatch={}", matches, displayWarningOnMatch);
    if (displayWarningOnMatch == matches) {
        super.handleWarning(warning, response, configuration, messages);
    }
}
 

import org.ldaptive.auth.AuthenticationResponse; //导入依赖的package包/类
@Override
public List<Message> handle(final AuthenticationResponse response, final LdapPasswordPolicyConfiguration configuration)
        throws LoginException {

    final AccountState state = response.getAccountState();
    final AccountState.Error error;
    final AccountState.Warning warning;
    if (state != null) {
        error = state.getError();
        warning = state.getWarning();
    } else {
        logger.debug("Account state not defined");
        error = null;
        warning = null;
    }
    final List<Message> messages = new ArrayList<Message>();
    handleError(error, response, configuration, messages);
    handleWarning(warning, response, configuration, messages);
    return messages;
}
 

import org.ldaptive.auth.AuthenticationResponse; //导入依赖的package包/类
@Override
public String authenticate(String login, String password) throws AuthenticationException {

  final AuthenticationResponse response;
  try {
    LOG.debug("Attempting LDAP authentication for: {}", login);
    final AuthenticationRequest request =
        new AuthenticationRequest(login, new Credential(password));
    request.setReturnAttributes(returnAttributes);
    response = this.ldapAuthenticator.authenticate(request);
  } catch (final LdapException e) {
    throw new AuthenticationException(401, "Unexpected LDAP error");
  }
  LOG.debug("LDAP response: {}", response);

  if (!response.getResult()) {
    throw new AuthenticationException(
        401, "Authentication failed. Please check username and password.");
  }

  if (AuthenticationResultCode.DN_RESOLUTION_FAILURE == response.getAuthenticationResultCode()) {
    throw new AuthenticationException(login + "  is not found");
  }
  LOG.debug("Account state {}", response.getAccountState());
  return idNormalizer.retrieveAndNormalize(response.getLdapEntry());
}
 

import org.ldaptive.auth.AuthenticationResponse; //导入依赖的package包/类
@Override
protected void handleWarning(
        final AccountState.Warning warning,
        final AuthenticationResponse response,
        final LdapPasswordPolicyConfiguration configuration,
        final List<MessageDescriptor> messages) {

    if (StringUtils.isBlank(this.warningAttributeName)) {
        logger.debug("No warning attribute name is defined");
        return;
    }

    if (StringUtils.isBlank(this.warningAttributeValue)) {
        logger.debug("No warning attribute value to match is defined");
        return;
    }


    final LdapAttribute attribute = response.getLdapEntry().getAttribute(this.warningAttributeName);
    boolean matches = false;
    if (attribute != null) {
        logger.debug("Found warning attribute {} with value {}", attribute.getName(), attribute.getStringValue());
        matches = this.warningAttributeValue.equals(attribute.getStringValue());
    }
    logger.debug("matches={}, displayWarningOnMatch={}", matches, displayWarningOnMatch);
    if (displayWarningOnMatch == matches) {
        super.handleWarning(warning, response, configuration, messages);
    }
}
 

import org.ldaptive.auth.AuthenticationResponse; //导入依赖的package包/类
@Override
public List<MessageDescriptor> handle(final AuthenticationResponse response, final LdapPasswordPolicyConfiguration configuration)
        throws LoginException {

    final AccountState state = response.getAccountState();
    if (state == null) {
        logger.debug("Account state not defined. Returning empty list of messages.");
        return Collections.emptyList();
    }
    final List<MessageDescriptor> messages = new ArrayList<>();
    handleError(state.getError(), response, configuration, messages);
    handleWarning(state.getWarning(), response, configuration, messages);

    return messages;
}
 

import org.ldaptive.auth.AuthenticationResponse; //导入依赖的package包/类
/**
 * Handle an account state error produced by ldaptive account state machinery.
 * <p>
 * Override this method to provide custom error handling.
 *
 * @param error Account state error.
 * @param response Ldaptive authentication response.
 * @param configuration Password policy configuration.
 * @param messages Container for messages produced by account state error handling.
 *
 * @throws LoginException On errors that should be communicated as login exceptions.
 */
protected void handleError(
        final AccountState.Error error,
        final AuthenticationResponse response,
        final LdapPasswordPolicyConfiguration configuration,
        final List<MessageDescriptor> messages)
        throws LoginException {

    logger.debug("Handling error {}", error);
    final LoginException ex = this.errorMap.get(error);
    if (ex != null) {
        throw ex;
    }
    logger.debug("No LDAP error mapping defined for {}", error);
}
 

import org.ldaptive.auth.AuthenticationResponse; //导入依赖的package包/类
/**
 * Handle an account state warning produced by ldaptive account state machinery.
 * <p>
 * Override this method to provide custom warning message handling.
 *
 * @param warning the account state warning messages.
 * @param response Ldaptive authentication response.
 * @param configuration Password policy configuration.
 * @param messages Container for messages produced by account state warning handling.
 */
protected void handleWarning(
        final AccountState.Warning warning,
        final AuthenticationResponse response,
        final LdapPasswordPolicyConfiguration configuration,
        final List<MessageDescriptor> messages) {

    logger.debug("Handling warning {}", warning);
    if (warning == null) {
        logger.debug("Account state warning not defined");
        return;
    }

    final Calendar expDate = warning.getExpiration();
    final Days ttl = Days.daysBetween(Instant.now(), new Instant(expDate));
    logger.debug(
            "Password expires in {} days. Expiration warning threshold is {} days.",
            ttl.getDays(),
            configuration.getPasswordWarningNumberOfDays());
    if (configuration.isAlwaysDisplayPasswordExpirationWarning()
            || ttl.getDays() < configuration.getPasswordWarningNumberOfDays()) {
        messages.add(new PasswordExpiringWarningMessageDescriptor(
                "Password expires in {0} days. Please change your password at <href=\"{1}\">{1}</a>",
                ttl.getDays(),
                configuration.getPasswordPolicyUrl()));
    }
    if (warning.getLoginsRemaining() > 0) {
        messages.add(new DefaultMessageDescriptor(
                "password.expiration.loginsRemaining",
                "You have {0} logins remaining before you MUST change your password.",
                warning.getLoginsRemaining()));

    }
}
 

import org.ldaptive.auth.AuthenticationResponse; //导入依赖的package包/类
@Override
protected HandlerResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential upc)
        throws GeneralSecurityException, PreventedException {
    final AuthenticationResponse response;
    try {
        logger.debug("Attempting LDAP authentication for {}", upc);
        final String password = getPasswordEncoder().encode(upc.getPassword());
        final AuthenticationRequest request = new AuthenticationRequest(upc.getUsername(),
                new org.ldaptive.Credential(password),
                this.authenticatedEntryAttributes);
        response = this.authenticator.authenticate(request);
    } catch (final LdapException e) {
        throw new PreventedException("Unexpected LDAP error", e);
    }
    logger.debug("LDAP response: {}", response);

    final List<MessageDescriptor> messageList;
    
    final LdapPasswordPolicyConfiguration ldapPasswordPolicyConfiguration =
            (LdapPasswordPolicyConfiguration) super.getPasswordPolicyConfiguration();
    if (ldapPasswordPolicyConfiguration != null) {
        logger.debug("Applying password policy to {}", response);
        messageList = ldapPasswordPolicyConfiguration.getAccountStateHandler().handle(
                response, ldapPasswordPolicyConfiguration);
    } else {
        messageList = Collections.emptyList();
    }
    
    if (response.getResult()) {
        return createHandlerResult(upc, createPrincipal(upc.getUsername(), response.getLdapEntry()), messageList);
    }

    if (AuthenticationResultCode.DN_RESOLUTION_FAILURE == response.getAuthenticationResultCode()) {
        throw new AccountNotFoundException(upc.getUsername() + " not found.");
    }
    throw new FailedLoginException("Invalid credentials");
}
 

import org.ldaptive.auth.AuthenticationResponse; //导入依赖的package包/类
@Override
protected HandlerResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential upc,
                                                             final String originalPassword) throws GeneralSecurityException, PreventedException {
    final AuthenticationResponse response;
    try {
        LOGGER.debug("Attempting LDAP authentication for [{}]. Authenticator pre-configured attributes are [{}], "
                        + "additional requested attributes for this authentication request are [{}]",
                upc, authenticator.getReturnAttributes(), authenticatedEntryAttributes);
        final AuthenticationRequest request = new AuthenticationRequest(upc.getUsername(),
                new org.ldaptive.Credential(upc.getPassword()), authenticatedEntryAttributes);
        response = authenticator.authenticate(request);
    } catch (final LdapException e) {
        LOGGER.trace(e.getMessage(), e);
        throw new PreventedException("Unexpected LDAP error", e);
    }
    LOGGER.debug("LDAP response: [{}]", response);

    final List<MessageDescriptor> messageList;
    final LdapPasswordPolicyConfiguration ldapPasswordPolicyConfiguration = (LdapPasswordPolicyConfiguration) super.getPasswordPolicyConfiguration();
    if (ldapPasswordPolicyConfiguration != null) {
        LOGGER.debug("Applying password policy to [{}]", response);
        messageList = ldapPasswordPolicyConfiguration.getAccountStateHandler().handle(response, ldapPasswordPolicyConfiguration);
    } else {
        LOGGER.debug("No ldap password policy configuration is defined");
        messageList = Collections.emptyList();
    }

    if (response.getResult()) {
        LOGGER.debug("LDAP response returned a result. Creating the final LDAP principal");
        return createHandlerResult(upc, createPrincipal(upc.getUsername(), response.getLdapEntry()), messageList);
    }

    if (AuthenticationResultCode.DN_RESOLUTION_FAILURE == response.getAuthenticationResultCode()) {
        LOGGER.warn("DN resolution failed. [{}]", response.getMessage());
        throw new AccountNotFoundException(upc.getUsername() + " not found.");
    }
    throw new FailedLoginException("Invalid credentials");
}
 

import org.ldaptive.auth.AuthenticationResponse; //导入依赖的package包/类
@Override
protected void handleWarning(
        final AccountState.Warning warning,
        final AuthenticationResponse response,
        final LdapPasswordPolicyConfiguration configuration,
        final List<MessageDescriptor> messages) {

    if (StringUtils.isBlank(this.warnAttributeName)) {
        LOGGER.debug("No warning attribute name is defined");
        return;
    }

    if (StringUtils.isBlank(this.warningAttributeValue)) {
        LOGGER.debug("No warning attribute value to match is defined");
        return;
    }
    
    final LdapAttribute attribute = response.getLdapEntry().getAttribute(
            this.warnAttributeName);
    boolean matches = false;
    if (attribute != null) {
        LOGGER.debug("Found warning attribute [{}] with value [{}]",
                attribute.getName(), attribute.getStringValue());
        matches = this.warningAttributeValue.equals(attribute.getStringValue());
    }
    LOGGER.debug("matches=[{}], displayWarningOnMatch=[{}]", matches,
            this.displayWarningOnMatch);
    if (this.displayWarningOnMatch == matches) {
        super.handleWarning(warning, response, configuration, messages);
    }
}
 

import org.ldaptive.auth.AuthenticationResponse; //导入依赖的package包/类
/**
 * Handle an account state error produced by ldaptive account state machinery.
 * <p>
 * Override this method to provide custom error handling.
 *
 * @param error         Account state error.
 * @param response      Ldaptive authentication response.
 * @param configuration Password policy configuration.
 * @param messages      Container for messages produced by account state error handling.
 * @throws LoginException On errors that should be communicated as login exceptions.
 */
protected void handleError(
        final AccountState.Error error,
        final AuthenticationResponse response,
        final LdapPasswordPolicyConfiguration configuration,
        final List<MessageDescriptor> messages)
        throws LoginException {

    LOGGER.debug("Handling error [{}]", error);
    final LoginException ex = this.errorMap.get(error);
    if (ex != null) {
        throw ex;
    }
    LOGGER.debug("No LDAP error mapping defined for [{}]", error);
}
 

import org.ldaptive.auth.AuthenticationResponse; //导入依赖的package包/类
/**
 * Handle an account state warning produced by ldaptive account state machinery.
 * <p>
 * Override this method to provide custom warning message handling.
 *
 * @param warning       the account state warning messages.
 * @param response      Ldaptive authentication response.
 * @param configuration Password policy configuration.
 * @param messages      Container for messages produced by account state warning handling.
 */
protected void handleWarning(
        final AccountState.Warning warning,
        final AuthenticationResponse response,
        final LdapPasswordPolicyConfiguration configuration,
        final List<MessageDescriptor> messages) {


    LOGGER.debug("Handling warning [{}]", warning);
    if (warning == null) {
        LOGGER.debug("Account state warning not defined");
        return;
    }

    final ZonedDateTime expDate = DateTimeUtils.zonedDateTimeOf(warning.getExpiration());
    final long ttl = ZonedDateTime.now(ZoneOffset.UTC).until(expDate, ChronoUnit.DAYS);
    LOGGER.debug(
            "Password expires in [{}] days. Expiration warning threshold is [{}] days.",
            ttl,
            configuration.getPasswordWarningNumberOfDays());
    if (configuration.isAlwaysDisplayPasswordExpirationWarning() || ttl < configuration.getPasswordWarningNumberOfDays()) {
        messages.add(new PasswordExpiringWarningMessageDescriptor("Password expires in {0} days.", ttl));
    }
    if (warning.getLoginsRemaining() > 0) {
        messages.add(new DefaultMessageDescriptor(
                "password.expiration.loginsRemaining",
                "You have {0} logins remaining before you MUST change your password.",
                warning.getLoginsRemaining()));

    }
}
 

import org.ldaptive.auth.AuthenticationResponse; //导入依赖的package包/类
/**
 * Maps boolean attribute values to their corresponding exception.
 * This handles ad-hoc password policies.
 *
 * @param response the authentication response.
 */
protected void handlePolicyAttributes(final AuthenticationResponse response) {
    final Collection<LdapAttribute> attrs = response.getLdapEntry().getAttributes();
    for (final LdapAttribute attr : attrs) {
        if (this.attributesToErrorMap.containsKey(attr.getName())
                && Boolean.parseBoolean(attr.getStringValue())) {
            final Class<LoginException> clazz = this.attributesToErrorMap.get(attr.getName());
            final LoginException ex = (LoginException) ClassUtils.newInstance(clazz);
            if (ex != null) {
                throw Throwables.propagate(ex);
            }
        }
    }
}
 

import org.ldaptive.auth.AuthenticationResponse; //导入依赖的package包/类
/**
 * Handle an account state error produced by ldaptive account state machinery.
 * <p>
 * Override this method to provide custom error handling.
 *
 * @param error Account state error.
 * @param response Ldaptive authentication response.
 * @param configuration Password policy configuration.
 * @param messages Container for messages produced by account state error handling.
 *
 * @throws LoginException On errors that should be communicated as login exceptions.
 */
protected void handleError(
        final AccountState.Error error,
        final AuthenticationResponse response,
        final LdapPasswordPolicyConfiguration configuration,
        final List<Message> messages)
        throws LoginException {

    logger.debug("Handling {}", error);
    final LoginException ex = ERROR_MAP.get(error);
    if (ex != null) {
        throw ex;
    }
    logger.debug("No LDAP error mapping defined for {}", error);
}
 

import org.ldaptive.auth.AuthenticationResponse; //导入依赖的package包/类
/**
 * Handle an account state warning produced by ldaptive account state machinery.
 * <p>
 * Override this method to provide custom warning message handling.
 *
 * @param error Account state warning.
 * @param response Ldaptive authentication response.
 * @param configuration Password policy configuration.
 * @param messages Container for messages produced by account state warning handling.
 */
protected void handleWarning(
        final AccountState.Warning warning,
        final AuthenticationResponse response,
        final LdapPasswordPolicyConfiguration configuration,
        final List<Message> messages) {

    if (warning == null) {
        logger.debug("Account state warning not defined");
        return;
    }

    final Calendar expDate = warning.getExpiration();
    final Days ttl = Days.daysBetween(Instant.now(), new Instant(expDate));
    logger.debug(
            "Password expires in {} days. Expiration warning threshold is {} days.",
            ttl.getDays(),
            configuration.getPasswordWarningNumberOfDays());
    if (configuration.isAlwaysDisplayPasswordExpirationWarning()
            || ttl.getDays() < configuration.getPasswordWarningNumberOfDays()) {
        messages.add(new PasswordExpiringWarningMessage(
                "Password expires in {0} days. Please change your password at <href=\"{1}\">{1}</a>",
                ttl.getDays(),
                configuration.getPasswordPolicyUrl()));
    }
    if (warning.getLoginsRemaining() > 0) {
        messages.add(new Message(
                "password.expiration.loginsRemaining",
                "You have {0} logins remaining before you MUST change your password.",
                warning.getLoginsRemaining()));

    }
}
 

import org.ldaptive.auth.AuthenticationResponse; //导入依赖的package包/类
@Override
protected HandlerResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential upc)
        throws GeneralSecurityException, PreventedException {
    final AuthenticationResponse response;
    try {
        logger.debug("Attempting LDAP authentication for {}", upc);
        final AuthenticationRequest request = new AuthenticationRequest(upc.getUsername(),
                new org.ldaptive.Credential(upc.getPassword()),
                this.authenticatedEntryAttributes);
        response = this.authenticator.authenticate(request);
    } catch (final LdapException e) {
        throw new PreventedException("Unexpected LDAP error", e);
    }
    logger.debug("LDAP response: {}", response);

    final List<Message> messageList;
    
    final LdapPasswordPolicyConfiguration ldapPasswordPolicyConfiguration =
            (LdapPasswordPolicyConfiguration) super.getPasswordPolicyConfiguration();
    if (ldapPasswordPolicyConfiguration != null) {
        logger.debug("Applying password policy to {}", response);
        messageList = ldapPasswordPolicyConfiguration.getAccountStateHandler().handle(
                response, ldapPasswordPolicyConfiguration);
    } else {
        messageList = Collections.emptyList();
    }
    
    if (response.getResult()) {
        return createHandlerResult(upc, createPrincipal(upc.getUsername(), response.getLdapEntry()), messageList);
    }

    if (AuthenticationResultCode.DN_RESOLUTION_FAILURE == response.getAuthenticationResultCode()) {
        throw new AccountNotFoundException(upc.getUsername() + " not found.");
    }
    throw new FailedLoginException("Invalid credentials.");
}
 

import org.ldaptive.auth.AuthenticationResponse; //导入依赖的package包/类
@Override
public void validate(final UsernamePasswordCredentials credentials, final WebContext context) throws HttpAction {
    init(context);

    final String username = credentials.getUsername();
    final String[] ldapAttributes = attributes.split(",");
    final AuthenticationResponse response;
    try {
        logger.debug("Attempting LDAP authentication for: {}", credentials);
        final AuthenticationRequest request = new AuthenticationRequest(username,
                new org.ldaptive.Credential(credentials.getPassword()),
                ldapAttributes);
        response = this.ldapAuthenticator.authenticate(request);
    } catch (final LdapException e) {
        throw new TechnicalException("Unexpected LDAP error", e);
    }
    logger.debug("LDAP response: {}", response);

    if (response.getResult()) {
        final LdapProfile profile = createProfile(username, ldapAttributes, response.getLdapEntry());
        credentials.setUserProfile(profile);
        return;
    }

    if (AuthenticationResultCode.DN_RESOLUTION_FAILURE == response.getAuthenticationResultCode()) {
        throw new AccountNotFoundException(username + " not found");
    }
    throw new BadCredentialsException("Invalid credentials for: " + username);
}