import org.apache.guacamole.net.auth.Credentials; //导入依赖的package包/类
/**
 * Returns an AuthenticatedUser representing the user authenticated by the
 * given credentials.
 *
 * @param credentials
 *     The credentials to use for authentication.
 *
 * @return
 *     An AuthenticatedUser representing the user authenticated by the
 *     given credentials.
 *
 * @throws GuacamoleException
 *     If an error occurs while authenticating the user, or if access is
 *     denied.
 */
public AuthenticatedUser authenticateUser(Credentials credentials)
        throws GuacamoleException {

    // Request UserData for the given credentials
    UserData userData = callbackService.retrieveUserData(credentials);
    if (userData == null)
        throw new GuacamoleInvalidCredentialsException("Permission denied.",
                CredentialsInfo.EMPTY);

    // Produce AuthenticatedUser associated with derived UserData
    AuthenticatedUser authenticatedUser = authenticatedUserProvider.get();
    authenticatedUser.init(credentials, userData);
    return authenticatedUser;

}
 

import org.apache.guacamole.net.auth.Credentials; //导入依赖的package包/类
@Test
public void testHostnameFailure() {

    // invalid payload
    Date exp = new Date(System.currentTimeMillis() + 10000L);
    Claims claims = getClaims();
    claims.remove("guac.hostname");
    claims.put("guac.hostnam", "192.168.42.2");
    String token = Jwts.builder().setClaims(claims).setExpiration(exp).signWith(SignatureAlgorithm.HS512, secretKey.getBytes()).compact();

    HttpServletRequest request = getHttpServletRequest(token);

    Credentials credentials = new Credentials();
    credentials.setRequest(request);

    JwtAuthenticationProvider authProvider = new JwtAuthenticationProvider(getInjector(), environment);

    Map<String, GuacamoleConfiguration> configs = authProvider.getAuthorizedConfigurations(credentials);

    assertNull(configs);
}
 

import org.apache.guacamole.net.auth.Credentials; //导入依赖的package包/类
/**
 * Creates a new SimpleAuthenticatedUser associated with the given
 * credentials and having access to the given Map of
 * GuacamoleConfigurations.
 *
 * @param credentials
 *     The credentials provided by the user when they authenticated.
 *
 * @param configs
 *     A Map of all GuacamoleConfigurations for which this user has
 *     access. The keys of this Map are Strings which uniquely identify
 *     each configuration.
 */
public SimpleAuthenticatedUser(Credentials credentials, Map<String, GuacamoleConfiguration> configs) {

    // Store credentials and configurations
    this.credentials = credentials;
    this.configs = configs;

    // Pull username from credentials if it exists
    String username = credentials.getUsername();
    if (username != null && !username.isEmpty())
        setIdentifier(username);

    // Otherwise generate a random username
    else
        setIdentifier(UUID.randomUUID().toString());

}
 

import org.apache.guacamole.net.auth.Credentials; //导入依赖的package包/类
/**
 * Given an arbitrary credentials object, returns a Map containing all
 * configurations authorized by those credentials, filtering those
 * configurations using a TokenFilter and the standard credential tokens
 * (like ${GUAC_USERNAME} and ${GUAC_PASSWORD}). The keys of this Map
 * are Strings which uniquely identify each configuration.
 *
 * @param credentials
 *     The credentials to use to retrieve authorized configurations.
 *
 * @return
 *     A Map of all configurations authorized by the given credentials, or
 *     null if the credentials given are not authorized.
 *
 * @throws GuacamoleException
 *     If an error occurs while retrieving configurations.
 */
private Map<String, GuacamoleConfiguration>
        getFilteredAuthorizedConfigurations(Credentials credentials)
        throws GuacamoleException {

    // Get configurations
    Map<String, GuacamoleConfiguration> configs =
            getAuthorizedConfigurations(credentials);

    // Return as unauthorized if not authorized to retrieve configs
    if (configs == null)
        return null;

    // Build credential TokenFilter
    TokenFilter tokenFilter = new TokenFilter();
    StandardTokens.addStandardTokens(tokenFilter, credentials);

    // Filter each configuration
    for (GuacamoleConfiguration config : configs.values())
        tokenFilter.filterValues(config.getParameters());

    return configs;

}
 

import org.apache.guacamole.net.auth.Credentials; //导入依赖的package包/类
@Override
public Map<String, GuacamoleConfiguration>
        getAuthorizedConfigurations(Credentials credentials)
        throws GuacamoleException {

    // Abort authorization if no user mapping exists
    UserMapping userMapping = getUserMapping();
    if (userMapping == null)
        return null;

    // Validate and return info for given user and pass
    Authorization auth = userMapping.getAuthorization(credentials.getUsername());
    if (auth != null && auth.validate(credentials.getUsername(), credentials.getPassword()))
        return auth.getConfigurations();

    // Unauthorized
    return null;

}
 

import org.apache.guacamole.net.auth.Credentials; //导入依赖的package包/类
@Override
public Map<String, GuacamoleConfiguration> getAuthorizedConfigurations(Credentials credentials) throws GuacamoleException {

    // Check mapping file mod time
    File configFile = getConfigurationFile();
    if (configFile.exists() && configTime < configFile.lastModified()) {

        // If modified recently, gain exclusive access and recheck
        synchronized (this) {
            if (configFile.exists() && configTime < configFile.lastModified()) {
                logger.debug("Configuration file \"{}\" has been modified.", configFile);
                init(); // If still not up to date, re-init
            }
        }

    }

    // If no mapping available, report as such
    if (configs == null)
        throw new GuacamoleServerException("Configuration could not be read.");

    return configs;

}
 

import org.apache.guacamole.net.auth.Credentials; //导入依赖的package包/类
/**
 * Derives the remote host of the authenticating user from the given
 * credentials object. The remote host is derived from X-Forwarded-For
 * in addition to the actual source IP of the request, and thus is not
 * trusted. The derived remote host is really only useful for logging,
 * unless the server is configured such that X-Forwarded-For is guaranteed
 * to be trustworthy.
 *
 * @param credentials
 *     The credentials to derive the remote host from.
 *
 * @return
 *     The remote host from which the user with the given credentials is
 *     authenticating.
 */
private static String getRemoteHost(Credentials credentials) {

    HttpServletRequest request = credentials.getRequest();

    // Use X-Forwarded-For, if present and valid
    String header = request.getHeader("X-Forwarded-For");
    if (header != null) {
        Matcher matcher = X_FORWARDED_FOR.matcher(header);
        if (matcher.matches())
            return matcher.group(1);
    }

    // If header absent or invalid, just use source IP
    return request.getRemoteAddr();

}
 

import org.apache.guacamole.net.auth.Credentials; //导入依赖的package包/类
/**
 * Retrieves the user corresponding to the given credentials from the
 * database. Note that this function will not enforce any additional
 * account restrictions, including explicitly disabled accounts,
 * scheduling, and password expiration. It is the responsibility of the
 * caller to enforce such restrictions, if desired.
 *
 * @param authenticationProvider
 *     The AuthenticationProvider on behalf of which the user is being
 *     retrieved.
 *
 * @param credentials
 *     The credentials to use when locating the user.
 *
 * @return
 *     An AuthenticatedUser containing the existing ModeledUser object if
 *     the credentials given are valid, null otherwise.
 *
 * @throws GuacamoleException
 *     If the provided credentials to not conform to expectations.
 */
public ModeledAuthenticatedUser retrieveAuthenticatedUser(AuthenticationProvider authenticationProvider,
        Credentials credentials) throws GuacamoleException {

    // Get username and password
    String username = credentials.getUsername();
    String password = credentials.getPassword();

    // Retrieve corresponding user model, if such a user exists
    UserModel userModel = userMapper.selectOne(username);
    if (userModel == null)
        return null;

    // Verify provided password is correct
    byte[] hash = encryptionService.createPasswordHash(password, userModel.getPasswordSalt());
    if (!Arrays.equals(hash, userModel.getPasswordHash()))
        return null;

    // Create corresponding user object, set up cyclic reference
    ModeledUser user = getObjectInstance(null, userModel);
    user.setCurrentUser(new ModeledAuthenticatedUser(authenticationProvider, user, credentials));

    // Return now-authenticated user
    return user.getCurrentUser();

}
 

import org.apache.guacamole.net.auth.Credentials; //导入依赖的package包/类
/**
 * Returns a UserContext object initialized with data accessible to the
 * given AuthenticatedUser.
 *
 * @param authenticatedUser
 *     The AuthenticatedUser to retrieve data for.
 *
 * @return
 *     A UserContext object initialized with data accessible to the given
 *     AuthenticatedUser.
 *
 * @throws GuacamoleException
 *     If the UserContext cannot be created due to an error.
 */
public UserContext getUserContext(org.apache.guacamole.net.auth.AuthenticatedUser authenticatedUser)
        throws GuacamoleException {

    // Bind using credentials associated with AuthenticatedUser
    Credentials credentials = authenticatedUser.getCredentials();
    LDAPConnection ldapConnection = bindAs(credentials);
    if (ldapConnection == null)
        return null;

    try {

        // Build user context by querying LDAP
        UserContext userContext = userContextProvider.get();
        userContext.init(authenticatedUser, ldapConnection);
        return userContext;

    }

    // Always disconnect
    finally {
        ldapService.disconnect(ldapConnection);
    }

}
 

import org.apache.guacamole.net.auth.Credentials; //导入依赖的package包/类
/**
 * Returns an AuthenticatedUser representing the user authenticated by the
 * given credentials.
 *
 * @param credentials
 *     The credentials to use for authentication.
 *
 * @return
 *     An AuthenticatedUser representing the user authenticated by the
 *     given credentials.
 *
 * @throws GuacamoleException
 *     If an error occurs while authenticating the user, or if access is
 *     denied.
 */
public AuthenticatedUser authenticateUser(Credentials credentials)
        throws GuacamoleException {

    // Pull HTTP header from request if present
    HttpServletRequest request = credentials.getRequest();
    if (request != null) {

        // Get the username from the header configured in guacamole.properties
        String username = request.getHeader(confService.getHttpAuthHeader());

        if (username != null) {
            AuthenticatedUser authenticatedUser = authenticatedUserProvider.get();
            authenticatedUser.init(username, credentials);
            return authenticatedUser;
        }

    }

    // Authentication not provided via header, yet, so we request it.
    throw new GuacamoleInvalidCredentialsException("Invalid login.", CredentialsInfo.USERNAME_PASSWORD);

}
 

import org.apache.guacamole.net.auth.Credentials; //导入依赖的package包/类
/**
 * Returns an AuthenticatedUser representing the user authenticated by the
 * given credentials.
 *
 * @param credentials
 *     The credentials to use for authentication.
 *
 * @return
 *     An AuthenticatedUser representing the user authenticated by the
 *     given credentials.
 *
 * @throws GuacamoleException
 *     If an error occurs while authenticating the user, or if access is
 *     denied.
 */
public AuthenticatedUser authenticateUser(Credentials credentials)
        throws GuacamoleException {

    String token = null;

    // Pull OAuth token from request if present
    HttpServletRequest request = credentials.getRequest();
    if (request != null)
        token = request.getParameter(OAuthTokenField.PARAMETER_NAME);

    // If token provided, validate and produce authenticated user
    if (token != null) {

        // Create corresponding authenticated user
        AuthenticatedUser authenticatedUser = authenticatedUserProvider.get();
        authenticatedUser.init(tokenService.processUsername(token), credentials);
        return authenticatedUser;

    }

    // Request OAuth token
    throw new GuacamoleInvalidCredentialsException("Invalid login.",
        new CredentialsInfo(Arrays.asList(new Field[] {

            // OAuth-specific token (will automatically redirect the user
            // to the authorization page via JavaScript)
            new OAuthTokenField(
                confService.getAuthorizationEndpoint(),
                confService.getClientID(),
                confService.getRedirectURI()
            )

        }))
    );

}
 

import org.apache.guacamole.net.auth.Credentials; //导入依赖的package包/类
@Override
public AuthenticatedUser authenticateUser(Credentials credentials)
        throws GuacamoleException {

    // Attempt to authenticate user with given credentials
    AuthenticationProviderService authProviderService = injector.getInstance(AuthenticationProviderService.class);
    return authProviderService.authenticateUser(credentials);

}
 

import org.apache.guacamole.net.auth.Credentials; //导入依赖的package包/类
@Override
public AuthenticatedUser updateAuthenticatedUser(
        AuthenticatedUser authenticatedUser, Credentials credentials)
        throws GuacamoleException {

    // No update necessary
    return authenticatedUser;

}
 

import org.apache.guacamole.net.auth.Credentials; //导入依赖的package包/类
@Override
public UserContext updateUserContext(UserContext context,
        AuthenticatedUser authenticatedUser, Credentials credentials)
        throws GuacamoleException {

    // No update necessary
    return context;

}
 

import org.apache.guacamole.net.auth.Credentials; //导入依赖的package包/类
/**
 * Adds tokens which are standardized by guacamole-ext to the given
 * TokenFilter using the values from the given Credentials object. These
 * standardized tokens include the current username (GUAC_USERNAME),
 * password (GUAC_PASSWORD), and the server date and time (GUAC_DATE and
 * GUAC_TIME respectively). If either the username or password are not set
 * within the given credentials, the corresponding token(s) will remain
 * unset.
 *
 * @param filter
 *     The TokenFilter to add standard tokens to.
 *
 * @param credentials
 *     The Credentials to use when populating the GUAC_USERNAME and
 *     GUAC_PASSWORD tokens.
 */
public static void addStandardTokens(TokenFilter filter, Credentials credentials) {

    // Add username token
    String username = credentials.getUsername();
    if (username != null)
        filter.setToken(USERNAME_TOKEN, username);

    // Add password token
    String password = credentials.getPassword();
    if (password != null)
        filter.setToken(PASSWORD_TOKEN, password);

    // Add client hostname token
    String hostname = credentials.getRemoteHostname();
    if (hostname != null)
        filter.setToken(CLIENT_HOSTNAME_TOKEN, hostname);

    // Add client address token
    String address = credentials.getRemoteAddress();
    if (address != null)
        filter.setToken(CLIENT_ADDRESS_TOKEN, address);

    // Add any tokens which do not require credentials
    addStandardTokens(filter);

}
 

import org.apache.guacamole.net.auth.Credentials; //导入依赖的package包/类
@Override
public AuthenticatedUser authenticateUser(final Credentials credentials)
        throws GuacamoleException {

    // Get configurations
    Map<String, GuacamoleConfiguration> configs =
            getFilteredAuthorizedConfigurations(credentials);

    // Return as unauthorized if not authorized to retrieve configs
    if (configs == null)
        return null;

    return new SimpleAuthenticatedUser(credentials, configs);

}
 

import org.apache.guacamole.net.auth.Credentials; //导入依赖的package包/类
@Override
public AuthenticatedUser updateAuthenticatedUser(AuthenticatedUser authenticatedUser,
        Credentials credentials) throws GuacamoleException {

    // Simply return the given user, updating nothing
    return authenticatedUser;

}
 

import org.apache.guacamole.net.auth.Credentials; //导入依赖的package包/类
@Override
public UserContext updateUserContext(UserContext context,
    AuthenticatedUser authorizedUser, Credentials credentials)
        throws GuacamoleException {

    // Simply return the given context, updating nothing
    return context;
    
}
 

import org.apache.guacamole.net.auth.Credentials; //导入依赖的package包/类
@Override
public AuthenticatedUser authenticateUser(Credentials credentials)
        throws GuacamoleException {

    // Ignore auth attempts if no auth provider could be loaded
    if (authProvider == null) {
        logger.warn("Authentication attempt denied because the authentication system could not be loaded. Please check for errors earlier in the logs.");
        throw new GuacamoleInvalidCredentialsException("Permission denied.", CredentialsInfo.USERNAME_PASSWORD);
    }

    // Delegate to underlying auth provider
    return authProvider.authenticateUser(credentials);

}
 

import org.apache.guacamole.net.auth.Credentials; //导入依赖的package包/类
@Override
public AuthenticatedUser updateAuthenticatedUser(AuthenticatedUser authenticatedUser,
        Credentials credentials) throws GuacamoleException {

    // Ignore auth attempts if no auth provider could be loaded
    if (authProvider == null) {
        logger.warn("Reauthentication attempt denied because the authentication system could not be loaded. Please check for errors earlier in the logs.");
        throw new GuacamoleInvalidCredentialsException("Permission denied.", CredentialsInfo.USERNAME_PASSWORD);
    }

    // Delegate to underlying auth provider
    return authProvider.updateAuthenticatedUser(authenticatedUser, credentials);

}