import org.apereo.cas.authentication.PreventedException; //导入依赖的package包/类
@Override
protected HandlerResult doAuthentication(final Credential credential) throws GeneralSecurityException, PreventedException {
    try {
        final RadiusTokenCredential radiusCredential = (RadiusTokenCredential) credential;
        final String password = radiusCredential.getToken();

        final RequestContext context = RequestContextHolder.getRequestContext();
        final String username = WebUtils.getAuthentication(context).getPrincipal().getId();

        final Pair<Boolean, Optional<Map<String, Object>>> result =
                RadiusUtils.authenticate(username, password, this.servers,
                        this.failoverOnAuthenticationFailure, this.failoverOnException);
        if (result.getKey()) {
            return createHandlerResult(credential,
                    this.principalFactory.createPrincipal(username, result.getValue().get()),
                    new ArrayList<>());
        }
        throw new FailedLoginException("Radius authentication failed for user " + username);
    } catch (final Exception e) {
        throw new FailedLoginException("Radius authentication failed " + e.getMessage());
    }
}
 

import org.apereo.cas.authentication.PreventedException; //导入依赖的package包/类
@Override
protected HandlerResult doAuthentication(final Credential credential) throws GeneralSecurityException, PreventedException {
    try {
        final AzureAuthenticatorTokenCredential c = (AzureAuthenticatorTokenCredential) credential;
        final RequestContext context = RequestContextHolder.getRequestContext();
        final Principal principal = WebUtils.getAuthentication(context).getPrincipal();

        LOGGER.debug("Received principal id [{}]", principal.getId());
        final PFAuthParams params = authenticationRequestBuilder.build(principal, c);
        final PFAuthResult r = azureAuthenticatorInstance.authenticate(params);

        if (r.getAuthenticated()) {
            return createHandlerResult(c, principalFactory.createPrincipal(principal.getId()), null);
        }
        LOGGER.error("Authentication failed. Call status: [{}]-[{}]. Error: [{}]", r.getCallStatus(),
                r.getCallStatusString(), r.getMessageError());

    } catch (final Exception e) {
        LOGGER.error(e.getMessage(), e);
    }
    throw new FailedLoginException("Failed to authenticate user");
}
 

import org.apereo.cas.authentication.PreventedException; //导入依赖的package包/类
@Override
protected HandlerResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential transformedCredential, 
                                                             final String originalPassword)
        throws GeneralSecurityException, PreventedException {
    try {
        if (this.fileName == null) {
            throw new FileNotFoundException("Filename does not exist");
        }
        final String username = transformedCredential.getUsername();
        final String passwordOnRecord = getPasswordOnRecord(username);
        if (StringUtils.isBlank(passwordOnRecord)) {
            throw new AccountNotFoundException(username + " not found in backing file.");
        }
        if (matches(originalPassword, passwordOnRecord)) {
            return createHandlerResult(transformedCredential, this.principalFactory.createPrincipal(username), null);
        }
    } catch (final IOException e) {
        throw new PreventedException("IO error reading backing file", e);
    }
    throw new FailedLoginException();
}
 

import org.apereo.cas.authentication.PreventedException; //导入依赖的package包/类
@Override
protected HandlerResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential credential, final String originalPassword)
        throws GeneralSecurityException, PreventedException {

    try {
        final String username = credential.getUsername();
        final Pair<Boolean, Optional<Map<String, Object>>> result =
                RadiusUtils.authenticate(username, credential.getPassword(), this.servers,
                        this.failoverOnAuthenticationFailure, this.failoverOnException);
        if (result.getKey()) {
            return createHandlerResult(credential,
                    this.principalFactory.createPrincipal(username, result.getValue().get()),
                    new ArrayList<>());
        }
        throw new FailedLoginException("Radius authentication failed for user " + username);
    } catch (final Exception e) {
        throw new FailedLoginException("Radius authentication failed " + e.getMessage());
    }
}
 

import org.apereo.cas.authentication.PreventedException; //导入依赖的package包/类
@Override
protected HandlerResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential c, final String originalPassword)
        throws GeneralSecurityException, PreventedException {

    try {
        final UsernamePasswordCredential creds = new UsernamePasswordCredential(c.getUsername(), c.getPassword());
        
        final ResponseEntity<SimplePrincipal> authenticationResponse = api.authenticate(creds);
        if (authenticationResponse.getStatusCode() == HttpStatus.OK) {
            final SimplePrincipal principalFromRest = authenticationResponse.getBody();
            if (principalFromRest == null || StringUtils.isBlank(principalFromRest.getId())) {
                throw new FailedLoginException("Could not determine authentication response from rest endpoint for " + c.getUsername());
            }
            return createHandlerResult(c,
                    this.principalFactory.createPrincipal(principalFromRest.getId(), principalFromRest.getAttributes()),
                    new ArrayList<>());
        }
    } catch (final HttpClientErrorException e) {
        if (e.getStatusCode() == HttpStatus.FORBIDDEN) {
            throw new AccountDisabledException("Could not authenticate forbidden account for " + c.getUsername());
        }
        if (e.getStatusCode() == HttpStatus.UNAUTHORIZED) {
            throw new FailedLoginException("Could not authenticate account for " + c.getUsername());
        }
        if (e.getStatusCode() == HttpStatus.NOT_FOUND) {
            throw new AccountNotFoundException("Could not locate account for " + c.getUsername());
        }
        if (e.getStatusCode() == HttpStatus.LOCKED) {
            throw new AccountLockedException("Could not authenticate locked account for " + c.getUsername());
        }
        if (e.getStatusCode() == HttpStatus.PRECONDITION_REQUIRED) {
            throw new AccountExpiredException("Could not authenticate expired account for " + c.getUsername());
        }

        throw new FailedLoginException("Rest endpoint returned an unknown status code "
                + e.getStatusCode() + " for " + c.getUsername());
    }
    throw new FailedLoginException("Rest endpoint returned an unknown response for " + c.getUsername());
}
 

import org.apereo.cas.authentication.PreventedException; //导入依赖的package包/类
/**
 * Build the handler result.
 *
 * @param credentials the provided credentials
 * @param profile     the retrieved user profile
 * @return the built handler result
 * @throws GeneralSecurityException On authentication failure.
 * @throws PreventedException       On the indeterminate case when authentication is prevented.
 */
protected HandlerResult createResult(final ClientCredential credentials, final UserProfile profile)
        throws GeneralSecurityException, PreventedException {

    if (profile != null) {
        final String id;
        if (isTypedIdUsed) {
            id = profile.getTypedId();
        } else {
            id = profile.getId();
        }
        if (StringUtils.isNotBlank(id)) {
            credentials.setUserProfile(profile);
            credentials.setTypedIdUsed(isTypedIdUsed);
            return new DefaultHandlerResult(
                    this,
                    new BasicCredentialMetaData(credentials),
                    this.principalFactory.createPrincipal(id, profile.getAttributes()));
        }

        throw new FailedLoginException("No identifier found for this user profile: " + profile);
    }

    throw new FailedLoginException("Authentication did not produce a user profile for: " + credentials);
}
 

import org.apereo.cas.authentication.PreventedException; //导入依赖的package包/类
@Override
protected HandlerResult doAuthentication(final Credential credential) throws GeneralSecurityException, PreventedException {
    final AuthyTokenCredential tokenCredential = (AuthyTokenCredential) credential;
    final RequestContext context = RequestContextHolder.getRequestContext();
    final Principal principal = WebUtils.getAuthentication(context).getPrincipal();

    final User user = instance.getOrCreateUser(principal);
    if (!user.isOk()) {
        throw new FailedLoginException(AuthyClientInstance.getErrorMessage(user.getError()));
    }

    final Map<String, String> options = new HashMap<>(1);
    options.put("force", this.forceVerification.toString());

    final Token verification = this.instance.getAuthyTokens().verify(user.getId(), tokenCredential.getToken(), options);

    if (!verification.isOk()) {
        throw new FailedLoginException(AuthyClientInstance.getErrorMessage(verification.getError()));
    }

    return createHandlerResult(tokenCredential, principal, new ArrayList<>());
}
 

import org.apereo.cas.authentication.PreventedException; //导入依赖的package包/类
@Override
protected HandlerResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential credential, final String originalPassword)
        throws GeneralSecurityException, PreventedException {

    if (this.kerberosKdcSystemProperty != null) {
        LOGGER.debug("Configured kerberos system property [{}] to [{}]", SYS_PROP_KERB5_KDC, this.kerberosKdcSystemProperty);
        System.setProperty(SYS_PROP_KERB5_KDC, this.kerberosKdcSystemProperty);
    }
    if (this.kerberosRealmSystemProperty != null) {
        LOGGER.debug("Setting kerberos system property [{}] to [{}]", SYS_PROP_KRB5_REALM, this.kerberosRealmSystemProperty);
        System.setProperty(SYS_PROP_KRB5_REALM, this.kerberosRealmSystemProperty);
    }

    final String username = credential.getUsername();
    final String password = credential.getPassword();

    final LoginContext lc = new LoginContext(this.realm, new UsernamePasswordCallbackHandler(username, password));
    try {
        LOGGER.debug("Attempting authentication for: [{}]", username);
        lc.login();
    } finally {
        lc.logout();
    }

    Principal principal = null;
    final Set<java.security.Principal> principals = lc.getSubject().getPrincipals();
    if (principals != null && !principals.isEmpty()) {
        final java.security.Principal secPrincipal = principals.iterator().next();
        principal = this.principalFactory.createPrincipal(secPrincipal.getName());
    }
    return createHandlerResult(credential, principal, null);
}
 

import org.apereo.cas.authentication.PreventedException; //导入依赖的package包/类
@Override
protected HandlerResult doAuthentication(Credential credential) throws GeneralSecurityException, PreventedException {
    final Map<String, Object> map = new LinkedHashMap<>();
    if (credential instanceof TaraCredential) {
        TaraCredential taraCredential = (TaraCredential) credential;
        this.putIfNotEmpty(map, "principalCode", taraCredential.getPrincipalCode());
        this.putIfNotEmpty(map, "firstName", taraCredential.getFirstName());
        this.putIfNotEmpty(map, "lastName", taraCredential.getLastName());
        if (AuthenticationType.MobileID.equals(taraCredential.getType())) {
            this.putIfNotEmpty(map, "mobileNumber", taraCredential.getMobileNumber());
        }
        return this.createHandlerResult(credential, this.principalFactory
            .createPrincipal(taraCredential.getId(), map), new ArrayList<>());
    }
    return null;
}
 

import org.apereo.cas.authentication.PreventedException; //导入依赖的package包/类
@Override
protected HandlerResult doAuthentication(final Credential credential) throws GeneralSecurityException, PreventedException {
    final GoogleAuthenticatorTokenCredential tokenCredential = (GoogleAuthenticatorTokenCredential) credential;

    if (!NumberUtils.isCreatable(tokenCredential.getToken())) {
        throw new PreventedException("Invalid non-numeric OTP format specified.",
                new IllegalArgumentException("Invalid token " + tokenCredential.getToken()));
    }
    final int otp = Integer.parseInt(tokenCredential.getToken());
    LOGGER.debug("Received OTP [{}]", otp);

    final RequestContext context = RequestContextHolder.getRequestContext();
    if (context == null) {
        new IllegalArgumentException("No request context could be found to locate an authentication event");
    }
    final Authentication authentication = WebUtils.getAuthentication(context);
    if (authentication == null) {
        new IllegalArgumentException("Request context has no reference to an authentication event to locate a principal");
    }
    final String uid = authentication.getPrincipal().getId();

    LOGGER.debug("Received principal id [{}]", uid);
    final String secKey = this.credentialRepository.getSecret(uid);
    if (StringUtils.isBlank(secKey)) {
        throw new AccountNotFoundException(uid + " cannot be found in the registry");
    }

    if (this.tokenRepository.exists(uid, otp)) {
        throw new AccountExpiredException(uid + " cannot reuse OTP " + otp + " as it may be expired/invalid");
    }

    final boolean isCodeValid = this.googleAuthenticatorInstance.authorize(secKey, otp);
    if (isCodeValid) {
        this.tokenRepository.store(new GoogleAuthenticatorToken(otp, uid));
        return createHandlerResult(tokenCredential, this.principalFactory.createPrincipal(uid), null);
    }
    throw new FailedLoginException("Failed to authenticate code " + otp);
}
 

import org.apereo.cas.authentication.PreventedException; //导入依赖的package包/类
@Override
protected HandlerResult doAuthentication(final Credential credential) throws GeneralSecurityException, PreventedException {
    final YubiKeyCredential yubiKeyCredential = (YubiKeyCredential) credential;

    final String otp = yubiKeyCredential.getToken();

    if (!YubicoClient.isValidOTPFormat(otp)) {
        LOGGER.debug("Invalid OTP format [{}]", otp);
        throw new AccountNotFoundException("OTP format is invalid");
    }

    final RequestContext context = RequestContextHolder.getRequestContext();
    final String uid = WebUtils.getAuthentication(context).getPrincipal().getId();
    final String publicId = YubicoClient.getPublicId(otp);
    if (this.registry != null
            && !this.registry.isYubiKeyRegisteredFor(uid, publicId)) {
        LOGGER.debug("YubiKey public id [{}] is not registered for user [{}]", publicId, uid);
        throw new AccountNotFoundException("YubiKey id is not recognized in registry");
    }

    try {
        final VerificationResponse response = this.client.verify(otp);
        final ResponseStatus status = response.getStatus();
        if (status.compareTo(ResponseStatus.OK) == 0) {
            LOGGER.debug("YubiKey response status [{}] at [{}]", status, response.getTimestamp());
            return createHandlerResult(yubiKeyCredential, this.principalFactory.createPrincipal(uid), null);
        }
        throw new FailedLoginException("Authentication failed with status: " + status);
    } catch (final YubicoVerificationException | YubicoValidationFailure e) {
        LOGGER.error(e.getMessage(), e);
        throw new FailedLoginException("YubiKey validation failed: " + e.getMessage());
    }
}
 

import org.apereo.cas.authentication.PreventedException; //导入依赖的package包/类
@Override
protected HandlerResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential credential, final String originalPassword)
        throws GeneralSecurityException, PreventedException {

    final String username = credential.getUsername();
    if (this.users.contains(username)) {
        throw new FailedLoginException();
    }

    return createHandlerResult(credential, this.principalFactory.createPrincipal(username), null);
}
 

import org.apereo.cas.authentication.PreventedException; //导入依赖的package包/类
@Test
public void verifyAuthenticateNoFileName() throws Exception {
    final UsernamePasswordCredential c = new UsernamePasswordCredential();
    this.authenticationHandler = new FileAuthenticationHandler("", null, null, new ClassPathResource("fff"), FileAuthenticationHandler.DEFAULT_SEPARATOR);

    c.setUsername("scott");
    c.setPassword("rutgers");

    this.thrown.expect(PreventedException.class);
    this.thrown.expectMessage("IO error reading backing file");

    this.authenticationHandler.authenticate(c);
}
 

import org.apereo.cas.authentication.PreventedException; //导入依赖的package包/类
@Override
protected HandlerResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential credential, final String originalPassword)
        throws GeneralSecurityException, PreventedException {

    String sql = null;
    if (StringUtils.isNotBlank(tableUsers) || StringUtils.isNotBlank(fieldUser) || StringUtils.isNotBlank(fieldPassword)) {
        sql = "SELECT COUNT('x') FROM ".concat(this.tableUsers).concat(" WHERE ").concat(this.fieldUser)
                .concat(" = ? AND ").concat(this.fieldPassword).concat("= ?");
    }

    if (StringUtils.isBlank(sql) || getJdbcTemplate() == null) {
        throw new GeneralSecurityException("Authentication handler is not configured correctly. "
                + "No SQL statement or JDBC template found");
    }

    final String username = credential.getUsername();
    try {
        LOGGER.debug("Executing SQL query [{}]", sql);

        final int count = getJdbcTemplate().queryForObject(sql, Integer.class, username, credential.getPassword());
        if (count == 0) {
            throw new FailedLoginException(username + " not found with SQL query.");
        }
        return createHandlerResult(credential, this.principalFactory.createPrincipal(username), null);
    } catch (final DataAccessException e) {
        throw new PreventedException("SQL exception while executing query for " + username, e);
    }
}
 

import org.apereo.cas.authentication.PreventedException; //导入依赖的package包/类
@Test
public void verifyBadQuery() throws Exception {
    final QueryDatabaseAuthenticationHandler q = new QueryDatabaseAuthenticationHandler("", null, null, null, this.dataSource, SQL.replace("*", "error"),
            PASSWORD_FIELD, null, null, Collections.emptyMap());
    this.thrown.expect(PreventedException.class);
    q.authenticate(CoreAuthenticationTestUtils.getCredentialsWithDifferentUsernameAndPassword("user0", "psw0"));
}
 

import org.apereo.cas.authentication.PreventedException; //导入依赖的package包/类
@Test
public void verifyAuthenticationInvalidSql() throws Exception {
    final QueryAndEncodeDatabaseAuthenticationHandler q = new QueryAndEncodeDatabaseAuthenticationHandler("", null, null, null, dataSource, ALG_NAME,
            buildSql("makesNoSenseInSql"), PASSWORD_FIELD_NAME, "salt", null, null, "ops", 0, "");

    this.thrown.expect(PreventedException.class);
    this.thrown.expectMessage("SQL exception while executing query for test");

    q.authenticate(CoreAuthenticationTestUtils.getCredentialsWithSameUsernameAndPassword());
}
 

import org.apereo.cas.authentication.PreventedException; //导入依赖的package包/类
@Override
protected HandlerResult doAuthentication(final Credential credential) throws GeneralSecurityException, PreventedException {
    CommonHelper.assertNotNull("profileCreator", this.profileCreator);

    final C credentials = convertToPac4jCredentials((I) credential);
    LOGGER.debug("credentials: [{}]", credentials);

    try {
        final Authenticator authenticator = getAuthenticator(credential);
 
        if (authenticator instanceof InitializableObject) {
            ((InitializableObject) authenticator).init();
        }
        if (authenticator instanceof InitializableWebObject) {
            ((InitializableWebObject) authenticator).init(getWebContext());
        }
        
        CommonHelper.assertNotNull("authenticator", authenticator);
        authenticator.validate(credentials, getWebContext());

        final UserProfile profile = this.profileCreator.create(credentials, getWebContext());
        LOGGER.debug("profile: [{}]", profile);

        return createResult(new ClientCredential(credentials), profile);
    } catch (final Exception e) {
        LOGGER.error("Failed to validate credentials", e);
        throw new FailedLoginException("Failed to validate credentials: " + e.getMessage());
    }
}
 

import org.apereo.cas.authentication.PreventedException; //导入依赖的package包/类
@Override
protected TokenCredentials convertToPac4jCredentials(final BasicIdentifiableCredential casCredential)
        throws GeneralSecurityException, PreventedException {
    LOGGER.debug("CAS credentials: [{}]", casCredential);

    final String id = this.principalNameTransformer.transform(casCredential.getId());
    if (id == null) {
        throw new AccountNotFoundException("Id is null.");
    }
    final TokenCredentials credentials = new TokenCredentials(id, getClass().getSimpleName());
    LOGGER.debug("pac4j credentials: [{}]", credentials);
    return credentials;
}
 

import org.apereo.cas.authentication.PreventedException; //导入依赖的package包/类
@Override
protected UsernamePasswordCredentials convertToPac4jCredentials(final UsernamePasswordCredential casCredential)
        throws GeneralSecurityException, PreventedException {
    LOGGER.debug("CAS credentials: [{}]", casCredential);

    final String username = this.principalNameTransformer.transform(casCredential.getUsername());
    if (username == null) {
        throw new AccountNotFoundException("Username is null.");
    }
    final String password = this.passwordEncoder.encode(casCredential.getPassword());
    final UsernamePasswordCredentials credentials = new UsernamePasswordCredentials(username, password, getClass().getSimpleName());
    LOGGER.debug("pac4j credentials: [{}]", credentials);
    return credentials;
}
 

import org.apereo.cas.authentication.PreventedException; //导入依赖的package包/类
@Override
protected HandlerResult doAuthentication(final Credential credential) throws GeneralSecurityException, PreventedException {
    try {
        final ClientCredential clientCredentials = (ClientCredential) credential;
        LOGGER.debug("clientCredentials  [{}]", clientCredentials);

        final Credentials credentials = clientCredentials.getCredentials();
        final String clientName = credentials.getClientName();
        LOGGER.debug("clientName:  [{}]", clientName);

        // get client
        final Client client = this.clients.findClient(clientName);
        LOGGER.debug("client: [{}]", client);

        // web context
        final HttpServletRequest request = WebUtils.getHttpServletRequest();
        final HttpServletResponse response = WebUtils.getHttpServletResponse();
        final WebContext webContext = WebUtils.getPac4jJ2EContext(request, response);

        // get user profile
        final UserProfile userProfile = client.getUserProfile(credentials, webContext);
        LOGGER.debug("userProfile: [{}]", userProfile);
        return createResult(clientCredentials, userProfile);
    } catch (final HttpAction e) {
        throw new PreventedException(e);
    }
}