import com.yubico.client.v2.YubicoClient; //导入依赖的package包/类
/**
 * {@inheritDoc}
 * Attempts to authenticate the received credentials using the Yubico cloud validation platform.
 * In this implementation, the {@link UsernamePasswordCredential#getUsername()}
 * is mapped to the {@code uid} which will be used by the plugged-in instance of the
 * {@link YubiKeyAccountRegistry}
 * and the {@link UsernamePasswordCredential#getPassword()} is the received
 * one-time password token issued by the YubiKey device.
 */
@Override
protected HandlerResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential transformedCredential)
        throws GeneralSecurityException, PreventedException {

    final String uid = transformedCredential.getUsername();
    final String otp = transformedCredential.getPassword();

    if (!YubicoClient.isValidOTPFormat(otp)) {
        logger.debug("Invalid OTP format [{}]", otp);
        throw new FailedLoginException("OTP format is invalid");
    }

    final String publicId = YubicoClient.getPublicId(otp);
    if (this.registry != null
          &&!this.registry.isYubiKeyRegisteredFor(uid, publicId)) {
        logger.debug("YubiKey public id [{}] is not registered for user [{}]", publicId, uid);
        throw new AccountNotFoundException("YubiKey id is not recognized in registry");
    }

    try {
        final VerificationResponse response = this.client.verify(otp);
        final ResponseStatus status = response.getStatus();
        if (status.compareTo(ResponseStatus.OK) == 0) {
            logger.debug("YubiKey response status {} at {}", status, response.getTimestamp());
            return createHandlerResult(transformedCredential,
                    this.principalFactory.createPrincipal(uid), null);
        }
        throw new FailedLoginException("Authentication failed with status: " + status);
    } catch (final YubicoVerificationException | YubicoValidationFailure e) {
        logger.error(e.getMessage(), e);
        throw new FailedLoginException("YubiKey validation failed: " + e.getMessage());
    }
}
 

import com.yubico.client.v2.YubicoClient; //导入依赖的package包/类
@Override
protected HandlerResult doAuthentication(final Credential credential) throws GeneralSecurityException, PreventedException {
    final YubiKeyCredential yubiKeyCredential = (YubiKeyCredential) credential;

    final String otp = yubiKeyCredential.getToken();

    if (!YubicoClient.isValidOTPFormat(otp)) {
        LOGGER.debug("Invalid OTP format [{}]", otp);
        throw new AccountNotFoundException("OTP format is invalid");
    }

    final RequestContext context = RequestContextHolder.getRequestContext();
    final String uid = WebUtils.getAuthentication(context).getPrincipal().getId();
    final String publicId = YubicoClient.getPublicId(otp);
    if (this.registry != null
            && !this.registry.isYubiKeyRegisteredFor(uid, publicId)) {
        LOGGER.debug("YubiKey public id [{}] is not registered for user [{}]", publicId, uid);
        throw new AccountNotFoundException("YubiKey id is not recognized in registry");
    }

    try {
        final VerificationResponse response = this.client.verify(otp);
        final ResponseStatus status = response.getStatus();
        if (status.compareTo(ResponseStatus.OK) == 0) {
            LOGGER.debug("YubiKey response status [{}] at [{}]", status, response.getTimestamp());
            return createHandlerResult(yubiKeyCredential, this.principalFactory.createPrincipal(uid), null);
        }
        throw new FailedLoginException("Authentication failed with status: " + status);
    } catch (final YubicoVerificationException | YubicoValidationFailure e) {
        LOGGER.error(e.getMessage(), e);
        throw new FailedLoginException("YubiKey validation failed: " + e.getMessage());
    }
}
 

import com.yubico.client.v2.YubicoClient; //导入依赖的package包/类
@PostConstruct
public void initialize() {
	YubicoClient yubicoClient = YubicoClient.getClient(clientId, apiKey);
	// could set up more stuff with the client here .. for example override the default validation servers or other stuff
	yubiAuth = new Yubiauth(yubicoClient);

	log.debug("YubicoClient initialized, clientId={}, apiKey={}", clientId, apiKey);
}
 

import com.yubico.client.v2.YubicoClient; //导入依赖的package包/类
public YubicoClient getClient() {
    return this.client;
}
 

import com.yubico.client.v2.YubicoClient; //导入依赖的package包/类
private synchronized YubicoClient getYubicoClient() {
  return _yubicoClient;
}
 

import com.yubico.client.v2.YubicoClient; //导入依赖的package包/类
private YubicoClient createYubicoClient() {
  return YubicoClient.getClient(Integer.valueOf(_yubicoProperties.getProperty("client_id")),
      _yubicoProperties.getProperty("secret_key"));
}
 

import com.yubico.client.v2.YubicoClient; //导入依赖的package包/类
@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject)
    throws AuthException {
  _logger.debug("Enter validateRequest");

  if (!requiresAuthentication(messageInfo)) {
    _logger.debug("Returning success, auth policy not mandatory");
    return AuthStatus.SUCCESS;
  }

  HttpServletRequest req = (HttpServletRequest) messageInfo.getRequestMessage();
  HttpServletResponse resp = (HttpServletResponse) messageInfo.getResponseMessage();

  try {
    UserAccount account = (UserAccount) req.getSession().getAttribute(USER_ACCOUNT_SESSION_KEY);
    if (account != null) {
      _logger.debug("Returning success, user already logged in");
      addPrincipalsToSubject(clientSubject, account);
      return AuthStatus.SUCCESS;
    }

    if (!req.getRequestURI().endsWith(LOGIN_PAGE)) {
      redirectToLoginPage(req, resp);
      return AuthStatus.SEND_CONTINUE;
    }

    if ("GET".equals(req.getMethod())) {
      forwardToLoginPage(req, resp, "GET request");
      return AuthStatus.SEND_CONTINUE;
    }

    String userName = req.getParameter("j_username");
    String password = req.getParameter("j_password");
    String otp = req.getParameter("j_otp");

    if (userName == null || password == null || otp == null) {
      _logger.debug("Returning failure, missing request parameter(s)");
      forwardToFailedLoginPage(req, resp, null);
      return AuthStatus.SEND_CONTINUE;
    }

    UserAccount userAccount = _accountMap.get(userName);
    if (userAccount != null
        && userAccount.getHashedPassword().equals(
            PasswordEncoder.encodePasswordForUser(userName, userAccount.getSalt(), password))
        && YubicoClient.isValidOTPFormat(otp)) {
      _logger.debug("Verifying Yubikey for {}...", userName);
      VerificationResponse response = _yubicoClient.verify(otp);
      if (response.isOk()) {
        if (response.getPublicId().equals(userAccount.getPublicYubiId())) {
          addPrincipalsToSubject(clientSubject, userAccount);
          req.getSession().setAttribute(USER_ACCOUNT_SESSION_KEY, userAccount);

          String originalUri = (String) req.getSession().getAttribute(ORIGINAL_URI_SESSION_KEY);
          if (originalUri != null) {
            _logger.debug("Login successful for {}, redirecting to {}", userName, originalUri);
            resp.sendRedirect(originalUri);
            return AuthStatus.SEND_CONTINUE;
          } else {
            _logger.debug("Login successful for {}, returning success", userName);
            return AuthStatus.SUCCESS;
          }
        } else {
          _logger.warn("Login attempt for {} with wrong Yubikey {}!", userName, response.getPublicId());
        }
      } else {
        _logger.info("Failed to verify Yubikey for {}, response not OK", userName);
      }
    }

    forwardToFailedLoginPage(req, resp, "authentication failed");
    return AuthStatus.SEND_CONTINUE;
  } catch (Exception e) {
    _logger.error("Authentication failed with exception", e);
    throw new AuthException(e.getMessage());
  }
}
 

import com.yubico.client.v2.YubicoClient; //导入依赖的package包/类
/**
 * Prepares the Yubico client with the received clientId and secretKey. If you wish to
 * limit the usage of this handler only to a particular set of yubikey accounts for a special
 * group of users, you may verify an compliant implementation of {@link YubiKeyAccountRegistry}.
 * By default, all accounts are allowed.
 *
 * @param name             the name
 * @param servicesManager  the services manager
 * @param principalFactory the principal factory
 * @param clientId         the client id
 * @param secretKey        the secret key
 * @param registry         the account registry which holds registrations.
 */
public YubiKeyAuthenticationHandler(final String name, final ServicesManager servicesManager, final PrincipalFactory principalFactory,
                                    final Integer clientId, final String secretKey, final YubiKeyAccountRegistry registry) {
    super(name, servicesManager, principalFactory, null);
    this.registry = registry;
    this.client = YubicoClient.getClient(clientId, secretKey);

    if (this.registry == null) {
        LOGGER.warn("No YubiKey account registry is defined. All credentials are considered "
                        + "eligible for YubiKey authentication. Consider providing an account registry implementation via [{}]",
                YubiKeyAccountRegistry.class.getName());
    }
}
 

import com.yubico.client.v2.YubicoClient; //导入依赖的package包/类
/**
 * Prepares the Yubico client with the received clientId and secretKey. If you wish to
 * limit the usage of this handler only to a particular set of yubikey accounts for a special
 * group of users, you may provide an compliant implementation of {@link YubiKeyAccountRegistry}.
 * By default, all accounts are allowed.
 *
 * @param clientId the client id
 * @param secretKey the secret key
 */
@Autowired
public YubiKeyAuthenticationHandler(@NotNull @Value("${yubikey.client.id:}") final Integer clientId,
                                    @NotNull @Value("${yubikey.secret.key:}") final String secretKey) {
    this.client = YubicoClient.getClient(clientId, secretKey);
}
 

import com.yubico.client.v2.YubicoClient; //导入依赖的package包/类
/**
 * Get a client.
 * 
 * @return client.
 */
public static YubicoClient getYubicoClient() {
  return INSTANCE.createYubicoClient();
}