Put back UsernamePasswordToken

adrienlauer · adrienlauer · commit 50eb2e258e00 · 2021-05-19T13:22:20.000+02:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,7 @@
+# Version 3.12.1 (2021-05-19)
+
+* [fix] 
+
 # Version 3.12.0 (2021-05-06)
 
 * [new] Java 15 support
diff --git a/cli/pom.xml b/cli/pom.xml
@@ -14,7 +14,7 @@
     <parent>
         <groupId>org.seedstack.seed</groupId>
         <artifactId>seed</artifactId>
-        <version>3.12.0-SNAPSHOT</version>
+        <version>3.12.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>seed-cli</artifactId>
diff --git a/core/pom.xml b/core/pom.xml
@@ -14,7 +14,7 @@
     <parent>
         <groupId>org.seedstack.seed</groupId>
         <artifactId>seed</artifactId>
-        <version>3.12.0-SNAPSHOT</version>
+        <version>3.12.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>seed-core</artifactId>
diff --git a/pom.xml b/pom.xml
@@ -19,7 +19,7 @@
 
     <groupId>org.seedstack.seed</groupId>
     <artifactId>seed</artifactId>
-    <version>3.12.0-SNAPSHOT</version>
+    <version>3.12.1-SNAPSHOT</version>
     <packaging>pom</packaging>
 
     <properties>
@@ -213,7 +213,6 @@
                                 <exclude>org.seedstack.seed.security.SecurityConfig</exclude>
                                 <exclude>org.seedstack.seed.security.principals.SimplePrincipalProvider</exclude>
                                 <exclude>org.seedstack.seed.security.principals.X509CertificatePrincipalProvider</exclude>
-                                <exclude>org.seedstack.seed.security.UsernamePasswordToken</exclude>
                                 <exclude>org.seedstack.seed.rest.hal.Link</exclude>
                                 <exclude>org.seedstack.seed.undertow.UndertowConfig</exclude>
                                 <exclude>org.seedstack.seed.transaction.spi.TransactionMetadata</exclude>
diff --git a/rest/core/pom.xml b/rest/core/pom.xml
@@ -14,7 +14,7 @@
     <parent>
         <groupId>org.seedstack.seed</groupId>
         <artifactId>seed-rest</artifactId>
-        <version>3.12.0-SNAPSHOT</version>
+        <version>3.12.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>seed-rest-core</artifactId>
diff --git a/rest/jersey2/pom.xml b/rest/jersey2/pom.xml
@@ -14,7 +14,7 @@
     <parent>
         <groupId>org.seedstack.seed</groupId>
         <artifactId>seed-rest</artifactId>
-        <version>3.12.0-SNAPSHOT</version>
+        <version>3.12.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>seed-rest-jersey2</artifactId>
diff --git a/rest/pom.xml b/rest/pom.xml
@@ -13,7 +13,7 @@
     <parent>
         <groupId>org.seedstack.seed</groupId>
         <artifactId>seed</artifactId>
-        <version>3.12.0-SNAPSHOT</version>
+        <version>3.12.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>seed-rest</artifactId>
diff --git a/rest/specs/pom.xml b/rest/specs/pom.xml
@@ -13,7 +13,7 @@
     <parent>
         <groupId>org.seedstack.seed</groupId>
         <artifactId>seed-rest</artifactId>
-        <version>3.12.0-SNAPSHOT</version>
+        <version>3.12.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>seed-rest-specs</artifactId>
diff --git a/security/core/pom.xml b/security/core/pom.xml
@@ -14,7 +14,7 @@
     <parent>
         <groupId>org.seedstack.seed</groupId>
         <artifactId>seed-security</artifactId>
-        <version>3.12.0-SNAPSHOT</version>
+        <version>3.12.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>seed-security-core</artifactId>
diff --git a/security/core/src/main/java/org/seedstack/seed/security/internal/SeedUsernamePasswordToken.java b/security/core/src/main/java/org/seedstack/seed/security/internal/SeedUsernamePasswordToken.java
diff --git a/security/core/src/main/java/org/seedstack/seed/security/internal/ShiroRealmAdapter.java b/security/core/src/main/java/org/seedstack/seed/security/internal/ShiroRealmAdapter.java
@@ -7,7 +7,13 @@
  */
 package org.seedstack.seed.security.internal;
 
-import org.apache.shiro.authc.*;
+import org.apache.shiro.authc.AuthenticationException;
+import org.apache.shiro.authc.AuthenticationInfo;
+import org.apache.shiro.authc.AuthenticationToken;
+import org.apache.shiro.authc.IncorrectCredentialsException;
+import org.apache.shiro.authc.SimpleAuthenticationInfo;
+import org.apache.shiro.authc.UnknownAccountException;
+import org.apache.shiro.authc.UsernamePasswordToken;
 import org.apache.shiro.authc.pam.UnsupportedTokenException;
 import org.apache.shiro.authz.AuthorizationInfo;
 import org.apache.shiro.realm.AuthorizingRealm;
@@ -173,11 +179,11 @@ private org.seedstack.seed.security.AuthenticationToken convertToken(Authenticat
             return (org.seedstack.seed.security.AuthenticationToken) token;
         } else if (token instanceof UsernamePasswordToken) {
             UsernamePasswordToken shiroToken = (UsernamePasswordToken) token;
-            return new SeedUsernamePasswordToken(
+            return new org.seedstack.seed.security.UsernamePasswordToken(
                     shiroToken.getUsername(),
                     shiroToken.getPassword(),
-                    shiroToken.isRememberMe(),
-                    shiroToken.getHost()
+                    shiroToken.getHost(),
+                    shiroToken.isRememberMe()
             );
         } else if (token instanceof AuthenticationTokenWrapper) {
             AuthenticationTokenWrapper shiroToken = (AuthenticationTokenWrapper) token;
diff --git a/security/core/src/main/java/org/seedstack/seed/security/internal/realms/ConfigurationRealm.java b/security/core/src/main/java/org/seedstack/seed/security/internal/realms/ConfigurationRealm.java
@@ -7,16 +7,28 @@
  */
 package org.seedstack.seed.security.internal.realms;
 
-import org.apache.shiro.authc.UsernamePasswordToken;
-import org.seedstack.seed.security.*;
-import org.seedstack.seed.security.internal.SeedUsernamePasswordToken;
+import org.seedstack.seed.security.AuthenticationException;
+import org.seedstack.seed.security.AuthenticationInfo;
+import org.seedstack.seed.security.AuthenticationToken;
+import org.seedstack.seed.security.IncorrectCredentialsException;
+import org.seedstack.seed.security.Realm;
+import org.seedstack.seed.security.RoleMapping;
+import org.seedstack.seed.security.RolePermissionResolver;
+import org.seedstack.seed.security.SecurityConfig;
+import org.seedstack.seed.security.UnknownAccountException;
+import org.seedstack.seed.security.UnsupportedTokenException;
+import org.seedstack.seed.security.UsernamePasswordToken;
 import org.seedstack.seed.security.principals.PrincipalProvider;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import javax.inject.Inject;
 import javax.inject.Named;
-import java.util.*;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
 
 /**
  * A realm that authenticate users and gives authorities using SeedStack configuration.
@@ -55,8 +67,8 @@ public Set<String> getRealmRoles(PrincipalProvider<?> identityPrincipal,
 
     @Override
     public AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
-        if (token instanceof SeedUsernamePasswordToken) {
-            UsernamePasswordToken userNamePasswordToken = (SeedUsernamePasswordToken) token;
+        if (token instanceof UsernamePasswordToken) {
+            UsernamePasswordToken userNamePasswordToken = (UsernamePasswordToken) token;
             ConfigurationUser user = findUser(userNamePasswordToken.getUsername());
             if (user == null) {
                 throw new UnknownAccountException("Unknown user " + userNamePasswordToken.getUsername());
@@ -82,7 +94,7 @@ public RolePermissionResolver getRolePermissionResolver() {
 
     @Override
     public Class<? extends AuthenticationToken> supportedToken() {
-        return SeedUsernamePasswordToken.class;
+        return UsernamePasswordToken.class;
     }
 
     private ConfigurationUser findUser(String username) {
diff --git a/security/core/src/test/java/org/seedstack/seed/security/internal/realms/ConfigurationRealmUnitTest.java b/security/core/src/test/java/org/seedstack/seed/security/internal/realms/ConfigurationRealmUnitTest.java
@@ -9,8 +9,13 @@
 
 import org.junit.Before;
 import org.junit.Test;
-import org.seedstack.seed.security.*;
-import org.seedstack.seed.security.internal.SeedUsernamePasswordToken;
+import org.seedstack.seed.security.AuthenticationInfo;
+import org.seedstack.seed.security.AuthenticationToken;
+import org.seedstack.seed.security.IncorrectCredentialsException;
+import org.seedstack.seed.security.SecurityConfig;
+import org.seedstack.seed.security.UnknownAccountException;
+import org.seedstack.seed.security.UnsupportedTokenException;
+import org.seedstack.seed.security.UsernamePasswordToken;
 import org.seedstack.seed.security.principals.PrincipalProvider;
 import org.seedstack.seed.security.principals.Principals;
 
@@ -55,26 +60,26 @@ public void getRealmRoles_returns_empty_if_user_unknown() {
 
     @Test
     public void getAuthenticationInfo_nominal() {
-        SeedUsernamePasswordToken token = new SeedUsernamePasswordToken(USERNAME, PASSWORD.toCharArray(), false, null);
+        UsernamePasswordToken token = new UsernamePasswordToken(USERNAME, PASSWORD.toCharArray(), null, false);
         AuthenticationInfo authInfo = underTest.getAuthenticationInfo(token);
         assertThat(authInfo.getIdentityPrincipal().get()).isEqualTo(USERNAME);
     }
 
     @Test(expected = IncorrectCredentialsException.class)
     public void getAuthenticationInfo_throws_exception_if_incorrect_password() {
-        SeedUsernamePasswordToken token = new SeedUsernamePasswordToken(USERNAME, "".toCharArray(), false, null);
+        UsernamePasswordToken token = new UsernamePasswordToken(USERNAME, "".toCharArray(), null, false);
         underTest.getAuthenticationInfo(token);
     }
 
     @Test(expected = UnknownAccountException.class)
     public void getAuthenticationInfo_throws_exception_if_unknown_user() {
-        SeedUsernamePasswordToken token = new SeedUsernamePasswordToken("", PASSWORD.toCharArray(), false, null);
+        UsernamePasswordToken token = new UsernamePasswordToken("", PASSWORD.toCharArray(), null, false);
         underTest.getAuthenticationInfo(token);
     }
 
     @Test(expected = NullPointerException.class)
     public void null_password_is_invalid() {
-        SeedUsernamePasswordToken token = new SeedUsernamePasswordToken(USERNAME, null, false, null);
+        UsernamePasswordToken token = new UsernamePasswordToken(USERNAME, null, null, false);
         underTest.getAuthenticationInfo(token);
     }
 
diff --git a/security/pom.xml b/security/pom.xml
@@ -14,7 +14,7 @@
     <parent>
         <groupId>org.seedstack.seed</groupId>
         <artifactId>seed</artifactId>
-        <version>3.12.0-SNAPSHOT</version>
+        <version>3.12.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>seed-security</artifactId>
diff --git a/security/specs/pom.xml b/security/specs/pom.xml
@@ -13,7 +13,7 @@
 	<parent>
 		<groupId>org.seedstack.seed</groupId>
 		<artifactId>seed-security</artifactId>
-		<version>3.12.0-SNAPSHOT</version>
+		<version>3.12.1-SNAPSHOT</version>
 	</parent>
 
 	<artifactId>seed-security-specs</artifactId>
diff --git a/security/specs/src/main/java/org/seedstack/seed/security/UsernamePasswordToken.java b/security/specs/src/main/java/org/seedstack/seed/security/UsernamePasswordToken.java
@@ -0,0 +1,113 @@
+/*
+ * Copyright © 2013-2021, The SeedStack authors <http://seedstack.org>
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+package org.seedstack.seed.security;
+
+import static java.util.Objects.requireNonNull;
+
+/**
+ * This authentication token is based on a username/password couple.<br>
+ * The host of the user is added if it exists.
+ *
+ * <p>Note that this class stores a password as a char[] instead of a String
+ * (which may seem more logical).  This is because Strings are immutable and their
+ * internal value cannot be overwritten - meaning even a nulled String instance might be accessible in memory at a later
+ * time (e.g. memory dump).  This is not good for sensitive information such as passwords. For more information, see the
+ * <a href="http://java.sun.com/j2se/1.5.0/docs/guide/security/jce/JCERefGuide.html#PBEEx">Java Cryptography
+ * Extension Reference Guide</a>.</p>
+ */
+public class UsernamePasswordToken implements AuthenticationToken {
+    private static final long serialVersionUID = 1L;
+    private final String username;
+    private final char[] password;
+    private final String host;
+    private final boolean rememberMe;
+
+    /**
+     * Constructor
+     *
+     * @param username username
+     * @param password password
+     */
+    public UsernamePasswordToken(String username, char[] password) {
+        this(username, password, null);
+    }
+
+    /**
+     * Constructor
+     *
+     * @param username username
+     * @param password password
+     */
+    public UsernamePasswordToken(String username, String password) {
+        this(username, requireNonNull(password, "Password should not be null").toCharArray(), null);
+    }
+
+    /**
+     * Constructor
+     *
+     * @param username username
+     * @param password password
+     * @param host     host
+     */
+    public UsernamePasswordToken(String username, char[] password, String host) {
+        this(username, password, host, false);
+    }
+
+    /**
+     * Constructor
+     *
+     * @param username   username
+     * @param password   password
+     * @param host       host
+     * @param rememberMe rememberMe
+     */
+    public UsernamePasswordToken(String username, char[] password, String host, boolean rememberMe) {
+        this.username = requireNonNull(username, "Username should not be null");
+        this.password = requireNonNull(password, "Password should not be null").clone();
+        this.host = host;
+        this.rememberMe = rememberMe;
+    }
+
+    /**
+     * @return the username
+     */
+    public String getUsername() {
+        return username;
+    }
+
+    /**
+     * @return the password
+     */
+    public char[] getPassword() {
+        return password.clone();
+    }
+
+    /**
+     * @return the host
+     */
+    public String getHost() {
+        return host;
+    }
+
+    /**
+     * @return the rememberMe flag
+     */
+    public boolean isRememberMe() {
+        return rememberMe;
+    }
+
+    @Override
+    public Object getPrincipal() {
+        return username;
+    }
+
+    @Override
+    public Object getCredentials() {
+        return password != null ? password.clone() : null;
+    }
+}
diff --git a/specs/pom.xml b/specs/pom.xml
@@ -14,7 +14,7 @@
     <parent>
         <groupId>org.seedstack.seed</groupId>
         <artifactId>seed</artifactId>
-        <version>3.12.0-SNAPSHOT</version>
+        <version>3.12.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>seed-specs</artifactId>
diff --git a/testing/arquillian/pom.xml b/testing/arquillian/pom.xml
@@ -14,7 +14,7 @@
     <parent>
         <groupId>org.seedstack.seed</groupId>
         <artifactId>seed-testing</artifactId>
-        <version>3.12.0-SNAPSHOT</version>
+        <version>3.12.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>seed-testing-arquillian</artifactId>
diff --git a/testing/core/pom.xml b/testing/core/pom.xml
@@ -14,7 +14,7 @@
     <parent>
         <groupId>org.seedstack.seed</groupId>
         <artifactId>seed-testing</artifactId>
-        <version>3.12.0-SNAPSHOT</version>
+        <version>3.12.1-SNAPSHOT</version>
     </parent>
 
     <artifactId>seed-testing-core</artifactId>
diff --git a/testing/junit4/pom.xml b/testing/junit4/pom.xml
diff --git a/testing/pom.xml b/testing/pom.xml
diff --git a/testing/specs/pom.xml b/testing/specs/pom.xml
diff --git a/web/core/pom.xml b/web/core/pom.xml
diff --git a/web/pom.xml b/web/pom.xml
diff --git a/web/security/pom.xml b/web/security/pom.xml
diff --git a/web/specs/pom.xml b/web/specs/pom.xml
diff --git a/web/undertow/pom.xml b/web/undertow/pom.xml
