Bug 5425 AAAFilter always assumes the default domain

This change allows another domain to be specified as part of the
username.  Just use "username"@"domain".  If no @domain is specified,
then the default domain "sdn" is assumed.

Change-Id: Ia7cdd06fbc92f9fef3723260950ef9f6682dabfa
Signed-off-by: Ryan Goulding <ryandgoulding@gmail.com>

diff --git a/aaa-shiro/src/main/java/org/opendaylight/aaa/shiro/realm/TokenAuthRealm.java b/aaa-shiro/src/main/java/org/opendaylight/aaa/shiro/realm/TokenAuthRealm.java
index 41649223599976dda8dfa09d1c84805a22a73111..aa12f5d0e0ce675c6fb968e3ec56985a46e806ab 100644 (file)
--- a/aaa-shiro/src/main/java/org/opendaylight/aaa/shiro/realm/TokenAuthRealm.java
+++ b/aaa-shiro/src/main/java/org/opendaylight/aaa/shiro/realm/TokenAuthRealm.java
@@ -42,6 +42,8 @@ import org.slf4j.LoggerFactory;
  */
 public class TokenAuthRealm extends AuthorizingRealm {
 
+    private static final String USERNAME_DOMAIN_SEPARATOR = "@";
+
     /**
      * The unique identifying name for <code>TokenAuthRealm</code>
      */
@@ -100,13 +102,16 @@ public class TokenAuthRealm extends AuthorizingRealm {
     }
 
     /**
+     * Bridge new to old style <code>TokenAuth</code> interface.
      *
-     * @param username
-     * @param password
-     * @return <code>username</code>:<code>password</code>
+     * @param username The request username
+     * @param password The request password
+     * @param domain The request domain
+     * @return <code>username:password:domain</code>
      */
-    static String getUsernamePasswordString(final String username, final String password) {
-        return username + HttpBasicAuth.AUTH_SEP + password;
+    static String getUsernamePasswordDomainString(final String username, final String password,
+            final String domain) {
+        return username + HttpBasicAuth.AUTH_SEP + password  + HttpBasicAuth.AUTH_SEP + domain;
     }
 
     /**
@@ -144,12 +149,14 @@ public class TokenAuthRealm extends AuthorizingRealm {
      * Adapter between basic authentication mechanism and existing
      * <code>TokenAuth</code> interface.
      *
-     * @param username
-     * @param password
+     * @param username Username from the request
+     * @param password Password from the request
+     * @param domain Domain from the request
      * @return input map for <code>TokenAuth.validate()</code>
      */
-    Map<String, List<String>> formHeaders(final String username, final String password) {
-        String usernamePasswordToken = getUsernamePasswordString(username, password);
+    Map<String, List<String>> formHeaders(final String username, final String password,
+            final String domain) {
+        String usernamePasswordToken = getUsernamePasswordDomainString(username, password, domain);
         String encodedToken = getEncodedToken(usernamePasswordToken);
         String tokenAuthHeader = getTokenAuthHeader(encodedToken);
         return formHeadersWithToken(tokenAuthHeader);
@@ -178,12 +185,26 @@ public class TokenAuthRealm extends AuthorizingRealm {
     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken)
             throws AuthenticationException {
 
-        String username;
-        String password;
+        String username = "";
+        String password = "";
+        String domain = HttpBasicAuth.DEFAULT_DOMAIN;
 
         try {
-            username = extractUsername(authenticationToken);
+            final String qualifiedUser = extractUsername(authenticationToken);
+            if (qualifiedUser.contains(USERNAME_DOMAIN_SEPARATOR)) {
+                final String [] qualifiedUserArray = qualifiedUser.split(USERNAME_DOMAIN_SEPARATOR);
+                try {
+                    username = qualifiedUserArray[0];
+                    domain = qualifiedUserArray[1];
+                } catch (ArrayIndexOutOfBoundsException e) {
+                    LOG.trace("Couldn't parse domain from {}; trying without one",
+                            qualifiedUser, e);
+                }
+            } else {
+                username = qualifiedUser;
+            }
             password = extractPassword(authenticationToken);
+
         } catch (NullPointerException e) {
             throw new AuthenticationException(FATAL_ERROR_DECODING_CREDENTIALS, e);
         } catch (ClassCastException e) {
@@ -199,7 +220,7 @@ public class TokenAuthRealm extends AuthorizingRealm {
         // Auth request
         if (!Strings.isNullOrEmpty(password)) {
             if (ServiceLocator.getInstance().getAuthenticationService().isAuthEnabled()) {
-                Map<String, List<String>> headers = formHeaders(username, password);
+                Map<String, List<String>> headers = formHeaders(username, password, domain);
                 // iterate over <code>TokenAuth</code> implementations and
                 // attempt to
                 // authentication with each one

diff --git a/aaa-shiro/src/test/java/org/opendaylight/aaa/shiro/realm/TokenAuthRealmTest.java b/aaa-shiro/src/test/java/org/opendaylight/aaa/shiro/realm/TokenAuthRealmTest.java
index 5e98e9a2e3cbce78dd80385c2732b46e1ae5447e..f2eb92b561892cce8bbc57ee7726631b87fa9f96 100644 (file)
--- a/aaa-shiro/src/test/java/org/opendaylight/aaa/shiro/realm/TokenAuthRealmTest.java
+++ b/aaa-shiro/src/test/java/org/opendaylight/aaa/shiro/realm/TokenAuthRealmTest.java
@@ -42,11 +42,12 @@ public class TokenAuthRealmTest extends TokenAuthRealm {
     }
 
     @Test
-    public void testGetUsernamePasswordString() {
+    public void testGetUsernamePasswordDomainString() {
         final String username = "user";
         final String password = "password";
-        final String expectedUsernamePasswordString = "user:password";
-        assertEquals(expectedUsernamePasswordString, getUsernamePasswordString(username, password));
+        final String domain = "domain";
+        final String expectedUsernamePasswordString = "user:password:domain";
+        assertEquals(expectedUsernamePasswordString, getUsernamePasswordDomainString(username, password, domain));
     }
 
     @Test
@@ -59,16 +60,16 @@ public class TokenAuthRealmTest extends TokenAuthRealm {
 
     @Test
     public void testGetTokenAuthHeader() {
-        final String encodedCredentials = getEncodedToken(getUsernamePasswordString("user1",
-                "password"));
+        final String encodedCredentials = getEncodedToken(getUsernamePasswordDomainString("user1",
+                "password", "sdn"));
         final String expectedTokenAuthHeader = "Basic " + encodedCredentials;
         assertEquals(expectedTokenAuthHeader, getTokenAuthHeader(encodedCredentials));
     }
 
     @Test
     public void testFormHeadersWithToken() {
-        final String authHeader = getEncodedToken(getTokenAuthHeader(getUsernamePasswordString(
-                "user1", "password")));
+        final String authHeader = getEncodedToken(getTokenAuthHeader(getUsernamePasswordDomainString(
+                "user1", "password", "sdn")));
         final Map<String, List<String>> expectedHeaders = new HashMap<String, List<String>>();
         expectedHeaders.put("Authorization", Lists.newArrayList(authHeader));
         final Map<String, List<String>> actualHeaders = formHeadersWithToken(authHeader);
@@ -83,11 +84,12 @@ public class TokenAuthRealmTest extends TokenAuthRealm {
     public void testFormHeaders() {
         final String username = "basicUser";
         final String password = "basicPassword";
-        final String authHeader = getTokenAuthHeader(getEncodedToken(getUsernamePasswordString(
-                username, password)));
+        final String domain = "basicDomain";
+        final String authHeader = getTokenAuthHeader(getEncodedToken(getUsernamePasswordDomainString(
+                username, password, domain)));
         final Map<String, List<String>> expectedHeaders = new HashMap<String, List<String>>();
         expectedHeaders.put("Authorization", Lists.newArrayList(authHeader));
-        final Map<String, List<String>> actualHeaders = formHeaders(username, password);
+        final Map<String, List<String>> actualHeaders = formHeaders(username, password, domain);
         List<String> value;
         for (String key : expectedHeaders.keySet()) {
             value = expectedHeaders.get(key);