Package org.jivesoftware.openfire.auth

Class DefaultAuthProvider

java.lang.Object
org.jivesoftware.openfire.auth.DefaultAuthProvider
All Implemented Interfaces:
AuthProvider
public class DefaultAuthProvider extends Object implements AuthProvider
Default AuthProvider implementation. It authenticates against the ofUser database table and supports plain text and digest authentication. Because each call to authenticate() makes a database connection, the results of authentication should be cached whenever possible.
Author:
Matt Tucker

  • Field Details

    • UNIVERSAL_SCRAM_MECHANISMS_CACHE_DURATION

      public static final SystemProperty<Duration> UNIVERSAL_SCRAM_MECHANISMS_CACHE_DURATION
      How long the set of universally-held SCRAM mechanisms is cached before it is determined again. The determination scans the user table, so it is not something to do per session. It is invalidated when a password is stored, which is the operation that can complete a user's set of credentials. This duration bounds how long a change made by any other means (notably the creation or removal of a user) goes unnoticed.

    • SALT_LENGTH

      public static final int SALT_LENGTH
      The length of the salt used to generate salted passwords.
      See Also:

  • Constructor Details

    • DefaultAuthProvider

      public DefaultAuthProvider()
      Constructs a new DefaultAuthProvider.

  • Method Details

    • getSalt

      @Deprecated(forRemoval=true) public String getSalt(String username) throws UserNotFoundException
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: AuthProvider
      Returns a SCRAM-SHA-1 salt for a user.
      Specified by:
      getSalt in interface AuthProvider
      Throws:
      UserNotFoundException

    • getIterations

      @Deprecated(forRemoval=true) public int getIterations(String username) throws UserNotFoundException
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: AuthProvider
      Returns a SCRAM-SHA-1 iteration count for a user.
      Specified by:
      getIterations in interface AuthProvider
      Throws:
      UserNotFoundException

    • getStoredKey

      @Deprecated(forRemoval=true) public String getStoredKey(String username) throws UserNotFoundException
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: AuthProvider
      Returns a SCRAM-SHA-1 stored key for a user.
      Specified by:
      getStoredKey in interface AuthProvider
      Throws:
      UserNotFoundException

    • getServerKey

      @Deprecated(forRemoval=true) public String getServerKey(String username) throws UserNotFoundException
      Deprecated, for removal: This API element is subject to removal in a future version.
      Description copied from interface: AuthProvider
      Returns a SCRAM-SHA-1 server key for a user.
      Specified by:
      getServerKey in interface AuthProvider
      Throws:
      UserNotFoundException

    • getScramCredential

      public ScramCredentialData getScramCredential(String username, String mechanism) throws UnsupportedOperationException, UserNotFoundException
      Returns SCRAM credentials for a user and mechanism. When SCRAM credentials are missing but a plaintext (or decryptable) password is available, the credentials are regenerated (preserving the historical behavior of this provider).
      Specified by:
      getScramCredential in interface AuthProvider
      Parameters:
      username - the username of the user.
      mechanism - the SCRAM mechanism name.
      Returns:
      the SCRAM credentials for the user under the (normalized) mechanism.
      Throws:
      UnsupportedOperationException - if the mechanism is not SCRAM-SHA-1.
      UserNotFoundException - if the user's credentials could not be loaded.

    • authenticate

      public void authenticate(String username, String password) throws UnauthorizedException
      Description copied from interface: AuthProvider
      Returns if the username and password are valid; otherwise this method throws an UnauthorizedException.

      Specified by:
      authenticate in interface AuthProvider
      Parameters:
      username - the username or full JID.
      password - the password
      Throws:
      UnauthorizedException - if the username and password do not match any existing user.

    • getPassword

      public String getPassword(String username) throws UserNotFoundException
      Description copied from interface: AuthProvider
      Returns the user's password. This method should throw an UnsupportedOperationException if this operation is not supported by the backend user store.
      Specified by:
      getPassword in interface AuthProvider
      Parameters:
      username - the username of the user.
      Returns:
      the user's password.
      Throws:
      UserNotFoundException - if the given user's password could not be loaded.

    • checkPassword

      public boolean checkPassword(String username, String testPassword) throws UserNotFoundException
      Throws:
      UserNotFoundException

    • setPassword

      public void setPassword(String username, String password) throws UserNotFoundException
      Description copied from interface: AuthProvider
      Sets the user's password. This method should throw an UnsupportedOperationException if this operation is not supported by the backend user store.
      Specified by:
      setPassword in interface AuthProvider
      Parameters:
      username - the username of the user.
      password - the new plaintext password for the user.
      Throws:
      UserNotFoundException - if the given user could not be loaded.

    • supportsPasswordRetrieval

      public boolean supportsPasswordRetrieval()
      Description copied from interface: AuthProvider
      Returns true if this UserProvider is able to retrieve user passwords from the backend user store. If this operation is not supported then AuthProvider.getPassword(String) will throw an UnsupportedOperationException if invoked.
      Specified by:
      supportsPasswordRetrieval in interface AuthProvider
      Returns:
      true if this UserProvider is able to retrieve user passwords from the backend user store.

    • isScramSupported

      public boolean isScramSupported()
      Specified by:
      isScramSupported in interface AuthProvider

    • getScramMechanisms

      public Set<String> getScramMechanisms(@Nonnull String username)
      Returns the names of the SCRAM mechanisms for which credentials are available for a user. Implementations must not create or modify credentials as a side effect: this method is invoked before authentication, with a username that is supplied by an unauthenticated peer. Implementations should not distinguish between a user that does not exist and one that has no credentials. Note that this is why a mechanism can be reported that this user cannot actually use. That holds for a single provider as much as for a chained one.
      Specified by:
      getScramMechanisms in interface AuthProvider
      Parameters:
      username - the username to check
      Returns:
      the names of the SCRAM mechanisms for which credentials are available for the user.

    • getFallbackScramMechanisms

      public Set<String> getFallbackScramMechanisms()
      Returns the names of the SCRAM mechanisms that can be assumed to be usable by any user. The inherited implementation reports SCRAM-SHA-1 only, being the sole mechanism that existed when SCRAM support was first added. This implementation adds any other mechanism for which a credential is stored for every user: where that holds, a client that does not identify itself can safely be offered the stronger mechanism. The result is only ever a superset of what the inherited implementation reports, and a mechanism is only added on positive evidence. A failure to determine that evidence, or a determination that is not unanimous, leaves the inherited answer in place.
      Specified by:
      getFallbackScramMechanisms in interface AuthProvider
      Returns:
      the names of the SCRAM mechanisms that every user is assumed to have credentials for.