String mode_values = "";
for (PasswordMode pm : PasswordMode.values())
mode_values += "'" + pm + "', ";
mode_values += "or leave it unspecified.";
throw new AuthenticationException("The requested password check mode '" + pmode_plain + "' is not a valid mode. Possible values are " + mode_values);
}
}
String pfilename = System.getProperty(PASSWD_FILENAME_PROPERTY);
String username = authRequest.getCredentials().get(USERNAME_KEY);
if (null == username) throw new AuthenticationException("Authentication request was missing the required key '" + USERNAME_KEY + "'");
String password = authRequest.getCredentials().get(PASSWORD_KEY);
if (null == password) throw new AuthenticationException("Authentication request was missing the required key '" + PASSWORD_KEY + "'");
boolean authenticated = false;
try
{
FileInputStream in = new FileInputStream(pfilename);
Properties props = new Properties();
props.load(in);
in.close();
// note we keep the message here and for the wrong password exactly the same to prevent attackers from guessing what users are valid
if (null == props.getProperty(username)) throw new AuthenticationException(authenticationErrorMessage(mode, username));
switch (mode)
{
case PLAIN:
authenticated = password.equals(props.getProperty(username));
break;
case MD5:
authenticated = MessageDigest.isEqual(password.getBytes(), MessageDigest.getInstance("MD5").digest(props.getProperty(username).getBytes()));
break;
}
}
catch (NoSuchAlgorithmException e)
{
throw new AuthenticationException("You requested MD5 checking but the MD5 digest algorithm is not available: " + e.getMessage());
}
catch (FileNotFoundException e)
{
throw new RuntimeException("Authentication table file given by property " + PASSWD_FILENAME_PROPERTY + " could not be found: " + e.getMessage());
}
catch (IOException e)
{
throw new RuntimeException("Authentication table file given by property " + PASSWD_FILENAME_PROPERTY + " could not be opened: " + e.getMessage());
}
catch (Exception e)
{
throw new RuntimeException("Unexpected authentication problem", e);
}
if (!authenticated) throw new AuthenticationException(authenticationErrorMessage(mode, username));
// if we're here, the authentication succeeded. Now let's see if the user is authorized for this keyspace.
String afilename = System.getProperty(ACCESS_FILENAME_PROPERTY);
AccessLevel authorized = AccessLevel.NONE;