@Override
public Authentication authenticate(String username, Credentials credentials) throws AuthenticationException {
Integer code = ((OneTimeValue) credentials).getValue();
if (!NUMBER_RANGE.containsInteger(code)) {
throw new AuthenticationException("value is outside the specified range");
}
String baseCodeString;
String counterString;
try {
baseCodeString = userManager.getUserCredentials(username, "onetime-basecode");
counterString = userManager.getUserCredentials(username, "onetime-counter");
Integer baseCode = Integer.parseInt(baseCodeString);
Integer counter = Integer.parseInt(counterString);
Integer expectedCode = (baseCode * counter) % MAXCODE;
if (ObjectUtils.notEqual(code, expectedCode)) {
throw new AuthenticationException("wrong auth-code");
}
userManager.setUserCredentials(username, "counter", Integer.toString(counter + 1));
} catch (UserNotFoundException e) {
throw new AuthenticationException(e);
}
return new Authentication(username);
}