//authenticate the user, if required
if (!isAuthencated && authMode.equals(SAMLSSOConstants.AuthnModes.USERNAME_PASSWORD)) {
if (!authenticate(authnReqDTO.getUsername(), authnReqDTO.getPassword())) {
log.warn("Authentication Failure, invalid username or password.");
SAMLSSORespDTO errorResp = buildErrorResponse(authnReqDTO.getId(), SAMLSSOConstants.StatusCodes.AUTHN_FAILURE,
"Authentication Failure, invalid username or password.");
errorResp.setLoginPageURL(authnReqDTO.getLoginPageURL());
return errorResp;
}
SAMLSSOServiceProviderDO spDO = new SAMLSSOServiceProviderDO();
spDO.setIssuer(authnReqDTO.getIssuer());
spDO.setAssertionConsumerUrl(authnReqDTO.getAssertionConsumerURL());
spDO.setCertAlias(authnReqDTO.getCertAlias());
spDO.setLogoutURL(authnReqDTO.getLogoutURL());
sessionPersistenceManager.persistSession(sessionId, authnReqDTO.getUsername(),
spDO, authnReqDTO.getRpSessionId());
}
if (isAuthencated && authMode.equals(SAMLSSOConstants.AuthnModes.USERNAME_PASSWORD)) {
SessionInfoData sessionInfo = sessionPersistenceManager.getSessionInfo(sessionId);
authnReqDTO.setUsername(sessionInfo.getSubject());
sessionPersistenceManager.persistSession(sessionId, authnReqDTO.getIssuer(),
authnReqDTO.getAssertionConsumerURL(), authnReqDTO.getRpSessionId());
}
if(isAuthencated && authMode.equals(SAMLSSOConstants.AuthnModes.OPENID)){
SAMLSSOServiceProviderDO spDO = new SAMLSSOServiceProviderDO();
spDO.setIssuer(authnReqDTO.getIssuer());
spDO.setAssertionConsumerUrl(authnReqDTO.getAssertionConsumerURL());
spDO.setCertAlias(authnReqDTO.getCertAlias());
spDO.setLogoutURL(authnReqDTO.getLogoutURL());
sessionPersistenceManager.persistSession(sessionId, authnReqDTO.getUsername(),
spDO, authnReqDTO.getRpSessionId());
}
//Build the response for the successful scenario
ResponseBuilder respBuilder = new ResponseBuilder();
Response response = respBuilder.buildResponse(authnReqDTO, sessionId);
SAMLSSORespDTO samlssoRespDTO = new SAMLSSORespDTO();
samlssoRespDTO.setRespString(SAMLSSOUtil.encode(SAMLSSOUtil.marshall(response)));
samlssoRespDTO.setSessionEstablished(true);
samlssoRespDTO.setAssertionConsumerURL(authnReqDTO.getAssertionConsumerURL());
samlssoRespDTO.setLoginPageURL(authnReqDTO.getLoginPageURL());
return samlssoRespDTO;
} catch (Exception e) {
log.error("Error processing the authentication request",e);
SAMLSSORespDTO errorResp = buildErrorResponse(authnReqDTO.getId(), SAMLSSOConstants.StatusCodes.AUTHN_FAILURE,
"Authentication Failure, invalid username or password.");
errorResp.setLoginPageURL(authnReqDTO.getLoginPageURL());
return errorResp;
}
}