001    /*
002     * Licensed to the Apache Software Foundation (ASF) under one
003     * or more contributor license agreements.  See the NOTICE file
004     * distributed with this work for additional information
005     * regarding copyright ownership.  The ASF licenses this file
006     * to you under the Apache License, Version 2.0 (the
007     * "License"); you may not use this file except in compliance
008     * with the License.  You may obtain a copy of the License at
009     *
010     *     http://www.apache.org/licenses/LICENSE-2.0
011     *
012     * Unless required by applicable law or agreed to in writing,
013     * software distributed under the License is distributed on an
014     * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
015     * KIND, either express or implied.  See the License for the
016     * specific language governing permissions and limitations
017     * under the License.
018     */
019    package org.apache.shiro.authc.pam;
020    
021    import org.slf4j.Logger;
022    import org.slf4j.LoggerFactory;
023    
024    import org.apache.shiro.authc.AuthenticationException;
025    import org.apache.shiro.authc.AuthenticationInfo;
026    import org.apache.shiro.authc.AuthenticationToken;
027    import org.apache.shiro.authc.UnknownAccountException;
028    import org.apache.shiro.realm.Realm;
029    
030    
031    /**
032     * <tt>AuthenticationStrategy</tt> implementation that requires <em>all</em> configured realms to
033     * <b>successfully</b> process the submitted <tt>AuthenticationToken</tt> during the log-in attempt.
034     * <p/>
035     * <p>If one or more realms do not support the submitted token, or one or more are unable to acquire
036     * <tt>AuthenticationInfo</tt> for the token, this implementation will immediately fail the log-in attempt for the
037     * associated subject (user).
038     *
039     * @since 0.2
040     */
041    public class AllSuccessfulStrategy extends AbstractAuthenticationStrategy {
042    
043        /** Private class log instance. */
044        private static final Logger log = LoggerFactory.getLogger(AllSuccessfulStrategy.class);
045    
046        /**
047         * Because all realms in this strategy must complete successfully, this implementation ensures that the given
048         * <code>Realm</code> {@link org.apache.shiro.realm.Realm#supports(org.apache.shiro.authc.AuthenticationToken) supports} the given
049         * <code>token</code> argument.  If it does not, this method throws an
050         * {@link UnsupportedTokenException UnsupportedTokenException} to end the authentication
051         * process immediately. If the realm does support the token, the <code>info</code> argument is returned immediately.
052         */
053        public AuthenticationInfo beforeAttempt(Realm realm, AuthenticationToken token, AuthenticationInfo info) throws AuthenticationException {
054            if (!realm.supports(token)) {
055                String msg = "Realm [" + realm + "] of type [" + realm.getClass().getName() + "] does not support " +
056                        " the submitted AuthenticationToken [" + token + "].  The [" + getClass().getName() +
057                        "] implementation requires all configured realm(s) to support and be able to process the submitted " +
058                        "AuthenticationToken.";
059                throw new UnsupportedTokenException(msg);
060            }
061    
062            return info;
063        }
064    
065        /**
066         * Merges the specified <code>info</code> into the <code>aggregate</code> argument and returns it (just as the
067         * parent implementation does), but additionally ensures the following:
068         * <ol>
069         * <li>if the <code>Throwable</code> argument is not <code>null</code>, re-throws it to immediately cancel the
070         * authentication process, since this strategy requires all realms to authenticate successfully.</li>
071         * <li>neither the <code>info</code> or <code>aggregate</code> argument is <code>null</code> to ensure that each
072         * realm did in fact authenticate successfully</li>
073         * </ol>
074         */
075        public AuthenticationInfo afterAttempt(Realm realm, AuthenticationToken token, AuthenticationInfo info, AuthenticationInfo aggregate, Throwable t)
076                throws AuthenticationException {
077            if (t != null) {
078                if (t instanceof AuthenticationException) {
079                    //propagate:
080                    throw ((AuthenticationException) t);
081                } else {
082                    String msg = "Unable to acquire account data from realm [" + realm + "].  The [" +
083                            getClass().getName() + " implementation requires all configured realm(s) to operate successfully " +
084                            "for a successful authentication.";
085                    throw new AuthenticationException(msg, t);
086                }
087            }
088            if (info == null) {
089                String msg = "Realm [" + realm + "] could not find any associated account data for the submitted " +
090                        "AuthenticationToken [" + token + "].  The [" + getClass().getName() + "] implementation requires " +
091                        "all configured realm(s) to acquire valid account data for a submitted token during the " +
092                        "log-in process.";
093                throw new UnknownAccountException(msg);
094            }
095    
096            log.debug("Account successfully authenticated using realm [{}]", realm);
097    
098            // If non-null account is returned, then the realm was able to authenticate the
099            // user - so merge the account with any accumulated before:
100            merge(info, aggregate);
101    
102            return aggregate;
103        }
104    }