/**
* Save the user, encrypting their passwords if necessary
*
* @return success when good things happen
* @throws Exception when bad things happen
*/
public String save() throws Exception {
user.setEnabled(true);
// Set the default user role on this new user
user.addRole(roleManager.getRole(Constants.USER_ROLE));
try {
userManager.saveUser(user);
} catch (AccessDeniedException ade) {
// thrown by UserSecurityAdvice configured in aop:advisor userManagerSecurity
log.warn(ade.getMessage());
getResponse().sendError(HttpServletResponse.SC_FORBIDDEN);
return null;
} catch (UserExistsException e) {
log.warn(e.getMessage());
List<Object> args = new ArrayList<Object>();
args.add(user.getUsername());
args.add(user.getEmail());
addActionError(getText("errors.existing.user", args));
// redisplay the unencrypted passwords
user.setPassword(user.getConfirmPassword());
return INPUT;
}
saveMessage(getText("user.registered"));
getSession().setAttribute(Constants.REGISTERED, Boolean.TRUE);
// log user in automatically
UsernamePasswordAuthenticationToken auth =
new UsernamePasswordAuthenticationToken(
user.getUsername(), user.getConfirmPassword(), user.getAuthorities());
auth.setDetails(user);
SecurityContextHolder.getContext().setAuthentication(auth);
// Send an account information e-mail
mailMessage.setSubject(getText("signup.email.subject"));
try {
sendUserMessage(user, getText("signup.email.message"), RequestUtil.getAppURL(getRequest()));
} catch (MailException me) {
addActionError(me.getMostSpecificCause().getMessage());
}
return SUCCESS;
}
public void testAddUserAsAdmin() throws Exception {
SecurityContext context = new SecurityContextImpl();
User user = new User("admin");
user.setId(2L);
user.setPassword("password");
user.addRole(new Role(Constants.ADMIN_ROLE));
UsernamePasswordAuthenticationToken token =
new UsernamePasswordAuthenticationToken(
user.getUsername(), user.getPassword(), user.getAuthorities());
token.setDetails(user);
context.setAuthentication(token);
SecurityContextHolder.setContext(context);
UserManager userManager = makeInterceptedTarget();
User adminUser = new User("admin");
adminUser.setId(2L);
userDao.expects(once()).method("saveUser");
userManager.saveUser(adminUser);
}
@Override
protected void setUp() throws Exception {
super.setUp();
// store initial security context for later restoration
initialSecurityContext = SecurityContextHolder.getContext();
SecurityContext context = new SecurityContextImpl();
User user = new User("user");
user.setId(1L);
user.setPassword("password");
user.addRole(new Role(Constants.USER_ROLE));
UsernamePasswordAuthenticationToken token =
new UsernamePasswordAuthenticationToken(
user.getUsername(), user.getPassword(), user.getAuthorities());
token.setDetails(user);
context.setAuthentication(token);
SecurityContextHolder.setContext(context);
}
public void doFilter(
final ServletRequest request, final ServletResponse response, final FilterChain chain)
throws IOException, ServletException {
if (!(request instanceof HttpServletRequest)) {
throw new ServletException(
Messages.getInstance()
.getErrorString(
"RequestParameterAuthenticationFilter.ERROR_0005_HTTP_SERVLET_REQUEST_REQUIRED")); //$NON-NLS-1$
}
if (!(response instanceof HttpServletResponse)) {
throw new ServletException(
Messages.getInstance()
.getErrorString(
"RequestParameterAuthenticationFilter.ERROR_0006_HTTP_SERVLET_RESPONSE_REQUIRED")); //$NON-NLS-1$
}
HttpServletRequest httpRequest = (HttpServletRequest) request;
InputStream in = httpRequest.getInputStream();
byte[] bytes = IOUtils.toByteArray(in);
// Do something with Bytes.
final BufferedInputStream newStream = new BufferedInputStream(new ByteArrayInputStream(bytes));
final Map parameterMap = request.getParameterMap();
HttpServletRequestWrapper wrapper =
new HttpServletRequestWrapper(httpRequest) {
@Override
public Map getParameterMap() {
return parameterMap;
}
@Override
public ServletInputStream getInputStream() throws IOException {
return new ServletInputStream() {
@Override
public int read() throws IOException {
return newStream.read();
}
};
}
};
String username = httpRequest.getParameter(this.userNameParameter);
String password = httpRequest.getParameter(this.passwordParameter);
if (RequestParameterAuthenticationFilter.logger.isDebugEnabled()) {
RequestParameterAuthenticationFilter.logger.debug(
Messages.getInstance()
.getString(
"RequestParameterAuthenticationFilter.DEBUG_AUTH_USERID",
username)); //$NON-NLS-1$
}
if ((username != null) && (password != null)) {
// Only reauthenticate if username doesn't match SecurityContextHolder and user isn't
// authenticated (see SEC-53)
Authentication existingAuth = SecurityContextHolder.getContext().getAuthentication();
if ((existingAuth == null)
|| !existingAuth.getName().equals(username)
|| !existingAuth.isAuthenticated()) {
UsernamePasswordAuthenticationToken authRequest =
new UsernamePasswordAuthenticationToken(username, password);
authRequest.setDetails(new WebAuthenticationDetails(httpRequest));
Authentication authResult;
try {
authResult = authenticationManager.authenticate(authRequest);
} catch (AuthenticationException failed) {
// Authentication failed
if (RequestParameterAuthenticationFilter.logger.isDebugEnabled()) {
RequestParameterAuthenticationFilter.logger.debug(
Messages.getInstance()
.getString(
"RequestParameterAuthenticationFilter.DEBUG_AUTHENTICATION_REQUEST",
username,
failed.toString())); // $NON-NLS-1$
}
SecurityContextHolder.getContext().setAuthentication(null);
if (ignoreFailure) {
chain.doFilter(wrapper, response);
} else {
authenticationEntryPoint.commence(wrapper, response, failed);
}
return;
}
// Authentication success
if (RequestParameterAuthenticationFilter.logger.isDebugEnabled()) {
RequestParameterAuthenticationFilter.logger.debug(
Messages.getInstance()
.getString(
"RequestParameterAuthenticationFilter.DEBUG_AUTH_SUCCESS",
authResult.toString())); // $NON-NLS-1$
}
SecurityContextHolder.getContext().setAuthentication(authResult);
}
}
chain.doFilter(wrapper, response);
}