GUACAMOLE-1289: Move AuthenticationSession components to guacamole-exit.

This commit is contained in:
Virtually Nick
2023-10-05 17:08:11 -04:00
committed by Alex Leitner
parent 5a135f3361
commit 13494baa4a
11 changed files with 18 additions and 49 deletions

View File

@@ -19,11 +19,11 @@
package org.apache.guacamole.auth.sso; package org.apache.guacamole.auth.sso;
import com.google.inject.Inject;
import java.util.Iterator; import java.util.Iterator;
import java.util.Locale; import java.util.Locale;
import java.util.Map; import java.util.Map;
import java.util.concurrent.ConcurrentHashMap; import java.util.concurrent.ConcurrentHashMap;
import org.apache.guacamole.net.auth.IdentifierGenerator;
/** /**
* Service for generating and validating single-use random tokens (nonces). * Service for generating and validating single-use random tokens (nonces).
@@ -31,12 +31,6 @@ import java.util.concurrent.ConcurrentHashMap;
*/ */
public class NonceService { public class NonceService {
/**
* Generator of arbitrary, unique, unpredictable identifiers.
*/
@Inject
private IdentifierGenerator idGenerator;
/** /**
* Map of all generated nonces to their corresponding expiration timestamps. * Map of all generated nonces to their corresponding expiration timestamps.
* This Map must be periodically swept of expired nonces to avoid growing * This Map must be periodically swept of expired nonces to avoid growing
@@ -107,7 +101,7 @@ public class NonceService {
sweepExpiredNonces(); sweepExpiredNonces();
// Generate and store nonce, along with expiration timestamp // Generate and store nonce, along with expiration timestamp
String nonce = idGenerator.generateIdentifier(NONCE_BITS, false); String nonce = IdentifierGenerator.generateIdentifier(NONCE_BITS, false);
nonces.put(nonce, System.currentTimeMillis() + maxAge); nonces.put(nonce, System.currentTimeMillis() + maxAge);
return nonce; return nonce;

View File

@@ -19,7 +19,7 @@
package org.apache.guacamole.auth.saml.acs; package org.apache.guacamole.auth.saml.acs;
import org.apache.guacamole.auth.sso.AuthenticationSession; import org.apache.guacamole.net.auth.AuthenticationSession;
/** /**
* Representation of an in-progress SAML authentication attempt. * Representation of an in-progress SAML authentication attempt.

View File

@@ -20,7 +20,7 @@
package org.apache.guacamole.auth.saml.acs; package org.apache.guacamole.auth.saml.acs;
import com.google.inject.Singleton; import com.google.inject.Singleton;
import org.apache.guacamole.auth.sso.AuthenticationSessionManager; import org.apache.guacamole.net.auth.AuthenticationSessionManager;
/** /**
* Manager service that temporarily stores SAML authentication attempts while * Manager service that temporarily stores SAML authentication attempts while

View File

@@ -36,7 +36,7 @@ import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.GuacamoleSecurityException; import org.apache.guacamole.GuacamoleSecurityException;
import org.apache.guacamole.GuacamoleServerException; import org.apache.guacamole.GuacamoleServerException;
import org.apache.guacamole.auth.saml.conf.ConfigurationService; import org.apache.guacamole.auth.saml.conf.ConfigurationService;
import org.apache.guacamole.auth.sso.IdentifierGenerator; import org.apache.guacamole.net.auth.IdentifierGenerator;
import org.xml.sax.SAXException; import org.xml.sax.SAXException;
/** /**
@@ -58,12 +58,6 @@ public class SAMLService {
@Inject @Inject
private SAMLAuthenticationSessionManager sessionManager; private SAMLAuthenticationSessionManager sessionManager;
/**
* Generator of arbitrary, unique, unpredictable identifiers.
*/
@Inject
private IdentifierGenerator idGenerator;
/** /**
* Creates a new SAML request, beginning the overall authentication flow * Creates a new SAML request, beginning the overall authentication flow
* that will ultimately result in an asserted user identity if the user is * that will ultimately result in an asserted user identity if the user is
@@ -89,7 +83,7 @@ public class SAMLService {
Auth auth = new Auth(samlSettings, null, null); Auth auth = new Auth(samlSettings, null, null);
// Generate a unique ID to use for the relay state // Generate a unique ID to use for the relay state
String identifier = idGenerator.generateIdentifier(); String identifier = IdentifierGenerator.generateIdentifier();
// Create the request URL for the SAML IdP // Create the request URL for the SAML IdP
String requestUrl = auth.login( String requestUrl = auth.login(

View File

@@ -24,7 +24,6 @@ import com.onelogin.saml2.settings.IdPMetadataParser;
import com.onelogin.saml2.settings.Saml2Settings; import com.onelogin.saml2.settings.Saml2Settings;
import com.onelogin.saml2.settings.SettingsBuilder; import com.onelogin.saml2.settings.SettingsBuilder;
import com.onelogin.saml2.util.Constants; import com.onelogin.saml2.util.Constants;
import java.io.File; import java.io.File;
import java.io.IOException; import java.io.IOException;
import java.net.URI; import java.net.URI;

View File

@@ -20,14 +20,8 @@
package org.apache.guacamole.auth.ssl; package org.apache.guacamole.auth.ssl;
import com.google.inject.Inject; import com.google.inject.Inject;
import com.google.inject.Singleton;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.auth.ssl.SSLAuthenticationSessionManager;
import org.apache.guacamole.auth.sso.SSOAuthenticationEventListener; import org.apache.guacamole.auth.sso.SSOAuthenticationEventListener;
import org.apache.guacamole.net.auth.Credentials; import org.apache.guacamole.net.auth.Credentials;
import org.apache.guacamole.net.event.AuthenticationFailureEvent;
import org.apache.guacamole.net.event.AuthenticationSuccessEvent;
import org.apache.guacamole.net.event.listener.Listener;
/** /**
* A Listener that will reactivate or invalidate SSL auth sessions depending on * A Listener that will reactivate or invalidate SSL auth sessions depending on

View File

@@ -19,7 +19,7 @@
package org.apache.guacamole.auth.ssl; package org.apache.guacamole.auth.ssl;
import org.apache.guacamole.auth.sso.AuthenticationSession; import org.apache.guacamole.net.auth.AuthenticationSession;
/** /**
* Representation of an in-progress SSL/TLS authentication attempt. * Representation of an in-progress SSL/TLS authentication attempt.

View File

@@ -20,7 +20,7 @@
package org.apache.guacamole.auth.ssl; package org.apache.guacamole.auth.ssl;
import com.google.inject.Singleton; import com.google.inject.Singleton;
import org.apache.guacamole.auth.sso.AuthenticationSessionManager; import org.apache.guacamole.net.auth.AuthenticationSessionManager;
/** /**
* Manager service that temporarily stores SSL/TLS authentication attempts * Manager service that temporarily stores SSL/TLS authentication attempts

View File

@@ -17,7 +17,7 @@
* under the License. * under the License.
*/ */
package org.apache.guacamole.auth.sso; package org.apache.guacamole.net.auth;
/** /**
* Representation of an in-progress authentication attempt. * Representation of an in-progress authentication attempt.

View File

@@ -17,10 +17,7 @@
* under the License. * under the License.
*/ */
package org.apache.guacamole.auth.sso; package org.apache.guacamole.net.auth;
import com.google.inject.Inject;
import com.google.inject.Singleton;
import java.util.Map; import java.util.Map;
import java.util.concurrent.ConcurrentHashMap; import java.util.concurrent.ConcurrentHashMap;
@@ -39,14 +36,7 @@ import java.util.concurrent.TimeUnit;
* @param <T> * @param <T>
* The type of sessions managed by this session manager. * The type of sessions managed by this session manager.
*/ */
@Singleton public abstract class AuthenticationSessionManager<T extends AuthenticationSession> {
public class AuthenticationSessionManager<T extends AuthenticationSession> {
/**
* Generator of arbitrary, unique, unpredictable identifiers.
*/
@Inject
private IdentifierGenerator idGenerator;
/** /**
* Map of authentication session identifiers to their associated * Map of authentication session identifiers to their associated
@@ -98,7 +88,7 @@ public class AuthenticationSessionManager<T extends AuthenticationSession> {
* token. * token.
*/ */
public String generateInvalid() { public String generateInvalid() {
return idGenerator.generateIdentifier(); return IdentifierGenerator.generateIdentifier();
} }
/** /**
@@ -193,7 +183,7 @@ public class AuthenticationSessionManager<T extends AuthenticationSession> {
* given session when calling resume(). * given session when calling resume().
*/ */
public String defer(T session) { public String defer(T session) {
String identifier = idGenerator.generateIdentifier(); String identifier = IdentifierGenerator.generateIdentifier();
sessions.put(identifier, session); sessions.put(identifier, session);
return identifier; return identifier;
} }

View File

@@ -17,10 +17,9 @@
* under the License. * under the License.
*/ */
package org.apache.guacamole.auth.sso; package org.apache.guacamole.net.auth;
import com.google.common.io.BaseEncoding; import com.google.common.io.BaseEncoding;
import com.google.inject.Singleton;
import java.math.BigInteger; import java.math.BigInteger;
import java.security.SecureRandom; import java.security.SecureRandom;
@@ -29,14 +28,13 @@ import java.security.SecureRandom;
* is an arbitrary, random string produced using a cryptographically-secure * is an arbitrary, random string produced using a cryptographically-secure
* random number generator. * random number generator.
*/ */
@Singleton
public class IdentifierGenerator { public class IdentifierGenerator {
/** /**
* Cryptographically-secure random number generator for generating unique * Cryptographically-secure random number generator for generating unique
* identifiers. * identifiers.
*/ */
private final SecureRandom secureRandom = new SecureRandom(); private static final SecureRandom secureRandom = new SecureRandom();
/** /**
* Generates a unique and unpredictable identifier. Each identifier is at * Generates a unique and unpredictable identifier. Each identifier is at
@@ -48,7 +46,7 @@ public class IdentifierGenerator {
* A unique and unpredictable identifier with at least 256 bits of * A unique and unpredictable identifier with at least 256 bits of
* entropy. * entropy.
*/ */
public String generateIdentifier() { public static String generateIdentifier() {
return generateIdentifier(256); return generateIdentifier(256);
} }
@@ -65,7 +63,7 @@ public class IdentifierGenerator {
* A unique and unpredictable identifier with at least the given number * A unique and unpredictable identifier with at least the given number
* of bits of entropy. * of bits of entropy.
*/ */
public String generateIdentifier(int minBits) { public static String generateIdentifier(int minBits) {
return generateIdentifier(minBits, true); return generateIdentifier(minBits, true);
} }
@@ -87,7 +85,7 @@ public class IdentifierGenerator {
* A unique and unpredictable identifier with at least the given number * A unique and unpredictable identifier with at least the given number
* of bits of entropy. * of bits of entropy.
*/ */
public String generateIdentifier(int minBits, boolean caseSensitive) { public static String generateIdentifier(int minBits, boolean caseSensitive) {
// Generate a base64 identifier if we're allowed to vary by case // Generate a base64 identifier if we're allowed to vary by case
if (caseSensitive) { if (caseSensitive) {