# SecurityManagerAuthenticator.java

    /*
     ** Module   : SecurityManagerAuthenticator.java
     ** Abstract : SecurityManager implementation of Authenticator interface moved to its own class.
     **
     ** Copyright (c) 2023, Golden Code Development Corporation.
     **
     ** -#- -I- --Date-- -----------------------Description------------------------
     ** 001 GBB 20230825 Initial version.
     */

    /*
    ** This program is free software: you can redistribute it and/or modify
    ** it under the terms of the GNU Affero General Public License as
    ** published by the Free Software Foundation, either version 3 of the
    ** License, or (at your option) any later version.
    **
    ** This program is distributed in the hope that it will be useful,
    ** but WITHOUT ANY WARRANTY; without even the implied warranty of
    ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    ** GNU Affero General Public License for more details.
    **
    ** You may find a copy of the GNU Affero GPL version 3 at the following
    ** location: https://www.gnu.org/licenses/agpl-3.0.en.html
    **
    ** Additional terms under GNU Affero GPL version 3 section 7:
    **
    **   Under Section 7 of the GNU Affero GPL version 3, the following additional
    **   terms apply to the works covered under the License.  These additional terms
    **   are non-permissive additional terms allowed under Section 7 of the GNU
    **   Affero GPL version 3 and may not be removed by you.
    **
    **   0. Attribution Requirement.
    **
    **     You must preserve all legal notices or author attributions in the covered
    **     work or Appropriate Legal Notices displayed by works containing the covered
    **     work.  You may not remove from the covered work any author or developer
    **     credit already included within the covered work.
    **
    **   1. No License To Use Trademarks.
    **
    **     This license does not grant any license or rights to use the trademarks
    **     Golden Code, FWD, any Golden Code or FWD logo, or any other trademarks
    **     of Golden Code Development Corporation. You are not authorized to use the
    **     name Golden Code, FWD, or the names of any author or contributor, for
    **     publicity purposes without written authorization.
    **
    **   2. No Misrepresentation of Affiliation.
    **
    **     You may not represent yourself as Golden Code Development Corporation or FWD.
    **
    **     You may not represent yourself for publicity purposes as associated with
    **     Golden Code Development Corporation, FWD, or any author or contributor to
    **     the covered work, without written authorization.
    **
    **   3. No Misrepresentation of Source or Origin.
    **
    **     You may not represent the covered work as solely your work.  All modified
    **     versions of the covered work must be marked in a reasonable way to make it
    **     clear that the modified work is not originating from Golden Code Development
    **     Corporation or FWD.  All modified versions must contain the notices of
    **     attribution required in this license.
    */

    package com.goldencode.p2j.security;

    import com.goldencode.p2j.cfg.*;
    import com.goldencode.p2j.directory.*;
    import com.goldencode.p2j.net.*;
    import com.goldencode.p2j.util.*;
    import com.goldencode.p2j.util.logging.*;

    import java.io.*;
    import java.util.*;
    import java.util.logging.*;

    /**
     * SecurityManager implementation of Authenticator interface moved to its own class.
     * Using it through {@link SecurityManager#serverAuthenticator} allows resetting SecurityManager instance.
     */
    class SecurityManagerAuthenticator
    implements Authenticator
    {
       /** Logger. */
       private static final CentralLogger LOG = CentralLogger.get(SecurityManagerAuthenticator.class);

       /** SecurityManager instance. */
       private SecurityManager sm;

       /** The value of "option" node from AuthPlugin for this Authenticator */
       @SuppressWarnings("unused")
       private String authOption = null;

       /**
        * Public constructor.
        *
        * @param    securityManager
        *           SecurityManager instance.
        */
       SecurityManagerAuthenticator(SecurityManager securityManager)
       {
          sm = securityManager;
       }

       /**
        * Implements client side standard authentication logic.
        * <p>
        * Returns a byte array to be transmitted to the server as authentication
        * input.  The userid and password values will be obtained by prompting
        * the user using <code>stdin</code> and <code>stdout</code>.
        * <p>
        * If this method is called, it simply provides a userID and password no
        * matter what authentication mode is. It works, because certificates are
        * verified before the call, if the authentication mode required that.
        * <p>
        * This logic allows specifying
        * <code>com.goldencode.p2j.security.SecurityManager</code> as a hook name.
        *
        * @param    parameters
        *           Additional configuration parameters. Not used in this
        *           implementation.
        * @param    code
        *           The result of the most recent attempt to authenticate or
        *           <code>AUTH_RESULT_NONE</code> if this is the first attempt.
        *
        * @return   Array of bytes that is taken as an authentication input.
        *           The array is suitable for passing to {@link #serverAuthHook}
        *           for authentication processing.
        */
       @Override
       public byte[] clientAuthHook(Map<String, Object> parameters, int code)
       {
          return clientAuthHookWorker(parameters, code, sm.getConfig());
       }

       /**
        * Finalizes any resources allocated during authentication by the client.
        */
       @Override
       public void clientFinalize()
       {
       }

       /**
        * Implements server side standard authorization logic.
        * <p>
        * Accepts the byte array produced by the client side authorization hook
        * as the authentication input, and custom parameters.
        *
        * @param    auth
        *           The authentication input from the client in a form that is
        *           created using {@link SecurityUtil#packageIdPassword}.
        * @param    entity
        *           Entity to be processed.
        *           Not used in this implementation.
        *
        * @return   The authentication result.
        */
       @Override
       public AuthenticationResponse serverAuthHook(byte[] auth, String entity)
       {
          if (!sm.isServer())
             return null;

          // parse the byte array input
          ByteArrayInputStream bis = new ByteArrayInputStream(auth);
          DataInputStream      dis = new DataInputStream(bis);

          String userId = null;
          String pw     = null;
          char[] userPw = null;

          try
          {
             userId = dis.readUTF();
             pw     = dis.readUTF();
             userPw = pw.toCharArray();
          }
          catch (IOException ioe)
          {
             return new AuthenticationResponse(null, AUTH_RESULT_UNSPECIFIED_FAILURE);
          }

          // WARNING: the security cache accessed here may be different than the caller's security
          // cache generation

          // Safely query cached data
          SecurityCache sc = sm.getCache();

          // locate the account and its password hash
          LOG.finer("Received user ID <" + userId + ">");
          Account acc = sc.getAccountById(userId);

          if (acc == null)
          {
             LOG.finer("No account for ID <" + userId + ">");
             return new AuthenticationResponse(null, AUTH_RESULT_INVALID_USERID);
          }

          // TODO: Why is this restriction needed? By doing this, one cannot
          //       use the custom auth method to authenticate processes, right?
          if (acc.getAccountType() != Account.ACC_USER)
          {
             LOG.finer("Wrong account type for ID <" + userId + ">");
             return new AuthenticationResponse(null, AUTH_RESULT_UNSPECIFIED_FAILURE);
          }

          UserAccount user = (UserAccount) acc;

          if (user.getAuthMode() == AUTH_MODE_X509)
          {
             LOG.finer("Account <" + userId + "> uses x509 auth mode, cancelling custom or id/pw auth");
             return new AuthenticationResponse(null, AUTH_RESULT_INVALID_USERID);
          }

          // verify password
          if (LOG.isLoggable(Level.FINEST))
             LOG.finest("Received password <" + pw + ">");
          else
             LOG.finer("Received password");

          if (checkPassword(new String(userPw), user))
          {
             agePassword(user);
             return new AuthenticationResponse(userId, AUTH_RESULT_SUCCESS);
          }

          return new AuthenticationResponse(null, AUTH_RESULT_INVALID_PASSWORD);
       }

       /**
        * Always returns <code>null</code>.
        *
        * @return  Always <code>null</code>.
        */
       @Override
       public SessionListener getSessionListener()
       {
          return null;
       }

       /**
        * Configures the Authenticator by setting the "option" parameter from directory.xml.
        *
        * @param   option
        *          The value of "option" entry for the auth plugin.
        */
       @Override
       public void configure(String option)
       {
          this.authOption = option;
       }

       /**
        * Returns a set of entities that this class handles. The list of entities / parameters will
        * be configured using other ways.
        *
        * @return  Always <code>null</code>.
        */
       @Override
       public Set<String> getAuthenticationEntities()
       {
          return null;
       }

       /**
        * Implements client side standard authentication logic.
        * <p>
        * Returns a byte array to be transmitted to the server as authentication
        * input.  If not contained in the given bootstrap configuration, the userid
        * and password values will be obtained by prompting the user using
        * <code>stdin</code> and <code>stdout</code>.
        * <p>
        * If this method is called, it simply provides a userID and password no
        * matter what authentication mode is. It works, because certificates are
        * verified before the call, if the authentication mode required that.
        *
        * @param    parameters
        *           Additional configuration parameters. Not used in this
        *           implementation.
        * @param    code
        *           The result of the most recent attempt to authenticate or
        *           <code>AUTH_RESULT_NONE</code> if this is the first attempt.
        * @param    config
        *           Configuration data upon which to base default processing.
        *
        * @return   Array of bytes that is taken as an authentication input.
        *           The array is suitable for passing to {@link #serverAuthHook}
        *           for authentication processing.
        */
       byte[] clientAuthHookWorker(Map<String, Object> parameters, int code, BootstrapConfig config)
       {
          if (config.isServer())
             return null;

          String id = null;
          String pw = null;
          boolean stored = true;

          try
          {
             id = config.getString("access", "subject", "id", null);

             if (id == null)
             {
                id = new String(Utils.prompt("User ID  :"));
                stored = false;
             }

             pw = config.getString("access", "password", "user", null);

             if (pw == null)
             {
                pw = new String(Utils.prompt("Password :"));
                stored = false;
             }

             config.setConfigItem("access", "password", "user", "password");
          }

          catch (Exception exc)
          {
             // pass through any failures
          }

          // if there was a failure and this input comes from the config, fail
          if (stored && code > AUTH_RESULT_SUCCESS)
          {
             return null;
          }

          return SecurityUtil.packageIdPassword(id, pw);
       }

       /**
        * Verifies the plain text password against the one stored with
        * the specified user account.
        *
        * @param   plain
        *          plain text password
        * @param   user
        *          <code>UserAccount</code> instance
        * @return  <code>true</code> if password is valid
        */
       private boolean checkPassword(String plain, UserAccount user)
       {
          if (user.getWebServiceToken() != null)
          {
             // this is an user used for web service requests, don't allow password authentication
             return false;
          }

          if (!user.isProtected())
          {
             // this user account is not protected with a password
             return true;
          }

          byte[] hashpw = null;

          synchronized (sm.pwchSync)
          {
             hashpw = user.getPassword();
          }

          if (hashpw == null)
          {
             // no password assigned - the account can't be used
             return false;
          }

          byte[] testpw = HashPassword.hashPassword(plain);

          if (testpw == null)
          {
             return false;
          }

          if (testpw.length != hashpw.length)
          {
             LOG.finer("Wrong password");
             return false;
          }

          for (int i = 0; i < hashpw.length; i++)
          {
             if (testpw[i] != hashpw[i])
             {
                LOG.finer("Wrong password");
                return false;
             }
          }

          return true;
       }

       /**
        * Calculates the age of the existing user account password and checks to
        * see whether it is too old, according to the maxAge parameter.
        *
        * @param   user
        *          <code>UserAccount</code> instance
        */
       private void agePassword(UserAccount user)
       {
          // Pick up the generation of the security cache
          SecurityCache sc = sm.getCache();

          // get and check the password aging parameter
          int max = sc.getMaxAge();
          if (max == 0)
             return;

          // get the timestamp of the last password change, if any
          DateValue pdate = user.getPasswordDate();
          TimeValue ptime = user.getPasswordTime();

          // no or incomplete timestamp means the password is considered aged
          if (pdate == null || ptime == null)
          {
             user.setPasswordAged(true);
             return;
          }

          // calculate password age
          Date pwDate = pdate.getDate();
          Date now = new Date();

          long maxAge = ((long)max) * 86400 * 1000;
          long age = now.getTime() - pwDate.getTime();

          // flag the password as aged if its age exceeds the limit
          if (age > maxAge)
             user.setPasswordAged(true);
       }
    }