import com.yubico.client.v2.VerificationResponse; //导入依赖的package包/类
/**
 * {@inheritDoc}
 * Attempts to authenticate the received credentials using the Yubico cloud validation platform.
 * In this implementation, the {@link UsernamePasswordCredential#getUsername()}
 * is mapped to the {@code uid} which will be used by the plugged-in instance of the
 * {@link YubiKeyAccountRegistry}
 * and the {@link UsernamePasswordCredential#getPassword()} is the received
 * one-time password token issued by the YubiKey device.
 */
@Override
protected HandlerResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential transformedCredential)
        throws GeneralSecurityException, PreventedException {

    final String uid = transformedCredential.getUsername();
    final String otp = transformedCredential.getPassword();

    if (!YubicoClient.isValidOTPFormat(otp)) {
        logger.debug("Invalid OTP format [{}]", otp);
        throw new FailedLoginException("OTP format is invalid");
    }

    final String publicId = YubicoClient.getPublicId(otp);
    if (this.registry != null
          &&!this.registry.isYubiKeyRegisteredFor(uid, publicId)) {
        logger.debug("YubiKey public id [{}] is not registered for user [{}]", publicId, uid);
        throw new AccountNotFoundException("YubiKey id is not recognized in registry");
    }

    try {
        final VerificationResponse response = this.client.verify(otp);
        final ResponseStatus status = response.getStatus();
        if (status.compareTo(ResponseStatus.OK) == 0) {
            logger.debug("YubiKey response status {} at {}", status, response.getTimestamp());
            return createHandlerResult(transformedCredential,
                    this.principalFactory.createPrincipal(uid), null);
        }
        throw new FailedLoginException("Authentication failed with status: " + status);
    } catch (final YubicoVerificationException | YubicoValidationFailure e) {
        logger.error(e.getMessage(), e);
        throw new FailedLoginException("YubiKey validation failed: " + e.getMessage());
    }
}
 

import com.yubico.client.v2.VerificationResponse; //导入依赖的package包/类
@Override
protected HandlerResult doAuthentication(final Credential credential) throws GeneralSecurityException, PreventedException {
    final YubiKeyCredential yubiKeyCredential = (YubiKeyCredential) credential;

    final String otp = yubiKeyCredential.getToken();

    if (!YubicoClient.isValidOTPFormat(otp)) {
        LOGGER.debug("Invalid OTP format [{}]", otp);
        throw new AccountNotFoundException("OTP format is invalid");
    }

    final RequestContext context = RequestContextHolder.getRequestContext();
    final String uid = WebUtils.getAuthentication(context).getPrincipal().getId();
    final String publicId = YubicoClient.getPublicId(otp);
    if (this.registry != null
            && !this.registry.isYubiKeyRegisteredFor(uid, publicId)) {
        LOGGER.debug("YubiKey public id [{}] is not registered for user [{}]", publicId, uid);
        throw new AccountNotFoundException("YubiKey id is not recognized in registry");
    }

    try {
        final VerificationResponse response = this.client.verify(otp);
        final ResponseStatus status = response.getStatus();
        if (status.compareTo(ResponseStatus.OK) == 0) {
            LOGGER.debug("YubiKey response status [{}] at [{}]", status, response.getTimestamp());
            return createHandlerResult(yubiKeyCredential, this.principalFactory.createPrincipal(uid), null);
        }
        throw new FailedLoginException("Authentication failed with status: " + status);
    } catch (final YubicoVerificationException | YubicoValidationFailure e) {
        LOGGER.error(e.getMessage(), e);
        throw new FailedLoginException("YubiKey validation failed: " + e.getMessage());
    }
}
 

import com.yubico.client.v2.VerificationResponse; //导入依赖的package包/类
@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject)
    throws AuthException {
  _logger.debug("Enter validateRequest");

  if (!requiresAuthentication(messageInfo)) {
    _logger.debug("Returning success, auth policy not mandatory");
    return AuthStatus.SUCCESS;
  }

  HttpServletRequest req = (HttpServletRequest) messageInfo.getRequestMessage();
  HttpServletResponse resp = (HttpServletResponse) messageInfo.getResponseMessage();

  try {
    UserAccount account = (UserAccount) req.getSession().getAttribute(USER_ACCOUNT_SESSION_KEY);
    if (account != null) {
      _logger.debug("Returning success, user already logged in");
      addPrincipalsToSubject(clientSubject, account);
      return AuthStatus.SUCCESS;
    }

    if (!req.getRequestURI().endsWith(LOGIN_PAGE)) {
      redirectToLoginPage(req, resp);
      return AuthStatus.SEND_CONTINUE;
    }

    if ("GET".equals(req.getMethod())) {
      forwardToLoginPage(req, resp, "GET request");
      return AuthStatus.SEND_CONTINUE;
    }

    String userName = req.getParameter("j_username");
    String password = req.getParameter("j_password");
    String otp = req.getParameter("j_otp");

    if (userName == null || password == null || otp == null) {
      _logger.debug("Returning failure, missing request parameter(s)");
      forwardToFailedLoginPage(req, resp, null);
      return AuthStatus.SEND_CONTINUE;
    }

    UserAccount userAccount = _accountMap.get(userName);
    if (userAccount != null
        && userAccount.getHashedPassword().equals(
            PasswordEncoder.encodePasswordForUser(userName, userAccount.getSalt(), password))
        && YubicoClient.isValidOTPFormat(otp)) {
      _logger.debug("Verifying Yubikey for {}...", userName);
      VerificationResponse response = _yubicoClient.verify(otp);
      if (response.isOk()) {
        if (response.getPublicId().equals(userAccount.getPublicYubiId())) {
          addPrincipalsToSubject(clientSubject, userAccount);
          req.getSession().setAttribute(USER_ACCOUNT_SESSION_KEY, userAccount);

          String originalUri = (String) req.getSession().getAttribute(ORIGINAL_URI_SESSION_KEY);
          if (originalUri != null) {
            _logger.debug("Login successful for {}, redirecting to {}", userName, originalUri);
            resp.sendRedirect(originalUri);
            return AuthStatus.SEND_CONTINUE;
          } else {
            _logger.debug("Login successful for {}, returning success", userName);
            return AuthStatus.SUCCESS;
          }
        } else {
          _logger.warn("Login attempt for {} with wrong Yubikey {}!", userName, response.getPublicId());
        }
      } else {
        _logger.info("Failed to verify Yubikey for {}, response not OK", userName);
      }
    }

    forwardToFailedLoginPage(req, resp, "authentication failed");
    return AuthStatus.SEND_CONTINUE;
  } catch (Exception e) {
    _logger.error("Authentication failed with exception", e);
    throw new AuthException(e.getMessage());
  }
}
 

import com.yubico.client.v2.VerificationResponse; //导入依赖的package包/类
static YubiVerifyResponse ok(VerificationResponse yubicoResponse) {
	return builder().verifyStatus(VerifyStatus.OK).yubicoResponse(yubicoResponse).build();
}
 

import com.yubico.client.v2.VerificationResponse; //导入依赖的package包/类
static YubiVerifyResponse failed(VerificationResponse status) {
	return builder().verifyStatus(VerifyStatus.FAILED).yubicoResponse(status).build();
}
 

import com.yubico.client.v2.VerificationResponse; //导入依赖的package包/类
/**
 * 验证OTP正确性
 *
 * @param otp
 * @return
 * @throws YubicoVerificationException
 * @throws YubicoValidationFailure
 */
public boolean verifyYubicoOTP(String otp) throws YubicoVerificationException, YubicoValidationFailure {
    VerificationResponse response = yubicoClient.verify(otp);
    return response.isOk();
}