import org.jivesoftware.openfire.auth.AuthFactory; //导入依赖的package包/类
/**
 * Authenticates the connection manager. Shared secret is validated with the one provided
 * by the connection manager. If everything went fine then the session will have a status
 * of "authenticated" and the connection manager will receive the client configuration
 * options.
 *
 * @param digest the digest provided by the connection manager with the handshake stanza.
 * @return true if the connection manager was sucessfully authenticated.
 */
public boolean authenticate(String digest) {
    // Perform authentication. Wait for the handshake (with the secret key)
    String anticipatedDigest = AuthFactory.createDigest(getStreamID().getID(),
            ConnectionMultiplexerManager.getDefaultSecret());
    // Check that the provided handshake (secret key + sessionID) is correct
    if (!anticipatedDigest.equalsIgnoreCase(digest)) {
        Log.debug("LocalConnectionMultiplexerSession: [ConMng] Incorrect handshake for connection manager with domain: " +
                getAddress().getDomain());
        //  The credentials supplied by the initiator are not valid (answer an error
        // and close the connection)
        conn.deliverRawText(new StreamError(StreamError.Condition.not_authorized).toXML());
        // Close the underlying connection
        conn.close();
        return false;
    }
    else {
        // Component has authenticated fine
        setStatus(STATUS_AUTHENTICATED);
        // Send empty handshake element to acknowledge success
        conn.deliverRawText("<handshake></handshake>");
        Log.debug("LocalConnectionMultiplexerSession: [ConMng] Connection manager was AUTHENTICATED with domain: " + getAddress());
        sendClientOptions();
        return true;
    }
}
 

import org.jivesoftware.openfire.auth.AuthFactory; //导入依赖的package包/类
/**
 * Sets a new password for this user.
 *
 * @param password the new password for the user.
 * @throws UnsupportedOperationException exception
 */
public void setPassword(String password) throws UnsupportedOperationException {
    if (UserManager.getUserProvider().isReadOnly()) {
        throw new UnsupportedOperationException("User provider is read-only.");
    }

    try {
        AuthFactory.setPassword(username, password);

        // Fire event.
        Map<String,Object> params = new HashMap<>();
        params.put("type", "passwordModified");
        UserEventDispatcher.dispatchEvent(this, UserEventDispatcher.EventType.user_modified,
                params);
    }
    catch (UserNotFoundException | ConnectionException | InternalUnauthenticatedException e) {
        Log.error(e.getMessage(), e);
    }
}
 

import org.jivesoftware.openfire.auth.AuthFactory; //导入依赖的package包/类
/**
 * Sets a new password for this user.
 *
 * @param password the new password for the user.
 * @throws UnsupportedOperationException exception
 */
public void setPassword(String password) throws UnsupportedOperationException {
    if (UserManager.getUserProvider().isReadOnly()) {
        throw new UnsupportedOperationException("User provider is read-only.");
    }

    try {
        AuthFactory.getAuthProvider().setPassword(username, password);

        // Fire event.
        Map<String,Object> params = new HashMap<String,Object>();
        params.put("type", "passwordModified");
        UserEventDispatcher.dispatchEvent(this, UserEventDispatcher.EventType.user_modified,
                params);
    }
    catch (UserNotFoundException unfe) {
        Log.error(unfe.getMessage(), unfe);
    }
}
 

import org.jivesoftware.openfire.auth.AuthFactory; //导入依赖的package包/类
/**
 * Clients are not authenticated when accessing this handler.
 */
public IQAuthHandler() {
    super("XMPP Authentication handler");
    info = new IQHandlerInfo("query", "jabber:iq:auth");

    probeResponse = DocumentHelper.createElement(QName.get("query", "jabber:iq:auth"));
    probeResponse.addElement("username");
    if (AuthFactory.isPlainSupported()) {
        probeResponse.addElement("password");
    }
    if (AuthFactory.isDigestSupported()) {
        probeResponse.addElement("digest");
    }
    probeResponse.addElement("resource");
    anonymousAllowed = JiveGlobals.getBooleanProperty("xmpp.auth.anonymous");
}
 

import org.jivesoftware.openfire.auth.AuthFactory; //导入依赖的package包/类
@Override
public String getEncrypted(String value) {
  String encrypted = null;
  try {
    encrypted = AuthFactory.encryptPassword(value);
    // Set password to null so that it's inserted that way.
  } catch (UnsupportedOperationException uoe) {
    // Encrypting the apiKey may have failed. Therefore,

  }
  return encrypted;
}
 

import org.jivesoftware.openfire.auth.AuthFactory; //导入依赖的package包/类
@Override
public String getDecrypted(String value) {
  String decrypted = null;
  try {
    decrypted = AuthFactory.decryptPassword(value);
    // Set password to null so that it's inserted that way.
  } catch (UnsupportedOperationException uoe) {
    // Encrypting the apiKey may have failed. Therefore,

  }
  return decrypted;
}
 

import org.jivesoftware.openfire.auth.AuthFactory; //导入依赖的package包/类
/**
 * Encrypt a string value using the openfire AuthFactory
 * @param value
 * @return
 */
protected String getEncrypted(String value) {
  String encrypted = null;
  try {
    encrypted = AuthFactory.encryptPassword(value);
    // Set password to null so that it's inserted that way.
  } catch (UnsupportedOperationException uoe) {
    // Encrypting the apiKey may have failed. Therefore,

  }
  return encrypted;
}
 

import org.jivesoftware.openfire.auth.AuthFactory; //导入依赖的package包/类
/**
 * Decrypt a string using openfire AuthFactory
 * @param value
 * @return
 */
protected String getDecrypted(String value) {
  String decrypted = null;
  try {
    decrypted = AuthFactory.decryptPassword(value);
  } catch (UnsupportedOperationException uoe) {
  }
  return decrypted;
}
 

import org.jivesoftware.openfire.auth.AuthFactory; //导入依赖的package包/类
/**
 * Retrieve the iteration count from the database for a given username.
 */
private int getIterations(final String username) {
    try {
        return AuthFactory.getIterations(username);
    } catch (UserNotFoundException e) {
        return JiveGlobals.getIntProperty("sasl.scram-sha-1.iteration-count",
            ScramUtils.DEFAULT_ITERATION_COUNT);
    }
}
 

import org.jivesoftware.openfire.auth.AuthFactory; //导入依赖的package包/类
/**
 * Retrieve the server key from the database for a given username.
 */
private byte[] getServerKey(final String username) throws UserNotFoundException {
    final String serverKey = AuthFactory.getServerKey(username);
    if (serverKey == null) {
        return null;
    } else {
        return DatatypeConverter.parseBase64Binary( serverKey );
    }
}
 

import org.jivesoftware.openfire.auth.AuthFactory; //导入依赖的package包/类
/**
 * Retrieve the stored key from the database for a given username.
 */
private byte[] getStoredKey(final String username) throws UserNotFoundException {
    final String storedKey = AuthFactory.getStoredKey(username);
    if (storedKey == null) {
        return null;
    } else {
        return DatatypeConverter.parseBase64Binary( storedKey );
    }
}
 

import org.jivesoftware.openfire.auth.AuthFactory; //导入依赖的package包/类
/**
 * Verifies that the user is authenticated via some mechanism such as Basic Auth.  If the
 * authentication fails, this method will alter the HTTP response to include a request for
 * auth and send the unauthorized response back to the client.
 *
 * TODO: Handle some form of special token auth, perhaps provided a room connection?
 * TODO: If it's not a local account, we should try message auth access?  XEP-0070?
 * TODO: Should we support digest auth as well?
 *
 * @param request Object representing the HTTP request.
 * @param response Object representing the HTTP response.
 * @return True or false if the user is authenticated.
 * @throws ServletException If there was a servlet related exception.
 * @throws IOException If there was an IO error while setting the error.
 */
private Boolean isAuthenticated(HttpServletRequest request, HttpServletResponse response)
        throws ServletException, IOException {
    String auth = request.getHeader("Authorization");
    JID jid;
    try {
        if (auth == null || !request.getAuthType().equals(HttpServletRequest.BASIC_AUTH)) {
            throw new Exception("No authorization or improper authorization provided.");
        }
        auth = auth.substring(auth.indexOf(" "));
        String decoded = new String(Base64.decode(auth));
        int i = decoded.indexOf(":");
        String username = decoded.substring(0,i);
        if (!username.contains("@")) {
            throw new Exception("Not a valid JID.");
        }
        jid = new JID(username);
        if (XMPPServer.getInstance().isLocal(jid)) {
            String password = decoded.substring(i+1, decoded.length());
            if (AuthFactory.authenticate(username, password) == null) {
                throw new Exception("Authentication failed.");
            }
        }
        else {
            // TODO: Authenticate a remote user, probably via message auth.
            throw new Exception("Not a local account.");
        }
        return true;
    }
    catch (Exception e) {
        /*
         * This covers all possible authentication issues.  Eg:
         * - not enough of auth info passed in
         * - failed auth
         */
        response.setHeader("WWW-Authenticate", "Basic realm=\"Openfire WebDAV\"");
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
        return false;
    }
}
 

import org.jivesoftware.openfire.auth.AuthFactory; //导入依赖的package包/类
/**
 * Verifies the key sent by a Receiving Server. This server will be acting as the
 * Authoritative Server when executing this method. The remote server may have established
 * a new connection to the Authoritative Server (i.e. this server) for verifying the key
 * or it may be reusing an existing incoming connection.
 *
 * @param doc the Element that contains the key to verify.
 * @param connection the connection to use for sending the verification result
 * @return true if the key was verified.
 */
public static boolean verifyReceivedKey(Element doc, Connection connection) {
    String verifyFROM = doc.attributeValue("from");
    String verifyTO = doc.attributeValue("to");
    String key = doc.getTextTrim();
    StreamID streamID = BasicStreamIDFactory.createStreamID( doc.attributeValue("id") );

    final Logger log = LoggerFactory.getLogger( Log.getName() + "[Acting as Authoritative Server: Verify key sent by RS: " + verifyFROM + " (id " + streamID+ ")]" );

    log.debug( "Verifying key... ");

    // TODO If the value of the 'to' address does not match a recognized hostname,
    // then generate a <host-unknown/> stream error condition
    // TODO If the value of the 'from' address does not match the hostname
    // represented by the Receiving Server when opening the TCP connection, then
    // generate an <invalid-from/> stream error condition

    // Verify the received key
    // Created the expected key based on the received ID value and the shared secret
    String expectedKey = AuthFactory.createDigest(streamID.getID(), getSecretkey());
    boolean verified = expectedKey.equals(key);

    // Send the result of the key verification
    StringBuilder sb = new StringBuilder();
    sb.append("<db:verify");
    sb.append(" from=\"").append(verifyTO).append("\"");
    sb.append(" to=\"").append(verifyFROM).append("\"");
    sb.append(" type=\"");
    sb.append(verified ? "valid" : "invalid");
    sb.append("\" id=\"").append(streamID.getID()).append("\"/>");
    connection.deliverRawText(sb.toString());
    log.debug("Verification successful! Key was: " + (verified ? "VALID" : "INVALID"));
    return verified;
}
 

import org.jivesoftware.openfire.auth.AuthFactory; //导入依赖的package包/类
/**
 * Sets the password used for logging in to the transport.
 *
 * @param password new password for registration.
 */
public void setPassword(String password) {
    this.password = password;
    if (disconnectedMode) { return; }
    // The password is stored in encrypted form for improved security.
    String encryptedPassword = AuthFactory.encryptPassword(password);
    Connection con = null;
    PreparedStatement pstmt = null;
    try {
        con = DbConnectionManager.getConnection();
        pstmt = con.prepareStatement(SET_PASSWORD);
        if (password != null) {
            pstmt.setString(1, encryptedPassword);
        }
        else {
            pstmt.setNull(1, Types.VARCHAR);
        }
        pstmt.setLong(2, registrationID);
        pstmt.executeUpdate();
    }
    catch (SQLException sqle) {
        Log.error(sqle);
    }
    finally {
        DbConnectionManager.closeConnection(pstmt, con);
    }
}
 

import org.jivesoftware.openfire.auth.AuthFactory; //导入依赖的package包/类
/**
 * Inserts a new registration into the database.
 *
 * @throws SQLException if the SQL statement is wrong for whatever reason.
 */
private void insertIntoDb() throws SQLException {
    if (disconnectedMode) { return; }
    this.registrationID = SequenceManager.nextID(this);
    Connection con = null;
    PreparedStatement pstmt = null;
    boolean abortTransaction = false;
    try {
        con = DbConnectionManager.getTransactionConnection();
        pstmt = con.prepareStatement(INSERT_REGISTRATION);
        pstmt.setLong(1, registrationID);
        pstmt.setString(2, jid.toString());
        pstmt.setString(3, transportType.name());
        pstmt.setString(4, username);
        if (password != null) {
            // The password is stored in encrypted form for improved security.
            String encryptedPassword = AuthFactory.encryptPassword(password);
            pstmt.setString(5, encryptedPassword);
        }
        else {
            pstmt.setNull(5, Types.VARCHAR);
        }
        if (nickname != null) {
            pstmt.setString(6, nickname);
        }
        else {
            pstmt.setNull(6, Types.VARCHAR);
        }
        pstmt.setLong(7, registrationDate.getTime());
        pstmt.executeUpdate();
    }
    catch (SQLException sqle) {
        abortTransaction = true;
        throw sqle;
    }
    finally {
        DbConnectionManager.closeTransactionConnection(pstmt, con, abortTransaction);
    }
}
 

import org.jivesoftware.openfire.auth.AuthFactory; //导入依赖的package包/类
/**
 * Load registration from database.
 *
 * @throws NotFoundException if registration was not found in database.
 */
private void loadFromDb() throws NotFoundException {
    if (disconnectedMode) { return; }        
    Connection con = null;
    PreparedStatement pstmt = null;
    ResultSet rs = null;
    try {
        con = DbConnectionManager.getConnection();
        pstmt = con.prepareStatement(LOAD_REGISTRATION);
        pstmt.setLong(1, registrationID);
        rs = pstmt.executeQuery();
        if (!rs.next()) {
            throw new NotFoundException("Registration not found: " + registrationID);
        }
        this.jid = new JID(rs.getString(1));
        this.transportType = TransportType.valueOf(rs.getString(2));
        this.username = rs.getString(3);
        // The password is stored in encrypted form, so decrypt it.
        this.password = AuthFactory.decryptPassword(rs.getString(4));
        this.nickname = rs.getString(5);
        this.registrationDate = new Date(rs.getLong(6));
        long loginDate = rs.getLong(7);
        if (rs.wasNull()) {
            this.lastLogin = null;
        }
        else {
            this.lastLogin = new Date(loginDate);
        }
    }
    catch (SQLException sqle) {
        Log.error(sqle);
    }
    finally {
        DbConnectionManager.closeConnection(rs, pstmt, con);
    }
}
 

import org.jivesoftware.openfire.auth.AuthFactory; //导入依赖的package包/类
/**
 * Clients are not authenticated when accessing this handler.
 */
public IQAuthHandler() {
    super("XMPP Authentication handler");
    info = new IQHandlerInfo("query", "jabber:iq:auth");

    probeResponse = DocumentHelper.createElement(QName.get("query", "jabber:iq:auth"));
    probeResponse.addElement("username");
    if (AuthFactory.supportsPasswordRetrieval()) {
        probeResponse.addElement("password");
        probeResponse.addElement("digest");
    }
    probeResponse.addElement("resource");
}
 

import org.jivesoftware.openfire.auth.AuthFactory; //导入依赖的package包/类
/**
 * Authenticates a user with a username, token, and digest and returns an AuthToken.
 * The digest should be generated using the {@link AuthFactory#createDigest(String, String)} method.
 * If the username and digest do not match the record of any user in the system, the
 * method throws an UnauthorizedException.
 *
 * @param username the username.
 * @param token the token that was used with plain-text password to generate the digest.
 * @param digest the digest generated from plain-text password and unique token.
 * @return an AuthToken token if the username and digest are correct for the user's
 *      password and given token.
 * @throws UnauthorizedException if the username and password do not match any
 *      existing user or the account is locked out.
 */
public static AuthToken authenticate(String username, String token, String digest)
        throws UnauthorizedException, ConnectionException, InternalUnauthenticatedException {
    if (username == null || token == null || digest == null) {
        throw new UnauthorizedException();
    }
    if ( LockOutManager.getInstance().isAccountDisabled(username)) {
        LockOutManager.getInstance().recordFailedLogin(username);
        throw new UnauthorizedException();
    }
    username = username.trim().toLowerCase();
    if (username.contains("@")) {
        // Check that the specified domain matches the server's domain
        int index = username.indexOf("@");
        String domain = username.substring(index + 1);
        if (domain.equals( XMPPServer.getInstance().getServerInfo().getXMPPDomain())) {
            username = username.substring(0, index);
        } else {
            // Unknown domain. Return authentication failed.
            throw new UnauthorizedException();
        }
    }
    try {
        String password = AuthFactory.getPassword( username );
        String anticipatedDigest = AuthFactory.createDigest(token, password);
        if (!digest.equalsIgnoreCase(anticipatedDigest)) {
            throw new UnauthorizedException();
        }
    }
    catch (UserNotFoundException unfe) {
        throw new UnauthorizedException();
    }
    // Got this far, so the user must be authorized.
    return new AuthToken(username);
}
 

import org.jivesoftware.openfire.auth.AuthFactory; //导入依赖的package包/类
/**
 * Verifies that the user is authenticated via some mechanism such as Basic Auth.  If the
 * authentication fails, this method will alter the HTTP response to include a request for
 * auth and send the unauthorized response back to the client.
 *
 * TODO: Handle some form of special token auth, perhaps provided a room connection?
 * TODO: If it's not a local account, we should try message auth access?  XEP-0070?
 * TODO: Should we support digest auth as well?
 *
 * @param request Object representing the HTTP request.
 * @param response Object representing the HTTP response.
 * @return True or false if the user is authenticated.
 * @throws ServletException If there was a servlet related exception.
 * @throws IOException If there was an IO error while setting the error.
 */
private Boolean isAuthenticated(HttpServletRequest request, HttpServletResponse response)
        throws ServletException, IOException {
    String auth = request.getHeader("Authorization");
    JID jid;
    try {
        if (auth == null || !request.getAuthType().equals(HttpServletRequest.BASIC_AUTH)) {
            throw new Exception("No authorization or improper authorization provided.");
        }
        auth = auth.substring(auth.indexOf(" "));
        String decoded = new String(Base64.decode(auth));
        int i = decoded.indexOf(":");
        String username = decoded.substring(0,i);
        if (!username.contains("@")) {
            throw new Exception("Not a valid JID.");
        }
        jid = new JID(username);
        if (XMPPServer.getInstance().isLocal(jid)) {
            String password = decoded.substring(i+1, decoded.length());
            if (AuthFactory.authenticate(username, password) == null) {
                throw new Exception("Authentication failed.");
            }
        }
        else {
            // TODO: Authenticate a remote user, probably via message auth.
            throw new Exception("Not a local account.");
        }
        return true;
    }
    catch (Exception e) {
        /**
         * This covers all possible authentication issues.  Eg:
         * - not enough of auth info passed in
         * - failed auth
         */
        response.setHeader("WWW-Authenticate", "Basic realm=\"Openfire WebDAV\"");
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
        return false;
    }
}
 

import org.jivesoftware.openfire.auth.AuthFactory; //导入依赖的package包/类
/**
 * Verifies the key sent by a Receiving Server. This server will be acting as the
 * Authoritative Server when executing this method. The remote server may have established
 * a new connection to the Authoritative Server (i.e. this server) for verifying the key
 * or it may be reusing an existing incoming connection.
 *
 * @param doc the Element that contains the key to verify.
 * @param connection the connection to use for sending the verification result
 * @return true if the key was verified.
 */
public static boolean verifyReceivedKey(Element doc, Connection connection) {
    String verifyFROM = doc.attributeValue("from");
    String verifyTO = doc.attributeValue("to");
    String key = doc.getTextTrim();
    String id = doc.attributeValue("id");
    Log.debug("ServerDialback: AS - Verifying key for host: " + verifyFROM + " id: " + id);

    // TODO If the value of the 'to' address does not match a recognized hostname,
    // then generate a <host-unknown/> stream error condition
    // TODO If the value of the 'from' address does not match the hostname
    // represented by the Receiving Server when opening the TCP connection, then
    // generate an <invalid-from/> stream error condition

    // Verify the received key
    // Created the expected key based on the received ID value and the shared secret
    String expectedKey = AuthFactory.createDigest(id, getSecretkey());
    boolean verified = expectedKey.equals(key);

    // Send the result of the key verification
    StringBuilder sb = new StringBuilder();
    sb.append("<db:verify");
    sb.append(" from=\"").append(verifyTO).append("\"");
    sb.append(" to=\"").append(verifyFROM).append("\"");
    sb.append(" type=\"");
    sb.append(verified ? "valid" : "invalid");
    sb.append("\" id=\"").append(id).append("\"/>");
    connection.deliverRawText(sb.toString());
    Log.debug("ServerDialback: AS - Key was: " + (verified ? "VALID" : "INVALID") + " for host: " +
            verifyFROM +
            " id: " +
            id);
    return verified;
}