import io.undertow.util.FlexBase64; //导入依赖的package包/类
public void testCall(final String path, final String expectedResponse, Charset charset, String userAgent, String user, String password, int expect) throws Exception {
        TestHttpClient client = new TestHttpClient();
        try {
            String url = DefaultServer.getDefaultServerURL() + "/dumprunwarrequest?userpath=" + path;
            HttpGet get = new HttpGet(url);
            get = new HttpGet(url);
            get.addHeader(Headers.USER_AGENT_STRING, userAgent);
            get.addHeader(AUTHORIZATION.toString(), BASIC + " " + FlexBase64.encodeString((user + ":" + password).getBytes(charset), false));
            HttpResponse result = client.execute(get);
            assertEquals(expect, result.getStatusLine().getStatusCode());

            final String response = HttpClientUtils.readResponse(result);
            System.out.println(response);
            if(expect == 200) {
                JSONObject responseData = (JSONObject) JSONValue.parse(response);
                String authType = responseData.get(path)!=null?responseData.get(path).toString():"";
                String authHeader = ((JSONObject) responseData.get("headers")).get(Headers.AUTHORIZATION_STRING).toString();
                assertEquals(expectedResponse, authType);
            }
        } finally {
            client.getConnectionManager().shutdown();
        }
}
 

import io.undertow.util.FlexBase64; //导入依赖的package包/类
@Override
public AuthenticationMechanismOutcome authenticate(final HttpServerExchange exchange,
                                                   final SecurityContext securityContext) {
    ServerConnection connection = exchange.getConnection();
    NegotiationContext negContext = connection.getAttachment(NegotiationContext.ATTACHMENT_KEY);
    if (negContext != null) {
        exchange.putAttachment(NegotiationContext.ATTACHMENT_KEY, negContext);
        if (negContext.isEstablished()) {
            IdentityManager identityManager = securityContext.getIdentityManager();
            final Account account = identityManager.verify(new GSSContextCredential(negContext.getGssContext()));
            if (account != null) {
                securityContext.authenticationComplete(account, name, false);
                return AuthenticationMechanismOutcome.AUTHENTICATED;
            } else {
                return AuthenticationMechanismOutcome.NOT_AUTHENTICATED;
            }
        }
    }

    List<String> authHeaders = exchange.getRequestHeaders().get(AUTHORIZATION);
    if (authHeaders != null) {
        for (String current : authHeaders) {
            if (current.startsWith(NEGOTIATE_PREFIX)) {
                String base64Challenge = current.substring(NEGOTIATE_PREFIX.length());
                try {
                    ByteBuffer challenge = FlexBase64.decode(base64Challenge);
                    return runGSSAPI(exchange, challenge, securityContext);
                } catch (IOException e) {
                }

                // By this point we had a header we should have been able to verify but for some reason
                // it was not correctly structured.
                return AuthenticationMechanismOutcome.NOT_AUTHENTICATED;
            }
        }
    }

    // No suitable header was found so authentication was not even attempted.
    return AuthenticationMechanismOutcome.NOT_ATTEMPTED;
}
 

import io.undertow.util.FlexBase64; //导入依赖的package包/类
public ChallengeResult sendChallenge(final HttpServerExchange exchange, final SecurityContext securityContext) {
    NegotiationContext negContext = exchange.getAttachment(NegotiationContext.ATTACHMENT_KEY);

    String header = NEGOTIATION_PLAIN;

    if (negContext != null) {
        byte[] responseChallenge = negContext.useResponseToken();
        exchange.putAttachment(NegotiationContext.ATTACHMENT_KEY, null);
        if (responseChallenge != null) {
            header = NEGOTIATE_PREFIX + FlexBase64.encodeString(responseChallenge, false);
        }
    } else {
        Subject server = null;
        try {
            server = subjectFactory.getSubjectForHost(getHostName(exchange));
        } catch (GeneralSecurityException e) {
            // Deliberately ignore - no Subject so don't offer GSSAPI is our main concern here.
        }
        if (server == null) {
            return new ChallengeResult(false);
        }
    }

    exchange.getResponseHeaders().add(WWW_AUTHENTICATE, header);

    return new ChallengeResult(true, UNAUTHORIZED);
}
 

import io.undertow.util.FlexBase64; //导入依赖的package包/类
public AuthenticationMechanismOutcome run() throws GSSException {
    NegotiationContext negContext = exchange.getAttachment(NegotiationContext.ATTACHMENT_KEY);
    if (negContext == null) {
        negContext = new NegotiationContext();
        exchange.putAttachment(NegotiationContext.ATTACHMENT_KEY, negContext);
        // Also cache it on the connection for future calls.
        exchange.getConnection().putAttachment(NegotiationContext.ATTACHMENT_KEY, negContext);
    }

    GSSContext gssContext = negContext.getGssContext();
    if (gssContext == null) {
        GSSManager manager = GSSManager.getInstance();
        gssContext = manager.createContext((GSSCredential) null);

        negContext.setGssContext(gssContext);
    }

    byte[] respToken = gssContext.acceptSecContext(challenge.array(), challenge.arrayOffset(), challenge.limit());
    negContext.setResponseToken(respToken);

    if (negContext.isEstablished()) {

        if (respToken != null) {
            // There will be no further challenge but we do have a token so set it here.
            exchange.getResponseHeaders().add(WWW_AUTHENTICATE,
                    NEGOTIATE_PREFIX + FlexBase64.encodeString(respToken, false));
        }
        IdentityManager identityManager = securityContext.getIdentityManager();
        final Account account = identityManager.verify(new GSSContextCredential(negContext.getGssContext()));
        if (account != null) {
            securityContext.authenticationComplete(account, name, false);
            return AuthenticationMechanismOutcome.AUTHENTICATED;
        } else {
            return AuthenticationMechanismOutcome.NOT_AUTHENTICATED;
        }
    } else {
        // This isn't a failure but as the context is not established another round trip with the client is needed.
        return AuthenticationMechanismOutcome.NOT_AUTHENTICATED;
    }
}
 

import io.undertow.util.FlexBase64; //导入依赖的package包/类
public SimpleNonceManager(final String hashAlg) {
    // Verify it is a valid algorithm (at least for now)
    MessageDigest digest = getDigest(hashAlg);

    this.hashAlg = hashAlg;
    this.hashLength = digest.getDigestLength();

    // Create a new secret only valid within this NonceManager instance.
    Random rand = new SecureRandom();
    byte[] secretBytes = new byte[32];
    rand.nextBytes(secretBytes);
    secret = FlexBase64.encodeString(digest.digest(secretBytes), false);
}
 

import io.undertow.util.FlexBase64; //导入依赖的package包/类
private String createNonce(final byte[] prefix, final byte[] timeStamp) {
    byte[] hashedPart = generateHash(prefix, timeStamp);
    byte[] complete = new byte[9 + timeStamp.length + hashedPart.length];
    System.arraycopy(prefix, 0, complete, 0, 8);
    complete[8] = (byte) timeStamp.length;
    System.arraycopy(timeStamp, 0, complete, 9, timeStamp.length);
    System.arraycopy(hashedPart, 0, complete, 9 + timeStamp.length, hashedPart.length);

    return FlexBase64.encodeString(complete, false);
}
 

import io.undertow.util.FlexBase64; //导入依赖的package包/类
@Override
public String readAttribute(HttpServerExchange exchange) {
    SSLSessionInfo ssl = exchange.getConnection().getSslSessionInfo();
    if(ssl == null || ssl.getSessionId() == null) {
        return null;
    }
    return FlexBase64.encodeString(ssl.getSessionId(), false);
}
 

import io.undertow.util.FlexBase64; //导入依赖的package包/类
private static byte[] base64Decode(String sessionId) {
    try {
        ByteBuffer sessionIdBuffer = FlexBase64.decode(sessionId);
        byte[] sessionIdData;
        if (sessionIdBuffer.hasArray()) {
            sessionIdData = sessionIdBuffer.array();
        } else {
            sessionIdData = new byte[sessionIdBuffer.remaining()];
            sessionIdBuffer.get(sessionIdData);
        }
        return sessionIdData;
    } catch (IOException e) {
        throw new RuntimeException(e); //won't happen
    }
}
 

import io.undertow.util.FlexBase64; //导入依赖的package包/类
protected String createSecKey() {
    SecureRandom random = new SecureRandom();
    byte[] data = new byte[16];
    for (int i = 0; i < 4; ++i) {
        int val = random.nextInt();
        data[i * 4] = (byte) val;
        data[i * 4 + 1] = (byte) ((val >> 8) & 0xFF);
        data[i * 4 + 2] = (byte) ((val >> 16) & 0xFF);
        data[i * 4 + 3] = (byte) ((val >> 24) & 0xFF);
    }
    return FlexBase64.encodeString(data, false);
}
 

import io.undertow.util.FlexBase64; //导入依赖的package包/类
protected final String solve(final String nonceBase64) {
    try {
        final String concat = nonceBase64 + MAGIC_NUMBER;
        final MessageDigest digest = MessageDigest.getInstance("SHA1");

        digest.update(concat.getBytes(WebSocketUtils.UTF_8));
        final byte[] bytes = digest.digest();
        return FlexBase64.encodeString(bytes, false);
    } catch (NoSuchAlgorithmException e) {
        throw new RuntimeException(e);
    }
}
 

import io.undertow.util.FlexBase64; //导入依赖的package包/类
@SuppressWarnings("unchecked")
private String authenticate(String authHeader) throws ApiException {
    String result = null;
    if (authHeader.toLowerCase(Locale.ENGLISH).startsWith(LOWERCASE_BASIC_PREFIX)) {
        String base64Challenge = authHeader.substring(PREFIX_LENGTH);
        String plainChallenge;
        try {
            ByteBuffer decode = FlexBase64.decode(base64Challenge);
            // assume charset is UTF_8
            Charset charset = StandardCharsets.UTF_8;
            plainChallenge = new String(decode.array(), decode.arrayOffset(), decode.limit(), charset);
            logger.debug("Found basic auth header %s (decoded using charset %s) in %s", plainChallenge, charset, authHeader);
            int colonPos;
            if ((colonPos = plainChallenge.indexOf(COLON)) > -1) {
                String clientId = plainChallenge.substring(0, colonPos);
                String clientSecret = plainChallenge.substring(colonPos + 1);
                // match with db/cached user credentials.
                IMap<String, Client> clients = CacheStartupHookProvider.hz.getMap("clients");
                Client client = clients.get(clientId);
                if(client == null) {
                    throw new ApiException(new Status(CLIENT_NOT_FOUND, clientId));
                }
                if(!HashUtil.validatePassword(clientSecret.toCharArray(), client.getClientSecret())) {
                    throw new ApiException(new Status(UNAUTHORIZED_CLIENT));
                }
                result = clientId;
            }
        } catch (IOException | NoSuchAlgorithmException | InvalidKeySpecException e) {
            logger.error("Exception:", e);
            throw new ApiException(new Status(RUNTIME_EXCEPTION));
        }
    }
    return result;
}
 

import io.undertow.util.FlexBase64; //导入依赖的package包/类
@Test
public void testSuccessfulAuthentication() throws Exception {
    HttpClient httpClient = HttpClientBuilder.create().build();
    HttpGet get = new HttpGet(server.createUri());

    get.addHeader(AUTHORIZATION.toString(), BASIC + " " + FlexBase64.encodeString("elytron:Coleoptera".getBytes(), false));

    HttpResponse result = httpClient.execute(get);

    assertEquals(StatusCodes.OK, result.getStatusLine().getStatusCode());
    assertSuccessfulResponse(result, "elytron");
}
 

import io.undertow.util.FlexBase64; //导入依赖的package包/类
@Test
public void testFailedAuthentication() throws Exception {
    HttpClient httpClient = HttpClientBuilder.create().build();
    HttpGet get = new HttpGet(server.createUri());

    get.addHeader(AUTHORIZATION.toString(), BASIC + " " + FlexBase64.encodeString("elytron:bad_password".getBytes(), false));

    assertUnauthorizedResponse(httpClient.execute(get));
}
 

import io.undertow.util.FlexBase64; //导入依赖的package包/类
/**
 * Verify a previously unknown nonce and return the {@link NonceKey} representation for the nonce.
 *
 * Later when a nonce is re-used we can match based on the String alone - the information embedded within the nonce will be
 * cached with it.
 *
 * This stage of the verification simply extracts the prefix and the embedded timestamp and recreates a new hashed and
 * Base64 nonce based on the local secret - if the newly generated nonce matches the supplied one we accept it was created
 * by this nonce manager.
 *
 * This verification does not validate that the timestamp is within a valid time period.
 *
 * @param nonce -
 * @return
 */
private Nonce verifyUnknownNonce(final String nonce, final int nonceCount) {
    byte[] complete;
    int offset;
    int length;
    try {
        ByteBuffer decode = FlexBase64.decode(nonce);
        complete = decode.array();
        offset = decode.arrayOffset();
        length = decode.limit() - offset;
    } catch (IOException e) {
        throw MESSAGES.invalidBase64Token(e);
    }

    int timeStampLength = complete[offset + 8];
    // A sanity check to try and verify the sizes we expect from the arrays are correct.
    if (hashLength > 0) {
        int expectedLength = 9 + timeStampLength + hashLength;
        if (length != expectedLength) {
            throw MESSAGES.invalidNonceReceived();
        } else if (timeStampLength + 1 >= length)
            throw MESSAGES.invalidNonceReceived();
    }

    byte[] prefix = new byte[8];
    System.arraycopy(complete, offset, prefix, 0, 8);
    byte[] timeStampBytes = new byte[timeStampLength];
    System.arraycopy(complete, offset + 9, timeStampBytes, 0, timeStampBytes.length);

    String expectedNonce = createNonce(prefix, timeStampBytes);

    if (expectedNonce.equals(nonce)) {
        try {
            long timeStamp = Long.parseLong(new String(timeStampBytes, UTF_8));

            return new Nonce(expectedNonce, timeStamp, nonceCount);
        } catch (NumberFormatException dropped) {
        }
    }

    return null;
}
 

import io.undertow.util.FlexBase64; //导入依赖的package包/类
/**
 * @see io.undertow.server.HttpHandler#handleRequest(io.undertow.server.HttpServerExchange)
 */
@Override
public AuthenticationMechanismOutcome authenticate(HttpServerExchange exchange, SecurityContext securityContext) {

    List<String> authHeaders = exchange.getRequestHeaders().get(AUTHORIZATION);
    if (authHeaders != null) {
        for (String current : authHeaders) {
            if (current.startsWith(BASIC_PREFIX)) {
                String base64Challenge = current.substring(PREFIX_LENGTH);
                String plainChallenge = null;
                try {
                    ByteBuffer decode = FlexBase64.decode(base64Challenge);
                    plainChallenge = new String(decode.array(), decode.arrayOffset(), decode.limit(), UTF_8);
                } catch (IOException e) {
                }
                int colonPos;
                if (plainChallenge != null && (colonPos = plainChallenge.indexOf(COLON)) > -1) {
                    String userName = plainChallenge.substring(0, colonPos);
                    char[] password = plainChallenge.substring(colonPos + 1).toCharArray();

                    IdentityManager idm = securityContext.getIdentityManager();
                    PasswordCredential credential = new PasswordCredential(password);
                    try {
                        final AuthenticationMechanismOutcome result;
                        Account account = idm.verify(userName, credential);
                        if (account != null) {
                            securityContext.authenticationComplete(account, name, false);
                            result = AuthenticationMechanismOutcome.AUTHENTICATED;
                        } else {
                            securityContext.authenticationFailed(MESSAGES.authenticationFailed(userName), name);
                            result = AuthenticationMechanismOutcome.NOT_AUTHENTICATED;
                        }
                        return result;
                    } finally {
                        clear(password);
                    }
                }

                // By this point we had a header we should have been able to verify but for some reason
                // it was not correctly structured.
                return AuthenticationMechanismOutcome.NOT_AUTHENTICATED;
            }
        }
    }

    // No suitable header has been found in this request,
    return AuthenticationMechanismOutcome.NOT_ATTEMPTED;
}
 

import io.undertow.util.FlexBase64; //导入依赖的package包/类
@Test
public void testAuthentication() throws IOException, ScriptException {
    final TestHttpClient client = new TestHttpClient();
    try {

        HttpGet get = new HttpGet(DefaultServer.getDefaultServerURL() + "/servletContext/all-auth1");
        CloseableHttpResponse result = client.execute(get);
        Assert.assertEquals(StatusCodes.UNAUTHORIZED, result.getStatusLine().getStatusCode());
        Header[] values = result.getHeaders(WWW_AUTHENTICATE.toString());
        String header = getAuthHeader(BASIC, values);
        assertEquals(BASIC + " realm=\"Test Realm\"", header);
        HttpClientUtils.readResponse(result);

        get = new HttpGet(DefaultServer.getDefaultServerURL() + "/servletContext/all-auth1");
        get.addHeader(AUTHORIZATION.toString(), BASIC + " " + FlexBase64.encodeString("user1:password1".getBytes(), false));
        result = client.execute(get);
        Assert.assertEquals(StatusCodes.OK, result.getStatusLine().getStatusCode());

        Assert.assertEquals("ok", HttpClientUtils.readResponse(result));

        get = new HttpGet(DefaultServer.getDefaultServerURL() + "/servletContext/all-auth2");
        get.addHeader(AUTHORIZATION.toString(), BASIC + " " + FlexBase64.encodeString("user2:password2".getBytes(), false));
        result = client.execute(get);
        Assert.assertEquals(StatusCodes.OK, result.getStatusLine().getStatusCode());

        Assert.assertEquals("ok", HttpClientUtils.readResponse(result));


        get = new HttpGet(DefaultServer.getDefaultServerURL() + "/servletContext/admin");
        get.addHeader(AUTHORIZATION.toString(), BASIC + " " + FlexBase64.encodeString("user1:password1".getBytes(), false));
        result = client.execute(get);
        Assert.assertEquals(StatusCodes.OK, result.getStatusLine().getStatusCode());

        Assert.assertEquals("ok", HttpClientUtils.readResponse(result));
        get = new HttpGet(DefaultServer.getDefaultServerURL() + "/servletContext/admin");
        get.addHeader(AUTHORIZATION.toString(), BASIC + " " + FlexBase64.encodeString("user2:password2".getBytes(), false));
        result = client.execute(get);
        Assert.assertEquals(StatusCodes.FORBIDDEN, result.getStatusLine().getStatusCode());
        HttpClientUtils.readResponse(result);
    } finally {
        client.getConnectionManager().shutdown();
    }
}
 

import io.undertow.util.FlexBase64; //导入依赖的package包/类
@Override
public AuthenticationMechanismOutcome authenticate(HttpServerExchange exchange, SecurityContext securityContext) {

    List<String> authHeaders = exchange.getRequestHeaders().get(AUTHORIZATION);
    if (authHeaders != null) {
        for (String current : authHeaders) {
            if (current.startsWith(BASIC_PREFIX)) {
                String base64Challenge = current.substring(PREFIX_LENGTH);
                String plainChallenge = null;
                try {
                    ByteBuffer decode = FlexBase64.decode(base64Challenge);
                    plainChallenge = new String(decode.array(), decode.arrayOffset(), decode.limit(), UTF_8);
                } catch (IOException e) {
                }
                int colonPos;
                if (plainChallenge != null && (colonPos = plainChallenge.indexOf(COLON)) > -1) {
                    String userName = plainChallenge.substring(0, colonPos);
                    char[] password = plainChallenge.substring(colonPos + 1).toCharArray();

                    // this is where the token cache comes into play
                    IdentityManager idm = AuthTokenIdentityManager.getInstance();

                    PasswordCredential credential = new PasswordCredential(password);
                    try {
                        final AuthenticationMechanismOutcome result;
                        Account account = idm.verify(userName, credential);
                        if (account != null) {
                            securityContext.authenticationComplete(account, mechanismName, false);
                            result = AuthenticationMechanismOutcome.AUTHENTICATED;
                        } else {
                            result = AuthenticationMechanismOutcome.NOT_ATTEMPTED;
                        }
                        return result;
                    } finally {
                        clear(password);
                    }
                }

                return AuthenticationMechanismOutcome.NOT_ATTEMPTED;
            }
        }
    }

    return AuthenticationMechanismOutcome.NOT_ATTEMPTED;
}