package Ġuk . gov . just ice . digital . h mp ps . oauth 2 server . security Ċ Ċ import Ġcom . microsoft . application insights . Telemetry Client Ċ import Ġorg . slf 4 j . LoggerFactory Ċ import Ġorg . springframework . security . authentication . Account Expired Exception Ċ import Ġorg . springframework . security . authentication . Account Status Exception Ċ import Ġorg . springframework . security . authentication . Bad Credentials Exception Ċ import Ġorg . springframework . security . authentication . Locked Exception Ċ import Ġorg . springframework . security . authentication . Username Password Authentication Token Ċ import Ġorg . springframework . security . authentication . dao . Dao Authentication Provider Ċ import Ġorg . springframework . security . core . Authentication Ċ import Ġorg . springframework . security . core . Authentication Exception Ċ import Ġorg . springframework . security . core . user details . UserDetails Ċ import Ġorg . springframework . security . core . user details . UserDetails Checker Ċ import Ġorg . springframework . security . core . user details . UserDetails Service Ċ import Ġorg . springframework . security . crypto . bcrypt . BC rypt Password Encoder Ċ import Ġorg . springframework . security . crypto . password . Delegating Password Encoder Ċ import Ġuk . gov . just ice . digital . h mp ps . oauth 2 server . service . M fa Client Network Service Ċ Ċ abstract Ġclass ĠLock ing Authentication Provider ( ĊĠ Ġuser Details Service : ĠUser Details Service , ĊĠ Ġprivate Ġval Ġuser Retries Service : ĠUser Retries Service , ĊĠ Ġprivate Ġval Ġm fa Client Network Service : ĠM fa Client Network Service , ĊĠ Ġprivate Ġval ĠuserService : ĠUserService , ĊĠ Ġprivate Ġval Ġtelemetry Client : ĠTe lemetry Client Ċ ) Ġ: ĠDao Authentication Provider () Ġ{ ĊĊĠ Ġcompanion Ġobject Ġ{ ĊĠĠĠ Ġprivate Ġval Ġlog Ġ= ĠLoggerFactory . getLogger ( this :: class . java ) ĊĠ Ġ} ĊĊĠ Ġinit Ġ{ ĊĠĠĠ Ġ@ Suppress (" Le aking This ") ĊĠĠĠ Ġset UserDetails Service ( user Details Service ) ĊĠĠĠ Ġval Ġoracle Sha 1 Password Encoder Ġ= ĠOracle Sha 1 Password Encoder () ĊĠĠĠ Ġval Ġen coders Ġ= Ġmap Of (" bcrypt " Ġto ĠBC rypt Password Encoder (), Ġ" oracle " Ġto Ġoracle Sha 1 Password Encoder ) ĊĠĠĠ Ġval Ġdeleg ating Password Encoder Ġ= ĠDeleg ating Password Encoder (" bcrypt ", Ġen coders ) ĊĠĠĠ Ġdeleg ating Password Encoder . setDefault Password Encoder For Matches ( oracle Sha 1 Password Encoder ) ĊĠĠĠ Ġpassword Encoder Ġ= Ġdeleg ating Password Encoder ĊĠĠĠ Ġpre Authentication Checks Ġ= ĠPre Authentication Checks () ĊĠ Ġ} ĊĊĠ Ġprivate Ġinner Ġclass ĠPre Authentication Checks Ġ: ĠUser Details Checker Ġ{ ĊĊĠĠĠ Ġoverride Ġfun Ġcheck ( user : ĠUser Details ) Ġ{ ĊĠĠĠĠĠ Ġif Ġ(! user . is Account Non Locked ) Ġ{ ĊĠĠĠĠĠĠĠ Ġthrow ĠLocked Exception ( ĊĠĠĠĠĠĠĠĠĠ Ġmessages . getMessage ( ĊĠĠĠĠĠĠĠĠĠĠĠ Ġ" Abstract UserDetails Authentication Provider . locked ", ĊĠĠĠĠĠĠĠĠĠĠĠ Ġ" User Ġaccount Ġis Ġlocked " ĊĠĠĠĠĠĠĠĠĠ Ġ) ĊĠĠĠĠĠĠĠ Ġ) ĊĠĠĠĠĠ Ġ} ĊĠĠĠĠĠ Ġif Ġ(! user . isEnabled ) Ġ{ ĊĠĠĠĠĠĠĠ Ġthrow ĠNext Provider Disabled Exception ( ĊĠĠĠĠĠĠĠĠĠ Ġmessages . getMessage ( ĊĠĠĠĠĠĠĠĠĠĠĠ Ġ" Abstract UserDetails Authentication Provider . disabled ", ĊĠĠĠĠĠĠĠĠĠĠĠ Ġ" User Ġis Ġdisabled " ĊĠĠĠĠĠĠĠĠĠ Ġ) ĊĠĠĠĠĠĠĠ Ġ) ĊĠĠĠĠĠ Ġ} ĊĠĠĠĠĠ Ġif Ġ(! user . is Account Non Expired ) Ġ{ ĊĠĠĠĠĠĠĠ Ġthrow ĠAccount Expired Exception ( ĊĠĠĠĠĠĠĠĠĠ Ġmessages . getMessage ( ĊĠĠĠĠĠĠĠĠĠĠĠ Ġ" Abstract UserDetails Authentication Provider . expired ", ĊĠĠĠĠĠĠĠĠĠĠĠ Ġ" User Ġaccount Ġhas Ġexpired " ĊĠĠĠĠĠĠĠĠĠ Ġ) ĊĠĠĠĠĠĠĠ Ġ) ĊĠĠĠĠĠ Ġ} ĊĠĠĠ Ġ} ĊĠ Ġ} ĊĊĠ Ġ@ Throws ( Authentication Exception :: class ) ĊĠ Ġoverride Ġfun Ġauthenticate ( authentication : ĠAuthentication ): ĠAuthentication Ġ{ ĊĠĠĠ Ġif Ġ( authentication . name . isNull Or Blank () Ġ|| Ġauthentication . credentials Ġ== Ġnull Ġ|| ĊĠĠĠĠĠ Ġauthentication . credentials . toString (). isBlank () ĊĠĠĠ Ġ) Ġ{ ĊĠĠĠĠĠ Ġlog . info (" Credentials Ġmissing Ġfor Ġuser Ġ{}", Ġauthentication . name ) ĊĠĠĠĠĠ Ġthrow ĠMissing Credentials Exception () ĊĠĠĠ Ġ} ĊĠĠĠ Ġreturn Ġtry Ġ{ ĊĠĠĠĠĠ Ġval Ġfull Authentication Ġ= Ġsuper . authenticate ( authentication ) ĊĠĠĠĠĠ Ġval Ġuser Details Ġ= Ġfull Authentication . principal Ġas ĠUser Person Details ĊĊĠĠĠĠĠ Ġ// Ġnow Ġcheck Ġif Ġm fa Ġis Ġenabled Ġfor Ġthe Ġuser ĊĠĠĠĠĠ Ġif Ġ( m fa Client Network Service . needs M fa ( full Authentication . author ities )) Ġ{ ĊĠĠĠĠĠĠĠ Ġif Ġ( userService . has Verified M fa Method ( user Details )) Ġ{ ĊĠĠĠĠĠĠĠĠĠ Ġthrow ĠM fa Required Exception (" M FA Ġrequired ") ĊĠĠĠĠĠĠĠ Ġ} ĊĠĠĠĠĠĠĠ Ġthrow ĠM fa Unavailable Exception (" M FA Ġrequired , Ġbut Ġno Ġemail Ġset ") ĊĠĠĠĠĠ Ġ} ĊĠĠĠĠĠ Ġval Ġusername Ġ= Ġuser Details . username ĊĠĠĠĠĠ Ġlog . info (" Successful Ġlogin Ġfor Ġuser Ġ{} Ġand Ġsource Ġ{}", Ġusername , Ġuser Details . auth Source ) ĊĠĠĠĠĠ Ġtelemetry Client . track Event (" Authenticate Success ", Ġmap Of (" username " Ġto Ġusername , Ġ" auth Source " Ġto Ġuser Details . auth Source ), Ġnull ) ĊĠĠĠĠĠ Ġfull Authentication ĊĠĠĠ Ġ} Ġcatch Ġ( e : ĠAuthentication Exception ) Ġ{ ĊĠĠĠĠĠ Ġval Ġreason Ġ= Ġe . java Class . simple Name ĊĠĠĠĠĠ Ġval Ġusername Ġ= Ġauthentication . name ĊĠĠĠĠĠ Ġlog . info ( ĊĠĠĠĠĠĠĠ Ġ" Authenticate Ġfailed Ġfor Ġuser Ġ{} Ġwith Ġreason Ġ{} Ġand Ġmessage Ġ{}", ĊĠĠĠĠĠĠĠ Ġusername , ĊĠĠĠĠĠĠĠ Ġreason , ĊĠĠĠĠĠĠĠ Ġe . message ĊĠĠĠĠĠ Ġ) ĊĠĠĠĠĠ Ġthrow Ġe ĊĠĠĠ Ġ} ĊĠ Ġ} ĊĊĠ Ġ@ Throws ( Authentication Exception :: class ) ĊĠ Ġoverride Ġfun Ġadditional Authentication Checks ( ĊĠĠĠ Ġuser Details : ĠUser Details , ĊĠĠĠ Ġauthentication : ĠUsername Password Authentication Token ĊĠ Ġ) Ġ{ ĊĠĠĠ Ġval Ġpassword Ġ= Ġauthentication . credentials . toString () ĊĠĠĠ Ġcheck Password With Account Lock ( user Details Ġas ĠUser Person Details , Ġpassword ) ĊĠ Ġ} ĊĊĠ Ġprivate Ġfun Ġcheck Password With Account Lock ( user Details : ĠUser Person Details , Ġpassword : ĠString ) Ġ{ ĊĠĠĠ Ġval Ġusername Ġ= Ġuser Details . username ĊĠĠĠ Ġif Ġ( check Password ( user Details , Ġpassword )) Ġ{ ĊĠĠĠĠĠ Ġlog . info (" Reset ting Ġretries Ġfor Ġuser Ġ{}", Ġusername ) ĊĠĠĠĠĠ Ġuser Retries Service . reset Retries And Record Login ( user Details ) ĊĠĠĠ Ġ} Ġelse Ġ{ ĊĠĠĠĠĠ Ġval Ġlocked Ġ= Ġuser Retries Service . increment Retries And Lock Account If Ne cessary ( user Details ) ĊĊĠĠĠĠĠ Ġ// Ġcheck Ġthe Ġnumber Ġof Ġretries ĊĠĠĠĠĠ Ġif Ġ( locked ) Ġ{ ĊĠĠĠĠĠĠĠ Ġlog . info (" Locked Ġaccount Ġfor Ġuser Ġ{}", Ġusername ) ĊĠĠĠĠĠĠĠ Ġthrow ĠLocked Exception (" Account Ġis Ġlocked , Ġnumber Ġof Ġretries Ġexceeded ") ĊĠĠĠĠĠ Ġ} ĊĠĠĠĠĠ Ġlog . info (" Credentials Ġincorrect Ġfor Ġuser Ġ{}", Ġusername ) ĊĠĠĠĠĠ Ġthrow ĠBad Credentials Exception (" Authentication Ġfailed : Ġpassword Ġdoes Ġnot Ġmatch Ġstored Ġvalue ") ĊĠĠĠ Ġ} ĊĠ Ġ} ĊĊĠ Ġprotected Ġopen Ġfun Ġcheck Password ( user Details : ĠUser Details , Ġpassword : ĠString ): ĠBoolean Ġ= ĊĠĠĠ Ġpassword Encoder . matches ( password , Ġuser Details . password ) ĊĊĠ Ġclass ĠM fa Required Exception ( msg : ĠString ) Ġ: ĠAccount Status Exception ( msg ) ĊĠ Ġclass ĠM fa Unavailable Exception ( msg : ĠString ) Ġ: ĠAccount Status Exception ( msg ) ĊĠ Ġprivate Ġinner Ġclass ĠNext Provider Disabled Exception ( msg : ĠString ) Ġ: ĠAuthentication Exception ( msg ) Ċ } Ċ