Skip to content

Commit cc1f3e6

Browse files
AnuradhaSKAnuradhaSK
committed
update basic auth to authenticate shared users
1 parent 3c1e39b commit cc1f3e6

3 files changed

Lines changed: 131 additions & 2 deletions

File tree

‎components/org.wso2.carbon.identity.application.authenticator.basicauth/src/main/java/org/wso2/carbon/identity/application/authenticator/basicauth/BasicAuthenticator.java‎

Lines changed: 68 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,9 @@
6262
import org.wso2.carbon.identity.core.util.IdentityUtil;
6363
import org.wso2.carbon.identity.governance.IdentityGovernanceException;
6464
import org.wso2.carbon.identity.multi.attribute.login.mgt.ResolvedUserResult;
65+
import org.wso2.carbon.identity.organization.management.organization.user.sharing.models.UserAssociation;
66+
import org.wso2.carbon.identity.organization.management.service.exception.OrganizationManagementException;
67+
import org.wso2.carbon.identity.organization.management.service.util.OrganizationManagementUtil;
6568
import org.wso2.carbon.identity.recovery.RecoveryScenarios;
6669
import org.wso2.carbon.user.api.UserRealm;
6770
import org.wso2.carbon.user.core.UserCoreConstants;
@@ -735,8 +738,41 @@ protected void processAuthenticationResponse(HttpServletRequest request,
735738
if (userId != null) {
736739
authenticationResult = userStoreManager.authenticateWithID(userId, password);
737740
} else {
738-
authenticationResult = userStoreManager.authenticateWithID(UserCoreClaimConstants.USERNAME_CLAIM_URI,
739-
tenantAwareUsername, password, UserCoreConstants.DEFAULT_PROFILE);
741+
// Check whether the user is a shared user, if yes authenticate from the user resident org.
742+
org.wso2.carbon.user.core.common.User user = userStoreManager.getUser(null, tenantAwareUsername);
743+
if (user != null) {
744+
String userID = user.getUserID();
745+
boolean sharedUserProfile = isSharedUserProfile(userID, requestTenantDomain);
746+
if (sharedUserProfile) {
747+
// Get user's resident org.
748+
String currentOrganizationId =
749+
BasicAuthenticatorDataHolder.getInstance().getOrganizationManager()
750+
.resolveOrganizationId(requestTenantDomain);
751+
UserAssociation userAssociation =
752+
BasicAuthenticatorDataHolder.getInstance().getOrganizationUserSharingService()
753+
.getUserAssociation(userID, currentOrganizationId);
754+
String associationUserResidentOrganizationId = userAssociation.getUserResidentOrganizationId();
755+
String associationUserTenantDomain =
756+
BasicAuthenticatorDataHolder.getInstance().getOrganizationManager()
757+
.resolveTenantDomain(associationUserResidentOrganizationId);
758+
AbstractUserStoreManager residentOrguserStoreManager =
759+
getUserStoreManager(username, associationUserTenantDomain);
760+
authenticationResult = residentOrguserStoreManager.authenticateWithID(
761+
UserCoreClaimConstants.USERNAME_CLAIM_URI,
762+
tenantAwareUsername, password, UserCoreConstants.DEFAULT_PROFILE);
763+
if (AuthenticationResult.AuthenticationStatus.SUCCESS == authenticationResult.getAuthenticationStatus()) {
764+
authenticationResult.setAuthenticatedUser(user);
765+
}
766+
} else {
767+
authenticationResult =
768+
userStoreManager.authenticateWithID(UserCoreClaimConstants.USERNAME_CLAIM_URI,
769+
tenantAwareUsername, password, UserCoreConstants.DEFAULT_PROFILE);
770+
}
771+
} else {
772+
authenticationResult =
773+
userStoreManager.authenticateWithID(UserCoreClaimConstants.USERNAME_CLAIM_URI,
774+
tenantAwareUsername, password, UserCoreConstants.DEFAULT_PROFILE);
775+
}
740776
}
741777
if (AuthenticationResult.AuthenticationStatus.SUCCESS == authenticationResult.getAuthenticationStatus()
742778
&& authenticationResult.getAuthenticatedUser().isPresent()) {
@@ -825,6 +861,8 @@ protected void processAuthenticationResponse(HttpServletRequest request,
825861
ErrorMessages.USER_STORE_EXCEPTION_WHILE_TRYING_TO_AUTHENTICATE.getCode(), e.getMessage(),
826862
e);
827863
}
864+
} catch (OrganizationManagementException e) {
865+
throw new AuthenticationFailedException("Error while resolving organization", e);
828866
} finally {
829867
clearUserExistThreadLocal();
830868
}
@@ -1323,4 +1361,32 @@ public String getI18nKey() {
13231361
return AUTHENTICATOR_BASIC;
13241362
}
13251363

1364+
private static boolean isSharedUserProfile(String userID, String currentTenantDomain)
1365+
throws UserStoreClientException {
1366+
1367+
String currentOrganizationId = PrivilegedCarbonContext.getThreadLocalCarbonContext().getOrganizationId();
1368+
try {
1369+
if (!OrganizationManagementUtil.isOrganization(currentTenantDomain)) {
1370+
// There is no shared users in root organizations. Hence, return false.
1371+
return false;
1372+
}
1373+
if (StringUtils.isBlank(currentOrganizationId)) {
1374+
currentOrganizationId = BasicAuthenticatorDataHolder.getInstance().getOrganizationManager()
1375+
.resolveOrganizationId(currentTenantDomain);
1376+
}
1377+
UserAssociation userAssociation =
1378+
BasicAuthenticatorDataHolder.getInstance().getOrganizationUserSharingService()
1379+
.getUserAssociation(userID, currentOrganizationId);
1380+
if (userAssociation == null) {
1381+
// User is not a shared user. Hence, return false.
1382+
return false;
1383+
}
1384+
} catch (OrganizationManagementException e) {
1385+
throw new UserStoreClientException(
1386+
"Error while checking the user association of the user: " + userID + " with the organization: " +
1387+
currentOrganizationId, e);
1388+
}
1389+
return true;
1390+
}
1391+
13261392
}

‎components/org.wso2.carbon.identity.application.authenticator.basicauth/src/main/java/org/wso2/carbon/identity/application/authenticator/basicauth/internal/BasicAuthenticatorDataHolder.java‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@
2121
import org.wso2.carbon.identity.configuration.mgt.core.ConfigurationManager;
2222
import org.wso2.carbon.identity.governance.IdentityGovernanceService;
2323
import org.wso2.carbon.identity.multi.attribute.login.mgt.MultiAttributeLoginService;
24+
import org.wso2.carbon.identity.organization.management.organization.user.sharing.OrganizationUserSharingService;
25+
import org.wso2.carbon.identity.organization.management.service.OrganizationManager;
2426

2527
import java.util.Properties;
2628

@@ -35,6 +37,8 @@ public class BasicAuthenticatorDataHolder {
3537
private MultiAttributeLoginService multiAttributeLogin;
3638
private Properties recaptchaConfigs;
3739
private ConfigurationManager configurationManager = null;
40+
private OrganizationUserSharingService organizationUserSharingService;
41+
private OrganizationManager organizationManager;
3842

3943
private BasicAuthenticatorDataHolder() {
4044

@@ -79,4 +83,24 @@ public ConfigurationManager getConfigurationManager() {
7983

8084
return configurationManager;
8185
}
86+
87+
public OrganizationManager getOrganizationManager() {
88+
89+
return organizationManager;
90+
}
91+
92+
public void setOrganizationManager(OrganizationManager organizationManager) {
93+
94+
this.organizationManager = organizationManager;
95+
}
96+
97+
public void setOrganizationUserSharingService(OrganizationUserSharingService organizationUserSharingService) {
98+
99+
this.organizationUserSharingService = organizationUserSharingService;
100+
}
101+
102+
public OrganizationUserSharingService getOrganizationUserSharingService() {
103+
104+
return organizationUserSharingService;
105+
}
82106
}

‎components/org.wso2.carbon.identity.application.authenticator.basicauth/src/main/java/org/wso2/carbon/identity/application/authenticator/basicauth/internal/BasicAuthenticatorServiceComponent.java‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@
3636
import org.wso2.carbon.identity.core.util.IdentityUtil;
3737
import org.wso2.carbon.identity.governance.IdentityGovernanceService;
3838
import org.wso2.carbon.identity.multi.attribute.login.mgt.MultiAttributeLoginService;
39+
import org.wso2.carbon.identity.organization.management.organization.user.sharing.OrganizationUserSharingService;
40+
import org.wso2.carbon.identity.organization.management.service.OrganizationManager;
3941
import org.wso2.carbon.identity.user.registration.engine.graph.Executor;
4042
import org.wso2.carbon.user.core.service.RealmService;
4143
import org.wso2.securevault.SecretResolver;
@@ -169,6 +171,43 @@ protected void unregisterConfigurationManager(ConfigurationManager configuration
169171
BasicAuthenticatorDataHolder.getInstance().setConfigurationManager(null);
170172
}
171173

174+
@Reference(
175+
name = "organization.user.sharing.service",
176+
service = OrganizationUserSharingService.class,
177+
cardinality = ReferenceCardinality.MANDATORY,
178+
policy = ReferencePolicy.DYNAMIC,
179+
unbind = "unsetOrganizationUserAssociationService")
180+
protected void setOrganizationUserSharingService(OrganizationUserSharingService organizationUserSharingService) {
181+
182+
BasicAuthenticatorDataHolder.getInstance().setOrganizationUserSharingService(organizationUserSharingService);
183+
log.debug("Set organization user association service.");
184+
}
185+
186+
protected void unsetOrganizationUserAssociationService(
187+
OrganizationUserSharingService organizationUserSharingService) {
188+
189+
BasicAuthenticatorDataHolder.getInstance().setOrganizationUserSharingService(null);
190+
log.debug("Unset organization user association Service.");
191+
}
192+
193+
@Reference(
194+
name = "organization.management.service",
195+
service = OrganizationManager.class,
196+
cardinality = ReferenceCardinality.MANDATORY,
197+
policy = ReferencePolicy.DYNAMIC,
198+
unbind = "unsetOrganizationManagementService")
199+
protected void setOrganizationManagementService(OrganizationManager organizationManager) {
200+
201+
BasicAuthenticatorDataHolder.getInstance().setOrganizationManager(organizationManager);
202+
log.debug("Set Organization Management Service");
203+
}
204+
205+
protected void unsetOrganizationManagementService(OrganizationManager organizationManager) {
206+
207+
BasicAuthenticatorDataHolder.getInstance().setOrganizationManager(null);
208+
log.debug("Unset Organization Management Service");
209+
}
210+
172211
/**
173212
* Read the captcha-config.properties file located in repository/conf/identity directory and set the
174213
* configurations required to enable recaptcha in the Data holder.

0 commit comments

Comments
 (0)