SES-9: Add UserDetailsChecker to KerberosServiceAuthenticationProvider

spring-security-kerberos-core/src/main/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProvider.java

@@ -16,10 +16,12 @@
 
 package org.springframework.security.extensions.kerberos;
 
+import org.springframework.security.authentication.AccountStatusUserDetailsChecker;
 import org.springframework.security.authentication.AuthenticationProvider;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsChecker;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.extensions.kerberos.web.SpnegoAuthenticationProcessingFilter;
 
@@ -49,6 +51,7 @@ public class KerberosServiceAuthenticationProvider implements
 	
 	private KerberosTicketValidator ticketValidator;
 	private UserDetailsService userDetailsService;
+	private UserDetailsChecker userDetailsChecker = new AccountStatusUserDetailsChecker();
 	
 	
 	/** The <code>UserDetailsService</code> to use, for loading the user properties
@@ -75,8 +78,25 @@ public class KerberosServiceAuthenticationProvider implements
 		byte[] token = auth.getToken();
 		String username = this.ticketValidator.validateTicket(token);
 		UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);
+		userDetailsChecker.check(userDetails);
+		additionalAuthenticationChecks(userDetails, auth);
 		return new KerberosServiceRequestToken(userDetails, userDetails.getAuthorities(), token);
 	}
+	
+    
+	/** 
+	 * Allows subclasses to perform any additional checks of a returned <code>UserDetails</code>
+     * for a given authentication request.
+     * 
+     * @param userDetails as retrieved from the {@link UserDetailsService}
+	 * @param authentication validated {@link KerberosServiceRequestToken}
+	 * @throws AuthenticationException AuthenticationException if the credentials could not be validated (generally a
+     *         <code>BadCredentialsException</code>, an <code>AuthenticationServiceException</code>)
+	 */
+	protected void additionalAuthenticationChecks(UserDetails userDetails, KerberosServiceRequestToken authentication)
+            throws AuthenticationException {
+    	
+    }
 
 	/* (non-Javadoc)
 	 * @see org.springframework.security.authentication.AuthenticationProvider#supports(java.lang.Class)

spring-security-kerberos-core/src/test/java/org/springframework/security/extensions/kerberos/KerberosServiceAuthenticationProviderTest.java

@@ -23,7 +23,11 @@ import java.util.List;
 
 import org.junit.Before;
 import org.junit.Test;
+import org.springframework.security.authentication.AccountExpiredException;
 import org.springframework.security.authentication.BadCredentialsException;
+import org.springframework.security.authentication.CredentialsExpiredException;
+import org.springframework.security.authentication.DisabledException;
+import org.springframework.security.authentication.LockedException;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.AuthorityUtils;
@@ -64,18 +68,37 @@ public class KerberosServiceAuthenticationProviderTest {
 	
 	@Test
 	public void testEverythingWorks() throws Exception {
-		// stubbing
-		when(ticketValidator.validateTicket(TEST_TOKEN)).thenReturn(TEST_USER);
-		when(userDetailsService.loadUserByUsername(TEST_USER)).thenReturn(USER_DETAILS);
-		
-		// testing
-		Authentication output = provider.authenticate(INPUT_TOKEN);
+		Authentication output = callProviderAndReturnUser(USER_DETAILS);
 		assertNotNull(output);
 		assertEquals(TEST_USER, output.getName());
 		assertEquals(AUTHORITY_LIST, output.getAuthorities());
 		assertEquals(USER_DETAILS, output.getPrincipal());	
 	}
 	
+	@Test(expected=DisabledException.class)
+	public void testUserIsDisabled() throws Exception {
+		User disabledUser = new User(TEST_USER, "empty", false, true, true,true, AUTHORITY_LIST);
+		callProviderAndReturnUser(disabledUser);
+	}
+	
+	@Test(expected=AccountExpiredException.class)
+	public void testUserAccountIsExpired() throws Exception {
+		User expiredUser = new User(TEST_USER, "empty", true, false, true,true, AUTHORITY_LIST);
+		callProviderAndReturnUser(expiredUser);
+	}
+	
+	@Test(expected=CredentialsExpiredException.class)
+	public void testUserCredentialsExpired() throws Exception {
+		User credExpiredUser = new User(TEST_USER, "empty", true, true, false ,true, AUTHORITY_LIST);
+		callProviderAndReturnUser(credExpiredUser);
+	}
+	
+	@Test(expected=LockedException.class)
+	public void testUserAccountLockedCredentialsExpired() throws Exception {
+		User lockedUser = new User(TEST_USER, "empty", true, true, true ,false, AUTHORITY_LIST);
+		callProviderAndReturnUser(lockedUser);
+	}
+	
 	@Test(expected=UsernameNotFoundException.class)
 	public void testUsernameNotFound() throws Exception {
 		// stubbing
@@ -85,6 +108,7 @@ public class KerberosServiceAuthenticationProviderTest {
 		// testing
 		provider.authenticate(INPUT_TOKEN);
 	}
+
 	
 	@Test(expected=BadCredentialsException.class)
 	public void testTicketValidationWrong() throws Exception {
@@ -94,5 +118,14 @@ public class KerberosServiceAuthenticationProviderTest {
 		// testing
 		provider.authenticate(INPUT_TOKEN);
 	}
+	
+	private Authentication callProviderAndReturnUser(UserDetails disabledUser) {
+		// stubbing
+		when(ticketValidator.validateTicket(TEST_TOKEN)).thenReturn(TEST_USER);
+		when(userDetailsService.loadUserByUsername(TEST_USER)).thenReturn(disabledUser);
+		
+		// testing
+		return provider.authenticate(INPUT_TOKEN);
+	}
 
 }