User user =
connectorSession.getUserGroupManager().getUserByGsaName(gsaName);
if (user == null) {
LOGGER.logp(Level.FINE, CLASS_NAME, METHOD,
gsaName + " user is not authenticated");
return new AuthenticationResponse(false, null);
}
LOGGER.logp(Level.FINE, CLASS_NAME, METHOD,
user.getNotesName() + " user is authenticated");
// Find the user in Notes.
NotesSession notesSession = connectorSession.createNotesSession();
NotesDatabase notesDirectory = null;
NotesView notesUsersView = null;
NotesDocument notesUserDoc = null;
boolean hasValidPassword = false;
try {
notesDirectory = notesSession.getDatabase(
connectorSession.getServer(), connectorSession.getDirectory());
notesUsersView = notesDirectory.getView(NCCONST.DIRVIEW_USERS);
notesUserDoc =
notesUsersView.getDocumentByKey(user.getNotesName(), true);
if (notesUserDoc == null) {
LOGGER.logp(Level.FINE, CLASS_NAME, METHOD,
"Username not found in Notes directory");
return new AuthenticationResponse(false, null);
}
if (id.getPassword() != null) {
String hashedPassword =
notesUserDoc.getItemValueString("HTTPPassword");
hasValidPassword =
notesSession.verifyPassword(id.getPassword(), hashedPassword);
}
} finally {
Util.recycle(notesUserDoc);
Util.recycle(notesUsersView);
Util.recycle(notesDirectory);
connectorSession.closeNotesSession(notesSession);
}
Collection<String> groupsAndRoles = user.getGroupsAndRoles();
Collection<String> prefixedGroups = GsaUtil.getGsaGroups(
groupsAndRoles, connectorSession.getGsaGroupPrefix());
Collection<Principal> principalGroups = null;
if (prefixedGroups.size() != 0) {
principalGroups = new ArrayList<Principal>(prefixedGroups.size());
for (String group : prefixedGroups) {
Principal principal = new Principal(PrincipalType.UNQUALIFIED,
connectorSession.getConnector().getLocalNamespace(),
group, CaseSensitivityType.EVERYTHING_CASE_INSENSITIVE);
principalGroups.add(principal);
}
}
String idLog = getIdentityLog(gsaName, user.getNotesName(),
groupsAndRoles, prefixedGroups);
if (id.getPassword() != null) {
if (hasValidPassword) {
LOGGER.logp(Level.FINE, CLASS_NAME, METHOD,
"User succesfully authenticated: " + idLog);
return new AuthenticationResponse(true, null, principalGroups);
} else {
LOGGER.logp(Level.FINE, CLASS_NAME, METHOD,
"User failed authentication: " + idLog);
return new AuthenticationResponse(false, null, principalGroups);
}
} else {
LOGGER.logp(Level.FINE, CLASS_NAME, METHOD,
"No password; returning groups only: " + idLog);
// Although we don't actually know that the entity that
// submitted this username has a valid password, we have
// to return true because the GSA will refute the
// identity otherwise. This situation occurs when the GSA
// uses another authentication mechanism and uses the
// connector for group resolution only.
LOGGER.fine("principalgroups: " + principalGroups);
return new AuthenticationResponse(true, null, principalGroups);
}
} catch (Exception e) {
LOGGER.log(Level.SEVERE, CLASS_NAME, e);
} finally {
LOGGER.exiting(CLASS_NAME, METHOD);
}
return new AuthenticationResponse(false, null);
}