public void setAnonymousAccess(final boolean enabled, final String username, final String password)
throws InvalidConfigurationException
{
if (enabled) {
if (Strings.isNullOrEmpty(username) || Strings.isNullOrEmpty(password)) {
throw new InvalidConfigurationException(
"Anonymous access is getting enabled without valid username and/or password!");
}
final String oldUsername = getSecuritySystem().getAnonymousUsername();
final String oldPassword = getSecuritySystem().getAnonymousPassword();
// try to enable the "anonymous" user defined in XML realm, but ignore any problem (users might
// delete
// or already disabled it, or completely removed XML realm)
// this is needed as below we will try a login
final boolean statusChanged = setAnonymousUserEnabled(username, true);
// detect change
if (!Objects.equals(oldUsername, username) || !Objects.equals(oldPassword, password)) {
try {
// test authc with changed credentials
try {
// try to "log in" with supplied credentials
// the anon user a) should exists
securitySystem.getUser(username);
// b) the pwd must work
securitySystem.authenticate(new UsernamePasswordToken(username, password));
}
catch (UserNotFoundException e) {
final String msg = "User \"" + username + "'\" does not exist.";
log.warn(
"Nexus refused to apply configuration, the supplied anonymous information is wrong: " + msg,
e);
throw new InvalidConfigurationException(msg, e);
}
catch (AuthenticationException e) {
final String msg = "The password of user \"" + username + "\" is incorrect.";
log.warn(
"Nexus refused to apply configuration, the supplied anonymous information is wrong: " + msg,
e);
throw new InvalidConfigurationException(msg, e);
}
}
catch (InvalidConfigurationException e) {
if (statusChanged) {
setAnonymousUserEnabled(username, false);