Skip to content

O
Openfire
Commit 9fd11ffd authored by Jay Kline's avatar Jay Kline Committed by jay
Browse files
Options

Add support to disable IQ Auth (enforce SASL only) 



git-svn-id: http://svn.igniterealtime.org/svn/repos/openfire/trunk@8581 b35dd754-fafc-0310-a699-88a17e54d16e
parent 14ac1e1f
Hide whitespace changes
Inline Side-by-side
Showing with 54 additions and 43 deletions
src/java/org/jivesoftware/openfire/handler/IQAuthHandler.java
View file @ 9fd11ffd
...@@ -57,6 +57,7 @@ import java.util.List; ...@@ -57,6 +57,7 @@ import java.util.List;
public class IQAuthHandler extends IQHandler implements IQAuthInfo { public class IQAuthHandler extends IQHandler implements IQAuthInfo {
private boolean anonymousAllowed; private boolean anonymousAllowed;
private boolean iqAuthAllowed;
private Element probeResponse; private Element probeResponse;
private IQHandlerInfo info; private IQHandlerInfo info;
...@@ -100,57 +101,64 @@ public class IQAuthHandler extends IQHandler implements IQAuthInfo { ...@@ -100,57 +101,64 @@ public class IQAuthHandler extends IQHandler implements IQAuthInfo {
return reply; return reply;
} }
IQ response; IQ response;
try { if (JiveGlobals.getBooleanProperty("xmpp.auth.iqauth",true)) {
Element iq = packet.getElement(); try {
Element query = iq.element("query"); Element iq = packet.getElement();
Element queryResponse = probeResponse.createCopy(); Element query = iq.element("query");
if (IQ.Type.get == packet.getType()) { Element queryResponse = probeResponse.createCopy();
String username = query.elementTextTrim("username"); if (IQ.Type.get == packet.getType()) {
if (username != null) {
queryResponse.element("username").setText(username);
}
response = IQ.createResultIQ(packet);
response.setChildElement(queryResponse);
// This is a workaround. Since we don't want to have an incorrect TO attribute
// value we need to clean up the TO attribute and send directly the response.
// The TO attribute will contain an incorrect value since we are setting a fake
// JID until the user actually authenticates with the server.
if (session.getStatus() != Session.STATUS_AUTHENTICATED) {
response.setTo((JID)null);
}
}
// Otherwise set query
else {
if (query.elements().isEmpty()) {
// Anonymous authentication
response = anonymousLogin(session, packet);
}
else {
String username = query.elementTextTrim("username"); String username = query.elementTextTrim("username");
// Login authentication if (username != null) {
String password = query.elementTextTrim("password"); queryResponse.element("username").setText(username);
String digest = null;
if (query.element("digest") != null) {
digest = query.elementTextTrim("digest").toLowerCase();
} }
response = IQ.createResultIQ(packet);
// If we're already logged in, this is a password reset response.setChildElement(queryResponse);
if (session.getStatus() == Session.STATUS_AUTHENTICATED) { // This is a workaround. Since we don't want to have an incorrect TO attribute
response = passwordReset(password, packet, username, session); // value we need to clean up the TO attribute and send directly the response.
// The TO attribute will contain an incorrect value since we are setting a fake
// JID until the user actually authenticates with the server.
if (session.getStatus() != Session.STATUS_AUTHENTICATED) {
response.setTo((JID)null);
}
}
// Otherwise set query
else {
if (query.elements().isEmpty()) {
// Anonymous authentication
response = anonymousLogin(session, packet);
} }
else { else {
// it is an auth attempt String username = query.elementTextTrim("username");
response = login(username, query, packet, password, session, digest); // Login authentication
String password = query.elementTextTrim("password");
String digest = null;
if (query.element("digest") != null) {
digest = query.elementTextTrim("digest").toLowerCase();
}
// If we're already logged in, this is a password reset
if (session.getStatus() == Session.STATUS_AUTHENTICATED) {
response = passwordReset(password, packet, username, session);
}
else {
// it is an auth attempt
response = login(username, query, packet, password, session, digest);
}
} }
} }
} }
catch (UserNotFoundException e) {
response = IQ.createResultIQ(packet);
response.setChildElement(packet.getChildElement().createCopy());
response.setError(PacketError.Condition.not_authorized);
}
catch (UnauthorizedException e) {
response = IQ.createResultIQ(packet);
response.setChildElement(packet.getChildElement().createCopy());
response.setError(PacketError.Condition.not_authorized);
}
} }
catch (UserNotFoundException e) { else {
response = IQ.createResultIQ(packet);
response.setChildElement(packet.getChildElement().createCopy());
response.setError(PacketError.Condition.not_authorized);
}
catch (UnauthorizedException e) {
response = IQ.createResultIQ(packet); response = IQ.createResultIQ(packet);
response.setChildElement(packet.getChildElement().createCopy()); response.setChildElement(packet.getChildElement().createCopy());
response.setError(PacketError.Condition.not_authorized); response.setError(PacketError.Condition.not_authorized);
...@@ -181,6 +189,9 @@ public class IQAuthHandler extends IQHandler implements IQAuthInfo { ...@@ -181,6 +189,9 @@ public class IQAuthHandler extends IQHandler implements IQAuthInfo {
response.setError(PacketError.Condition.not_acceptable); response.setError(PacketError.Condition.not_acceptable);
return response; return response;
} }
if (! JiveGlobals.getBooleanProperty("xmpp.auth.iqauth",true)) {
throw new UnauthorizedException();
}
username = username.toLowerCase(); username = username.toLowerCase();
// Verify that supplied username and password are correct (i.e. user authentication was successful) // Verify that supplied username and password are correct (i.e. user authentication was successful)
AuthToken token = null; AuthToken token = null;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment

Technounit-GROUP 2023