libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases Packages Activity Actions

KEYCLOAK-5352 Basic Auth fails if password contains a ':'

Browse source
This commit is contained in:
Xiaojian Liu 2017-11-09 00:34:59 -06:00 committed by Stian Thorgersen
parent 9ff22f596d
commit 19eed51582
2 changed files with 0 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/BasicAuthRequestAuthenticator.java
View file

@ -71,11 +71,9 @@ public class BasicAuthRequestAuthenticator extends BearerTokenRequestAuthenticat
AccessTokenResponse atr=null; AccessTokenResponse atr=null;
try { try {
String userpw=new String(Base64.decode(tokenString)); String userpw=new String(Base64.decode(tokenString));
log.debug("Username and password string for basic auth is: " + userpw);
int seperatorIndex = userpw.indexOf(":"); int seperatorIndex = userpw.indexOf(":");
String user = userpw.substring(0, seperatorIndex); String user = userpw.substring(0, seperatorIndex);
String pw = userpw.substring(seperatorIndex + 1); String pw = userpw.substring(seperatorIndex + 1);
log.debug("Username for token is: " + user + ", password is: " + pw);
atr = getToken(user, pw); atr = getToken(user, pw);
tokenString = atr.getToken(); tokenString = atr.getToken();
} catch (Exception e) { } catch (Exception e) {

5
services/src/main/java/org/keycloak/protocol/saml/profile/ecp/authenticator/HttpBasicAuthenticator.java
View file

@ -11,8 +11,6 @@ import org.keycloak.models.RealmModel;
import org.keycloak.models.UserCredentialModel; import org.keycloak.models.UserCredentialModel;
import org.keycloak.models.UserModel; import org.keycloak.models.UserModel;
import org.jboss.logging.Logger;
import javax.ws.rs.core.HttpHeaders; import javax.ws.rs.core.HttpHeaders;
import javax.ws.rs.core.Response; import javax.ws.rs.core.Response;
import java.io.IOException; import java.io.IOException;
@ -22,7 +20,6 @@ public class HttpBasicAuthenticator implements Authenticator {
private static final String BASIC = "Basic"; private static final String BASIC = "Basic";
private static final String BASIC_PREFIX = BASIC + " "; private static final String BASIC_PREFIX = BASIC + " ";
private Logger log = Logger.getLogger(HttpBasicAuthenticator.class);
@Override @Override
public void authenticate(final AuthenticationFlowContext context) { public void authenticate(final AuthenticationFlowContext context) {
@ -98,12 +95,10 @@ public class HttpBasicAuthenticator implements Authenticator {
try { try {
String val = new String(Base64.decode(credentials)); String val = new String(Base64.decode(credentials));
log.debug("Username and password string is: " + val);
int seperatorIndex = val.indexOf(":"); int seperatorIndex = val.indexOf(":");
if(seperatorIndex == -1) return new String[]{val}; if(seperatorIndex == -1) return new String[]{val};
String user = val.substring(0, seperatorIndex); String user = val.substring(0, seperatorIndex);
String pw = val.substring(seperatorIndex + 1); String pw = val.substring(seperatorIndex + 1);
log.debug("Resolved username is: " + user + ", password is: " + pw);
return new String[]{user,pw}; return new String[]{user,pw};
} catch (final IOException e) { } catch (final IOException e) {
throw new RuntimeException("Failed to parse credentials.", e); throw new RuntimeException("Failed to parse credentials.", e);