/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
    *
    * Licensed under the Apache License, Version 2.0 (the "License");
    * you may not use this file except in compliance with the License.
    * You may obtain a copy of the License at
    *
    *     http://www.apache.org/licenses/LICENSE-2.0
    *
    * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  
  package org.acegisecurity.providers.ldap.authenticator;
  
  import org.acegisecurity.BadCredentialsException;
  
  import org.acegisecurity.ldap.InitialDirContextFactory;
  import org.acegisecurity.ldap.LdapTemplate;
  import org.acegisecurity.ldap.LdapUtils;
  
  import org.acegisecurity.providers.encoding.PasswordEncoder;
  
  import org.acegisecurity.userdetails.UsernameNotFoundException;
  import org.acegisecurity.userdetails.ldap.LdapUserDetails;
  import org.acegisecurity.userdetails.ldap.LdapUserDetailsImpl;
  
  import org.apache.commons.logging.Log;
  import org.apache.commons.logging.LogFactory;
  
  import org.springframework.util.Assert;
  
  import java.util.Iterator;
  
  
  /**
   * An {@link org.acegisecurity.providers.ldap.LdapAuthenticator LdapAuthenticator} which compares the login
   * password with the value stored in the directory.
   *
   * <p>
   * This can be achieved either by retrieving the password attribute for the user and comparing it locally,
   * or by peforming an LDAP "compare" operation. If the password attribute (default "userPassword") is found in the
   * retrieved attributes it will be compared locally. If not, the remote comparison will be attempted.
   * </p>
   * <p>
   * If passwords are stored in digest form in the repository, then a suitable {@link PasswordEncoder}
   * implementation must be supplied. By default, passwords are encoded using the {@link LdapShaPasswordEncoder}.
   * </p>
   *
   * @author Luke Taylor
   * @version $Id: PasswordComparisonAuthenticator.java 1784 2007-02-24 21:00:24Z luke_t $
   */
  public final class PasswordComparisonAuthenticator extends AbstractLdapAuthenticator {
      //~ Static fields/initializers =====================================================================================
  
      private static final Log logger = LogFactory.getLog(PasswordComparisonAuthenticator.class);
  
      //~ Instance fields ================================================================================================
  
      private PasswordEncoder passwordEncoder = new LdapShaPasswordEncoder();
      private String passwordAttributeName = "userPassword";
  
      //~ Constructors ===================================================================================================
  
      public PasswordComparisonAuthenticator(InitialDirContextFactory initialDirContextFactory) {
          super(initialDirContextFactory);
      }
  
      //~ Methods ========================================================================================================
  
      public LdapUserDetails authenticate(final String username, final String password) {
          // locate the user and check the password
          LdapUserDetails user = null;
  
          Iterator dns = getUserDns(username).iterator();
  
          LdapTemplate ldapTemplate = new LdapTemplate(getInitialDirContextFactory());
  
          while (dns.hasNext() && (user == null)) {
              final String userDn = (String) dns.next();
  
              if (ldapTemplate.nameExists(userDn)) {
                  LdapUserDetailsImpl.Essence userEssence = (LdapUserDetailsImpl.Essence)
                          ldapTemplate.retrieveEntry(userDn, getUserDetailsMapper(), getUserAttributes());
                  userEssence.setUsername(username);
                  user = userEssence.createUserDetails();
              }
          }
  
          if ((user == null) && (getUserSearch() != null)) {
              user = getUserSearch().searchForUser(username);
          }
  
          if (user == null) {
              throw new UsernameNotFoundException(username);
          }
  
         String retrievedPassword = user.getPassword();
 
         if (retrievedPassword != null) {
             if (!verifyPassword(password, retrievedPassword)) {
                 throw new BadCredentialsException(messages.getMessage(
                         "PasswordComparisonAuthenticator.badCredentials", "Bad credentials"));
             }
 
             return user;
         }
 
         if (logger.isDebugEnabled()) {
             logger.debug("Password attribute wasn't retrieved for user '" + username + "' using mapper "
                 + getUserDetailsMapper() + ". Performing LDAP compare of password attribute '" + passwordAttributeName
                 + "'");
         }
 
         String encodedPassword = passwordEncoder.encodePassword(password, null);
         byte[] passwordBytes = LdapUtils.getUtf8Bytes(encodedPassword);
 
         if (!ldapTemplate.compare(user.getDn(), passwordAttributeName, passwordBytes)) {
             throw new BadCredentialsException(messages.getMessage("PasswordComparisonAuthenticator.badCredentials",
                     "Bad credentials"));
         }
 
         return user;
     }
 
     public void setPasswordAttributeName(String passwordAttribute) {
         Assert.hasLength(passwordAttribute, "passwordAttributeName must not be empty or null");
         this.passwordAttributeName = passwordAttribute;
     }
 
     public void setPasswordEncoder(PasswordEncoder passwordEncoder) {
         Assert.notNull(passwordEncoder, "passwordEncoder must not be null.");
         this.passwordEncoder = passwordEncoder;
     }
 
     /**
      * Allows the use of both simple and hashed passwords in the directory.
      *
      * @param password the password supplied by the user
      * @param ldapPassword the (possibly hashed) password (from the directory)
      *
      * @return true if they match
      */
     private boolean verifyPassword(String password, String ldapPassword) {
         if (ldapPassword.equals(password)) {
             return true;
         }
 
         if (passwordEncoder.isPasswordValid(ldapPassword, password, null)) {
             return true;
         }
 
         return false;
     }
 }