Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add changes to allow colon in password #3048

Merged
merged 1 commit into from
Dec 8, 2023
Merged

Add changes to allow colon in password #3048

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions ...or.management.apis/src/main/java/org/wso2/micro/integrator/management/apis/Constants.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -237,5 +237,6 @@ public class Constants {

// Searching constants
public static final String SEARCH_KEY = "searchKey";
public static final Character BASIC_AUTH_SEPARATOR_CHAR = ':';

}
7 changes: 6 additions & 1 deletion ...anagement.apis/src/main/java/org/wso2/micro/integrator/management/apis/UsersResource.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,7 @@
import static org.wso2.micro.integrator.management.apis.Constants.ROLE;
import static org.wso2.micro.integrator.management.apis.Constants.SEARCH_KEY;
import static org.wso2.micro.integrator.management.apis.Constants.STATUS;
import static org.wso2.micro.integrator.management.apis.Constants.BASIC_AUTH_SEPARATOR_CHAR;
/**
* Resource for a retrieving and adding users.
* <p>
Expand Down Expand Up @@ -187,13 +188,17 @@ private JSONObject handlePost(MessageContext messageContext,
JsonObject payload = Utils.getJsonPayload(axis2MessageContext);
boolean isAdmin = false;
if (payload.has(USER_ID) && payload.has(PASSWORD)) {
String user = payload.get(USER_ID).getAsString();
// validate username
if (user == null || user.isEmpty() || user.indexOf(BASIC_AUTH_SEPARATOR_CHAR) != -1) {
throw new IOException("Invalid username");
}
String[] roleList = null;
if (payload.has(IS_ADMIN) && payload.get(IS_ADMIN).getAsBoolean()) {
String adminRole = Utils.getRealmConfiguration().getAdminRoleName();
roleList = new String[]{adminRole};
isAdmin = payload.get(IS_ADMIN).getAsBoolean();
}
String user = payload.get(USER_ID).getAsString();
String domain = null;
if (payload.has(DOMAIN) ) {
domain = payload.get(DOMAIN).getAsString();
Expand Down
6 changes: 4 additions & 2 deletions .../wso2/micro/integrator/management/apis/security/handler/AuthenticationHandlerAdapter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,8 +148,10 @@ boolean processAuthRequestWithFileBasedUserStore(MessageContext messageContext,
private String[] extractDetails(String token) {

String decodedCredentials = new String(new Base64().decode(token.getBytes()));
String[] usernamePasswordArray = decodedCredentials.split(":");
if (usernamePasswordArray.length != 2) {
// everything before the first colon can be considered as the username
// since RFC-2617 specifies that username cannot contain a colon.
String[] usernamePasswordArray = decodedCredentials.split(":",2);
if (usernamePasswordArray.length < 2) {
return new String[] {};
}
return new String[] { usernamePasswordArray[0], usernamePasswordArray[1] };
Expand Down
Loading