<commit_before>package org.wyona.yanel.servlet.security.impl;

import org.wyona.yanel.core.map.Map;
import org.wyona.yanel.core.map.Realm;
import org.wyona.yanel.servlet.IdentityMap;
import org.wyona.yanel.servlet.YanelServlet;
import org.wyona.yanel.core.api.security.WebAuthenticator;

import org.wyona.security.core.api.AccessManagementException;
import org.wyona.security.core.ExpiredIdentityException;
import org.wyona.security.core.api.Identity;
import org.wyona.security.core.api.User;
import org.wyona.security.core.api.UserManager;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import java.io.File;
import java.io.IOException;
import java.io.PrintWriter;

import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerFactory;
import javax.xml.transform.stream.StreamSource;

import java.net.URL;

import org.w3c.dom.Element;

import org.apache.log4j.Category;

import org.apache.avalon.framework.configuration.Configuration;
import org.apache.avalon.framework.configuration.DefaultConfigurationBuilder;

// JOID is an alternative openid impl
/*
import org.verisign.joid.consumer.OpenIdFilter;
import org.verisign.joid.util.UrlUtils;
*/

import org.openid4java.consumer.ConsumerManager;
import org.openid4java.consumer.VerificationResult;
import org.openid4java.discovery.Discovery;
import org.openid4java.discovery.DiscoveryInformation;
import org.openid4java.discovery.Identifier;
import org.openid4java.message.AuthRequest;
import org.openid4java.message.ParameterList;

/**
 *
 */
public class DefaultWebAuthenticatorImpl implements WebAuthenticator {

    private static Category log = Category.getInstance(DefaultWebAuthenticatorImpl.class);

    private static String OPENID_DISCOVERED_KEY = "openid-discovered";

    // NOTE: The OpenID consumer manager needs to be the same instance for redirect to provider and provider verification
    private ConsumerManager manager;
    private boolean allowOpenIdUserCreation;

    /**
     *
     */
    public void init(org.w3c.dom.Document configuration, javax.xml.transform.URIResolver resolver) throws Exception {
        manager = new ConsumerManager();

        // TODO: Make this configurable in order to prevent OpenID user creation attack
        allowOpenIdUserCreation = true;
    }

    /**
     *
     */
    public HttpServletResponse doAuthenticate(HttpServletRequest request, HttpServletResponse response, Map map, String reservedPrefix, String xsltLoginScreenDefault, String servletContextRealPath, String sslPort) throws ServletException, IOException {
        try {
            Realm realm = map.getRealm(request.getServletPath());
            String path = map.getPath(realm, request.getServletPath());
            //Realm realm = map.getRealm(new Path(request.getServletPath()));
            if (log.isDebugEnabled()) log.debug("Generic WebAuthenticator called for realm path " + path);




            // HTML Form based authentication
            String loginUsername = request.getParameter("yanel.login.username");
            String openID = request.getParameter("yanel.login.openid");
            String openIDSignature = request.getParameter("openid.sig");
            if(loginUsername != null) {
                HttpSession session = request.getSession(true);
                try {
                    User user = realm.getIdentityManager().getUserManager().getUser(loginUsername, true);
                    if (user != null && user.authenticate(request.getParameter("yanel.login.password"))) {
                        log.debug("Realm: " + realm);<commit_msg>disabled openid because it doesn't work at the moment<commit_after>package org.wyona.yanel.servlet.security.impl;

import org.wyona.yanel.core.map.Map;
import org.wyona.yanel.core.map.Realm;
import org.wyona.yanel.servlet.IdentityMap;
import org.wyona.yanel.servlet.YanelServlet;
import org.wyona.yanel.core.api.security.WebAuthenticator;

import org.wyona.security.core.api.AccessManagementException;
import org.wyona.security.core.ExpiredIdentityException;
import org.wyona.security.core.api.Identity;
import org.wyona.security.core.api.User;
import org.wyona.security.core.api.UserManager;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import java.io.File;
import java.io.IOException;
import java.io.PrintWriter;

import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerFactory;
import javax.xml.transform.stream.StreamSource;

import java.net.URL;

import org.w3c.dom.Element;

import org.apache.log4j.Category;

import org.apache.avalon.framework.configuration.Configuration;
import org.apache.avalon.framework.configuration.DefaultConfigurationBuilder;

// JOID is an alternative openid impl
/*
import org.verisign.joid.consumer.OpenIdFilter;
import org.verisign.joid.util.UrlUtils;
*/

import org.openid4java.consumer.ConsumerManager;
import org.openid4java.consumer.VerificationResult;
import org.openid4java.discovery.Discovery;
import org.openid4java.discovery.DiscoveryInformation;
import org.openid4java.discovery.Identifier;
import org.openid4java.message.AuthRequest;
import org.openid4java.message.ParameterList;

/**
 *
 */
public class DefaultWebAuthenticatorImpl implements WebAuthenticator {

    private static Category log = Category.getInstance(DefaultWebAuthenticatorImpl.class);

    private static String OPENID_DISCOVERED_KEY = "openid-discovered";

    // NOTE: The OpenID consumer manager needs to be the same instance for redirect to provider and provider verification
    private ConsumerManager manager;
    private boolean allowOpenIdUserCreation;

    /**
     *
     */
    public void init(org.w3c.dom.Document configuration, javax.xml.transform.URIResolver resolver) throws Exception {
        // TODO: commented because there is a problem with this line 
        //manager = new ConsumerManager();

        // TODO: Make this configurable in order to prevent OpenID user creation attack
        allowOpenIdUserCreation = true;
    }

    /**
     *
     */
    public HttpServletResponse doAuthenticate(HttpServletRequest request, HttpServletResponse response, Map map, String reservedPrefix, String xsltLoginScreenDefault, String servletContextRealPath, String sslPort) throws ServletException, IOException {
        try {
            Realm realm = map.getRealm(request.getServletPath());
            String path = map.getPath(realm, request.getServletPath());
            //Realm realm = map.getRealm(new Path(request.getServletPath()));
            if (log.isDebugEnabled()) log.debug("Generic WebAuthenticator called for realm path " + path);




            // HTML Form based authentication
            String loginUsername = request.getParameter("yanel.login.username");
            String openID = request.getParameter("yanel.login.openid");
            String openIDSignature = request.getParameter("openid.sig");
            if(loginUsername != null) {
                HttpSession session = request.getSession(true);
                try {
                    User user = realm.getIdentityManager().getUserManager().getUser(loginUsername, true);
                    if (user != null && user.authenticate(request.getParameter("yanel.login.password"))) {
                        log.debug("Realm: " + realm);
{'fraction_non_alphanumeric': 0.09532710280373832, 'fraction_numerical': 0.0026702269692923898, 'mean_word_length': 3.892880470280862, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 8}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4158740', 'n_tokens_mistral': 2074, 'n_tokens_neox': 2029, 'n_words': 435}