authentication/audit/AuthenticationProcessEventAuditor.java

563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste/*
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste * The contents of this file are subject to the terms of the Common Development and
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste * Distribution License (the License). You may not use this file except in compliance with the
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste * License.
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste *
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste * specific language governing permission and limitations under the License.
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste *
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste * When distributing Covered Software, include this CDDL Header Notice in each file and include
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste * Header, with the fields enclosed by brackets [] replaced by your own identifying
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste * information: "Portions copyright [year] [name of copyright owner]".
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste *
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste * Copyright 2015 ForgeRock AS.
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste */
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joostepackage com.sun.identity.authentication.audit;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport static com.sun.identity.authentication.util.ISAuthConstants.*;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport static org.forgerock.audit.events.AuthenticationAuditEventBuilder.Status.*;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport static org.forgerock.openam.audit.AMAuditEventBuilderUtils.getTrackingIdFromSSOToken;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport static org.forgerock.openam.audit.AuditConstants.AUTHENTICATION_TOPIC;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport static org.forgerock.openam.audit.AuditConstants.AuthenticationFailureReason.*;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport static org.forgerock.openam.audit.AuditConstants.Component.AUTHENTICATION;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport static org.forgerock.openam.audit.AuditConstants.EntriesInfoFieldKey.*;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport static org.forgerock.openam.audit.AuditConstants.EntriesInfoFieldKey.AUTH_LEVEL;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport static org.forgerock.openam.audit.AuditConstants.EventName.*;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport static org.forgerock.openam.audit.context.AuditRequestContext.getTransactionIdValue;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport static org.forgerock.openam.utils.StringUtils.isNotEmpty;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport com.iplanet.sso.SSOException;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport com.iplanet.sso.SSOToken;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport com.sun.identity.authentication.AuthContext;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport com.sun.identity.authentication.service.AMAuthErrorCode;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport com.sun.identity.authentication.service.LoginState;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport com.sun.identity.common.DNUtils;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport org.forgerock.openam.audit.AMAuditEventBuilderUtils;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport org.forgerock.openam.audit.AMAuthenticationAuditEventBuilder;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport org.forgerock.openam.audit.AuditConstants;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport org.forgerock.openam.audit.AuditConstants.AuthenticationFailureReason;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport org.forgerock.openam.audit.AuditEventFactory;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport org.forgerock.openam.audit.AuditEventPublisher;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport org.forgerock.openam.audit.model.AuthenticationAuditEntry;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport org.forgerock.openam.utils.CollectionUtils;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport javax.inject.Inject;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport javax.security.auth.callback.Callback;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport javax.security.auth.callback.NameCallback;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joosteimport java.security.Principal;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste/**
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste * This auditor is specifically aimed at constructing and logging authentication events for the login process.
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste *
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste * @since 13.0.0
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste */
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Joostepublic class AuthenticationProcessEventAuditor extends AbstractAuthenticationEventAuditor {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    /**
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     * Constructor for {@link AuthenticationProcessEventAuditor}.
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     *
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     * @param eventPublisher The publisher responsible for logging the events.
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     * @param eventFactory The factory that can be used to create the events.
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     */
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    @Inject
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    public AuthenticationProcessEventAuditor(AuditEventPublisher eventPublisher, AuditEventFactory eventFactory) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        super(eventPublisher, eventFactory);
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    /**
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     * Log an authentication process successful completion event.
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     *
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     * @param loginState The login state object.
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     */
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    public void auditLoginSuccess(LoginState loginState) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        String realm = getRealmFromState(loginState);
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
dfa51161ad226f5998270e3becb25817774aa168Tony Bamford        if (eventPublisher.isAuditing(realm, AUTHENTICATION_TOPIC, AM_LOGIN_COMPLETED)) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            String moduleName = null;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            String userDN = null;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            if (loginState != null) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                moduleName = loginState.getAuthModuleNames();
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                userDN = loginState.getUserDN();
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
c1218d78f656be3cbe77704bc80bb83b82fdc277Jaco Jooste            AMAuthenticationAuditEventBuilder builder = eventFactory.authenticationEvent(realm)
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    .transactionId(getTransactionIdValue())
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    .component(AUTHENTICATION)
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    .eventName(AM_LOGIN_COMPLETED)
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    .result(SUCCESSFUL)
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    .entry(getAuditEntryDetail(moduleName, loginState))
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    .trackingIds(getTrackingIds(loginState))
a805ad8fd997c440021b625583752605188e4de3Brian Bailey                    .userId(userDN == null ? "" : userDN)
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    .principal(DNUtils.DNtoName(userDN));
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            eventPublisher.tryPublish(AUTHENTICATION_TOPIC, builder.toEvent());
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    /**
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     * Log an authentication process failure event.
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     *
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     * @param loginState The login state object.
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     */
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    public void auditLoginFailure(LoginState loginState) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        auditLoginFailure(loginState, findFailureReason(loginState));
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    /**
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     * Log an authentication process failure event.
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     *
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     * @param loginState The login state object.
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     * @param failureReason The reason for the failure. If {@literal failureReason} is null then the value of
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     * {@link LoginState#getErrorCode()} will be mapped to an {@link AuthenticationFailureReason} with
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     * {@link AuthenticationFailureReason#LOGIN_FAILED} as default if the value could not be mapped.
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     */
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    public void auditLoginFailure(LoginState loginState, AuthenticationFailureReason failureReason) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        String realm = getRealmFromState(loginState);
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
dfa51161ad226f5998270e3becb25817774aa168Tony Bamford        if (eventPublisher.isAuditing(realm, AUTHENTICATION_TOPIC, AM_LOGIN_COMPLETED)) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            String principal = getFailedPrincipal(loginState);
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            String moduleName = loginState == null ? null : loginState.getFailureModuleNames();
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            AuthenticationAuditEntry entryDetail = getAuditEntryDetail(moduleName, loginState);
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            if (failureReason == null) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                failureReason = findFailureReason(loginState);
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            entryDetail.addInfo(FAILURE_REASON, failureReason.name());
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
c1218d78f656be3cbe77704bc80bb83b82fdc277Jaco Jooste            AMAuthenticationAuditEventBuilder builder = eventFactory.authenticationEvent(realm)
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    .transactionId(getTransactionIdValue())
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    .component(AUTHENTICATION)
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    .eventName(AM_LOGIN_COMPLETED)
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    .result(FAILED)
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    .entry(entryDetail)
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    .trackingIds(getTrackingIds(loginState))
a805ad8fd997c440021b625583752605188e4de3Brian Bailey                    .userId(getUserId(principal, realm))
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    .principal(principal);
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            eventPublisher.tryPublish(AUTHENTICATION_TOPIC, builder.toEvent());
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    /**
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     * Log a logout event.
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     *
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     * @param token The {@Link SSOToken} of the event.
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste     */
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    public void auditLogout(SSOToken token) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        String realm = getRealmFromToken(token);
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
dfa51161ad226f5998270e3becb25817774aa168Tony Bamford        if (eventPublisher.isAuditing(realm, AUTHENTICATION_TOPIC, AM_LOGOUT)) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            String principalName;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            try {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                Principal principal = token == null ? null : token.getPrincipal();
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                principalName = principal == null ? null : DNUtils.DNtoName(principal.getName());
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            } catch (SSOException e) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                principalName = null;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            AuthenticationAuditEntry entryDetail = new AuthenticationAuditEntry();
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            entryDetail.setModuleId(getSSOTokenProperty(token, AUTH_TYPE));
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            String host = getSSOTokenProperty(token, HOST);
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            if (isNotEmpty(host)) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                entryDetail.addInfo(IP_ADDRESS, host);
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            String trackingId = getTrackingIdFromSSOToken(token);
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            String userId = AMAuditEventBuilderUtils.getUserId(token);
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
c1218d78f656be3cbe77704bc80bb83b82fdc277Jaco Jooste            AMAuthenticationAuditEventBuilder builder = eventFactory.authenticationEvent(realm)
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    .transactionId(getTransactionIdValue())
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    .component(AUTHENTICATION)
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    .eventName(AM_LOGOUT)
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    .result(SUCCESSFUL)
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    .entry(entryDetail)
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    .trackingId(trackingId == null ? "" : trackingId)
a805ad8fd997c440021b625583752605188e4de3Brian Bailey                    .userId(userId == null ? "" : userId)
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    .principal(principalName);
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            eventPublisher.tryPublish(AUTHENTICATION_TOPIC, builder.toEvent());
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    private AuthenticationAuditEntry getAuditEntryDetail(String moduleName, LoginState loginState) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        AuthenticationAuditEntry entryDetail = new AuthenticationAuditEntry();
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        entryDetail.setModuleId(moduleName == null ? "" : moduleName);
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        if (loginState != null) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            String ip = loginState.getClient();
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            if (isNotEmpty(ip)) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                entryDetail.addInfo(IP_ADDRESS, ip);
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            AuthContext.IndexType indexType = loginState.getIndexType();
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            if (indexType != null) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                entryDetail.addInfo(AUTH_INDEX, indexType.toString());
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            entryDetail.addInfo(AUTH_LEVEL, String.valueOf(loginState.getAuthLevel()));
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        return entryDetail;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    private String getSSOTokenProperty(SSOToken ssoToken, String name) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        try {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            return (ssoToken == null || name == null) ? null : ssoToken.getProperty(name);
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        } catch (SSOException e) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            return null;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    private String getFailedPrincipal(LoginState loginState) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        if (loginState == null) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            return null;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        String principal = loginState.getUserDN();
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        if (principal != null) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            return DNUtils.DNtoName(principal);
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        principal = loginState.getFailureTokenId();
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        if (principal != null) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            return principal;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        if (CollectionUtils.isNotEmpty(loginState.getAllReceivedCallbacks())) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            for (Callback[] cb : loginState.getAllReceivedCallbacks().values()) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                for (Callback aCb : cb) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    if (aCb instanceof NameCallback) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                        return ((NameCallback) aCb).getName();
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                    }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        return null;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    private AuditConstants.AuthenticationFailureReason findFailureReason(LoginState loginState) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        String errorCode = loginState == null ? null : loginState.getErrorCode();
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        if (errorCode == null) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            return LOGIN_FAILED;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        switch (errorCode) {
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            case AMAuthErrorCode.AUTH_PROFILE_ERROR:
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                return NO_USER_PROFILE;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            case AMAuthErrorCode.AUTH_ACCOUNT_EXPIRED:
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                return ACCOUNT_EXPIRED;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            case AMAuthErrorCode.AUTH_INVALID_PASSWORD:
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                return INVALID_PASSWORD;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            case AMAuthErrorCode.AUTH_USER_INACTIVE:
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                return USER_INACTIVE;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            case AMAuthErrorCode.AUTH_CONFIG_NOT_FOUND:
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                return NO_CONFIG;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            case AMAuthErrorCode.AUTH_INVALID_DOMAIN:
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                return INVALID_REALM;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            case AMAuthErrorCode.AUTH_ORG_INACTIVE:
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                return REALM_INACTIVE;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            case AMAuthErrorCode.AUTH_TIMEOUT:
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                return LOGIN_TIMEOUT;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            case AMAuthErrorCode.AUTH_MODULE_DENIED:
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                return MODULE_DENIED;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            case AMAuthErrorCode.AUTH_USER_LOCKED:
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                return LOCKED_OUT;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            case AMAuthErrorCode.AUTH_USER_NOT_FOUND:
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                return USER_NOT_FOUND;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            case AMAuthErrorCode.AUTH_TYPE_DENIED:
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                return AUTH_TYPE_DENIED;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            case AMAuthErrorCode.AUTH_MAX_SESSION_REACHED:
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                return MAX_SESSION_REACHED;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            case AMAuthErrorCode.AUTH_SESSION_CREATE_ERROR:
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                return SESSION_CREATE_ERROR;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            case AMAuthErrorCode.INVALID_AUTH_LEVEL:
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                return INVALID_LEVEL;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            case AMAuthErrorCode.MODULE_BASED_AUTH_NOT_ALLOWED:
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                return MODULE_DENIED;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste            default:
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste                return LOGIN_FAILED;
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste        }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste    }
563b922249eadd0562ddea89c52ed308c2d31c0aJaco Jooste}