Revert manual specification of ssh user auth factories

diff --git a/src/main/distrib/data/defaults.properties b/src/main/distrib/data/defaults.properties
index d4ebcc394364bed106941282e183a77f0053d5a1..f88407f4eb167eb8516fa043978c5d7f4ef6d80f 100644 (file)
--- a/src/main/distrib/data/defaults.properties
+++ b/src/main/distrib/data/defaults.properties
@@ -138,27 +138,21 @@ git.sshKeysManager = com.gitblit.transport.ssh.FileKeyManager
 # SINCE 1.5.0
 git.sshKeysFolder= ${baseFolder}/ssh
 
-# Use kerberos5 (GSS) authentication
+# Use Kerberos5 (GSS) authentication
 #
 # SINCE 1.7.0
-git.sshWithKrb5 = "false"
+git.sshWithKrb5 = false
 
-# The path to a kerberos 5 keytab.
+# The path to a Kerberos 5 keytab.
 #
 # SINCE 1.7.0
-git.sshKrb5Keytab = ""
+git.sshKrb5Keytab = 
 
-# The service principal name to be used for Kerberos5.  The default is host/hostname.
+# The service principal name to be used for Kerberos5.
+# The default is host/hostname.
 #
 # SINCE 1.7.0
-git.sshKrb5ServicePrincipalName = ""
-
-# A comma-separated list of authentication method. They will be tried in
-# the given order. Possible values are 
-# "gssapi-with-mic", "publickey", "keyboard-interactive" or "password"
-#
-# SINCE 1.7.0
-git.sshAuthenticatorsOrder = "password,keyboard-interactive,publickey"
+git.sshKrb5ServicePrincipalName = 
 
 # SSH backend NIO2|MINA.
 #

diff --git a/src/main/java/com/gitblit/transport/ssh/SshDaemon.java b/src/main/java/com/gitblit/transport/ssh/SshDaemon.java
index b6fae25ee6a194180d3051560b4d644bc951967f..5a94c9a3f13ffd75e5ec1c21851909416544c076 100644 (file)
--- a/src/main/java/com/gitblit/transport/ssh/SshDaemon.java
+++ b/src/main/java/com/gitblit/transport/ssh/SshDaemon.java
@@ -23,24 +23,14 @@ import java.net.InetSocketAddress;
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
 import java.text.MessageFormat;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Locale;
 import java.util.concurrent.atomic.AtomicBoolean;
 
-import org.apache.sshd.common.NamedFactory;
 import org.apache.sshd.common.io.IoServiceFactoryFactory;
 import org.apache.sshd.common.io.mina.MinaServiceFactoryFactory;
 import org.apache.sshd.common.io.nio2.Nio2ServiceFactoryFactory;
 import org.apache.sshd.common.util.SecurityUtils;
 import org.apache.sshd.server.SshServer;
 import org.apache.sshd.server.auth.CachingPublicKeyAuthenticator;
-import org.apache.sshd.server.auth.UserAuth;
-import org.apache.sshd.server.auth.UserAuthKeyboardInteractiveFactory;
-import org.apache.sshd.server.auth.UserAuthPasswordFactory;
-import org.apache.sshd.server.auth.UserAuthPublicKeyFactory;
-import org.apache.sshd.server.auth.gss.GSSAuthenticator;
-import org.apache.sshd.server.auth.gss.UserAuthGSSFactory;
 import org.bouncycastle.openssl.PEMWriter;
 import org.eclipse.jgit.internal.JGitText;
 import org.slf4j.Logger;
@@ -130,48 +120,6 @@ public class SshDaemon {
                        addr = new InetSocketAddress(bindInterface, port);
                }
 
-               //Will do GSS ?
-               GSSAuthenticator gssAuthenticator = null;
-               if(settings.getBoolean(Keys.git.sshWithKrb5, false)) {
-                       gssAuthenticator = new SshKrbAuthenticator(gitblit);
-                       String keytabString = settings.getString(Keys.git.sshKrb5Keytab,
-                                       "");
-                       if(! keytabString.isEmpty()) {
-                               gssAuthenticator.setKeytabFile(keytabString);
-                       }
-                       String servicePrincipalName = settings.getString(Keys.git.sshKrb5ServicePrincipalName,
-                                       "");
-                       if(! servicePrincipalName.isEmpty()) {
-                               gssAuthenticator.setServicePrincipalName(servicePrincipalName);
-                       }
-               }
-
-               //Sort the authenticators for sshd
-               List<NamedFactory<UserAuth>> userAuthFactories = new ArrayList<>();
-               String sshAuthenticatorsOrderString = settings.getString(Keys.git.sshAuthenticatorsOrder,
-                               "password,keyboard-interactive,publickey");
-               for(String authenticator: sshAuthenticatorsOrderString.split(",")) {
-                       String authenticatorName = authenticator.trim().toLowerCase(Locale.US);
-                       switch (authenticatorName) {
-                       case "gssapi-with-mic":
-                               if(gssAuthenticator != null) {
-                                       userAuthFactories.add(new UserAuthGSSFactory());
-                               }
-                               break;
-                       case "publickey":
-                               userAuthFactories.add(new UserAuthPublicKeyFactory());
-                               break;
-                       case "password":
-                               userAuthFactories.add(new UserAuthPasswordFactory());
-                               break;
-                       case "keyboard-interactive":
-                               userAuthFactories.add(new UserAuthKeyboardInteractiveFactory());
-                               break;
-                       default:
-                               log.error("Unknown ssh authenticator: '{}'", authenticatorName);
-                       }
-               }
-
                // Create the SSH server
                sshd = SshServer.setUpDefaultServer();
                sshd.setPort(addr.getPort());
@@ -179,10 +127,9 @@ public class SshDaemon {
                sshd.setKeyPairProvider(hostKeyPairProvider);
                sshd.setPublickeyAuthenticator(new CachingPublicKeyAuthenticator(keyAuthenticator));
                sshd.setPasswordAuthenticator(new UsernamePasswordAuthenticator(gitblit));
-               if(gssAuthenticator != null) {
-                       sshd.setGSSAuthenticator(gssAuthenticator);
+               if (settings.getBoolean(Keys.git.sshWithKrb5, false)) {
+                       sshd.setGSSAuthenticator(new SshKrbAuthenticator(settings, gitblit));
                }
-               sshd.setUserAuthFactories(userAuthFactories);
                sshd.setSessionFactory(new SshServerSessionFactory());
                sshd.setFileSystemFactory(new DisabledFilesystemFactory());
                sshd.setTcpipForwardingFilter(new NonForwardingFilter());

diff --git a/src/main/java/com/gitblit/transport/ssh/SshKrbAuthenticator.java b/src/main/java/com/gitblit/transport/ssh/SshKrbAuthenticator.java
index 8170c934f94553f757eda7c8e1da6d44565b5192..4afc00fc6a1a2b59bf9499c01750b669ef3c3e7a 100644 (file)
--- a/src/main/java/com/gitblit/transport/ssh/SshKrbAuthenticator.java
+++ b/src/main/java/com/gitblit/transport/ssh/SshKrbAuthenticator.java
@@ -15,27 +15,41 @@
  */
 package com.gitblit.transport.ssh;
 
-import com.gitblit.manager.IAuthenticationManager;
-import com.gitblit.models.UserModel;
 import java.util.Locale;
+
 import org.apache.sshd.server.auth.gss.GSSAuthenticator;
 import org.apache.sshd.server.session.ServerSession;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import com.gitblit.IStoredSettings;
+import com.gitblit.Keys;
+import com.gitblit.manager.IAuthenticationManager;
+import com.gitblit.models.UserModel;
+
 public class SshKrbAuthenticator extends GSSAuthenticator {
-       
+
        protected final Logger log = LoggerFactory.getLogger(getClass());
        protected final IAuthenticationManager authManager;
 
-       public SshKrbAuthenticator(IAuthenticationManager authManager) {
+       public SshKrbAuthenticator(IStoredSettings settings, IAuthenticationManager authManager) {
                this.authManager = authManager;
-               log.info("registry  {}", authManager);
+
+               String keytabString = settings.getString(Keys.git.sshKrb5Keytab, "");
+               if(! keytabString.isEmpty()) {
+                       setKeytabFile(keytabString);
+               }
+
+               String servicePrincipalName = settings.getString(Keys.git.sshKrb5ServicePrincipalName, "");
+               if(! servicePrincipalName.isEmpty()) {
+                       setServicePrincipalName(servicePrincipalName);
+               }
        }
 
+       @Override
        public boolean validateIdentity(ServerSession session, String identity) {
                log.info("identify with kerberos {}", identity);
-               SshDaemonClient client = (SshDaemonClient)session.getAttribute(SshDaemonClient.KEY);
+               SshDaemonClient client = session.getAttribute(SshDaemonClient.KEY);
                if (client.getUser() != null) {
                        log.info("{} has already authenticated!", identity);
                        return true;

diff --git a/src/test/config/test-gitblit.properties b/src/test/config/test-gitblit.properties
index 398047c1d44e8e309a4b78dc008d0f962761586a..78e9ab957c926d4a37d132c9bc8c03eac163cdd9 100644 (file)
--- a/src/test/config/test-gitblit.properties
+++ b/src/test/config/test-gitblit.properties
@@ -9,8 +9,6 @@ git.enableGitServlet = true
 git.daemonPort = 8300
 git.sshPort = 29418
 git.sshKeysManager = com.gitblit.transport.ssh.MemoryKeyManager
-git.sshWithKrb5 = true
-git.sshAuthenticatorsOrder = password, publickey,gssapi-with-mic,invalid
 groovy.scriptsFolder = src/main/distrib/data/groovy
 groovy.preReceiveScripts = blockpush
 groovy.postReceiveScripts = sendmail

diff --git a/src/test/java/com/gitblit/tests/JschConfigTestSessionFactory.java b/src/test/java/com/gitblit/tests/JschConfigTestSessionFactory.java
index 421f3366611d41cdcab53cfb27c6c0dbddb56f3c..5d24b4017e7c9e22f1833f4750da0c8438d29ecb 100644 (file)
--- a/src/test/java/com/gitblit/tests/JschConfigTestSessionFactory.java
+++ b/src/test/java/com/gitblit/tests/JschConfigTestSessionFactory.java
@@ -21,7 +21,6 @@ public class JschConfigTestSessionFactory extends JschConfigSessionFactory {
     @Override\r
     protected void configure(OpenSshConfig.Host host, Session session) {\r
         session.setConfig("StrictHostKeyChecking", "no");\r
-        session.setConfig("PreferredAuthentications", "password");\r
     }\r
 \r
     @Override\r

diff --git a/src/test/java/com/gitblit/tests/SshKerberosAuthenticationTest.java b/src/test/java/com/gitblit/tests/SshKerberosAuthenticationTest.java
index 1bebf61e7f2a53339f050e61cc5ffe8789cc55e1..4ba16b67deab701fd019af84403a018607171e2b 100644 (file)
--- a/src/test/java/com/gitblit/tests/SshKerberosAuthenticationTest.java
+++ b/src/test/java/com/gitblit/tests/SshKerberosAuthenticationTest.java
@@ -27,6 +27,7 @@ import com.gitblit.manager.AuthenticationManager;
 import com.gitblit.manager.IRuntimeManager;
 import com.gitblit.manager.IUserManager;
 import com.gitblit.models.UserModel;
+import com.gitblit.tests.mock.MemorySettings;
 import com.gitblit.transport.ssh.SshDaemonClient;
 import com.gitblit.transport.ssh.SshKrbAuthenticator;
 
@@ -39,20 +40,21 @@ public class SshKerberosAuthenticationTest extends GitblitUnitTest {
        @Test
        public void testUserManager() {
                IRuntimeManager rm = Mockito.mock(IRuntimeManager.class);
-               
+
                //Build an UserManager that can build a UserModel
                IUserManager im = Mockito.mock(IUserManager.class);
                Mockito.doAnswer(new Answer<Object>() {
+                       @Override
                        public Object answer(InvocationOnMock invocation) {
                                Object[] args = invocation.getArguments();
                                String user = (String) args[0];
                                return new UserModel(user);
-                       }           
+                       }
                }).when(im).getUserModel(Mockito.anyString());
 
                AuthenticationManager am = new AuthenticationManager(rm, im);
-                               
-               GSSAuthenticator gssAuthenticator = new SshKrbAuthenticator(am);
+
+               GSSAuthenticator gssAuthenticator = new SshKrbAuthenticator(new MemorySettings(), am);
 
                ServerSession session = Mockito.mock(ServerSession.class);
 
@@ -61,12 +63,13 @@ public class SshKerberosAuthenticationTest extends GitblitUnitTest {
                SshDaemonClient client = Mockito.mock(SshDaemonClient.class);
                Mockito.when(client.getUser()).thenReturn(umw.um);
                Mockito.doAnswer(new Answer<Object>() {
+                       @Override
                        public Object answer(InvocationOnMock invocation) {
                                Object[] args = invocation.getArguments();
                                UserModel um = (UserModel) args[0];
                                umw.um = um;
                                return null;
-                       }           
+                       }
                }).when(client).setUser(Mockito.any(UserModel.class));
 
                Mockito.when(session.getAttribute(SshDaemonClient.KEY)).thenReturn(client);

diff --git a/src/test/java/com/gitblit/tests/SshUnitTest.java b/src/test/java/com/gitblit/tests/SshUnitTest.java
index 453f304366d39863d43d08fa51dc8cc8d9c5238a..27b4ec73b645637831c0bd68a2617919d25442f9 100644 (file)
--- a/src/test/java/com/gitblit/tests/SshUnitTest.java
+++ b/src/test/java/com/gitblit/tests/SshUnitTest.java
@@ -24,17 +24,12 @@ import java.net.SocketAddress;
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
 import java.security.PublicKey;
-import java.util.ArrayList;
-import java.util.List;
 import java.util.concurrent.atomic.AtomicBoolean;
 
 import org.apache.sshd.client.ServerKeyVerifier;
 import org.apache.sshd.client.SshClient;
-import org.apache.sshd.client.auth.UserAuth;
-import org.apache.sshd.client.auth.UserAuthPublicKeyFactory;
 import org.apache.sshd.client.channel.ClientChannel;
 import org.apache.sshd.client.session.ClientSession;
-import org.apache.sshd.common.NamedFactory;
 import org.apache.sshd.common.util.SecurityUtils;
 import org.junit.After;
 import org.junit.AfterClass;
@@ -107,9 +102,6 @@ public abstract class SshUnitTest extends GitblitUnitTest {
                                return true;
                        }
                });
-               List<NamedFactory<UserAuth>> userAuthFactories = new ArrayList<>();
-               userAuthFactories.add(new UserAuthPublicKeyFactory());
-               client.setUserAuthFactories(userAuthFactories);
                client.start();
                return client;
        }