Skip to content
This repository has been archived by the owner on Dec 10, 2023. It is now read-only.

Commit

Permalink
[SECURITY-1068]
Browse files Browse the repository at this point in the history
  • Loading branch information
@martinspielmann @daniel-beck
martinspielmann authored and daniel-beck committed Sep 13, 2018
1 parent a93d0fa commit 580be2a
Show file tree
Hide file tree
Showing 2 changed files with 58 additions and 11 deletions.
11 changes: 7 additions & 4 deletions src/main/java/de/theit/jenkins/crowd/CrowdConfigurationService.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,9 @@
import com.atlassian.crowd.service.client.ClientProperties;
import com.atlassian.crowd.service.client.ClientPropertiesImpl;
import com.atlassian.crowd.service.client.CrowdClient;

import hudson.util.Secret;

import org.acegisecurity.GrantedAuthority;
import org.acegisecurity.GrantedAuthorityImpl;

Expand Down Expand Up @@ -166,11 +169,11 @@ public class CrowdConfigurationService {
* @param pNestedGroups Specifies whether nested groups should be used when validating
* users against a group name.
*/
public CrowdConfigurationService(String url, String applicationName, String password,
public CrowdConfigurationService(String url, String applicationName, Secret password,
int sessionValidationInterval, boolean useSSO,
String cookieDomain, String cookieTokenkey, Boolean useProxy,
String httpProxyHost, String httpProxyPort, String httpProxyUsername,
String httpProxyPassword, String socketTimeout,
Secret httpProxyPassword, String socketTimeout,
String httpTimeout, String httpMaxConnections,
boolean useCache, Integer cacheSize, Integer cacheTTL,
String pGroupNames, boolean pNestedGroups) {
Expand All @@ -193,9 +196,9 @@ public CrowdConfigurationService(String url, String applicationName, String pass
this.useCache = useCache;
this.cacheSize = cacheSize;
this.cacheTTL = cacheTTL;
Properties props = getProperties(url, applicationName, password, sessionValidationInterval,
Properties props = getProperties(url, applicationName, Secret.toString(password), sessionValidationInterval,
useSSO, cookieDomain, cookieTokenkey, useProxy, httpProxyHost, httpProxyPort, httpProxyUsername,
httpProxyPassword, socketTimeout, httpTimeout, httpMaxConnections);
Secret.toString(httpProxyPassword), socketTimeout, httpTimeout, httpMaxConnections);
this.clientProperties = ClientPropertiesImpl.newInstanceFromProperties(props);
this.crowdClient = new RestCrowdClientFactory().newInstance(this.clientProperties);
this.tokenHelper = CrowdHttpTokenHelperImpl.getInstance(CrowdHttpValidationFactorExtractorImpl.getInstance());
Expand Down
58 changes: 51 additions & 7 deletions src/main/java/de/theit/jenkins/crowd/CrowdSecurityRealm.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@
import hudson.security.SecurityRealm;
import hudson.util.FormValidation;
import hudson.util.ListBoxModel;
import hudson.util.Secret;
import jenkins.model.Jenkins;

import org.acegisecurity.AccountExpiredException;
Expand Down Expand Up @@ -92,7 +93,7 @@ public class CrowdSecurityRealm extends AbstractPasswordBasedSecurityRealm {
public final String applicationName;

/** Contains the application password to access Crowd. */
public final String password;
public final Secret password;

/** Contains the Crowd group to which a user must belong to. */
public final String group;
Expand Down Expand Up @@ -129,7 +130,7 @@ public class CrowdSecurityRealm extends AbstractPasswordBasedSecurityRealm {
public final String httpProxyHost;
public final String httpProxyPort;
public final String httpProxyUsername;
public final String httpProxyPassword;
public final Secret httpProxyPassword;

public final String socketTimeout;
public final String httpTimeout;
Expand Down Expand Up @@ -176,10 +177,10 @@ public class CrowdSecurityRealm extends AbstractPasswordBasedSecurityRealm {
* @param cache The cache configuration
*/
@DataBoundConstructor
public CrowdSecurityRealm(String url, String applicationName, String password, String group, boolean nestedGroups,
public CrowdSecurityRealm(String url, String applicationName, Secret password, String group, boolean nestedGroups,
int sessionValidationInterval, boolean useSSO, String cookieDomain,
String cookieTokenkey, Boolean useProxy, String httpProxyHost, String httpProxyPort,
String httpProxyUsername, String httpProxyPassword, String socketTimeout,
String httpProxyUsername, Secret httpProxyPassword, String socketTimeout,
String httpTimeout, String httpMaxConnections, CacheConfiguration cache) {
this.cookieTokenkey = cookieTokenkey;
this.useProxy = useProxy;
Expand All @@ -192,14 +193,57 @@ public CrowdSecurityRealm(String url, String applicationName, String password, S
this.httpMaxConnections = httpMaxConnections;
this.url = url.trim();
this.applicationName = applicationName.trim();
this.password = password.trim();
this.password = password;
this.group = group.trim();
this.nestedGroups = nestedGroups;
this.sessionValidationInterval = sessionValidationInterval;
this.useSSO = useSSO;
this.cookieDomain = cookieDomain;
this.cache = cache;
}

/**
* Default constructor. Fields in config.jelly must match the parameter
* names in the "DataBoundConstructor".
*
* @param url The URL for Crowd.
* @param applicationName The application name.
* @param password The application password.
* @param group The group to which users must belong to. If this parameter is
* not specified, a users group membership will not be checked.
* @param nestedGroups <code>true</code> when nested groups may be used.
* <code>false</code> else.
* @param sessionValidationInterval The number of minutes to cache authentication validation in
* the session. If this value is set to <code>0</code>, each HTTP
* request will be authenticated with the Crowd server.
* @param useSSO Enable SSO authentication.
* @param cookieDomain The cookie domain
* @param cookieTokenkey The cookie token key
* @param useProxy Specifies if a proxy should be used
* @param httpProxyHost The http proxy host
* @param httpProxyPort The http proxy port
* @param httpProxyUsername The http proxy username
* @param httpProxyPassword The http proxy password
* @param socketTimeout The socket timeout
* @param httpTimeout The http timeout
* @param httpMaxConnections The http max connections
* @param cache The cache configuration
*
* @deprecated retained for backwards binary compatibility.
*/
@Deprecated
public CrowdSecurityRealm(String url, String applicationName, String password, String group, boolean nestedGroups,
int sessionValidationInterval, boolean useSSO, String cookieDomain,
String cookieTokenkey, Boolean useProxy, String httpProxyHost, String httpProxyPort,
String httpProxyUsername, String httpProxyPassword, String socketTimeout,
String httpTimeout, String httpMaxConnections, CacheConfiguration cache) {
this(url, applicationName, Secret.fromString(password.trim()), group, nestedGroups, sessionValidationInterval, useSSO,
cookieDomain, cookieTokenkey, useProxy, httpProxyHost, httpProxyPort, httpProxyUsername,
Secret.fromString(httpProxyPassword), socketTimeout, httpTimeout, httpMaxConnections, cache);
// If this constructor is called, make sure to re-save the configuration.
// This way, migrated secrets are persisted securely without user interaction.
getDescriptor().save();
}

/**
* Fields in config.jelly must match the parameter names in the "DataBoundConstructor".
Expand Down Expand Up @@ -585,9 +629,9 @@ public FormValidation doTestConnection(@QueryParameter String url, @QueryParamet
// Logger log = Logger.getLogger(getClass().getName());
Jenkins.getInstance().checkPermission(Jenkins.ADMINISTER);
CrowdConfigurationService tConfiguration = new CrowdConfigurationService(
url, applicationName, password, sessionValidationInterval,
url, applicationName, Secret.fromString(password), sessionValidationInterval,
useSSO, cookieDomain, cookieTokenkey, useProxy, httpProxyHost, httpProxyPort, httpProxyUsername,
httpProxyPassword, socketTimeout, httpTimeout, httpMaxConnections,
Secret.fromString(httpProxyPassword), socketTimeout, httpTimeout, httpMaxConnections,
false, null, null,
group, false
);
Expand Down

0 comments on commit 580be2a

Please # to comment.