{"action":"created","comment":{"url":"https://api.github.com/repos/Jasig/cas/pulls/comments/36163404","id":36163404,"diff_hunk":"@@ -0,0 +1,146 @@\n+/*\n+ * Licensed to Apereo under one or more contributor license\n+ * agreements. See the NOTICE file distributed with this work\n+ * for additional information regarding copyright ownership.\n+ * Apereo licenses this file to you under the Apache License,\n+ * Version 2.0 (the \"License\"); you may not use this file\n+ * except in compliance with the License.  You may obtain a\n+ * copy of the License at the following location:\n+ *\n+ *   http://www.apache.org/licenses/LICENSE-2.0\n+ *\n+ * Unless required by applicable law or agreed to in writing,\n+ * software distributed under the License is distributed on an\n+ * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n+ * KIND, either express or implied.  See the License for the\n+ * specific language governing permissions and limitations\n+ * under the License.\n+ */\n+\n+package org.jasig.cas.adaptors.yubikey;\n+\n+import com.yubico.client.v2.ResponseStatus;\n+import com.yubico.client.v2.VerificationResponse;\n+import com.yubico.client.v2.YubicoClient;\n+import com.yubico.client.v2.exceptions.YubicoValidationFailure;\n+import com.yubico.client.v2.exceptions.YubicoVerificationException;\n+import org.jasig.cas.authentication.HandlerResult;\n+import org.jasig.cas.authentication.PreventedException;\n+import org.jasig.cas.authentication.UsernamePasswordCredential;\n+import org.jasig.cas.authentication.handler.support.AbstractUsernamePasswordAuthenticationHandler;\n+import org.springframework.beans.factory.InitializingBean;\n+\n+import javax.annotation.PostConstruct;\n+import javax.security.auth.login.AccountNotFoundException;\n+import javax.security.auth.login.FailedLoginException;\n+import javax.validation.constraints.NotNull;\n+import java.security.GeneralSecurityException;\n+\n+/**\n+ * An authentication handler that uses the Yubico cloud validation\n+ * platform to authenticate one-time password tokens that are\n+ * issued by a YubiKey device. To use YubiCloud you need a\n+ * client id and an API key which must be obtained from Yubico.\n+ *\n+ * <p>For more info, please visit\n+ * <a href=\"http://yubico.github.io/yubico-java-client/\">this link</a></p>\n+ *\n+ * @author Misagh Moayyed\n+ * @since 4.1\n+ */\n+public class YubiKeyAuthenticationHandler extends AbstractUsernamePasswordAuthenticationHandler\n+        implements InitializingBean {\n+\n+    private YubiKeyAccountRegistry registry;\n+\n+    private final YubicoClient client;\n+\n+    /**\n+     * Prepares the Yubico client with the received clientId and secretKey. By default,\n+     * all YubiKey accounts are allowed to authenticate.\n+     * <p/>\n+     * <strong>WARNING: THIS CONSTRUCTOR RESULTS IN A\n+     * CONFIGURATION THAT CONSIDERS ALL Yubikeys VALID FOR ALL USERS. YOU MUST NOT USE\n+     * THIS CONSTRUCTOR IN PRODUCTION.</strong>\n+     *\n+     * @param clientId the client id\n+     * @param secretKey the secret key\n+     */\n+    public YubiKeyAuthenticationHandler(@NotNull final Integer clientId,\n+                                        @NotNull final String secretKey) {\n+        this.client = YubicoClient.getClient(clientId, secretKey);\n+    }\n+\n+    /**\n+     * Prepares the Yubico client with the received clientId and secretKey. If you wish to\n+     * limit the usage of this handler only to a particular set of yubikey accounts for a special\n+     * group of users, you may provide an compliant implementation of {@link YubiKeyAccountRegistry}.\n+     * By default, all accounts are allowed.\n+     *\n+     * @param clientId the client id\n+     * @param secretKey the secret key\n+     * @param registry the registry\n+     */\n+    public YubiKeyAuthenticationHandler(@NotNull final Integer clientId, final String secretKey,\n+                                        @NotNull final YubiKeyAccountRegistry registry) {\n+        this(clientId, secretKey);\n+        this.registry = registry;\n+    }\n+\n+    @Override\n+    @PostConstruct\n+    public void afterPropertiesSet() throws Exception {\n+        if (this.registry == null) {\n+            logger.warn(\"No YubiKey account registry is defined. All credentials are considered\"\n+                    + \"eligible for YubiKey authentication. Consider providing an account registry via [{}]\",\n+                    YubiKeyAccountRegistry.class.getName());\n+        }\n+    }\n+\n+    /**\n+     * {@inheritDoc}\n+     * <p/>\n+     * Attempts to authenticate the received credentials using the Yubico cloud validation platform.\n+     * In this implementation, the {@link UsernamePasswordCredential#getUsername()}\n+     * is mapped to the <code>uid</code> which will be used by the plugged-in instance of the\n+     * {@link YubiKeyAccountRegistry}\n+     * and the {@link UsernamePasswordCredential#getPassword()} is the received\n+     * one-time password token issued by the YubiKey device.\n+     */\n+    @Override\n+    protected HandlerResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential transformedCredential)\n+            throws GeneralSecurityException, PreventedException {\n+\n+        final String uid = transformedCredential.getUsername();\n+        final String otp = transformedCredential.getPassword();\n+\n+        if (!YubicoClient.isValidOTPFormat(otp)) {\n+            logger.debug(\"Invalid OTP format [{}]\", otp);\n+            throw new FailedLoginException(\"OTP format is invalid\");\n+        }\n+\n+        final String publicId = YubicoClient.getPublicId(otp);\n+        if (this.registry != null\n+              &&!this.registry.isYubiKeyRegisteredFor(uid, publicId)) {","path":"cas-server-support-yubikey/src/main/java/org/jasig/cas/adaptors/yubikey/YubiKeyAuthenticationHandler.java","position":124,"original_position":124,"commit_id":"8a6db4b708c77309da1672786437f2159ec2f7b2","original_commit_id":"8a6db4b708c77309da1672786437f2159ec2f7b2","user":{"login":"leleuj","id":1038508,"avatar_url":"https://avatars.githubusercontent.com/u/1038508?v=3","gravatar_id":"","url":"https://api.github.com/users/leleuj","html_url":"https://github.com/leleuj","followers_url":"https://api.github.com/users/leleuj/followers","following_url":"https://api.github.com/users/leleuj/following{/other_user}","gists_url":"https://api.github.com/users/leleuj/gists{/gist_id}","starred_url":"https://api.github.com/users/leleuj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leleuj/subscriptions","organizations_url":"https://api.github.com/users/leleuj/orgs","repos_url":"https://api.github.com/users/leleuj/repos","events_url":"https://api.github.com/users/leleuj/events{/privacy}","received_events_url":"https://api.github.com/users/leleuj/received_events","type":"User","site_admin":false},"body":"I'm not sure to understand the logic behind the `registry`.","created_at":"2015-08-04T07:28:01Z","updated_at":"2015-08-04T07:28:01Z","html_url":"https://github.com/Jasig/cas/pull/1070#discussion_r36163404","pull_request_url":"https://api.github.com/repos/Jasig/cas/pulls/1070","_links":{"self":{"href":"https://api.github.com/repos/Jasig/cas/pulls/comments/36163404"},"html":{"href":"https://github.com/Jasig/cas/pull/1070#discussion_r36163404"},"pull_request":{"href":"https://api.github.com/repos/Jasig/cas/pulls/1070"}}},"pull_request":{"url":"https://api.github.com/repos/Jasig/cas/pulls/1070","id":41414552,"html_url":"https://github.com/Jasig/cas/pull/1070","diff_url":"https://github.com/Jasig/cas/pull/1070.diff","patch_url":"https://github.com/Jasig/cas/pull/1070.patch","issue_url":"https://api.github.com/repos/Jasig/cas/issues/1070","number":1070,"state":"open","locked":false,"title":"Yubikey authN support","user":{"login":"mmoayyed","id":1205228,"avatar_url":"https://avatars.githubusercontent.com/u/1205228?v=3","gravatar_id":"","url":"https://api.github.com/users/mmoayyed","html_url":"https://github.com/mmoayyed","followers_url":"https://api.github.com/users/mmoayyed/followers","following_url":"https://api.github.com/users/mmoayyed/following{/other_user}","gists_url":"https://api.github.com/users/mmoayyed/gists{/gist_id}","starred_url":"https://api.github.com/users/mmoayyed/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mmoayyed/subscriptions","organizations_url":"https://api.github.com/users/mmoayyed/orgs","repos_url":"https://api.github.com/users/mmoayyed/repos","events_url":"https://api.github.com/users/mmoayyed/events{/privacy}","received_events_url":"https://api.github.com/users/mmoayyed/received_events","type":"User","site_admin":false},"body":"Partially related to #572 \r\n\r\nFeature previously existed as a separate addon. ","created_at":"2015-08-02T08:37:18Z","updated_at":"2015-08-04T07:28:01Z","closed_at":null,"merged_at":null,"merge_commit_sha":"2c064b8ac4f7e3ab28c49d6dc5ec924ce3fb9e7d","assignee":null,"milestone":{"url":"https://api.github.com/repos/Jasig/cas/milestones/2","html_url":"https://github.com/Jasig/cas/milestones/4.1.0","labels_url":"https://api.github.com/repos/Jasig/cas/milestones/2/labels","id":721279,"number":2,"title":"4.1.0","description":"CAS 4.1.0 Release","creator":{"login":"mmoayyed","id":1205228,"avatar_url":"https://avatars.githubusercontent.com/u/1205228?v=3","gravatar_id":"","url":"https://api.github.com/users/mmoayyed","html_url":"https://github.com/mmoayyed","followers_url":"https://api.github.com/users/mmoayyed/followers","following_url":"https://api.github.com/users/mmoayyed/following{/other_user}","gists_url":"https://api.github.com/users/mmoayyed/gists{/gist_id}","starred_url":"https://api.github.com/users/mmoayyed/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mmoayyed/subscriptions","organizations_url":"https://api.github.com/users/mmoayyed/orgs","repos_url":"https://api.github.com/users/mmoayyed/repos","events_url":"https://api.github.com/users/mmoayyed/events{/privacy}","received_events_url":"https://api.github.com/users/mmoayyed/received_events","type":"User","site_admin":false},"open_issues":4,"closed_issues":370,"state":"open","created_at":"2014-07-15T06:16:10Z","updated_at":"2015-08-03T11:16:05Z","due_on":null,"closed_at":null},"commits_url":"https://api.github.com/repos/Jasig/cas/pulls/1070/commits","review_comments_url":"https://api.github.com/repos/Jasig/cas/pulls/1070/comments","review_comment_url":"https://api.github.com/repos/Jasig/cas/pulls/comments{/number}","comments_url":"https://api.github.com/repos/Jasig/cas/issues/1070/comments","statuses_url":"https://api.github.com/repos/Jasig/cas/statuses/8a6db4b708c77309da1672786437f2159ec2f7b2","head":{"label":"Unicon:yubikey-authN","ref":"yubikey-authN","sha":"8a6db4b708c77309da1672786437f2159ec2f7b2","user":{"login":"Unicon","id":835400,"avatar_url":"https://avatars.githubusercontent.com/u/835400?v=3","gravatar_id":"","url":"https://api.github.com/users/Unicon","html_url":"https://github.com/Unicon","followers_url":"https://api.github.com/users/Unicon/followers","following_url":"https://api.github.com/users/Unicon/following{/other_user}","gists_url":"https://api.github.com/users/Unicon/gists{/gist_id}","starred_url":"https://api.github.com/users/Unicon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Unicon/subscriptions","organizations_url":"https://api.github.com/users/Unicon/orgs","repos_url":"https://api.github.com/users/Unicon/repos","events_url":"https://api.github.com/users/Unicon/events{/privacy}","received_events_url":"https://api.github.com/users/Unicon/received_events","type":"Organization","site_admin":false},"repo":{"id":6410069,"name":"cas","full_name":"Unicon/cas","owner":{"login":"Unicon","id":835400,"avatar_url":"https://avatars.githubusercontent.com/u/835400?v=3","gravatar_id":"","url":"https://api.github.com/users/Unicon","html_url":"https://github.com/Unicon","followers_url":"https://api.github.com/users/Unicon/followers","following_url":"https://api.github.com/users/Unicon/following{/other_user}","gists_url":"https://api.github.com/users/Unicon/gists{/gist_id}","starred_url":"https://api.github.com/users/Unicon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Unicon/subscriptions","organizations_url":"https://api.github.com/users/Unicon/orgs","repos_url":"https://api.github.com/users/Unicon/repos","events_url":"https://api.github.com/users/Unicon/events{/privacy}","received_events_url":"https://api.github.com/users/Unicon/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/Unicon/cas","description":"Jasig CAS - Single Sign On for the Web","fork":true,"url":"https://api.github.com/repos/Unicon/cas","forks_url":"https://api.github.com/repos/Unicon/cas/forks","keys_url":"https://api.github.com/repos/Unicon/cas/keys{/key_id}","collaborators_url":"https://api.github.com/repos/Unicon/cas/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/Unicon/cas/teams","hooks_url":"https://api.github.com/repos/Unicon/cas/hooks","issue_events_url":"https://api.github.com/repos/Unicon/cas/issues/events{/number}","events_url":"https://api.github.com/repos/Unicon/cas/events","assignees_url":"https://api.github.com/repos/Unicon/cas/assignees{/user}","branches_url":"https://api.github.com/repos/Unicon/cas/branches{/branch}","tags_url":"https://api.github.com/repos/Unicon/cas/tags","blobs_url":"https://api.github.com/repos/Unicon/cas/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/Unicon/cas/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/Unicon/cas/git/refs{/sha}","trees_url":"https://api.github.com/repos/Unicon/cas/git/trees{/sha}","statuses_url":"https://api.github.com/repos/Unicon/cas/statuses/{sha}","languages_url":"https://api.github.com/repos/Unicon/cas/languages","stargazers_url":"https://api.github.com/repos/Unicon/cas/stargazers","contributors_url":"https://api.github.com/repos/Unicon/cas/contributors","subscribers_url":"https://api.github.com/repos/Unicon/cas/subscribers","subscription_url":"https://api.github.com/repos/Unicon/cas/subscription","commits_url":"https://api.github.com/repos/Unicon/cas/commits{/sha}","git_commits_url":"https://api.github.com/repos/Unicon/cas/git/commits{/sha}","comments_url":"https://api.github.com/repos/Unicon/cas/comments{/number}","issue_comment_url":"https://api.github.com/repos/Unicon/cas/issues/comments{/number}","contents_url":"https://api.github.com/repos/Unicon/cas/contents/{+path}","compare_url":"https://api.github.com/repos/Unicon/cas/compare/{base}...{head}","merges_url":"https://api.github.com/repos/Unicon/cas/merges","archive_url":"https://api.github.com/repos/Unicon/cas/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/Unicon/cas/downloads","issues_url":"https://api.github.com/repos/Unicon/cas/issues{/number}","pulls_url":"https://api.github.com/repos/Unicon/cas/pulls{/number}","milestones_url":"https://api.github.com/repos/Unicon/cas/milestones{/number}","notifications_url":"https://api.github.com/repos/Unicon/cas/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/Unicon/cas/labels{/name}","releases_url":"https://api.github.com/repos/Unicon/cas/releases{/id}","created_at":"2012-10-26T20:34:46Z","updated_at":"2015-07-28T07:56:52Z","pushed_at":"2015-08-03T22:40:13Z","git_url":"git://github.com/Unicon/cas.git","ssh_url":"git@github.com:Unicon/cas.git","clone_url":"https://github.com/Unicon/cas.git","svn_url":"https://github.com/Unicon/cas","homepage":"http://www.jasig.org/cas","size":47238,"stargazers_count":23,"watchers_count":23,"language":"Java","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":24,"mirror_url":null,"open_issues_count":0,"forks":24,"open_issues":0,"watchers":23,"default_branch":"master"}},"base":{"label":"Jasig:master","ref":"master","sha":"98aabd08ec090f6453ce96bc6b17654eedda78e7","user":{"login":"Jasig","id":884285,"avatar_url":"https://avatars.githubusercontent.com/u/884285?v=3","gravatar_id":"","url":"https://api.github.com/users/Jasig","html_url":"https://github.com/Jasig","followers_url":"https://api.github.com/users/Jasig/followers","following_url":"https://api.github.com/users/Jasig/following{/other_user}","gists_url":"https://api.github.com/users/Jasig/gists{/gist_id}","starred_url":"https://api.github.com/users/Jasig/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Jasig/subscriptions","organizations_url":"https://api.github.com/users/Jasig/orgs","repos_url":"https://api.github.com/users/Jasig/repos","events_url":"https://api.github.com/users/Jasig/events{/privacy}","received_events_url":"https://api.github.com/users/Jasig/received_events","type":"Organization","site_admin":false},"repo":{"id":2352744,"name":"cas","full_name":"Jasig/cas","owner":{"login":"Jasig","id":884285,"avatar_url":"https://avatars.githubusercontent.com/u/884285?v=3","gravatar_id":"","url":"https://api.github.com/users/Jasig","html_url":"https://github.com/Jasig","followers_url":"https://api.github.com/users/Jasig/followers","following_url":"https://api.github.com/users/Jasig/following{/other_user}","gists_url":"https://api.github.com/users/Jasig/gists{/gist_id}","starred_url":"https://api.github.com/users/Jasig/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Jasig/subscriptions","organizations_url":"https://api.github.com/users/Jasig/orgs","repos_url":"https://api.github.com/users/Jasig/repos","events_url":"https://api.github.com/users/Jasig/events{/privacy}","received_events_url":"https://api.github.com/users/Jasig/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/Jasig/cas","description":"Apereo CAS - Single Sign On for the Web","fork":false,"url":"https://api.github.com/repos/Jasig/cas","forks_url":"https://api.github.com/repos/Jasig/cas/forks","keys_url":"https://api.github.com/repos/Jasig/cas/keys{/key_id}","collaborators_url":"https://api.github.com/repos/Jasig/cas/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/Jasig/cas/teams","hooks_url":"https://api.github.com/repos/Jasig/cas/hooks","issue_events_url":"https://api.github.com/repos/Jasig/cas/issues/events{/number}","events_url":"https://api.github.com/repos/Jasig/cas/events","assignees_url":"https://api.github.com/repos/Jasig/cas/assignees{/user}","branches_url":"https://api.github.com/repos/Jasig/cas/branches{/branch}","tags_url":"https://api.github.com/repos/Jasig/cas/tags","blobs_url":"https://api.github.com/repos/Jasig/cas/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/Jasig/cas/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/Jasig/cas/git/refs{/sha}","trees_url":"https://api.github.com/repos/Jasig/cas/git/trees{/sha}","statuses_url":"https://api.github.com/repos/Jasig/cas/statuses/{sha}","languages_url":"https://api.github.com/repos/Jasig/cas/languages","stargazers_url":"https://api.github.com/repos/Jasig/cas/stargazers","contributors_url":"https://api.github.com/repos/Jasig/cas/contributors","subscribers_url":"https://api.github.com/repos/Jasig/cas/subscribers","subscription_url":"https://api.github.com/repos/Jasig/cas/subscription","commits_url":"https://api.github.com/repos/Jasig/cas/commits{/sha}","git_commits_url":"https://api.github.com/repos/Jasig/cas/git/commits{/sha}","comments_url":"https://api.github.com/repos/Jasig/cas/comments{/number}","issue_comment_url":"https://api.github.com/repos/Jasig/cas/issues/comments{/number}","contents_url":"https://api.github.com/repos/Jasig/cas/contents/{+path}","compare_url":"https://api.github.com/repos/Jasig/cas/compare/{base}...{head}","merges_url":"https://api.github.com/repos/Jasig/cas/merges","archive_url":"https://api.github.com/repos/Jasig/cas/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/Jasig/cas/downloads","issues_url":"https://api.github.com/repos/Jasig/cas/issues{/number}","pulls_url":"https://api.github.com/repos/Jasig/cas/pulls{/number}","milestones_url":"https://api.github.com/repos/Jasig/cas/milestones{/number}","notifications_url":"https://api.github.com/repos/Jasig/cas/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/Jasig/cas/labels{/name}","releases_url":"https://api.github.com/repos/Jasig/cas/releases{/id}","created_at":"2011-09-09T01:36:42Z","updated_at":"2015-08-03T13:46:22Z","pushed_at":"2015-08-03T13:54:37Z","git_url":"git://github.com/Jasig/cas.git","ssh_url":"git@github.com:Jasig/cas.git","clone_url":"https://github.com/Jasig/cas.git","svn_url":"https://github.com/Jasig/cas","homepage":"http://jasig.github.io/cas/","size":522762,"stargazers_count":789,"watchers_count":789,"language":"Java","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":610,"mirror_url":null,"open_issues_count":65,"forks":610,"open_issues":65,"watchers":789,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/Jasig/cas/pulls/1070"},"html":{"href":"https://github.com/Jasig/cas/pull/1070"},"issue":{"href":"https://api.github.com/repos/Jasig/cas/issues/1070"},"comments":{"href":"https://api.github.com/repos/Jasig/cas/issues/1070/comments"},"review_comments":{"href":"https://api.github.com/repos/Jasig/cas/pulls/1070/comments"},"review_comment":{"href":"https://api.github.com/repos/Jasig/cas/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/Jasig/cas/pulls/1070/commits"},"statuses":{"href":"https://api.github.com/repos/Jasig/cas/statuses/8a6db4b708c77309da1672786437f2159ec2f7b2"}}}}