Reverse structure of restriction enforcement such that the default action is to deny access.
@@ -88,33 +88,18 @@ public class JDBCAuthenticationProviderService implements AuthenticationProvider
// Retrieve user account for already-authenticated user
ModeledUser user = userService.retrieveUser(authenticationProvider, authenticatedUser);
- if (user == null) {
+ if (user != null) {
- // Do not invalidate the authentication result of users who were
- // authenticated via our own connection sharing links
- if (authenticatedUser instanceof SharedAuthenticatedUser)
- return null;
-
- // Simply return no data if a database user account is not required
- if (!environment.isUserRequired())
- return null;
-
- // Otherwise, invalidate the authentication result, as database user
- // accounts are absolutely required
- throw new GuacamoleInvalidCredentialsException("Invalid login",
- CredentialsInfo.USERNAME_PASSWORD);
-
- }
-
- // Apply account restrictions if this extension authenticated the user
- // OR if an account from this extension is explicitly required
+ // User data only exists for purposes of retrieval if the account
+ // is not disabled
UserModel userModel = user.getModel();
- if (authenticatedUser instanceof ModeledAuthenticatedUser || environment.isUserRequired()) {
+ if (!userModel.isDisabled()) {
- // If user is disabled, pretend user does not exist
- if (userModel.isDisabled())
- throw new GuacamoleInvalidCredentialsException("Invalid login",
- CredentialsInfo.USERNAME_PASSWORD);
+ // Apply account restrictions if this extension authenticated
+ // the user OR if an account from this extension is explicitly
+ // required
+ if (authenticatedUser instanceof ModeledAuthenticatedUser
+ || environment.isUserRequired()) {
// Verify user account is still valid as of today
if (!user.isAccountValid())
@@ -124,12 +109,12 @@ public class JDBCAuthenticationProviderService implements AuthenticationProvider
if (!user.isAccountAccessible())
throw new GuacamoleClientException("LOGIN.ERROR_NOT_ACCESSIBLE");
- }
-
// Update password if password is expired
if (userModel.isExpired() || passwordPolicyService.isPasswordExpired(user))
userService.resetExpiredPassword(user, authenticatedUser.getCredentials());
+ }
+
// Link to user context
ModeledUserContext context = userContextProvider.get();
context.init(user.getCurrentUser());
@@ -137,6 +122,24 @@ public class JDBCAuthenticationProviderService implements AuthenticationProvider
}
+ }
+
+ // Do not invalidate the authentication result of users who were
+ // authenticated via our own connection sharing links
+ if (authenticatedUser instanceof SharedAuthenticatedUser)
+ return null;
+
+ // Simply return no data if a database user account is not required
+ if (!environment.isUserRequired())
+ return null;
+
+ // Otherwise, invalidate the authentication result, as database user
+ // accounts are absolutely required
+ throw new GuacamoleInvalidCredentialsException("Invalid login",
+ CredentialsInfo.USERNAME_PASSWORD);
+
+ }
+
@Override
public UserContext updateUserContext(AuthenticationProvider authenticationProvider,
UserContext context, AuthenticatedUser authenticatedUser,
