1 /*
2 * SPDX-License-Identifier: MIT
3 * See LICENSE file for details.
4 *
5 * Copyright 2010-2026 The Waffle Project Contributors: https://github.com/Waffle/waffle/graphs/contributors
6 */
7 package waffle.shiro.negotiate;
8
9 import org.apache.shiro.authc.AuthenticationInfo;
10 import org.apache.shiro.authc.AuthenticationToken;
11 import org.apache.shiro.authc.pam.AbstractAuthenticationStrategy;
12 import org.apache.shiro.realm.Realm;
13
14 /**
15 * Custom authentication strategy for the negotiate logic required for SSO/Negotiate auth realm
16 * {@link NegotiateAuthenticationRealm}. When the negotiate logic is executing, one of more round trips with the client
17 * occur. When the {@link NegotiateAuthenticationRealm} determines another handshake is needed, it throws the exception:
18 * {@link AuthenticationInProgressException}. This custom strategy detects this exception, and immediately re-throws it
19 * so classes higher up in the call stack will allow the handshake to proceed. Without this added logic, the handshake
20 * could be halted after the first connection by the existing error handling. <br>
21 * <br>
22 * This strategy is needed when using {@link NegotiateAuthenticationFilter} and more than one realm is configured in
23 * shiro.ini. If only one realm is defined, the current error handling in
24 * {@link org.apache.shiro.authc.pam.ModularRealmAuthenticator#doSingleRealmAuthentication(org.apache.shiro.realm.Realm, org.apache.shiro.authc.AuthenticationToken)}
25 * works fine without requiring this strategy. However, the current error handling in
26 * {@link org.apache.shiro.authc.pam.ModularRealmAuthenticator#doMultiRealmAuthentication(java.util.Collection, org.apache.shiro.authc.AuthenticationToken)}
27 * does require the {@link NegotiateAuthenticationStrategy} to ensure negotiate 'continue' calls will proceed. So for
28 * now, the most reliable approach is to use this strategy.
29 *
30 * @see NegotiateAuthenticationStrategy#afterAttempt(org.apache.shiro.realm.Realm,
31 * org.apache.shiro.authc.AuthenticationToken, org.apache.shiro.authc.AuthenticationInfo,
32 * org.apache.shiro.authc.AuthenticationInfo, Throwable)
33 */
34 public class NegotiateAuthenticationStrategy extends AbstractAuthenticationStrategy {
35
36 /**
37 * When the negotiate logic is executing, one of more round trips with the client occur. When the
38 * {@link NegotiateAuthenticationRealm negotiate realm} determines another handshake is needed, it throws the
39 * exception: {@link AuthenticationInProgressException}. This custom strategy detects this exception, and
40 * immediately re-throws it so classes higher up in the call stack will allow the handshake to proceed. Without this
41 * added logic, the handshake would be halted after the first connection by the existing error handling.
42 * <p>
43 * {@inheritDoc}
44 */
45 @Override
46 public AuthenticationInfo afterAttempt(final Realm realm, final AuthenticationToken token,
47 final AuthenticationInfo singleRealmInfo, final AuthenticationInfo aggregateInfo, final Throwable t) {
48
49 if (realm instanceof NegotiateAuthenticationRealm && t instanceof AuthenticationInProgressException) {
50 // propagate exception upward as is, to signal continue is needed
51 throw (AuthenticationInProgressException) t;
52 }
53
54 return super.afterAttempt(realm, token, singleRealmInfo, aggregateInfo, t);
55 }
56
57 }