/*
 * JBoss, Home of Professional Open Source.
 * Copyright 2013 Red Hat, Inc., and individual contributors
 * as indicated by the @author tags.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package io.undertow.security.impl;

import java.security.cert.Certificate;
import java.security.cert.X509Certificate;

import javax.net.ssl.SSLPeerUnverifiedException;
import javax.net.ssl.SSLSession;

import io.undertow.security.api.AuthenticationMechanism;
import io.undertow.security.api.SecurityContext;
import io.undertow.security.idm.Account;
import io.undertow.security.idm.Credential;
import io.undertow.security.idm.IdentityManager;
import io.undertow.security.idm.X509CertificateCredential;
import io.undertow.server.HttpServerExchange;

/**
 * The Client Cert based authentication mechanism.
 *
 * When authenticate is called the current request is checked to see if it a SSL request, this is further checked to identify if
 * the client has been verified at the SSL level.
 *
 * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
 */
public class ClientCertAuthenticationMechanism implements AuthenticationMechanism {

    private final String name;

    public ClientCertAuthenticationMechanism() {
        this("CLIENT-CERT");
    }

    public ClientCertAuthenticationMechanism(final String mechanismName) {
        this.name = mechanismName;
    }

    public String getName() {
        return name;
    }

    public AuthenticationMechanismOutcome authenticate(final HttpServerExchange exchange,
                                                       final SecurityContext securityContext) {

        SSLSession sslSession = exchange.getConnection().getSslSession();
        if (sslSession != null) {
            try {
                Certificate[] clientCerts = sslSession.getPeerCertificates();
                if (clientCerts[0] instanceof X509Certificate) {
                    // Hand off to the executor as now we need an IDM based check.
                    return runClientCert(securityContext,  (X509Certificate) clientCerts[0]);
                }
            } catch (SSLPeerUnverifiedException e) {
                // No action - this mechanism can not attempt authentication without peer certificates so allow it to drop out
                // to NOT_ATTEMPTED.
            }
        }

        // There was no SSLSession to verify or early verification failed.
        return AuthenticationMechanismOutcome.NOT_ATTEMPTED;
    }

    public AuthenticationMechanismOutcome runClientCert(final SecurityContext securityContext, final X509Certificate certificate) {
        Credential credential = new X509CertificateCredential(certificate);

        IdentityManager idm = securityContext.getIdentityManager();
        Account account = idm.verify(credential);
        if (account != null) {
            securityContext.authenticationComplete(account, getName());
            return AuthenticationMechanismOutcome.AUTHENTICATED;
        } else {
            // Return NOT_ATTEMPTED to give other mechanisms a chance.
            return AuthenticationMechanismOutcome.NOT_ATTEMPTED;
        }
    }

    @Override
    public ChallengeResult sendChallenge(HttpServerExchange exchange, SecurityContext securityContext) {
        return new ChallengeResult(false);
    }

}

@@ -2038,63 +2038,8 @@
 nge,
-%0A                                                      
  fin
@@ -2076,17 +2076,16 @@
 text) %7B%0A
-%0A
         
@@ -2369,1155 +2369,1042 @@
     
-// Hand off to the executor as now we need an IDM based check.%0A                    return runClientCert(securityContext,  (X509Certificate) clientCerts%5B0%5D);%0A                %7D%0A            %7D catch (SSLPeerUnverifiedException e) %7B%0A                // No action - this mechanism can not attempt authentication without peer certificates so allow it to drop out%0A                // to NOT_ATTEMPTED.%0A            %7D%0A        %7D%0A%0A        // There was no SSLSession to verify or early verification failed.%0A        return AuthenticationMechanismOutcome.NOT_ATTEMPTED;%0A    %7D%0A%0A    public AuthenticationMechanismOutcome runClientCert(final SecurityContext securityContext, final X509Certificate certificate) %7B%0A        Credential credential = new X509CertificateCredential(certificate);%0A%0A        IdentityManager idm = securityContext.getIdentityManager();%0A        Account account = idm.verify(credential);%0A        if (account != null) %7B%0A            securityContext.authenticationComplete(account, getName());%0A            return AuthenticationMechanismOutcome.AUTHENTICATED;%0A        %7D else %7B%0A            // Return NOT_ATTEMPTED to give other mechanisms a chance.%0A    
+Credential credential = new X509CertificateCredential((X509Certificate) clientCerts%5B0%5D);%0A%0A                    IdentityManager idm = securityContext.getIdentityManager();%0A                    Account account = idm.verify(credential);%0A                    if (account != null) %7B%0A                        securityContext.authenticationComplete(account, getName());%0A                        return AuthenticationMechanismOutcome.AUTHENTICATED;%0A                    %7D%0A                %7D%0A            %7D catch (SSLPeerUnverifiedException e) %7B%0A                // No action - this mechanism can not attempt authentication without peer certificates so allow it to drop out%0A                // to NOT_ATTEMPTED.%0A            %7D%0A        %7D%0A%0A        /*%0A         * For ClientCert we do not have a concept of a failed authentication, if the client did use a key then it was deemed%0A         * acceptable for the connection to be established, this mechanism then just 'attempts' to use it for authentication but%0A         * does not mandate success.%0A         */%0A%0A
     
@@ -3460,26 +3460,16 @@
 EMPTED;%0A
-        %7D%0A
     %7D%0A%0A 

Update the ClientCertAuthenticationMechanism to remove the additional method that was a left over from using an inner class for authentication.