openam-annotations/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.openidentityplatform.openam</groupId>
         <artifactId>openam</artifactId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
 
     <!-- Component Definition -->

openam-audit/openam-audit-configuration/pom.xml

@@ -18,7 +18,7 @@
     <parent>
         <artifactId>openam-audit</artifactId>
         <groupId>org.openidentityplatform.openam</groupId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
     <modelVersion>4.0.0</modelVersion>
 

openam-audit/openam-audit-context/pom.xml

@@ -18,7 +18,7 @@
     <parent>
         <artifactId>openam-audit</artifactId>
         <groupId>org.openidentityplatform.openam</groupId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
     <modelVersion>4.0.0</modelVersion>
 

openam-audit/openam-audit-core/pom.xml

@@ -18,7 +18,7 @@
     <parent>
         <artifactId>openam-audit</artifactId>
         <groupId>org.openidentityplatform.openam</groupId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
     <modelVersion>4.0.0</modelVersion>
 

openam-audit/openam-audit-rest/pom.xml

@@ -18,7 +18,7 @@
     <parent>
         <artifactId>openam-audit</artifactId>
         <groupId>org.openidentityplatform.openam</groupId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
     <modelVersion>4.0.0</modelVersion>
 

openam-audit/pom.xml

@@ -18,7 +18,7 @@
     <parent>
         <artifactId>openam</artifactId>
         <groupId>org.openidentityplatform.openam</groupId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
     <modelVersion>4.0.0</modelVersion>
 

openam-authentication/openam-auth-ad/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.openidentityplatform.openam</groupId>
         <artifactId>openam-authentication</artifactId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
 
     <!-- Component Definition -->

openam-authentication/openam-auth-adaptive/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.openidentityplatform.openam</groupId>
         <artifactId>openam-authentication</artifactId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
 
     <!-- Component Definition -->

openam-authentication/openam-auth-amster/pom.xml

@@ -19,7 +19,7 @@
     <parent>
         <artifactId>openam-authentication</artifactId>
         <groupId>org.openidentityplatform.openam</groupId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
     <modelVersion>4.0.0</modelVersion>
 

openam-authentication/openam-auth-anonymous/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.openidentityplatform.openam</groupId>
         <artifactId>openam-authentication</artifactId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
     <artifactId>openam-auth-anonymous</artifactId>
     <packaging>jar</packaging>

openam-authentication/openam-auth-application/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.openidentityplatform.openam</groupId>
         <artifactId>openam-authentication</artifactId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
 
     <!-- Component Definition -->

openam-authentication/openam-auth-cert/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.openidentityplatform.openam</groupId>
         <artifactId>openam-authentication</artifactId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
 
     <!-- Component Definition -->

openam-authentication/openam-auth-cert/src/main/java/com/sun/identity/authentication/modules/cert/Cert.java

@@ -575,7 +575,6 @@ private void getTokenFromSubjectAltExt(X509Certificate cert)
                     (SubjectAlternativeNameExtension.SUBJECT_NAME);
 
                 GeneralName generalname = null;  
-                ObjectIdentifier upnoid = new ObjectIdentifier(new DerInputStream(UPNOID.getBytes()));
                 Iterator itr = (Iterator) names.iterator();
                 while ((userTokenId == null) && itr.hasNext()) {
                     generalname = (GeneralName) itr.next(); 
@@ -586,7 +585,7 @@ private void getTokenFromSubjectAltExt(X509Certificate cert)
                 	        GeneralNameInterface.NAME_ANY)) {
                             OtherName othername = 
                                 (OtherName)generalname.getName(); 
-                            if (upnoid.equals((Object)(othername.getOID()))) {
+                            if (UPNOID.equals(othername.getOID().toString())) {
                                 byte[] nval = othername.getNameValue(); 
                                 DerValue derValue = new DerValue(nval); 
                                 userTokenId = 

openam-authentication/openam-auth-common/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.openidentityplatform.openam</groupId>
         <artifactId>openam-authentication</artifactId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
 
     <!-- Component Definition -->

openam-authentication/openam-auth-datastore/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.openidentityplatform.openam</groupId>
         <artifactId>openam-authentication</artifactId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
 
     <!-- Component Definition -->

openam-authentication/openam-auth-device-id/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <groupId>org.openidentityplatform.openam</groupId>
         <artifactId>openam-authentication</artifactId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
 
     <name>OpenAM Device Id Authentication Module</name>

openam-authentication/openam-auth-fr-oath/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.openidentityplatform.openam</groupId>
         <artifactId>openam-authentication</artifactId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
 
     <!-- Component Definition -->

openam-authentication/openam-auth-hotp/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.openidentityplatform.openam</groupId>
         <artifactId>openam-authentication</artifactId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
 
     <!-- Component Definition -->

openam-authentication/openam-auth-httpbasic/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.openidentityplatform.openam</groupId>
         <artifactId>openam-authentication</artifactId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
 
     <!-- Component Definition -->

openam-authentication/openam-auth-jdbc/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.openidentityplatform.openam</groupId>
         <artifactId>openam-authentication</artifactId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
 
     <!-- Component Definition -->

openam-authentication/openam-auth-ldap/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.openidentityplatform.openam</groupId>
         <artifactId>openam-authentication</artifactId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
 
     <!-- Component Definition -->

openam-authentication/openam-auth-membership/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.openidentityplatform.openam</groupId>
         <artifactId>openam-authentication</artifactId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
 
     <!-- Component Definition -->

openam-authentication/openam-auth-msisdn/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.openidentityplatform.openam</groupId>
         <artifactId>openam-authentication</artifactId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
 
     <!-- Component Definition -->

openam-authentication/openam-auth-nt/pom.xml

@@ -21,13 +21,48 @@
     <parent>
         <groupId>org.openidentityplatform.openam</groupId>
         <artifactId>openam-authentication</artifactId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
 
     <!-- Component Definition -->
     <name>OpenAM NT Authentication Module</name>
     <description>OpenAM Authentication NT</description>
     <artifactId>openam-auth-nt</artifactId>
     <packaging>jar</packaging>
+    <dependencies>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-text</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.mockito</groupId>
+            <artifactId>mockito-all</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.powermock</groupId>
+            <artifactId>powermock-module-testng</artifactId>
+            <version>1.7.4</version>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.powermock</groupId>
+            <artifactId>powermock-core</artifactId>
+            <version>1.7.4</version>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.powermock</groupId>
+            <artifactId>powermock-api-mockito</artifactId>
+            <version>1.7.4</version>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>javax.servlet</groupId>
+            <artifactId>javax.servlet-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
 
 </project>

openam-authentication/openam-auth-nt/src/main/java/com/sun/identity/authentication/modules/nt/NT.java

@@ -32,25 +32,28 @@
 package com.sun.identity.authentication.modules.nt;
 
 import com.iplanet.am.util.SystemProperties;
-import com.sun.identity.shared.Constants;
-import com.sun.identity.shared.datastruct.CollectionHelper;
 import com.sun.identity.authentication.spi.AMLoginModule;
 import com.sun.identity.authentication.spi.AuthLoginException;
 import com.sun.identity.authentication.util.ISAuthConstants;
+import com.sun.identity.shared.Constants;
+import com.sun.identity.shared.datastruct.CollectionHelper;
+import org.apache.commons.text.translate.AggregateTranslator;
+import org.apache.commons.text.translate.EntityArrays;
+import org.apache.commons.text.translate.LookupTranslator;
 
+import javax.security.auth.Subject;
+import javax.security.auth.callback.Callback;
+import javax.security.auth.callback.NameCallback;
+import javax.security.auth.callback.PasswordCallback;
 import java.io.BufferedReader;
 import java.io.File;
-import java.io.InputStreamReader;
-import java.io.UnsupportedEncodingException;
 import java.io.FileOutputStream;
+import java.io.InputStreamReader;
 import java.io.OutputStreamWriter;
+import java.io.UnsupportedEncodingException;
 import java.security.Principal;
-import java.util.ResourceBundle;
 import java.util.Map;
-import javax.security.auth.Subject;
-import javax.security.auth.callback.Callback;
-import javax.security.auth.callback.NameCallback;
-import javax.security.auth.callback.PasswordCallback;
+import java.util.ResourceBundle;
 
 public class NT extends AMLoginModule {
     private static boolean hasInitialized = false;
@@ -75,7 +78,7 @@ public class NT extends AMLoginModule {
 
     public NT() {
     }
- 
+
     /**
      * TODO-JAVADOC
      */
@@ -127,6 +130,17 @@ public void init(Subject subject, Map sharedState, Map options) {
         hasInitialized = true;
     }
 
+    private static final AggregateTranslator translator;
+    static {
+        translator = new AggregateTranslator(
+                new LookupTranslator(EntityArrays.JAVA_CTRL_CHARS_ESCAPE)
+        );
+    }
+
+    String escapeSpecial(String src) {
+        return translator.translate(src);
+    }
+
     /**
      * TODO-JAVADOC
      */
@@ -180,6 +194,8 @@ public int process(Callback[] callbacks, int state)
                 throw new AuthLoginException(amAuthNT, "Passworderror", null);
             }
         }
+        //prevent replace samba username attack
+        userPassword = escapeSpecial(userPassword);
 
         // store username, password both in success and failure case        
         storeUsernamePasswd(userName, userPassword);
@@ -221,7 +237,7 @@ public int process(Callback[] callbacks, int state)
             // Create the tmpFile
             tmpFile = File.createTempFile(userName,"pwd");
             FileOutputStream fw = new FileOutputStream(tmpFile);
-            OutputStreamWriter dos = new OutputStreamWriter(fw, "ISO-8859-1");
+            OutputStreamWriter dos = new OutputStreamWriter(fw, "UTF-8");
             dos.write("username = " + userName + "\n");
             dos.write("password = " + userPassword);
             dos.flush();

openam-authentication/openam-auth-nt/src/test/java/com/sun/identity/authentication/modules/nt/NTTest.java

@@ -0,0 +1,40 @@
+package com.sun.identity.authentication.modules.nt;
+
+import com.iplanet.am.util.SystemProperties;
+import com.sun.identity.authentication.service.AuthD;
+import org.forgerock.guice.core.InjectorHolder;
+import org.powermock.api.mockito.PowerMockito;
+import org.powermock.core.classloader.annotations.PowerMockIgnore;
+import org.powermock.core.classloader.annotations.PrepareForTest;
+import org.powermock.modules.testng.PowerMockTestCase;
+import org.testng.annotations.DataProvider;
+import org.testng.annotations.Test;
+
+import static org.testng.Assert.assertEquals;
+
+@PrepareForTest({ SystemProperties.class, AuthD.class, InjectorHolder.class})
+@PowerMockIgnore({"jdk.internal.reflect.*", "javax.servlet.*"})
+public class NTTest extends PowerMockTestCase {
+
+    @Test (dataProvider = "data-provider")
+    public void testEncode(String string, String expected) {
+        PowerMockito.mockStatic(SystemProperties.class);
+        PowerMockito.mockStatic(InjectorHolder.class);
+        PowerMockito.mockStatic(AuthD.class);
+        NT nt = new NT();
+        String encoded = nt.escapeSpecial(string);
+        assertEquals(encoded, expected);
+    }
+
+    @DataProvider(name = "data-provider")
+    public Object[][] dpMethod(){
+        return new Object[][] {
+                {"t\nт", "t\\nт"},
+                {"t\\nт", "t\\nт"},
+                {"тест", "тест"},
+                {"test", "test"},
+                {"\r\n", "\\r\\n"},
+                {"\\\r\\\n", "\\\\r\\\\n"},
+        };
+    }
+}

openam-authentication/openam-auth-oath/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.openidentityplatform.openam</groupId>
         <artifactId>openam-authentication</artifactId>
-        <version>14.6.5</version>
+        <version>14.6.6</version>
     </parent>
 
     <!-- Component Definition -->