brute force refactr, mv protocol

saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlProtocolFactory.java

@@ -32,8 +32,8 @@
 public class SamlProtocolFactory extends AbstractLoginProtocolFactory {
 
     @Override
-    public Object createProtocolEndpoint(RealmModel realm, EventBuilder event, AuthenticationManager authManager) {
-        return new SamlService(realm, event, authManager);
+    public Object createProtocolEndpoint(RealmModel realm, EventBuilder event) {
+        return new SamlService(realm, event);
     }
 
     @Override

saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlService.java

@@ -61,8 +61,8 @@ public class SamlService extends AuthorizationEndpointBase {
 
     protected static final Logger logger = Logger.getLogger(SamlService.class);
 
-    public SamlService(RealmModel realm, EventBuilder event, AuthenticationManager authManager) {
-        super(realm, event, authManager);
+    public SamlService(RealmModel realm, EventBuilder event) {
+        super(realm, event);
     }
 
     public abstract class BindingProtocol {
@@ -556,7 +556,7 @@ public Response idpInitiatedSSO(@PathParam("client") String clientUrlName, @Quer
     @POST
     @Consumes("application/soap+xml")
     public Response soapBinding(InputStream inputStream) {
-        SamlEcpProfileService bindingService = new SamlEcpProfileService(realm, event, authManager);
+        SamlEcpProfileService bindingService = new SamlEcpProfileService(realm, event);
 
         ResteasyProviderFactory.getInstance().injectProperties(bindingService);
 

saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/profile/ecp/SamlEcpProfileService.java

@@ -36,8 +36,8 @@ public class SamlEcpProfileService extends SamlService {
     private static final String NS_PREFIX_SAML_PROTOCOL = "samlp";
     private static final String NS_PREFIX_SAML_ASSERTION = "saml";
 
-    public SamlEcpProfileService(RealmModel realm, EventBuilder event, AuthenticationManager authManager) {
-        super(realm, event, authManager);
+    public SamlEcpProfileService(RealmModel realm, EventBuilder event) {
+        super(realm, event);
     }
 
     public Response authenticate(InputStream inputStream) {

services/src/main/java/org/keycloak/protocol/LoginProtocolFactory.java → server-spi/src/main/java/org/keycloak/protocol/LoginProtocolFactory.java

@@ -30,7 +30,7 @@ public interface LoginProtocolFactory extends ProviderFactory<LoginProtocol> {
      */
     List<ProtocolMapperModel> getDefaultBuiltinMappers();
 
-    Object createProtocolEndpoint(RealmModel realm, EventBuilder event, AuthenticationManager authManager);
+    Object createProtocolEndpoint(RealmModel realm, EventBuilder event);
 
     /**
      * Setup default values for new clients. This expects that the representation has already set up the client

server-spi/src/main/java/org/keycloak/services/managers/BruteForceProtector.java

@@ -0,0 +1,16 @@
+package org.keycloak.services.managers;
+
+import org.keycloak.common.ClientConnection;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.provider.Provider;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface BruteForceProtector extends Provider {
+    void failedLogin(RealmModel realm, String username, ClientConnection clientConnection);
+
+    boolean isTemporarilyDisabled(KeycloakSession session, RealmModel realm, String username);
+}

server-spi/src/main/java/org/keycloak/services/managers/BruteForceProtectorFactory.java

@@ -0,0 +1,10 @@
+package org.keycloak.services.managers;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface BruteForceProtectorFactory extends ProviderFactory<BruteForceProtector> {
+}

server-spi/src/main/java/org/keycloak/services/managers/BruteForceProtectorSpi.java

@@ -0,0 +1,34 @@
+package org.keycloak.services.managers;
+
+import org.keycloak.models.UserFederationProvider;
+import org.keycloak.models.UserFederationProviderFactory;
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class BruteForceProtectorSpi implements Spi {
+
+    @Override
+    public boolean isInternal() {
+        return true;
+    }
+
+    @Override
+    public String getName() {
+        return "bruteForceProtector";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return BruteForceProtector.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return BruteForceProtectorFactory.class;
+    }
+
+}

server-spi/src/main/resources/META-INF/services/org.keycloak.provider.Spi

@@ -11,3 +11,8 @@ org.keycloak.events.EventStoreSpi
 org.keycloak.exportimport.ExportSpi
 org.keycloak.exportimport.ImportSpi
 org.keycloak.timer.TimerSpi
+org.keycloak.services.managers.BruteForceProtectorSpi
+org.keycloak.protocol.ClientInstallationSpi
+org.keycloak.protocol.LoginProtocolSpi
+org.keycloak.protocol.ProtocolMapperSpi
+

services/src/main/java/org/keycloak/authentication/AuthenticationProcessor.java

@@ -84,6 +84,13 @@ public AuthenticationProcessor setBrowserFlow(boolean browserFlow) {
         return this;
     }
 
+    public BruteForceProtector getBruteForceProtector() {
+        if (protector == null) {
+            protector = session.getProvider(BruteForceProtector.class);
+        }
+        return protector;
+    }
+
     public RealmModel getRealm() {
         return realm;
     }
@@ -149,11 +156,6 @@ public AuthenticationProcessor setSession(KeycloakSession session) {
         return this;
     }
 
-    public AuthenticationProcessor setProtector(BruteForceProtector protector) {
-        this.protector = protector;
-        return this;
-    }
-
     public AuthenticationProcessor setEventBuilder(EventBuilder eventBuilder) {
         this.event = eventBuilder;
         return this;
@@ -405,7 +407,7 @@ public void attachUserSession(UserSessionModel userSession) {
 
         @Override
         public BruteForceProtector getProtector() {
-            return AuthenticationProcessor.this.protector;
+            return AuthenticationProcessor.this.getBruteForceProtector();
         }
 
         @Override
@@ -571,7 +573,6 @@ public Response handleBrowserException(Exception failure) {
                         .setForwardedSuccessMessage(reset.getSuccessMessage())
                         .setConnection(connection)
                         .setEventBuilder(event)
-                        .setProtector(protector)
                         .setRealm(realm)
                         .setSession(session)
                         .setUriInfo(uriInfo)

services/src/main/java/org/keycloak/protocol/AuthorizationEndpointBase.java

@@ -48,10 +48,9 @@ public abstract class AuthorizationEndpointBase {
     @Context
     protected ClientConnection clientConnection;
 
-    public AuthorizationEndpointBase(RealmModel realm, EventBuilder event, AuthenticationManager authManager) {
+    public AuthorizationEndpointBase(RealmModel realm, EventBuilder event) {
         this.realm = realm;
         this.event = event;
-        this.authManager = authManager;
     }
 
     protected AuthenticationProcessor createProcessor(ClientSessionModel clientSession, String flowId, String flowPath) {
@@ -62,7 +61,6 @@ protected AuthenticationProcessor createProcessor(ClientSessionModel clientSessi
                 .setBrowserFlow(true)
                 .setConnection(clientConnection)
                 .setEventBuilder(event)
-                .setProtector(authManager.getProtector())
                 .setRealm(realm)
                 .setSession(session)
                 .setUriInfo(uriInfo)

services/src/main/java/org/keycloak/protocol/oidc/OIDCLoginProtocolFactory.java

@@ -160,8 +160,8 @@ protected void addDefaults(ClientModel client) {
     }
 
     @Override
-    public Object createProtocolEndpoint(RealmModel realm, EventBuilder event, AuthenticationManager authManager) {
-        return new OIDCLoginProtocolService(realm, event, authManager);
+    public Object createProtocolEndpoint(RealmModel realm, EventBuilder event) {
+        return new OIDCLoginProtocolService(realm, event);
     }
 
     @Override

services/src/main/java/org/keycloak/protocol/oidc/OIDCLoginProtocolService.java

@@ -45,7 +45,6 @@ public class OIDCLoginProtocolService {
     private RealmModel realm;
     private TokenManager tokenManager;
     private EventBuilder event;
-    private AuthenticationManager authManager;
 
     @Context
     private UriInfo uriInfo;
@@ -56,11 +55,10 @@ public class OIDCLoginProtocolService {
     @Context
     private HttpHeaders headers;
 
-    public OIDCLoginProtocolService(RealmModel realm, EventBuilder event, AuthenticationManager authManager) {
+    public OIDCLoginProtocolService(RealmModel realm, EventBuilder event) {
         this.realm = realm;
         this.tokenManager = new TokenManager();
         this.event = event;
-        this.authManager = authManager;
     }
 
     public static UriBuilder tokenServiceBaseUrl(UriInfo uriInfo) {
@@ -117,7 +115,7 @@ public static UriBuilder logoutUrl(UriBuilder baseUriBuilder) {
      */
     @Path("auth")
     public Object auth() {
-        AuthorizationEndpoint endpoint = new AuthorizationEndpoint(authManager, realm, event);
+        AuthorizationEndpoint endpoint = new AuthorizationEndpoint(realm, event);
         ResteasyProviderFactory.getInstance().injectProperties(endpoint);
         return endpoint;
     }
@@ -127,7 +125,7 @@ public Object auth() {
      */
     @Path("registrations")
     public Object registerPage() {
-        AuthorizationEndpoint endpoint = new AuthorizationEndpoint(authManager, realm, event);
+        AuthorizationEndpoint endpoint = new AuthorizationEndpoint(realm, event);
         ResteasyProviderFactory.getInstance().injectProperties(endpoint);
         return endpoint.register();
     }
@@ -137,7 +135,7 @@ public Object registerPage() {
      */
     @Path("forgot-credentials")
     public Object forgotCredentialsPage() {
-        AuthorizationEndpoint endpoint = new AuthorizationEndpoint(authManager, realm, event);
+        AuthorizationEndpoint endpoint = new AuthorizationEndpoint(realm, event);
         ResteasyProviderFactory.getInstance().injectProperties(endpoint);
         return endpoint.forgotCredentials();
     }
@@ -147,15 +145,15 @@ public Object forgotCredentialsPage() {
      */
     @Path("token")
     public Object token() {
-        TokenEndpoint endpoint = new TokenEndpoint(tokenManager, authManager, realm, event);
+        TokenEndpoint endpoint = new TokenEndpoint(tokenManager, realm, event);
         ResteasyProviderFactory.getInstance().injectProperties(endpoint);
         return endpoint;
     }
 
     @Path("login")
     @Deprecated
     public Object loginPage() {
-        AuthorizationEndpoint endpoint = new AuthorizationEndpoint(authManager, realm, event);
+        AuthorizationEndpoint endpoint = new AuthorizationEndpoint(realm, event);
         ResteasyProviderFactory.getInstance().injectProperties(endpoint);
         return endpoint.legacy(OIDCLoginProtocol.CODE_PARAM);
     }
@@ -170,23 +168,23 @@ public Object getLoginStatusIframe() {
     @Path("grants/access")
     @Deprecated
     public Object grantAccessToken() {
-        TokenEndpoint endpoint = new TokenEndpoint(tokenManager, authManager, realm, event);
+        TokenEndpoint endpoint = new TokenEndpoint(tokenManager, realm, event);
         ResteasyProviderFactory.getInstance().injectProperties(endpoint);
         return endpoint.legacy(OAuth2Constants.PASSWORD);
     }
 
     @Path("refresh")
     @Deprecated
     public Object refreshAccessToken() {
-        TokenEndpoint endpoint = new TokenEndpoint(tokenManager, authManager, realm, event);
+        TokenEndpoint endpoint = new TokenEndpoint(tokenManager, realm, event);
         ResteasyProviderFactory.getInstance().injectProperties(endpoint);
         return endpoint.legacy(OAuth2Constants.REFRESH_TOKEN);
     }
 
     @Path("access/codes")
     @Deprecated
     public Object accessCodeToToken() {
-        TokenEndpoint endpoint = new TokenEndpoint(tokenManager, authManager, realm, event);
+        TokenEndpoint endpoint = new TokenEndpoint(tokenManager, realm, event);
         ResteasyProviderFactory.getInstance().injectProperties(endpoint);
         return endpoint.legacy(OAuth2Constants.AUTHORIZATION_CODE);
     }
@@ -225,7 +223,7 @@ public Object issueUserInfo() {
 
     @Path("logout")
     public Object logout() {
-        LogoutEndpoint endpoint = new LogoutEndpoint(tokenManager, authManager, realm, event);
+        LogoutEndpoint endpoint = new LogoutEndpoint(tokenManager, realm, event);
         ResteasyProviderFactory.getInstance().injectProperties(endpoint);
         return endpoint;
     }

services/src/main/java/org/keycloak/protocol/oidc/endpoints/AuthorizationEndpoint.java

@@ -63,8 +63,8 @@ private enum Action {
 
     private String legacyResponseType;
 
-    public AuthorizationEndpoint(AuthenticationManager authManager, RealmModel realm, EventBuilder event) {
-        super(realm, event, authManager);
+    public AuthorizationEndpoint(RealmModel realm, EventBuilder event) {
+        super(realm, event);
         event.event(EventType.LOGIN);
     }
 

services/src/main/java/org/keycloak/protocol/oidc/endpoints/LogoutEndpoint.java

@@ -61,13 +61,11 @@ public class LogoutEndpoint {
     private UriInfo uriInfo;
 
     private TokenManager tokenManager;
-    private AuthenticationManager authManager;
     private RealmModel realm;
     private EventBuilder event;
 
-    public LogoutEndpoint(TokenManager tokenManager, AuthenticationManager authManager, RealmModel realm, EventBuilder event) {
+    public LogoutEndpoint(TokenManager tokenManager, RealmModel realm, EventBuilder event) {
         this.tokenManager = tokenManager;
-        this.authManager = authManager;
         this.realm = realm;
         this.event = event;
     }
@@ -117,7 +115,7 @@ public Response logout(@QueryParam(OIDCLoginProtocol.REDIRECT_URI_PARAM) String
         }
 
         // authenticate identity cookie, but ignore an access token timeout as we're logging out anyways.
-        AuthenticationManager.AuthResult authResult = authManager.authenticateIdentityCookie(session, realm, false);
+        AuthenticationManager.AuthResult authResult = AuthenticationManager.authenticateIdentityCookie(session, realm, false);
         if (authResult != null) {
             userSession = userSession != null ? userSession : authResult.getSession();
             if (redirect != null) userSession.setNote(OIDCLoginProtocol.LOGOUT_REDIRECT_URI, redirect);
@@ -129,7 +127,7 @@ public Response logout(@QueryParam(OIDCLoginProtocol.REDIRECT_URI_PARAM) String
             return response;
         } else if (userSession != null) { // non browser logout
             event.event(EventType.LOGOUT);
-            authManager.backchannelLogout(session, realm, userSession, uriInfo, clientConnection, headers, true);
+            AuthenticationManager.backchannelLogout(session, realm, userSession, uriInfo, clientConnection, headers, true);
             event.user(userSession.getUser()).session(userSession).success();
         }
 
@@ -185,7 +183,7 @@ public Response logoutToken(final @HeaderParam(HttpHeaders.AUTHORIZATION) String
     }
 
     private void logout(UserSessionModel userSession) {
-        authManager.backchannelLogout(session, realm, userSession, uriInfo, clientConnection, headers, true);
+        AuthenticationManager.backchannelLogout(session, realm, userSession, uriInfo, clientConnection, headers, true);
         event.user(userSession.getUser()).session(userSession).success();
     }
 

services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenEndpoint.java

@@ -76,7 +76,6 @@ private enum Action {
     private ClientConnection clientConnection;
 
     private final TokenManager tokenManager;
-    private final AuthenticationManager authManager;
     private final RealmModel realm;
     private final EventBuilder event;
 
@@ -86,9 +85,8 @@ private enum Action {
 
     private String legacyGrantType;
 
-    public TokenEndpoint(TokenManager tokenManager, AuthenticationManager authManager, RealmModel realm, EventBuilder event) {
+    public TokenEndpoint(TokenManager tokenManager, RealmModel realm, EventBuilder event) {
         this.tokenManager = tokenManager;
-        this.authManager = authManager;
         this.realm = realm;
         this.event = event;
     }
@@ -372,7 +370,6 @@ public Response buildResourceOwnerPasswordCredentialsGrant() {
                 .setFlowId(flowId)
                 .setConnection(clientConnection)
                 .setEventBuilder(event)
-                .setProtector(authManager.getProtector())
                 .setRealm(realm)
                 .setSession(session)
                 .setUriInfo(uriInfo)

services/src/main/java/org/keycloak/services/listeners/KeycloakSessionDestroyListener.java

@@ -1,7 +1,6 @@
 package org.keycloak.services.listeners;
 
 import org.keycloak.models.KeycloakSessionFactory;
-import org.keycloak.services.managers.BruteForceProtector;
 
 import javax.servlet.ServletContextEvent;
 import javax.servlet.ServletContextListener;
@@ -17,10 +16,6 @@ public void contextInitialized(ServletContextEvent sce) {
 
     @Override
     public void contextDestroyed(ServletContextEvent sce) {
-        BruteForceProtector protector = (BruteForceProtector) sce.getServletContext().getAttribute(BruteForceProtector.class.getName());
-        if (protector != null) {
-            protector.shutdown();
-        }
         KeycloakSessionFactory sessionFactory = (KeycloakSessionFactory) sce.getServletContext().getAttribute(KeycloakSessionFactory.class.getName());
         if (sessionFactory != null) {
             sessionFactory.close();