agave-systems/systems-core/src/main/java/org/iplantc/service/transfer/sftp/SftpRelay.java
/**
     * Given an ssh client perform authentication via PKI or password.
     * On return ssh2Client.isAuthenticated() will always be true.
     * If authentication fails then throw recoverable.AuthenticationException
     *
     * @param ssh2Client
     * @param username
     * @param publicKey
     * @param privateKey
     * @param password
     * @param host
     * @param port
     * @param proxyHost  - needed for capturing state in case of recoverable error
     * @param proxyPort  - needed for capturing state in case of recoverable error
     * @param msgPrefix
     * @param isProxy    - Used for logging only
     * @return
     * @throws Exception
     */
Given an ssh client perform authentication via PKI or password.
On return ssh2Client.isAuthenticated() will always be true.
If authentication fails then throw recoverable.AuthenticationException


Given an ssh client perform authentication via PKI or password . On return ssh2Client . isAuthenticated () will always be true . If authentication fails then throw recoverable . AuthenticationException
public SshAuthentication authenticateByPKIOrPassword(Ssh2Client ssh2Client, String username,
                                                         String publicKey, String privateKey, String password,
                                                         String host, int port, String proxyHost, int proxyPort,
                                                         String msgPrefix, boolean isProxy)
            throws AuthenticationException {
        SshAuthentication retAuth;
        String[] authenticationMethods;
        try {
            authenticationMethods = ssh2Client.getAuthenticationMethods(username);
        } catch (Exception e) {
            String msg = String.format("Failure to get ssh2 authentication methods for %s : %s", msgPrefix, e.getMessage());
            log.error(msg);
            throw new AuthenticationException(e.getMessage(), e);
        }
        int authStatus;
        if (!StringUtils.isEmpty(publicKey) && !StringUtils.isEmpty(privateKey)) {
            retAuth = new Ssh2PublicKeyAuthentication();
            SshPrivateKeyFile pkfile;
            try {
                pkfile = SshPrivateKeyFileFactory.parse(privateKey.getBytes());
            } catch (Exception e) {
                String msg = String.format("Failure to parse private key for %s : %s", msgPrefix, e.getMessage());
                log.error(msg);
                throw new AuthenticationException(e.getMessage(), e);
            }
            SshKeyPair pair;
            try {
                if (pkfile.isPassphraseProtected()) {
                    pair = pkfile.toKeyPair(password);
                } else {
                    pair = pkfile.toKeyPair(null);
                }
            } catch (Exception e) {
                String msg = String.format("Failed to create key pair for %s : %s", msgPrefix, e.getMessage());
                log.error(msg);
                throw new AuthenticationException(e.getMessage(), e);
            }
            ((PublicKeyAuthentication) retAuth).setPrivateKey(pair.getPrivateKey());
            ((PublicKeyAuthentication) retAuth).setPublicKey(pair.getPublicKey());
            do {
                try {
                    authStatus = ssh2Client.authenticate(retAuth);
                } catch (Exception e) {
                    String msg;
                    if (!isProxy) {
                        msg = String.format("Failure to authenticate using key pair for %s : %s", msgPrefix, e.getMessage());
                    } else {
                        msg = String.format("Failure to authenticate using proxy for %s : %s", msgPrefix, e.getMessage());
                    }
                    log.error(msg, e);
                    AuthenticationException rex = new AuthenticationException(e.getMessage(), e);
                    throw rex;
                }
                if (authStatus == SshAuthentication.FURTHER_AUTHENTICATION_REQUIRED &&
                        Arrays.asList(authenticationMethods).contains("keyboard-interactive")) {
                    String msg = String.format("Starting PKI multifactor authentication for user: %s host: %s port: %d", username, host, port);
                    log.trace(msg);
                    KBIAuthentication kbi = new KBIAuthentication();
                    kbi.setUsername(username);
                    kbi.setKBIRequestHandler(new MultiFactorKBIRequestHandler(password, null, username, host, port));
                    try {
                        authStatus = ssh2Client.authenticate(kbi);
                        msg = String.format("Multifactor authentication threw no exceptions for user: %s host: %s port: %d", username, host, port);
                        log.trace(msg);
                    } catch (Exception e) {
                        msg = String.format("Failure to MFA authenticate using key pair for %s : %s", msgPrefix, e.getMessage());
                        log.error(msg);
                        throw new AuthenticationException(e.getMessage(), e);
                    }
                }
            } while (authStatus != SshAuthentication.COMPLETE
                    && authStatus != SshAuthentication.FAILED
                    && authStatus != SshAuthentication.CANCELLED
                    && ssh2Client.isConnected());
        } else {
             the user using password authentication
            retAuth = new PasswordAuthentication();
            do {
                ((PasswordAuthentication) retAuth).setPassword(password);
                retAuth = checkForPasswordOverKBI(retAuth, authenticationMethods, username, password, host, port);
                boolean isMFA = !(retAuth instanceof PasswordAuthentication);
                try {
                    authStatus = ssh2Client.authenticate(retAuth);
                    if (isMFA) {
                        String msg = String.format("Multifactor authentication threw no exceptions for user: %s host: %s port: %d ", username, host, port);
                        log.trace(msg);
                    }
                } catch (Exception e) {
                    String msg;
                    if (isMFA) {
                        msg = String.format("Failure to MFA authenticate using password for %s : %s", msgPrefix, e.getMessage());
                    } else if (!isProxy) {
                        msg = String.format("Failure to authenticate using password for %s : %s", msgPrefix, e.getMessage());
                    } else {
                        msg = String.format("Failure to authenticate using proxy for %s : %s", msgPrefix, e.getMessage());
                    }
                    log.error(msg);
                    throw new AuthenticationException(e.getMessage(), e);
                }
            }
            while (authStatus != SshAuthentication.COMPLETE
                    && authStatus != SshAuthentication.FAILED
                    && authStatus != SshAuthentication.CANCELLED
                    && ssh2Client.isConnected());
        }
        if (!ssh2Client.isAuthenticated()) {
            String msg = String.format("Authentication failed with session left in state \"%s\" for %s", msgPrefix,
                    getAuthStateText(authStatus));
            throw new AuthenticationException(msg);
        }
        return retAuth;
    }
public SshAuthentication authenticateByPKIOrPassword ( Ssh2Client ssh2Client , String username , String publicKey , String privateKey , String password , String host , int port , String proxyHost , int proxyPort , String msgPrefix , boolean isProxy ) throws AuthenticationException { SshAuthentication retAuth ; String [ ] authenticationMethods ; try { authenticationMethods = ssh2Client . getAuthenticationMethods ( username ) ; } catch ( Exception e ) { String msg = String . format ( "Failure to get ssh2 authentication methods for %s : %s" , msgPrefix , e . getMessage ( ) ) ; log . error ( msg ) ; throw new AuthenticationException ( e . getMessage ( ) , e ) ; } int authStatus ; if ( ! StringUtils . isEmpty ( publicKey ) && ! StringUtils . isEmpty ( privateKey ) ) { retAuth = new Ssh2PublicKeyAuthentication ( ) ; SshPrivateKeyFile pkfile ; try { pkfile = SshPrivateKeyFileFactory . parse ( privateKey . getBytes ( ) ) ; } catch ( Exception e ) { String msg = String . format ( "Failure to parse private key for %s : %s" , msgPrefix , e . getMessage ( ) ) ; log . error ( msg ) ; throw new AuthenticationException ( e . getMessage ( ) , e ) ; } SshKeyPair pair ; try { if ( pkfile . isPassphraseProtected ( ) ) { pair = pkfile . toKeyPair ( password ) ; } else { pair = pkfile . toKeyPair ( null ) ; } } catch ( Exception e ) { String msg = String . format ( "Failed to create key pair for %s : %s" , msgPrefix , e . getMessage ( ) ) ; log . error ( msg ) ; throw new AuthenticationException ( e . getMessage ( ) , e ) ; } ( ( PublicKeyAuthentication ) retAuth ) . setPrivateKey ( pair . getPrivateKey ( ) ) ; ( ( PublicKeyAuthentication ) retAuth ) . setPublicKey ( pair . getPublicKey ( ) ) ; do { try { authStatus = ssh2Client . authenticate ( retAuth ) ; } catch ( Exception e ) { String msg ; if ( ! isProxy ) { msg = String . format ( "Failure to authenticate using key pair for %s : %s" , msgPrefix , e . getMessage ( ) ) ; } else { msg = String . format ( "Failure to authenticate using proxy for %s : %s" , msgPrefix , e . getMessage ( ) ) ; } log . error ( msg , e ) ; AuthenticationException rex = new AuthenticationException ( e . getMessage ( ) , e ) ; throw rex ; } if ( authStatus == SshAuthentication . FURTHER_AUTHENTICATION_REQUIRED && Arrays . asList ( authenticationMethods ) . contains ( "keyboard-interactive" ) ) { String msg = String . format ( "Starting PKI multifactor authentication for user: %s host: %s port: %d" , username , host , port ) ; log . trace ( msg ) ; KBIAuthentication kbi = new KBIAuthentication ( ) ; kbi . setUsername ( username ) ; kbi . setKBIRequestHandler ( new MultiFactorKBIRequestHandler ( password , null , username , host , port ) ) ; try { authStatus = ssh2Client . authenticate ( kbi ) ; msg = String . format ( "Multifactor authentication threw no exceptions for user: %s host: %s port: %d" , username , host , port ) ; log . trace ( msg ) ; } catch ( Exception e ) { msg = String . format ( "Failure to MFA authenticate using key pair for %s : %s" , msgPrefix , e . getMessage ( ) ) ; log . error ( msg ) ; throw new AuthenticationException ( e . getMessage ( ) , e ) ; } } } while ( authStatus != SshAuthentication . COMPLETE && authStatus != SshAuthentication . FAILED && authStatus != SshAuthentication . CANCELLED && ssh2Client . isConnected ( ) ) ; } else { retAuth = new PasswordAuthentication ( ) ; do { ( ( PasswordAuthentication ) retAuth ) . setPassword ( password ) ; retAuth = checkForPasswordOverKBI ( retAuth , authenticationMethods , username , password , host , port ) ; boolean isMFA = ! ( retAuth instanceof PasswordAuthentication ) ; try { authStatus = ssh2Client . authenticate ( retAuth ) ; if ( isMFA ) { String msg = String . format ( "Multifactor authentication threw no exceptions for user: %s host: %s port: %d " , username , host , port ) ; log . trace ( msg ) ; } } catch ( Exception e ) { String msg ; if ( isMFA ) { msg = String . format ( "Failure to MFA authenticate using password for %s : %s" , msgPrefix , e . getMessage ( ) ) ; } else if ( ! isProxy ) { msg = String . format ( "Failure to authenticate using password for %s : %s" , msgPrefix , e . getMessage ( ) ) ; } else { msg = String . format ( "Failure to authenticate using proxy for %s : %s" , msgPrefix , e . getMessage ( ) ) ; } log . error ( msg ) ; throw new AuthenticationException ( e . getMessage ( ) , e ) ; } } while ( authStatus != SshAuthentication . COMPLETE && authStatus != SshAuthentication . FAILED && authStatus != SshAuthentication . CANCELLED && ssh2Client . isConnected ( ) ) ; } if ( ! ssh2Client . isAuthenticated ( ) ) { String msg = String . format ( "Authentication failed with session left in state \"%s\" for %s" , msgPrefix , getAuthStateText ( authStatus ) ) ; throw new AuthenticationException ( msg ) ; } return retAuth ; }
Given an ssh client perform authentication via PKI or password.
Given an ssh client perform authentication via PKI or password .
// Authenticate the user using pki authentication // Create the key pair // Assign keys to auth object // Authenticate // Try to handle interactive session // Starting PKI multifactor authentication for user: <username> host: <host> port: <port> // Set up MFA request handler // Multifactor authentication threw no exceptions for user: {0} host: {1} port: {2} // Authenticate the user using password authentication // Multifactor authentication threw no exceptions for user: {0} host: {1} port: {2} // If auth has failed log a message and throw recoverable exception //            log.error(msg);