/*
 * Decompiled with CFR 0.152.
 * 
 * Could not load the following classes:
 *  com.l7tech.common.protocol.SecureSpanConstants
 *  com.l7tech.common.protocol.SecureSpanConstants$HttpHeaders
 *  com.l7tech.gateway.common.audit.AssertionMessages
 *  com.l7tech.gateway.common.audit.AuditDetailMessage
 *  com.l7tech.identity.AuthenticationException
 *  com.l7tech.identity.IdentityProvider
 *  com.l7tech.identity.InvalidClientCertificateException
 *  com.l7tech.identity.MissingCredentialsException
 *  com.l7tech.identity.User
 *  com.l7tech.message.HeadersKnob
 *  com.l7tech.message.Message
 *  com.l7tech.objectmodel.FindException
 *  com.l7tech.objectmodel.Goid
 *  com.l7tech.objectmodel.ObjectNotFoundException
 *  com.l7tech.policy.assertion.AssertionStatus
 *  com.l7tech.policy.assertion.credential.LoginCredentials
 *  com.l7tech.policy.assertion.identity.IdentityAssertion
 *  com.l7tech.policy.assertion.identity.MemberOfGroup
 *  com.l7tech.policy.assertion.identity.SpecificUser
 *  com.l7tech.util.ExceptionUtils
 *  com.l7tech.util.Pair
 *  org.springframework.context.ApplicationContext
 */
package com.l7tech.server.policy.assertion.identity;

import com.l7tech.common.protocol.SecureSpanConstants;
import com.l7tech.gateway.common.audit.AssertionMessages;
import com.l7tech.gateway.common.audit.AuditDetailMessage;
import com.l7tech.identity.AuthenticationException;
import com.l7tech.identity.IdentityProvider;
import com.l7tech.identity.InvalidClientCertificateException;
import com.l7tech.identity.MissingCredentialsException;
import com.l7tech.identity.User;
import com.l7tech.message.HeadersKnob;
import com.l7tech.message.Message;
import com.l7tech.objectmodel.FindException;
import com.l7tech.objectmodel.Goid;
import com.l7tech.objectmodel.ObjectNotFoundException;
import com.l7tech.policy.assertion.AssertionStatus;
import com.l7tech.policy.assertion.credential.LoginCredentials;
import com.l7tech.policy.assertion.identity.IdentityAssertion;
import com.l7tech.policy.assertion.identity.MemberOfGroup;
import com.l7tech.policy.assertion.identity.SpecificUser;
import com.l7tech.server.identity.AuthCache;
import com.l7tech.server.identity.AuthenticationResult;
import com.l7tech.server.identity.IdentityProviderFactory;
import com.l7tech.server.message.AuthenticationContext;
import com.l7tech.server.message.PolicyEnforcementContext;
import com.l7tech.server.policy.assertion.AbstractMessageTargetableServerAssertion;
import com.l7tech.util.ExceptionUtils;
import com.l7tech.util.Pair;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.List;
import java.util.logging.Level;
import org.springframework.context.ApplicationContext;

public abstract class ServerIdentityAssertion<AT extends IdentityAssertion>
extends AbstractMessageTargetableServerAssertion<AT> {
    private final IdentityProviderFactory d;
    private static final String[] h;

    public ServerIdentityAssertion(AT AT, ApplicationContext applicationContext) {
        super(AT);
        if (applicationContext == null) {
            String[] stringArray = h;
            throw new IllegalArgumentException(stringArray[10]);
        }
        this.d = (IdentityProviderFactory)applicationContext.getBean(h[0], IdentityProviderFactory.class);
    }

    /*
     * Could not resolve type clashes
     * Loose catch block
     */
    @Override
    protected AssertionStatus doCheckRequest(PolicyEnforcementContext policyEnforcementContext, Message message, String string, AuthenticationContext authenticationContext) {
        IdentityProvider identityProvider;
        AssertionStatus assertionStatus;
        List list;
        ArrayList<Pair<LoginCredentials, AuthenticationException>> arrayList;
        block47: {
            block46: {
                block42: {
                    block43: {
                        block44: {
                            arrayList = new ArrayList<Pair<LoginCredentials, AuthenticationException>>();
                            list = authenticationContext.getCredentials();
                            if (list.size() >= 1) break block42;
                            if (authenticationContext.getLastAuthenticatedUser() != null) break block42;
                            break block44;
                            catch (ObjectNotFoundException objectNotFoundException) {
                                throw ServerIdentityAssertion.a((Exception)((Object)objectNotFoundException));
                            }
                        }
                        try {
                            block45: {
                                if (!authenticationContext.isAuthenticated()) break block43;
                                break block45;
                                catch (ObjectNotFoundException objectNotFoundException) {
                                    throw ServerIdentityAssertion.a((Exception)((Object)objectNotFoundException));
                                }
                            }
                            this.logAndAudit((AuditDetailMessage)AssertionMessages.IDENTITY_AUTHENTICATED_NO_CREDS, string);
                            throw new IllegalStateException(h[2]);
                        }
                        catch (ObjectNotFoundException objectNotFoundException) {
                            throw ServerIdentityAssertion.a((Exception)((Object)objectNotFoundException));
                        }
                    }
                    try {
                        if (this.isRequest()) {
                            policyEnforcementContext.setAuthenticationMissing();
                        }
                    }
                    catch (ObjectNotFoundException objectNotFoundException) {
                        throw ServerIdentityAssertion.a((Exception)((Object)objectNotFoundException));
                    }
                    this.logAndAudit((AuditDetailMessage)AssertionMessages.IDENTITY_NO_CREDS);
                    return AssertionStatus.AUTH_REQUIRED;
                }
                try {
                    if (Goid.isDefault((Goid)((IdentityAssertion)this.assertion).getIdentityProviderOid())) {
                        this.logAndAudit((AuditDetailMessage)AssertionMessages.IDENTITY_PROVIDER_NOT_SET);
                        throw new IllegalStateException(h[7]);
                    }
                }
                catch (ObjectNotFoundException objectNotFoundException) {
                    throw ServerIdentityAssertion.a((Exception)((Object)objectNotFoundException));
                }
                assertionStatus = AssertionStatus.UNDEFINED;
                try {
                    identityProvider = this.getIdentityProvider();
                }
                catch (ObjectNotFoundException objectNotFoundException) {
                    this.logAndAudit((AuditDetailMessage)AssertionMessages.IDENTITY_PROVIDER_NOT_EXIST, new String[]{ExceptionUtils.getMessage((Throwable)objectNotFoundException)}, ExceptionUtils.getDebugException((Throwable)objectNotFoundException));
                    return AssertionStatus.AUTH_FAILED;
                }
                catch (FindException findException) {
                    this.logAndAudit((AuditDetailMessage)AssertionMessages.IDENTITY_PROVIDER_NOT_FOUND, new String[]{ExceptionUtils.getMessage((Throwable)findException)}, ExceptionUtils.getDebugException((Throwable)findException));
                    return AssertionStatus.AUTH_FAILED;
                }
                if (((IdentityAssertion)this.assertion).getIdentityTag() != null) break block46;
                for (Object object : authenticationContext.getUntaggedAuthenticationResults()) {
                    assertionStatus = this.checkUser((AuthenticationResult)object);
                    try {
                        if (!this.a(assertionStatus)) continue;
                        authenticationContext.tagAuthenticationResult((AuthenticationResult)object, "");
                        return assertionStatus;
                    }
                    catch (ObjectNotFoundException objectNotFoundException) {
                        throw ServerIdentityAssertion.a((Exception)((Object)objectNotFoundException));
                    }
                }
                break block47;
            }
            AuthenticationResult authenticationResult = authenticationContext.getAuthenticationResultForTag(((IdentityAssertion)this.assertion).getIdentityTag());
            if (authenticationResult != null) {
                assertionStatus = this.checkUser(authenticationResult);
                try {
                    if (this.a(assertionStatus)) {
                        return assertionStatus;
                    }
                }
                catch (ObjectNotFoundException objectNotFoundException) {
                    throw ServerIdentityAssertion.a((Exception)((Object)objectNotFoundException));
                }
            }
            for (AuthenticationResult authenticationResult2 : authenticationContext.getUntaggedAuthenticationResults()) {
                assertionStatus = this.checkUser(authenticationResult2);
                if (!this.a(assertionStatus)) continue;
                try {
                    block48: {
                        if (!authenticationContext.tagAuthenticationResult(authenticationResult2, ((IdentityAssertion)this.assertion).getIdentityTag())) continue;
                        break block48;
                        catch (ObjectNotFoundException objectNotFoundException) {
                            throw ServerIdentityAssertion.a((Exception)((Object)objectNotFoundException));
                        }
                    }
                    return assertionStatus;
                }
                catch (ObjectNotFoundException objectNotFoundException) {
                    throw ServerIdentityAssertion.a((Exception)((Object)objectNotFoundException));
                }
            }
        }
        for (Object object : list) {
            try {
                if (authenticationContext.isSecurityTokenUsed(object.getSecurityToken(), ((IdentityAssertion)this.assertion).getIdentityProviderOid())) {
                    continue;
                }
            }
            catch (ObjectNotFoundException objectNotFoundException) {
                throw ServerIdentityAssertion.a((Exception)((Object)objectNotFoundException));
            }
            try {
                assertionStatus = this.validateCredentials(identityProvider, (LoginCredentials)object, policyEnforcementContext, authenticationContext);
                if (!this.a(assertionStatus)) continue;
                return assertionStatus;
            }
            catch (InvalidClientCertificateException invalidClientCertificateException) {
                this.logAndAudit((AuditDetailMessage)AssertionMessages.IDENTITY_INVALID_CERT, object.getLogin());
                if (this.isRequest()) {
                    HeadersKnob headersKnob = (HeadersKnob)policyEnforcementContext.getResponse().getKnob(HeadersKnob.class);
                    try {
                        if (headersKnob != null) {
                            headersKnob.addHeader(SecureSpanConstants.HttpHeaders.CERT_STATUS, (Object)SecureSpanConstants.CERT_INVALID, h[12]);
                        }
                    }
                    catch (ObjectNotFoundException objectNotFoundException) {
                        throw ServerIdentityAssertion.a((Exception)((Object)objectNotFoundException));
                    }
                }
                assertionStatus = this.a((LoginCredentials)object, (Exception)((Object)invalidClientCertificateException));
            }
            catch (MissingCredentialsException missingCredentialsException) {
                try {
                    if (this.isRequest()) {
                        policyEnforcementContext.setAuthenticationMissing();
                    }
                }
                catch (ObjectNotFoundException objectNotFoundException) {
                    throw ServerIdentityAssertion.a((Exception)((Object)objectNotFoundException));
                }
                assertionStatus = this.a((LoginCredentials)object, (Exception)((Object)missingCredentialsException));
            }
            catch (AuthenticationException authenticationException) {
                this.logAndAudit((AuditDetailMessage)AssertionMessages.IDENTITY_CREDENTIAL_FAILED, object.getLogin(), ExceptionUtils.getMessage((Throwable)authenticationException));
                assertionStatus = this.a((LoginCredentials)object, (Exception)((Object)authenticationException));
                arrayList.add((Pair<LoginCredentials, AuthenticationException>)new Pair(object, (Object)authenticationException));
            }
        }
        this.logAndAudit((AuditDetailMessage)AssertionMessages.IDENTITY_AUTHENTICATION_FAILED, ((IdentityAssertion)this.assertion).loggingIdentity());
        this.processAuthFailure(policyEnforcementContext, arrayList);
        return assertionStatus;
    }

    protected AssertionStatus validateCredentials(IdentityProvider identityProvider, LoginCredentials loginCredentials, PolicyEnforcementContext policyEnforcementContext, AuthenticationContext authenticationContext) throws AuthenticationException {
        AssertionStatus assertionStatus;
        block18: {
            String string;
            AuthenticationResult authenticationResult;
            AuthenticationContext authenticationContext2;
            block20: {
                block19: {
                    String string2;
                    User user;
                    AuthenticationResult authenticationResult2;
                    block17: {
                        block16: {
                            authenticationResult2 = AuthCache.getInstance().getCachedAuthResult(loginCredentials, identityProvider, authenticationContext.getAuthSuccessCacheTime(), authenticationContext.getAuthFailureCacheTime());
                            try {
                                try {
                                    if (authenticationResult2 != null && authenticationResult2.getUser() != null) break block16;
                                }
                                catch (AuthenticationException authenticationException) {
                                    throw ServerIdentityAssertion.a((Exception)((Object)authenticationException));
                                }
                                this.logAndAudit((AuditDetailMessage)AssertionMessages.IDENTITY_CREDENTIAL_FAILED, loginCredentials.getLogin(), h[8]);
                                return this.a(loginCredentials, null);
                            }
                            catch (AuthenticationException authenticationException) {
                                throw ServerIdentityAssertion.a((Exception)((Object)authenticationException));
                            }
                        }
                        try {
                            if (!authenticationResult2.isCertSignedByStaleCA() || !this.isRequest()) break block17;
                        }
                        catch (AuthenticationException authenticationException) {
                            throw ServerIdentityAssertion.a((Exception)((Object)authenticationException));
                        }
                        user = (HeadersKnob)policyEnforcementContext.getResponse().getKnob(HeadersKnob.class);
                        try {
                            if (user != null) {
                                user.setHeader(SecureSpanConstants.HttpHeaders.CERT_STATUS, (Object)SecureSpanConstants.CERT_STALE, h[11]);
                            }
                        }
                        catch (AuthenticationException authenticationException) {
                            throw ServerIdentityAssertion.a((Exception)((Object)authenticationException));
                        }
                    }
                    if ((string2 = (user = authenticationResult2.getUser()).getLogin()) == null) {
                        string2 = user.getName();
                    }
                    if (string2 == null) {
                        string2 = user.getSubjectDn();
                    }
                    if (string2 == null) {
                        string2 = user.getId();
                    }
                    authenticationContext.addAuthenticationResult(authenticationResult2);
                    this.logAndAudit((AuditDetailMessage)AssertionMessages.IDENTITY_AUTHENTICATED, string2);
                    assertionStatus = this.checkUser(authenticationResult2);
                    try {
                        try {
                            if (!this.a(assertionStatus)) break block18;
                            authenticationContext2 = authenticationContext;
                            authenticationResult = authenticationResult2;
                            if (((IdentityAssertion)this.assertion).getIdentityTag() != null) break block19;
                        }
                        catch (AuthenticationException authenticationException) {
                            throw ServerIdentityAssertion.a((Exception)((Object)authenticationException));
                        }
                        string = "";
                        break block20;
                    }
                    catch (AuthenticationException authenticationException) {
                        throw ServerIdentityAssertion.a((Exception)((Object)authenticationException));
                    }
                }
                string = ((IdentityAssertion)this.assertion).getIdentityTag();
            }
            authenticationContext2.tagAuthenticationResult(authenticationResult, string);
        }
        return assertionStatus;
    }

    private boolean a(AssertionStatus assertionStatus) {
        return AssertionStatus.NONE.equals(assertionStatus);
    }

    private AssertionStatus a(LoginCredentials loginCredentials, Exception exception) {
        block9: {
            Object object;
            String string;
            String[] stringArray;
            block10: {
                block8: {
                    block7: {
                        stringArray = h;
                        this.logger.log(Level.FINE, stringArray[5], exception);
                        string = loginCredentials.getLogin();
                        try {
                            if (string != null && string.length() != 0) break block7;
                        }
                        catch (IllegalArgumentException illegalArgumentException) {
                            throw ServerIdentityAssertion.a(illegalArgumentException);
                        }
                        object = loginCredentials.getClientCert();
                        if (object != null) {
                            string = ((X509Certificate)object).getSubjectDN().getName();
                        }
                    }
                    object = ((IdentityAssertion)this.assertion).loggingIdentity();
                    try {
                        if (!(this.assertion instanceof MemberOfGroup)) break block8;
                        this.logger.info(h[1] + (String)object + h[4] + string);
                        break block9;
                    }
                    catch (IllegalArgumentException illegalArgumentException) {
                        throw ServerIdentityAssertion.a(illegalArgumentException);
                    }
                }
                try {
                    if (!(this.assertion instanceof SpecificUser)) break block10;
                    this.logger.info(h[13] + (String)object + h[3] + string);
                    break block9;
                }
                catch (IllegalArgumentException illegalArgumentException) {
                    throw ServerIdentityAssertion.a(illegalArgumentException);
                }
            }
            stringArray = h;
            this.logger.info(stringArray[6] + (String)object + stringArray[3] + string);
        }
        return AssertionStatus.AUTH_FAILED;
    }

    protected IdentityProvider getIdentityProvider() throws FindException {
        IdentityProvider identityProvider = this.d.getProvider(((IdentityAssertion)this.assertion).getIdentityProviderOid());
        try {
            if (identityProvider == null) {
                throw new ObjectNotFoundException(h[9]);
            }
        }
        catch (FindException findException) {
            throw ServerIdentityAssertion.a((Exception)((Object)findException));
        }
        return identityProvider;
    }

    protected abstract AssertionStatus checkUser(AuthenticationResult var1);

    protected void processAuthFailure(PolicyEnforcementContext policyEnforcementContext, List<Pair<LoginCredentials, AuthenticationException>> list) {
    }

    private static Exception a(Exception exception) {
        return exception;
    }

    /*
     * Unable to fully structure code
     */
    static {
        block10: {
            block9: {
                var5 = new String[14];
                var3_1 = 0;
                var2_2 = "JYP:7\u0004CZmG;5\u0004SFOs5 \u0019XQD%@R@8'MYLI\u0015\"&\u001f^ED\u00159&\u0000UFOF<*\u001d\u0017L[\u001531\u0002BS\u001d=qXD!&\u001eC\u0003TFt\"\u0018CKX[ *\u000eVWXQt!\u0018C\u0003OP%6\bDW\u001d]50MYL\u001dy;$\u0004Y`OP0&\u0003CJ\\Y'b\u0017\u0003J\\ +MTQXQ1-\u0019^BQFt%\u001fXN\u001d\u0017\u0003J\\ +MTQXQ1-\u0019^BQFt%\u001fXN\u001d\u001epXG\"&\u001f~GX[ *\u0019NbNF11\u0019^LS\u00152\"\u0004[FY\u0011@R@8'MYLI\u0015\"&\u001f^ED\u0015J`\\[s7MTBQYt \u0005R@Vg12\u0018RPI\u001d}c\u001a_FS\u0015:,MABQ\\0c\u0004SFSA=7\u0014gQRC='\bEdR\\0c\u0005VP\u001dW1&\u0003\u0017PXAu\u001evNP&c\u0003XW\u001dS;6\u0003S\u0003[Z&c\u000eEFYP:7\u0004VONBJY\u001550\u001eRQI\\;-MEF[P&0MCL\u001dT:c\u0004S\u0003MG;5\u0004SFO\u0015#+\u0004TK\u001dQ;&\u001e\u0017MRAt&\u0015^PI\u00155-\u0014ZLOP\u001fbME8*\u000eVWTZ:c.XMIP,7M^P\u001dG12\u0018^QXQ\u000bkia\u0004c%RBYP&";
                var4_3 = "JYP:7\u0004CZmG;5\u0004SFOs5 \u0019XQD%@R@8'MYLI\u0015\"&\u001f^ED\u00159&\u0000UFOF<*\u001d\u0017L[\u001531\u0002BS\u001d=qXD!&\u001eC\u0003TFt\"\u0018CKX[ *\u000eVWXQt!\u0018C\u0003OP%6\bDW\u001d]50MYL\u001dy;$\u0004Y`OP0&\u0003CJ\\Y'b\u0017\u0003J\\ +MTQXQ1-\u0019^BQFt%\u001fXN\u001d\u0017\u0003J\\ +MTQXQ1-\u0019^BQFt%\u001fXN\u001d\u001epXG\"&\u001f~GX[ *\u0019NbNF11\u0019^LS\u00152\"\u0004[FY\u0011@R@8'MYLI\u0015\"&\u001f^ED\u0015J`\\[s7MTBQYt \u0005R@Vg12\u0018RPI\u001d}c\u001a_FS\u0015:,MABQ\\0c\u0004SFSA=7\u0014gQRC='\bEdR\\0c\u0005VP\u001dW1&\u0003\u0017PXAu\u001evNP&c\u0003XW\u001dS;6\u0003S\u0003[Z&c\u000eEFYP:7\u0004VONBJY\u001550\u001eRQI\\;-MEF[P&0MCL\u001dT:c\u0004S\u0003MG;5\u0004SFO\u0015#+\u0004TK\u001dQ;&\u001e\u0017MRAt&\u0015^PI\u00155-\u0014ZLOP\u001fbME8*\u000eVWTZ:c.XMIP,7M^P\u001dG12\u0018^QXQ\u000bkia\u0004c%RBYP&".length();
                var1_4 = 23;
                var0_5 = -1;
lbl7:
                // 2 sources

                while (true) {
                    v0 = 91;
                    v1 = ++var0_5;
                    v2 = var2_2.substring(v1, v1 + var1_4);
                    v3 = -1;
                    break block9;
                    break;
                }
lbl13:
                // 1 sources

                while (true) {
                    var5[var3_1++] = ServerIdentityAssertion.c(v0, ServerIdentityAssertion.a(v2));
                    if ((var0_5 += var1_4) < var4_3) {
                        var1_4 = var2_2.charAt(var0_5);
                        ** continue;
                    }
                    var2_2 = "FDL)N\b\u007fot}\u000b\u001am\u007fm\u0015\n`tad8\u000f\u000b2shi8\u0010\n%tzyl\u0000N";
                    var4_3 = "FDL)N\b\u007fot}\u000b\u001am\u007fm\u0015\n`tad8\u000f\u000b2shi8\u0010\n%tzyl\u0000N".length();
                    var1_4 = 11;
                    var0_5 = -1;
lbl22:
                    // 2 sources

                    while (true) {
                        v0 = 118;
                        v4 = ++var0_5;
                        v2 = var2_2.substring(v4, v4 + var1_4);
                        v3 = 0;
                        break block9;
                        break;
                    }
                    break;
                }
lbl28:
                // 1 sources

                while (true) {
                    var5[var3_1++] = ServerIdentityAssertion.c(v0, ServerIdentityAssertion.a(v2));
                    if ((var0_5 += var1_4) < var4_3) {
                        var1_4 = var2_2.charAt(var0_5);
                        ** continue;
                    }
                    break block10;
                    break;
                }
            }
            switch (v3) {
                default: {
                    ** continue;
                }
                ** case 0:
lbl39:
                // 1 sources

                ** continue;
            }
        }
        ServerIdentityAssertion.h = var5;
    }

    private static char[] a(String string) {
        char[] cArray = string.toCharArray();
        if (cArray.length < 2) {
            cArray = cArray;
            cArray[0] = (char)(cArray[0] ^ 0x6C);
        }
        return cArray;
    }

    /*
     * Handled impossible loop by duplicating code
     * Enabled aggressive block sorting
     */
    private static String c(int n2, char[] cArray) {
        char[] cArray2;
        block11: {
            int n3;
            int n4;
            int n5;
            block10: {
                n5 = n2;
                cArray2 = cArray;
                n4 = cArray.length;
                n3 = 0;
                if (!true) break block10;
                n4 = n4;
                if (n4 <= n3) break block11;
            }
            do {
                n5 = n5;
                cArray2 = cArray2;
                int n6 = n3;
                cArray2[n6] = (char)(cArray2[n6] ^ (n5 ^ (switch (n3 % 7) {
                    case 0 -> 120;
                    case 1 -> 102;
                    case 2 -> 110;
                    case 3 -> 15;
                    case 4 -> 24;
                    case 5 -> 54;
                    default -> 108;
                })));
                ++n3;
                n4 = n4;
            } while (n4 > n3);
        }
        return new String(cArray2).intern();
    }
}