package com.l7tech.server.identity.fed;

import com.l7tech.common.io.CertUtils;
import com.l7tech.identity.AuthenticationException;
import com.l7tech.identity.BadCredentialsException;
import com.l7tech.identity.IdentityProviderConfig;
import com.l7tech.identity.InvalidIdProviderCfgException;
import com.l7tech.identity.User;
import com.l7tech.identity.cert.ClientCertManager.VetoSave;
import com.l7tech.identity.fed.FederatedGroup;
import com.l7tech.identity.fed.FederatedIdentityProviderConfig;
import com.l7tech.identity.fed.FederatedUser;
import com.l7tech.objectmodel.FindException;
import com.l7tech.objectmodel.Goid;
import com.l7tech.policy.assertion.credential.CredentialFormat;
import com.l7tech.policy.assertion.credential.LoginCredentials;
import com.l7tech.security.cert.CertVerifier;
import com.l7tech.security.cert.TrustedCert;
import com.l7tech.security.cert.TrustedCertManager;
import com.l7tech.security.cert.TrustedCert.TrustedFor;
import com.l7tech.security.token.SecurityToken;
import com.l7tech.security.token.SessionSecurityToken;
import com.l7tech.server.audit.Auditor;
import com.l7tech.server.identity.AuthenticationResult;
import com.l7tech.server.identity.ConfigurableIdentityProvider;
import com.l7tech.server.identity.PersistentIdentityProviderImpl;
import com.l7tech.server.identity.SessionAuthenticator;
import com.l7tech.server.identity.cert.TrustedCertServices;
import com.l7tech.server.security.cert.CertValidationProcessor;
import com.l7tech.util.ExceptionUtils;
import com.l7tech.util.HexUtils;
import java.security.cert.X509Certificate;
import java.util.Collections;
import java.util.EnumSet;
import java.util.HashSet;
import java.util.Set;
import java.util.logging.Level;
import java.util.logging.Logger;
import org.springframework.transaction.annotation.Propagation;
import org.springframework.transaction.annotation.Transactional;

@Transactional(propagation = Propagation.SUPPORTS, rollbackFor = Throwable.class)
public class FederatedIdentityProviderImpl
   extends PersistentIdentityProviderImpl<FederatedUser, FederatedGroup, FederatedUserManager, FederatedGroupManager>
   implements FederatedIdentityProvider,
   ConfigurableIdentityProvider {
   private c a;
   private b b;
   private SessionAuthenticator c;
   private FederatedIdentityProviderConfig d;
   private FederatedUserManager e;
   private FederatedGroupManager f;
   private TrustedCertManager g;
   private TrustedCertServices h;
   private CertValidationProcessor i;
   private final Set<Goid> j = new HashSet<>();
   private static final Logger k;
   private static final int l = 5000;
   private static final String[] n;

   public IdentityProviderConfig getConfig() {
      return this.d;
   }

   public FederatedUserManager getUserManager() {
      return this.e;
   }

   public FederatedGroupManager getGroupManager() {
      return this.f;
   }

   @Transactional(propagation = Propagation.SUPPORTS)
   @Override
   public Set<Goid> getValidTrustedCertOids() {
      return Collections.unmodifiableSet(this.j);
   }

   @Transactional(propagation = Propagation.REQUIRED, readOnly = true, noRollbackFor = AuthenticationException.class)
   @Override
   public AuthenticationResult authenticate(LoginCredentials var1) throws AuthenticationException {
      if (var1.getFormat() == CredentialFormat.CLIENTCERT) {
         User var11;
         try {
            var11 = this.a.a(var1);
         } catch (AuthenticationException var5) {
            String var15 = ExceptionUtils.getMessage(var5);
            String[] var12 = n;
            throw new AuthenticationException(var12[12] + var15, var5);
         } catch (Exception var6) {
            String var10002 = ExceptionUtils.getMessage(var6);
            String[] var4 = n;
            throw new AuthenticationException(var4[13] + var10002, var6);
         }

         try {
            if (var11 == null) {
               return null;
            }
         } catch (AuthenticationException var7) {
            throw a(var7);
         }

         return new AuthenticationResult(var11, var1.getSecurityTokens(), var1.getClientCert(), false);
      } else if (var1.getFormat() == CredentialFormat.SAML) {
         User var10 = this.b.a(var1);

         try {
            if (var10 == null) {
               return null;
            }
         } catch (AuthenticationException var8) {
            throw a(var8);
         }

         return new AuthenticationResult(var10, var1.getSecurityTokens(), var1.getClientCert(), false);
      } else if (var1.getFormat() == CredentialFormat.SESSIONTOKEN) {
         FederatedUser var2 = this.a(var1);

         try {
            if (var2 == null) {
               return null;
            }
         } catch (AuthenticationException var9) {
            throw a(var9);
         }

         return this.c.authenticateSessionCredentials(var1, var2);
      } else {
         throw new BadCredentialsException(n[8]);
      }
   }

   public FederatedUser findUserByCredential(LoginCredentials var1) {
      return null;
   }

   public String getAuthRealm() {
      return HexUtils.REALM;
   }

   public void test(boolean var1, String var2, char[] var3) {
   }

   public void preSaveClientCert(FederatedUser var1, X509Certificate[] var2) throws VetoSave {
      FederatedUser var3 = this.e.cast(var1);
      String var4 = var3.getSubjectDn();
      String var5 = var2[0].getSubjectDN().getName();

      try {
         if (!CertUtils.isEqualDNCanonical(var4, var5)) {
            throw new VetoSave(n[2] + var4 + n[18] + var5 + "'");
         }
      } catch (FindException var9) {
         throw a(var9);
      }

      try {
         try {
            if (!this.j.isEmpty()) {
               this.a(var2);
            }
         } catch (VetoSave var7) {
            throw a(var7);
         }
      } catch (FindException var8) {
         throw new VetoSave(n[0] + ExceptionUtils.getMessage(var8), var8);
      }
   }

   private void a(X509Certificate[] var1) throws FindException, VetoSave {
      X509Certificate var2 = var1[0];
      String var3 = CertUtils.getIssuerDN(var2);

      for (TrustedCert var6 : this.h.getCertsBySubjectDnFiltered(var3, true, EnumSet.of(TrustedFor.SIGNING_CLIENT_CERTS), null)) {
         try {
            CertVerifier.cachedVerify(var2, var6.getCertificate());
            return;
         } catch (Exception var13) {
            String var8 = var2.getSubjectDN().toString();
            Logger var10000 = k;
            Level var10001 = Level.WARNING;
            String var9 = ExceptionUtils.getMessage(var13);
            String var10 = var3;
            String var11 = var8;
            String[] var12 = n;
            var10000.log(var10001, var12[7] + var11 + var12[19] + var10 + var12[15] + var9, var13);
         }
      }

      throw new VetoSave(n[1]);
   }

   public void setTrustedCertManager(TrustedCertManager var1) {
      this.g = var1;
   }

   @Override
   public void setIdentityProviderConfig(IdentityProviderConfig var1) throws InvalidIdProviderCfgException {
      label56: {
         try {
            if (!(var1 instanceof FederatedIdentityProviderConfig)) {
               break label56;
            }

            this.d = (FederatedIdentityProviderConfig)var1;
         } catch (FindException var13) {
            throw a(var13);
         }

         try {
            if (this.e == null) {
               throw new InvalidIdProviderCfgException(n[16]);
            }
         } catch (FindException var11) {
            throw a(var11);
         }

         try {
            if (this.f == null) {
               throw new InvalidIdProviderCfgException(n[21]);
            }
         } catch (FindException var12) {
            throw a(var12);
         }

         this.e.configure(this);
         this.f.configure(this);
         Goid[] var2 = this.d.getTrustedCertGoids();

         for (Goid var6 : var2) {
            String var10000 = this.d.getName();
            String var10001 = String.valueOf(var6);
            String[] var9 = n;
            String var7 = var9[20] + var10000 + var9[22] + var10001;

            try {
               TrustedCert var8 = (TrustedCert)this.g.getCachedEntity(var6, 5000);
               if (var8 == null) {
                  k.log(Level.WARNING, var7 + var9[17]);
               } else {
                  this.j.add(var6);
               }
            } catch (FindException var10) {
               k.log(Level.SEVERE, var7 + n[6], var10);
            }
         }

         Auditor var14 = new Auditor(this, this.applicationContext, k);
         this.a = new c(this, this.h, this.clientCertManager, this.i, var14, this.j);
         this.b = new b(this, this.h, this.clientCertManager, this.i, var14, this.j);
         this.c = new SessionAuthenticator(this.d.getGoid());
         return;
      }

      String[] var15 = n;
      throw new InvalidIdProviderCfgException(var15[5]);
   }

   public void setUserManager(FederatedUserManager var1) {
      this.e = var1;
   }

   public void setGroupManager(FederatedGroupManager var1) {
      this.f = var1;
   }

   public boolean hasClientCert(String var1) throws AuthenticationException {
      return false;
   }

   public void setCertValidationProcessor(CertValidationProcessor var1) {
      this.i = var1;
   }

   public void setTrustedCertServices(TrustedCertServices var1) {
      this.h = var1;
   }

   @Override
   public void afterPropertiesSet() throws Exception {
      try {
         super.afterPropertiesSet();
         if (this.g == null) {
            throw new IllegalArgumentException(n[3]);
         }
      } catch (Exception var2) {
         throw a(var2);
      }

      try {
         if (this.h == null) {
            throw new IllegalArgumentException(n[4]);
         }
      } catch (Exception var3) {
         throw a(var3);
      }

      try {
         if (this.i == null) {
            throw new IllegalArgumentException(n[14]);
         }
      } catch (Exception var1) {
         throw a(var1);
      }
   }

   private FederatedUser a(LoginCredentials var1) throws AuthenticationException {
      SecurityToken var3 = var1.getSecurityToken();

      try {
         if (!(var3 instanceof SessionSecurityToken)) {
            throw new BadCredentialsException(n[9]);
         }
      } catch (FindException var11) {
         throw a(var11);
      }

      SessionSecurityToken var4 = (SessionSecurityToken)var3;

      try {
         if (!var4.getProviderId().equals(this.getConfig().getGoid())) {
            return null;
         }
      } catch (FindException var10) {
         throw a(var10);
      }

      String var5 = var4.getUserId();
      FederatedUser var2;
      if (var5 != null) {
         try {
            var2 = (FederatedUser)this.getUserManager().findByPrimaryKey(var5);
         } catch (FindException var9) {
            String var10002 = ExceptionUtils.getMessage(var9);
            String[] var7 = n;
            throw new AuthenticationException(var7[10] + var10002, var9);
         }

         try {
            if (var2 == null) {
               throw new AuthenticationException(n[11]);
            }
         } catch (FindException var8) {
            throw a(var8);
         }
      } else {
         var2 = new FederatedUser(this.getConfig().getGoid(), null);
      }

      return var2;
   }

   static {
      String[] var5 = new String[23];
      int var3 = 0;
      String var2 = "\u000e,\u001bc \"\u0013/-Zm#(X{7\n!85F(6\u001fel$V)6\u0013g%$R/'\t;lc\u000e1\u001fsk4\u00138'\bul0R(b\u0014n8g@2%\u0014d(gQ\"b\u001bol.@(7\u001fsl$V)6Zu>2@/'\u001e!.>\u0013/*\u0013rl.W>,\u000eh8>\u0013+0\u0015w%#V)b\u000enl4Z<,Zb .V56Zb)5G(\u0019\u000e1\u001fsk4\u0013\u0003lO1ug`. \u0010d/3\u0013\u001f\fZ&+\u000f*\u001f!\u00185F(6\u001fel\u0004V)6\u0013g%$R/'ZL-)R<'\b!%4\u0013)'\u000bt%5V?-\u000f*\u001f!\u00185F(6\u001fel\u0004V)6\u0013g%$R/'ZR)5E2!\u001frl&A>b\bd=2Z)'\u001e\"\u001d'\u001ed>&G>&ZQ>(E2&\u001fsl\u0004\\5$\u0013fl5V*7\u0013s)#\u001awb\ri%$[{!\u0015t #\u00135-\u000e!.\"\u0013=-\u000fo(\u001f\u000e,\u001bc \"\u0013/-Zw)5Z=;Zb)5G{5\u0013u$gw\u0015b]@\u0018#\u0014&8gR.6\u0012d\"3Z8#\u000edl0Z/*\u0015t8g`\u001a\u000f6!#5\u0013\u0003lO1ugP>0\u000eh*.P:6\u001f!/5V?'\u0014u%&_(\u0010\u000e,\u001fy<\"P/'\u001e!8(X>,'\u001e0\bn>gR.6\u0012n>.I2,\u001d!?\"@(+\u0015ol$A>&\u001fo8.R71@!6\u0018-\u000fm()\u0014/b\u001bt8/\\)+\u0000dl4V(1\u0013n\"gP)'\u001ed\"3Z:.\t;l2@>0Zo#3\u0013=-\u000fo(&\u0018-\u000fm()\u0014/b\u001bt8/\\)+\u0000dl\u001f\u001dnrC!/5V?'\u0014u%&_(xZ%\u001e0\bn>gR.6\u0012n>.I2,\u001d!\u0014i\u0006k{Zb>\"W>,\u000eh-+@ab0\u000f*\u001f!\u000f\"A/+\u001ch/&G>b,` .W:6\u0013n\"gc)-\u0019d?4\\)b\u0013rl5V*7\u0013s)#\u0003|xZ\u0016\u000e1\u001fs\u0001&]:%\u001fsl.@{,\u0015ul4V/\u0018wb\ri%$[{,\u0015! (]<'\b!)?Z(6\t\"|&\u0015d?)\u0014/b\u0017`8$[{!\u001fs8`@{\u0011\u000fc&\"P/b>Ol`'|b\u001bf-.](6Zu>2@/'\u001e!%4@.'\b!/\"A/b\rh8/\u0013\u001f\fZ&\u001d\u001d'\u001ed>&G>&ZH(\"]/+\u000exl\u0017A44\u0013e)5\u0013|";
      int var4 = "\u000e,\u001bc \"\u0013/-Zm#(X{7\n!85F(6\u001fel$V)6\u0013g%$R/'\t;lc\u000e1\u001fsk4\u00138'\bul0R(b\u0014n8g@2%\u0014d(gQ\"b\u001bol.@(7\u001fsl$V)6Zu>2@/'\u001e!.>\u0013/*\u0013rl.W>,\u000eh8>\u0013+0\u0015w%#V)b\u000enl4Z<,Zb .V56Zb)5G(\u0019\u000e1\u001fsk4\u0013\u0003lO1ug`. \u0010d/3\u0013\u001f\fZ&+\u000f*\u001f!\u00185F(6\u001fel\u0004V)6\u0013g%$R/'ZL-)R<'\b!%4\u0013)'\u000bt%5V?-\u000f*\u001f!\u00185F(6\u001fel\u0004V)6\u0013g%$R/'ZR)5E2!\u001frl&A>b\bd=2Z)'\u001e\"\u001d'\u001ed>&G>&ZQ>(E2&\u001fsl\u0004\\5$\u0013fl5V*7\u0013s)#\u001awb\ri%$[{!\u0015t #\u00135-\u000e!.\"\u0013=-\u000fo(\u001f\u000e,\u001bc \"\u0013/-Zw)5Z=;Zb)5G{5\u0013u$gw\u0015b]@\u0018#\u0014&8gR.6\u0012d\"3Z8#\u000edl0Z/*\u0015t8g`\u001a\u000f6!#5\u0013\u0003lO1ugP>0\u000eh*.P:6\u001f!/5V?'\u0014u%&_(\u0010\u000e,\u001fy<\"P/'\u001e!8(X>,'\u001e0\bn>gR.6\u0012n>.I2,\u001d!?\"@(+\u0015ol$A>&\u001fo8.R71@!6\u0018-\u000fm()\u0014/b\u001bt8/\\)+\u0000dl4V(1\u0013n\"gP)'\u001ed\"3Z:.\t;l2@>0Zo#3\u0013=-\u000fo(&\u0018-\u000fm()\u0014/b\u001bt8/\\)+\u0000dl\u001f\u001dnrC!/5V?'\u0014u%&_(xZ%\u001e0\bn>gR.6\u0012n>.I2,\u001d!\u0014i\u0006k{Zb>\"W>,\u000eh-+@ab0\u000f*\u001f!\u000f\"A/+\u001ch/&G>b,` .W:6\u0013n\"gc)-\u0019d?4\\)b\u0013rl5V*7\u0013s)#\u0003|xZ\u0016\u000e1\u001fs\u0001&]:%\u001fsl.@{,\u0015ul4V/\u0018wb\ri%$[{,\u0015! (]<'\b!)?Z(6\t\"|&\u0015d?)\u0014/b\u0017`8$[{!\u001fs8`@{\u0011\u000fc&\"P/b>Ol`'|b\u001bf-.](6Zu>2@/'\u001e!%4@.'\b!/\"A/b\rh8/\u0013\u001f\fZ&\u001d\u001d'\u001ed>&G>&ZH(\"]/+\u000exl\u0017A44\u0013e)5\u0013|"
         .length();
      char var1 = '(';
      int var7 = -1;

      label24:
      while (true) {
         byte var10000 = 100;
         String var10001 = var2.substring(++var7, var7 + var1);
         byte var10002 = -1;

         while (true) {
            String var8 = b(var10000, a(var10001));
            switch (var10002) {
               case 0:
                  var5[var3++] = var8;
                  if ((var7 += var1) >= var4) {
                     n = var5;
                     k = Logger.getLogger(FederatedIdentityProviderImpl.class.getName());
                     return;
                  }

                  var1 = var2.charAt(var7);
                  break;
               default:
                  var5[var3++] = var8;
                  if ((var7 += var1) < var4) {
                     var1 = var2.charAt(var7);
                     continue label24;
                  }

                  var2 = "\u0006*\u000fn&\u0010H/9\u0007~$}@2x\u000et\"}Z$,\u001afx\u0012~08[2x\u0014tv\t[4+\u0014~2}j$*\u0014;u";
                  var4 = "\u0006*\u000fn&\u0010H/9\u0007~$}@2x\u000et\"}Z$,\u001afx\u0012~08[2x\u0014tv\t[4+\u0014~2}j$*\u0014;u".length();
                  var1 = 23;
                  var7 = -1;
            }

            var10000 = 126;
            var10001 = var2.substring(++var7, var7 + var1);
            var10002 = 0;
         }
      }
   }

   private static Exception a(Exception var0) {
      return var0;
   }

   private static char[] a(String var0) {
      char[] var10000 = var0.toCharArray();
      if (var10000.length < 2) {
         var10000[0] = (char)(var10000[0] ^ 87);
      }

      return var10000;
   }

   private static String b(int var0, char[] var1) {
      int var10003 = var1.length;
      int var10002 = var0;
      char[] var10001 = var1;
      int var10000 = var10003;

      for (int var2 = 0; var10000 > var2; var2++) {
         var10001[var2] = (char)(var10001[var2] ^ var10002 ^ switch (var2 % 7) {
            case 0 -> 63;
            case 1 -> 38;
            case 2 -> 30;
            case 3 -> 101;
            case 4 -> 40;
            case 5 -> 35;
            default -> 87;
         });
      }

      return new String(var10001).intern();
   }
}