//  Licensed to the Apache Software Foundation (ASF) under one or more
//  contributor license agreements.  See the NOTICE file distributed with
//  this work for additional information regarding copyright ownership.
//  The ASF licenses this file to You under the Apache License, Version 2.0
//  (the "License"); you may not use this file except in compliance with
//  the License.  You may obtain a copy of the License at
//
//    http://www.apache.org/licenses/LICENSE-2.0
//
//  Unless required by applicable law or agreed to in writing, software
//  distributed under the License is distributed on an "AS IS" BASIS,
//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
//  See the License for the specific language governing permissions and
//  limitations under the License.
package org.apache.cloudstack;

import com.cloud.server.auth.DefaultUserAuthenticator;
import com.cloud.server.auth.UserAuthenticator;
import com.cloud.utils.Pair;
import org.apache.log4j.Logger;

import javax.ejb.Local;
import java.util.Map;

@Local(value = {UserAuthenticator.class})
public class SAML2UserAuthenticator extends DefaultUserAuthenticator {
    public static final Logger s_logger = Logger.getLogger(SAML2UserAuthenticator.class);

    @Override
    public Pair<Boolean, ActionOnFailedAuthentication> authenticate(String username, String password, Long domainId, Map<String, Object[]> requestParameters) {
        if (s_logger.isDebugEnabled()) {
            s_logger.debug("Trying SAML2 auth for user: " + username);
        }

        // TODO: implement core logic, HTTP GET redirections etc.

        return new Pair<Boolean, ActionOnFailedAuthentication>(true, null);
    }

    @Override
    public String encode(final String password) {
        // TODO: Complete method
        StringBuilder sb = new StringBuilder(32);
        return sb.toString();
    }
}

@@ -925,32 +925,172 @@
 rAuthenticator;%0A
+import com.cloud.user.User;%0Aimport com.cloud.user.UserAccount;%0Aimport com.cloud.user.dao.UserAccountDao;%0Aimport com.cloud.user.dao.UserDao;%0A
 import com.cloud
@@ -1102,16 +1102,16 @@
 s.Pair;%0A
-
 import o
@@ -1159,16 +1159,44 @@
 .Local;%0A
+import javax.inject.Inject;%0A
 import j
@@ -1414,16 +1414,115 @@
 lass);%0A%0A
+    @Inject%0A    private UserAccountDao _userAccountDao;%0A    @Inject%0A    private UserDao _userDao;%0A%0A
     @Ove
@@ -1809,25 +1809,24 @@
       %7D%0A
-%0A
         
 // TODO:
@@ -1821,140 +1821,807 @@
     
-// TODO: implement core logic, HTTP GET redirections etc.%0A%0A        return new Pair%3CBoolean, ActionOnFailedAuthentication%3E(true, null
+final UserAccount userAccount = _userAccountDao.getUserAccount(username, domainId);%0A        if (userAccount == null) %7B%0A            s_logger.debug(%22Unable to find user with %22 + username + %22 in domain %22 + domainId);%0A            return new Pair%3CBoolean, ActionOnFailedAuthentication%3E(false, null);%0A        %7D else %7B%0A            User user = _userDao.getUser(userAccount.getId());%0A            // TODO: check SAMLRequest, signature etc. from requestParameters%0A            if (user != null && user.getUuid().startsWith(%22saml%22)) %7B%0A                return new Pair%3CBoolean, ActionOnFailedAuthentication%3E(true, null);%0A            %7D%0A        %7D%0A        // Deny all by default%0A        return new Pair%3CBoolean, ActionOnFailedAuthentication%3E(false, ActionOnFailedAuthentication.INCREMENT_INCORRECT_LOGIN_ATTEMPT_COUNT
 );%0A 

Fix SAML2UserAuthenticator to not let every login credential