package jenkins.security;

import hudson.Extension;
import hudson.model.User;
import org.acegisecurity.Authentication;
import org.acegisecurity.userdetails.UserDetails;
import org.acegisecurity.userdetails.UsernameNotFoundException;
import org.springframework.dao.DataAccessException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.logging.Logger;

import static java.util.logging.Level.*;

/**
 * Checks if the password given in the BASIC header matches the user's API token.
 *
 * @author Kohsuke Kawaguchi
 * @since 1.576
 */
@Extension
public class BasicHeaderApiTokenAuthenticator extends BasicHeaderAuthenticator {
    /**
     * Note: if the token does not exist or does not match, we do not use {@link SecurityListener#fireFailedToAuthenticate(String)}
     * because it will be done in the {@link BasicHeaderRealPasswordAuthenticator} in the case the password is not valid either
     */
    @Override
    public Authentication authenticate(HttpServletRequest req, HttpServletResponse rsp, String username, String password) throws ServletException {
        User u = BasicApiTokenHelper.isConnectingUsingApiToken(username, password);
        if(u != null) {
            ApiTokenProperty t = u.getProperty(ApiTokenProperty.class);
            if (t != null && t.matchesPassword(password)) {
                Authentication auth;
                try {
                    UserDetails userDetails = u.getUserDetailsForImpersonation();
                    auth = u.impersonate(userDetails);

                    SecurityListener.fireAuthenticated(userDetails);
                } catch (UsernameNotFoundException x) {
                    // The token was valid, but the impersonation failed. This token is clearly not his real password,
                    // so there's no point in continuing the request processing. Report this error and abort.
                    LOGGER.log(WARNING, "API token matched for user " + username + " but the impersonation failed", x);
                    throw new ServletException(x);
                } catch (DataAccessException x) {
                    throw new ServletException(x);
                }

                req.setAttribute(BasicHeaderApiTokenAuthenticator.class.getName(), true);
                return auth;
            }
        }
        return null;
    }

    private static final Logger LOGGER = Logger.getLogger(BasicHeaderApiTokenAuthenticator.class.getName());
}

@@ -1267,144 +1267,8 @@
 ) %7B%0A
-            ApiTokenProperty t = u.getProperty(ApiTokenProperty.class);%0A            if (t != null && t.matchesPassword(password)) %7B%0A    
     
@@ -1308,20 +1308,16 @@
         
-    
 try %7B%0A  
@@ -1326,28 +1326,24 @@
             
-  
-  
 UserDetails 
@@ -1408,20 +1408,16 @@
         
-    
 auth = u
@@ -1460,20 +1460,16 @@
         
- 
-   
 Security
@@ -1513,36 +1513,32 @@
 s);%0A            
-   
- 
 %7D catch (Usernam
@@ -1553,36 +1553,32 @@
 dException x) %7B%0A
-    
                 
@@ -1692,20 +1692,16 @@
         
-  
-  
 // so th
@@ -1782,20 +1782,16 @@
  abort.%0A
-    
         
@@ -1906,36 +1906,32 @@
                 
-    
 throw new Servle
@@ -1949,36 +1949,32 @@
 x);%0A            
-   
- 
 %7D catch (DataAcc
@@ -1999,36 +1999,32 @@
                 
-    
 throw new Servle
@@ -2050,27 +2050,19 @@
         
- 
-   %7D%0A%0A    
+%7D%0A%0A
         
@@ -2147,28 +2147,24 @@
             
-    
 return auth;
@@ -2164,30 +2164,16 @@
 n auth;%0A
-            %7D%0A
         

Remove redundant token check