// AsReadOnlyCredentials configures the AssertContext to be used soley for
// public, read-only operations.
341433
func AsReadOnlyCredentials(ctx *AssertContext) {
	conf := ctx.Config
	Expect(conf).ToNot(BeNil(),
		"cannot set read-only AssertContext without config")

	conf.CredentialsSource = config.NoneCredentialsSource
	conf.ServiceAccountFile = ""
}
1208295
func readAuthenticationMethod(conn net.Conn) ([]byte, error) {
	// Read in the number of authentication methods supported.
	nmethods, err := readByte(conn)
	if err != nil {
		return nil, trace.Wrap(err)
	}

	// Read nmethods number of bytes from the connection return the list of
	// supported authentication methods to the caller.
	authMethods := make([]byte, nmethods)
	for i := byte(0); i < nmethods; i++ {
		method, err := readByte(conn)
		if err != nil {
			return nil, trace.Wrap(err)
		}

		authMethods = append(authMethods, method)
	}

	return authMethods, nil
}
974249
func (c *Core) setupCredentials(ctx context.Context) error {
	var persistNeeded bool

	c.authLock.Lock()
	defer c.authLock.Unlock()

	for _, entry := range c.auth.sortEntriesByPathDepth().Entries {
		var backend logical.Backend

		// Create a barrier view using the UUID
		viewPath := entry.ViewPath()

		// Singleton mounts cannot be filtered on a per-secondary basis
		// from replication
		if strutil.StrListContains(singletonMounts, entry.Type) {
			addFilterablePath(c, viewPath)
		}

		view := NewBarrierView(c.barrier, viewPath)

		// Determining the replicated state of the mount
		nilMount, err := preprocessMount(c, entry, view)
		if err != nil {
			return err
		}
		origViewReadOnlyErr := view.getReadOnlyErr()

		// Mark the view as read-only until the mounting is complete and
		// ensure that it is reset after. This ensures that there will be no
		// writes during the construction of the backend.
		view.setReadOnlyErr(logical.ErrSetupReadOnly)
		if strutil.StrListContains(singletonMounts, entry.Type) {
			defer view.setReadOnlyErr(origViewReadOnlyErr)
		} else {
			c.postUnsealFuncs = append(c.postUnsealFuncs, func() {
				view.setReadOnlyErr(origViewReadOnlyErr)
			})
		}

		// Initialize the backend
		sysView := c.mountEntrySysView(entry)

		backend, err = c.newCredentialBackend(ctx, entry, sysView, view)
		if err != nil {
			c.logger.Error("failed to create credential entry", "path", entry.Path, "error", err)
			if !c.builtinRegistry.Contains(entry.Type, consts.PluginTypeCredential) {
				// If we encounter an error instantiating the backend due to an error,
				// skip backend initialization but register the entry to the mount table
				// to preserve storage and path.
				c.logger.Warn("skipping plugin-based credential entry", "path", entry.Path)
				goto ROUTER_MOUNT
			}
			return errLoadAuthFailed
		}
		if backend == nil {
			return fmt.Errorf("nil backend returned from %q factory", entry.Type)
		}

		{
			// Check for the correct backend type
			backendType := backend.Type()
			if backendType != logical.TypeCredential {
				return fmt.Errorf("cannot mount %q of type %q as an auth backend", entry.Type, backendType)
			}

			addPathCheckers(c, entry, backend, viewPath)
		}

		// If the mount is filtered or we are on a DR secondary we don't want to
		// keep the actual backend running, so we clean it up and set it to nil
		// so the router does not have a pointer to the object.
		if nilMount {
			backend.Cleanup(ctx)
			backend = nil
		}

	ROUTER_MOUNT:
		// Mount the backend
		path := credentialRoutePrefix + entry.Path
		err = c.router.Mount(backend, path, entry, view)
		if err != nil {
			c.logger.Error("failed to mount auth entry", "path", entry.Path, "error", err)
			return errLoadAuthFailed
		}

		if c.logger.IsInfo() {
			c.logger.Info("successfully enabled credential backend", "type", entry.Type, "path", entry.Path)
		}

		// Ensure the path is tainted if set in the mount table
		if entry.Tainted {
			c.router.Taint(ctx, path)
		}

		// Check if this is the token store
		if entry.Type == "token" {
			c.tokenStore = backend.(*TokenStore)

			// At some point when this isn't beta we may persist this but for
			// now always set it on mount
			entry.Config.TokenType = logical.TokenTypeDefaultService

			// this is loaded *after* the normal mounts, including cubbyhole
			c.router.tokenStoreSaltFunc = c.tokenStore.Salt
			if !c.IsDRSecondary() {
				c.tokenStore.cubbyholeBackend = c.router.MatchingBackend(ctx, cubbyholeMountPath).(*CubbyholeBackend)
			}
		}

		// Populate cache
		NamespaceByID(ctx, entry.NamespaceID, c)
	}

	if persistNeeded {
		// persist non-local auth
		return c.persistAuth(ctx, c.auth, nil)
	}

	return nil
}
396628
func readOnlyAuthPrelude(c context.Context, methodName string, req proto.Message) (context.Context, error) {
	if !isReadOnly(methodName) {
		return c, status.Errorf(codes.PermissionDenied, "unauthorized user")
	}
	switch is, err := auth.IsMember(c, admins, writers, readers); {
	case err != nil:
		return c, err
	case is:
		logging.Debugf(c, "%s called %q:\n%s", auth.CurrentIdentity(c), methodName, req)
		return c, nil
	}
	return c, status.Errorf(codes.PermissionDenied, "unauthorized user")
}
415349
func (f *Facade) ValidateCredentials(ctx datastore.Context, user userdomain.User) (bool, error) {
	defer ctx.Metrics().Stop(ctx.Metrics().Start("Facade.ValidateCredentials"))
	var err error
	logger := plog.WithField("userName", user.Name)
	logger.Debug("Started Facade.ValidateCredentials")
	defer logger.WithError(err).Debug("Finished Facade.ValidateCredentials")

	var storedUser userdomain.User
	storedUser, err = f.GetUser(ctx, user.Name)
	if err != nil {
		return false, err
	}

	// hash the passed in password
	hashedPassword := hashPassword(user.Password)

	// confirm the password
	if storedUser.Password != hashedPassword {
		return false, nil
	}

	// at this point we found the user and confirmed the password
	return true, nil
}
879598
func (s *GCMChannelResponse) SetHasCredential(v bool) *GCMChannelResponse {
	s.HasCredential = &v
	return s
}
685241
func (_m *ClientInterface) ValidateCredentials(_a0 user.User) (bool, error) {
	ret := _m.Called(_a0)

	var r0 bool
	if rf, ok := ret.Get(0).(func(user.User) bool); ok {
		r0 = rf(_a0)
	} else {
		r0 = ret.Get(0).(bool)
	}

	var r1 error
	if rf, ok := ret.Get(1).(func(user.User) error); ok {
		r1 = rf(_a0)
	} else {
		r1 = ret.Error(1)
	}

	return r0, r1
}
564364
func (s *Server) ValidateCredentials(someUser user.User, valid *bool) error {
	result, err := s.f.ValidateCredentials(s.context(), someUser)
	if err != nil {
		return err
	}
	*valid = result
	return nil
}
647942
func (s *Integration) SetCredentials(v string) *Integration {
	s.Credentials = &v
	return s
}
873081
func (r *rest) CheckCredentials(c *gin.Context) {
	var reqDTO RequestDTOCheckCredentials
	if err := c.BindJSON(&reqDTO); err != nil {
		c.JSON(apihelper.BuildRequestError(err))
	} else {
		if resDTO, err := r.service.CheckCredentials(reqDTO); err != nil {
			c.JSON(apihelper.BuildResponseError(err))
		} else {
			c.JSON(http.StatusOK, resDTO)
		}
	}
}
1268085
func readLoginCredentials(ctx *cli.Context) (string, string) {
	fmt.Print("Username: ")

	reader := bufio.NewReader(os.Stdin)
	username, err := reader.ReadString('\n')
	if err != nil {
		errExit(ctx, exitIO, err.Error(), false)
	}

	username = strings.TrimSpace(username) // ReadString includes the newline
	if len(username) == 0 {
		errExit(ctx, exitInvalid, "you must specify a username", false)
	}

	fmt.Print("Password: ")

	// use terminal.ReadPassword() so there's no echoing of what's typed
	bytePassword, err := terminal.ReadPassword(0) // fd 0 = stdin
	if err != nil {
		errExit(ctx, exitIO, err.Error(), false)
	}
	password := string(bytePassword)
	fmt.Println("")

	return username, password
}
687166
func (c *Core) teardownCredentials(ctx context.Context) error {
	c.authLock.Lock()
	defer c.authLock.Unlock()

	if c.auth != nil {
		authTable := c.auth.shallowClone()
		for _, e := range authTable.Entries {
			backend := c.router.MatchingBackend(namespace.ContextWithNamespace(ctx, e.namespace), credentialRoutePrefix+e.Path)
			if backend != nil {
				backend.Cleanup(ctx)
			}

			viewPath := e.ViewPath()
			removePathCheckers(c, e, viewPath)
		}
	}

	c.auth = nil
	c.tokenStore = nil
	return nil
}
317089
func (s *store) AllCredentials() (map[string]cloud.CloudCredential, error) {
	cloudCredentials, err := ReadCredentialsFile(JujuCredentialsPath())
	if err != nil {
		return nil, errors.Trace(err)
	}
	return cloudCredentials, nil
}
425740
func askCredentials(c *context.Context, status int, text string) {
	c.Resp.Header().Set("WWW-Authenticate", "Basic realm=\".\"")
	c.HandleText(status, text)
}
476159
func (rc *RunContext) Credentials() (clientID, clientSecret string, err error) {
	return rc.ia.im.credentials()
}
598587
func HandleCredentialError(err error, ctx context.ProviderCallContext) {
	common.HandleCredentialError(IsAuthorisationFailure, err, ctx)
}
973390
func (s *APNSVoipChannelResponse) SetHasCredential(v bool) *APNSVoipChannelResponse {
	s.HasCredential = &v
	return s
}