// AuthenticatorsFor gets the authenticators for the specified security schemes
167345
func (d *API) AuthenticatorsFor(schemes map[string]spec.SecurityScheme) map[string]runtime.Authenticator {
	result := make(map[string]runtime.Authenticator)
	for k := range schemes {
		if a, ok := d.authenticators[k]; ok {
			result[k] = a
		}
	}
	return result
}
704791
func (r User_Customer_OpenIdConnect) CheckPhoneFactorAuthenticationForPasswordSet(passwordSet *datatypes.Container_User_Customer_PasswordSet, authenticationContainer *datatypes.Container_User_Customer_External_Binding) (resp bool, err error) {
	params := []interface{}{
		passwordSet,
		authenticationContainer,
	}
	err = r.Session.DoRequest("SoftLayer_User_Customer_OpenIdConnect", "checkPhoneFactorAuthenticationForPasswordSet", params, &r.Options, &resp)
	return
}
1163391
func WrapHandlerForAuthCreds(h http.Handler, adminuser, adminpass, authrealm string) http.Handler {
	if adminuser == "" && adminpass == "" {
		return h
	}
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if isAuthenticated(r, adminuser, adminpass) {
			if AuthRequest != nil {
				AuthRequest(r, AuthSuccess)
			}
			h.ServeHTTP(w, r)
		} else {
			if AuthRequest != nil {
				AuthRequest(r, AuthFailure)
			}
			w.Header().Set("WWW-Authenticate", `Basic realm="`+authrealm+`"`)
			w.WriteHeader(http.StatusUnauthorized)
			w.Write([]byte("Unauthorized\n"))
		}
	})
}
1158793
func (key *PrivateKey) CertificateForKey(template *x509.Certificate, issuer *Certificate, publicKey interface{}) (*Certificate, error) {
	var issuerCert *x509.Certificate
	if issuer == nil {
		// Note - for self-signed certificates, we include the host's external IP address
		issuerCert = template
	} else {
		issuerCert = issuer.cert
	}
	derBytes, err := x509.CreateCertificate(
		rand.Reader, // secure entropy
		template,    // the template for the new cert
		issuerCert,  // cert that's signing this cert
		publicKey,   // public key
		key.rsaKey,  // private key
	)
	if err != nil {
		return nil, err
	}
	return bytesToCert(derBytes)
}
1193487
func (vs *Set) IterateValidators(iter func(id crypto.Addressable, power *big.Int) error) error {
	if vs == nil {
		return nil
	}
	addresses := make(crypto.Addresses, 0, len(vs.powers))
	for address := range vs.powers {
		addresses = append(addresses, address)
	}
	sort.Sort(addresses)
	for _, address := range addresses {
		err := iter(vs.publicKeys[address], new(big.Int).Set(vs.powers[address]))
		if err != nil {
			return err
		}
	}
	return nil
}
1371659
func BuildAuthenticator(s *options.ServerRunOptions, extclient clientgoclientset.Interface, versionedInformer clientgoinformers.SharedInformerFactory) (authenticator.Request, *spec.SecurityDefinitions, error) {
	authenticatorConfig := s.Authentication.ToAuthenticationConfig()
	if s.Authentication.ServiceAccounts.Lookup {
		authenticatorConfig.ServiceAccountTokenGetter = serviceaccountcontroller.NewGetterFromClient(
			extclient,
			versionedInformer.Core().V1().Secrets().Lister(),
			versionedInformer.Core().V1().ServiceAccounts().Lister(),
			versionedInformer.Core().V1().Pods().Lister(),
		)
	}
	authenticatorConfig.BootstrapTokenAuthenticator = bootstrap.NewTokenAuthenticator(
		versionedInformer.Core().V1().Secrets().Lister().Secrets(v1.NamespaceSystem),
	)

	return authenticatorConfig.New()
}
420745
func StaticAuthenticator(username, password, otp string, user *empire.User) Authenticator {
	return AuthenticatorFunc(func(givenUsername, givenPassword, givenOtp string) (*Session, error) {
		if givenUsername != username {
			return nil, ErrForbidden
		}

		if givenPassword != password {
			return nil, ErrForbidden
		}

		if givenOtp != otp {
			return nil, ErrTwoFactor
		}

		return NewSession(user), nil
	})
}
1338028
func (a denyPasswordAuthenticator) AuthenticatePassword(ctx context.Context, username, password string) (*authenticator.Response, bool, error) {
	return nil, false, nil
}
184847
func NewBasicTicketAuthenticator(tickets ...string) CRAuthenticator {
	authenticator := &basicTicketAuthenticator{tickets: make(map[string]bool)}
	for _, ticket := range tickets {
		authenticator.tickets[ticket] = true
	}
	return authenticator
}
20072
func WrapHandlerForAuth(h http.Handler) http.Handler {
	return WrapHandlerForAuthCreds(h, _adminuser, _adminpass, _authrealm)
}
739899
func getAuthenticateeProvider(name string) (provider Authenticatee, ok bool) {
	providerLock.Lock()
	defer providerLock.Unlock()

	provider, ok = authenticateeProviders[name]
	return
}
870029
func checkCredentialsForPasswordAuth(s *service, email string, password string) (rest.ResponseDTOUserInfo, *servicehelper.Error) {
	if entity, err := s.repo.FindByEmail(email); err != nil {
		return rest.ResponseDTOUserInfo{}, &servicehelper.Error{
			Detail: errors.New("incorrect username or password"),
		}
	} else if err := scrypt.CompareHashAndPassword([]byte(entity.Password), []byte(password)); err != nil {
		return rest.ResponseDTOUserInfo{}, &servicehelper.Error{
			Detail: errors.New("incorrect username or password"),
		}
	} else {
		return rest.ResponseDTOUserInfo{
			UserId: entity.ID,
			Email:  entity.Email,
		}, nil
	}
}
434285
func NewAuthenticationProviderService(ctx servicecontext.ServiceContext, config AuthenticationProviderServiceConfig) service.AuthenticationProviderService {
	return &authenticationProviderServiceImpl{
		BaseService: base.NewBaseService(ctx),
		config:      config,
	}
}
1369027
func (a alwaysAcceptPasswordAuthenticator) AuthenticatePassword(ctx context.Context, username, password string) (*authenticator.Response, bool, error) {
	// Since this IDP doesn't validate usernames or passwords, disallow usernames consisting entirely of spaces
	// Normalize usernames by removing leading/trailing spaces
	username = strings.TrimSpace(username)

	if username == "" || password == "" {
		return nil, false, nil
	}

	identity := authapi.NewDefaultUserIdentityInfo(a.providerName, username)

	return identitymapper.ResponseFor(a.identityMapper, identity)
}
454716
func newAuthenticator(ctx context.Context, credentials, actAs string, scopes []string) *auth.Authenticator {
	// TODO(vadimsh): Don't hardcode auth options here, pass them from outside
	// somehow.
	authOpts := chromeinfra.DefaultAuthOptions()
	authOpts.ServiceAccountJSONPath = credentials
	authOpts.Scopes = scopes
	authOpts.ActAsServiceAccount = actAs
	return auth.NewAuthenticator(ctx, auth.SilentLogin, authOpts)
}
1154472
func UseAuthenticator(a BasicHTTPAuthenticator) Option {
	return func(p *Plugin) {
		p.Deps.Authenticator = a
	}
}
1261312
func (m *MockTransport) responderForKey(key routeKey) (Responder, routeKey, []string) {
	m.mu.RLock()
	defer m.mu.RUnlock()
	return m.responders[key], key, nil
}