loginmodules/password/authenticators/jdbc/src/main/java/org/beiter/michael/authn/jaas/loginmodules/password/authenticators/jdbc/JdbcPasswordAuthenticator.java
@edu.umd.cs.findbugs.annotations.SuppressWarnings("SQL_PREPARED_STATEMENT_GENERATED_FROM_NONCONSTANT_STRING")
    private UserRecord getUserRecord(final String domain, final String userName)
            throws LoginException {

        String userId;
        String credential;

        Connection connection = null;
        PreparedStatement statement = null;
        ResultSet resultSet = null;

        try {
            connection = getDatabaseConnection();

            statement = connection.prepareStatement(dbProps.get().getSqlUserQuery());
            statement.setString(1, domain);
            statement.setString(2, userName);

            resultSet = statement.executeQuery();

            if (resultSet.next()) {
                userId = resultSet.getString(1);
                credential = resultSet.getString(2);
            } else {
                final String error = "Username '" + userName + "' does not exist (query returned zero results)";
                LOG.warn(error);
                throw new LoginException(error);
            }

            resultSet.close();
            statement.close();
        } catch (SQLException e) {
            final String error = "Error executing SQL query";
            LOG.warn(error, e);
            throw Util.newLoginException(error, e);
        } finally {
            DbUtil.close(resultSet);
            DbUtil.close(statement);
            DbUtil.close(connection);
        }

        return new UserRecord(domain, userName, userId, credential);
    }
@edu.umd.cs.findbugs.annotations.SuppressWarnings("SQL_PREPARED_STATEMENT_GENERATED_FROM_NONCONSTANT_STRING")
    private UserRecord getUserRecord(final String domain, final String userName)
            throws LoginException {

        String userId;
        String credential;

        Connection connection = null;
        PreparedStatement statement = null;
        ResultSet resultSet = null;

        try {
            connection = getDatabaseConnection();

            statement = connection.prepareStatement(dbProps.get().getSqlUserQuery());
            statement.setString(1, domain);
            statement.setString(2, userName);

            resultSet = statement.executeQuery();

            if (resultSet.next()) {
                userId = resultSet.getString(1);
                credential = resultSet.getString(2);
            } else {
                final String error = "Username '" + userName + "' does not exist (query returned zero results)";
                LOG.warn(error);
                throw new LoginException(error);
            }

            resultSet.close();
            statement.close();
        } catch (SQLException e) {
            final String error = "Error executing SQL query";
            LOG.warn(error, e);
            throw Util.newLoginException(error, e);
        } finally {
            DbUtil.close(resultSet);
            DbUtil.close(statement);
            DbUtil.close(connection);
        }

        return new UserRecord(domain, userName, userId, credential);
    }
@ edu . umd . cs . findbugs . annotations . SuppressWarnings ( "SQL_PREPARED_STATEMENT_GENERATED_FROM_NONCONSTANT_STRING" ) private UserRecord getUserRecord ( final String domain , final String userName ) throws LoginException { String userId ; String credential ; Connection connection = null ; PreparedStatement statement = null ; ResultSet resultSet = null ; try { connection = getDatabaseConnection ( ) ; statement = connection . prepareStatement ( dbProps . get ( ) . getSqlUserQuery ( ) ) ; statement . setString ( 1 , domain ) ; statement . setString ( 2 , userName ) ; resultSet = statement . executeQuery ( ) ; if ( resultSet . next ( ) ) { userId = resultSet . getString ( 1 ) ; credential = resultSet . getString ( 2 ) ; } else { final String error = "Username '" + userName + "' does not exist (query returned zero results)" ; LOG . warn ( error ) ; throw new LoginException ( error ) ; } resultSet . close ( ) ; statement . close ( ) ; } catch ( SQLException e ) { final String error = "Error executing SQL query" ; LOG . warn ( error , e ) ; throw Util . newLoginException ( error , e ) ; } finally { DbUtil . close ( resultSet ) ; DbUtil . close ( statement ) ; DbUtil . close ( connection ) ; } return new UserRecord ( domain , userName , userId , credential ) ; }
The SQL statement is retrieved from the configuration, and the admin is trusted
The SQL statement is retrieved from the configuration and the admin is trusted