fixed update of account role mapping
This commit is contained in:
@ -1,371 +1,371 @@
|
||||
package de.muehlencord.shared.account.business.account.control;
|
||||
|
||||
import de.muehlencord.shared.account.business.account.entity.AccountException;
|
||||
import de.muehlencord.shared.account.business.account.entity.AccountStatus;
|
||||
import de.muehlencord.shared.account.business.mail.entity.MailException;
|
||||
import de.muehlencord.shared.account.business.mail.boundary.MailService;
|
||||
import de.muehlencord.shared.account.business.account.entity.AccountEntity;
|
||||
import de.muehlencord.shared.account.business.account.entity.AccountLoginEntity;
|
||||
import de.muehlencord.shared.account.business.application.entity.ApplicationRoleEntity;
|
||||
import de.muehlencord.shared.account.business.application.entity.ApplicationEntity;
|
||||
import de.muehlencord.shared.account.util.AccountPU;
|
||||
import de.muehlencord.shared.account.util.SecurityUtil;
|
||||
import de.muehlencord.shared.util.DateUtil;
|
||||
import java.io.Serializable;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Date;
|
||||
import java.util.List;
|
||||
import javax.ejb.EJB;
|
||||
import javax.ejb.Stateless;
|
||||
import javax.inject.Inject;
|
||||
import javax.persistence.EntityManager;
|
||||
import javax.persistence.NoResultException;
|
||||
import javax.persistence.Query;
|
||||
import javax.transaction.Transactional;
|
||||
import org.apache.commons.lang3.RandomStringUtils;
|
||||
import org.slf4j.Logger;
|
||||
import org.slf4j.LoggerFactory;
|
||||
import org.apache.shiro.SecurityUtils;
|
||||
import org.apache.shiro.subject.Subject;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author joern.muehlencord
|
||||
*/
|
||||
@Stateless
|
||||
public class AccountControl implements Serializable {
|
||||
|
||||
private static final Logger LOGGER = LoggerFactory.getLogger(AccountControl.class.getName());
|
||||
private static final long serialVersionUID = 3424816272598108101L;
|
||||
|
||||
@EJB
|
||||
private MailService mailService;
|
||||
|
||||
@Inject
|
||||
private ApplicationEntity application;
|
||||
|
||||
@Inject
|
||||
@AccountPU
|
||||
EntityManager em;
|
||||
|
||||
/**
|
||||
* returns a list of active accounts
|
||||
*
|
||||
* @return a list of active accounts
|
||||
*/
|
||||
public List<AccountEntity> getActiveAccounts() {
|
||||
Query query = em.createQuery("SELECT a FROM AccountEntity a WHERE a.status <> :status", AccountEntity.class);
|
||||
query.setParameter("status", AccountStatus.DISABLED.name());
|
||||
return query.getResultList();
|
||||
}
|
||||
|
||||
/**
|
||||
* returns a list of active accounts
|
||||
*
|
||||
* @return a list of active accounts
|
||||
*/
|
||||
public List<AccountEntity> getAllAccounts() {
|
||||
Query query = em.createNamedQuery("AccountEntity.findAll");
|
||||
return query.getResultList();
|
||||
}
|
||||
|
||||
public List<AccountEntity> getAccounts(boolean includeDisabled) {
|
||||
if (includeDisabled) {
|
||||
return getAllAccounts();
|
||||
} else {
|
||||
return getActiveAccounts();
|
||||
}
|
||||
}
|
||||
|
||||
public AccountEntity getAccountEntity(String userName, boolean loadRoles) {
|
||||
StringBuilder queryBuilder = new StringBuilder();
|
||||
queryBuilder.append("SELECT a FROM AccountEntity a ");
|
||||
if (loadRoles) {
|
||||
queryBuilder.append("LEFT JOIN FETCH a.applicationRoleList ");
|
||||
}
|
||||
queryBuilder.append("WHERE a.username = :username");
|
||||
Query query = em.createQuery(queryBuilder.toString());
|
||||
query.setParameter("username", userName);
|
||||
try {
|
||||
return (AccountEntity) query.getSingleResult();
|
||||
} catch (NoResultException ex) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
@Transactional
|
||||
public AccountEntity saveAccount(AccountEntity account, List<ApplicationRoleEntity> applicationRoles) {
|
||||
Date now = DateUtil.getCurrentTimeInUTC();
|
||||
Subject currentUser = SecurityUtils.getSubject();
|
||||
String currentLoggedInUser = currentUser.getPrincipal().toString();
|
||||
|
||||
account.setLastUpdatedBy(currentLoggedInUser);
|
||||
account.setLastUpdatedOn(now);
|
||||
|
||||
boolean newAccount = (account.getCreatedOn() == null);
|
||||
|
||||
// new account
|
||||
if (newAccount) {
|
||||
account.setCreatedOn(now);
|
||||
account.setCreatedBy(currentLoggedInUser);
|
||||
em.persist(account);
|
||||
} else {
|
||||
em.merge(account);
|
||||
|
||||
// reload account from db and join roles
|
||||
account = getAccountEntity(account.getUsername(), true);
|
||||
}
|
||||
|
||||
// assign roles to account
|
||||
if (account.getApplicationRoleList() == null) {
|
||||
account.setApplicationRoleList(new ArrayList<>());
|
||||
}
|
||||
|
||||
boolean roleSetupChanged = false;
|
||||
// remove roles which are no longer listed
|
||||
// ensure this is only done for the given application - keep the other applications untouched
|
||||
List<ApplicationRoleEntity> assignedRoles = new ArrayList<>();
|
||||
assignedRoles.addAll(account.getApplicationRoleList());
|
||||
for (ApplicationRoleEntity currentlyAssignedRole : assignedRoles) {
|
||||
if ((currentlyAssignedRole.getApplication().equals(application) && (!applicationRoles.contains(currentlyAssignedRole)))) {
|
||||
account.getApplicationRoleList().remove(currentlyAssignedRole);
|
||||
roleSetupChanged = true;
|
||||
if (LOGGER.isDebugEnabled()) {
|
||||
LOGGER.debug("Removed role {} ({}) from user {}", currentlyAssignedRole.getRoleName(), application.getApplicationName(), account.getUsername());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// add newly added roles to role list
|
||||
for (ApplicationRoleEntity applicationRole : applicationRoles) {
|
||||
if (!account.getApplicationRoleList().contains(applicationRole)) {
|
||||
account.addApplicationRole(applicationRole);
|
||||
roleSetupChanged = true;
|
||||
if (LOGGER.isDebugEnabled()) {
|
||||
LOGGER.debug("Added role {} ({}) to account {}", applicationRole.getRoleName(), application.getApplicationName(), account.getUsername());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// update account in database if roles changed
|
||||
if (roleSetupChanged) {
|
||||
em.merge(account);
|
||||
}
|
||||
return account;
|
||||
}
|
||||
|
||||
@Transactional
|
||||
public void deleteAccount(AccountEntity account) throws AccountException {
|
||||
Date now = new Date(); // Todo now in UTC
|
||||
Subject currentUser = SecurityUtils.getSubject();
|
||||
String currentUserName = currentUser.getPrincipal().toString();
|
||||
|
||||
if (account.getUsername().equals(currentUserName)) {
|
||||
throw new AccountException("Cannot delete own account");
|
||||
} else {
|
||||
account.setStatus(AccountStatus.DISABLED.name());
|
||||
account.setLastUpdatedBy(currentUserName);
|
||||
account.setLastUpdatedOn(now);
|
||||
em.merge(account);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
public boolean initPasswordReset(String userName) {
|
||||
try {
|
||||
AccountEntity account = getAccountEntity(userName, false);
|
||||
if (account == null) {
|
||||
LOGGER.warn("Account with name " + userName + " not found");
|
||||
return false;
|
||||
}
|
||||
|
||||
if (account.getStatus().equals(AccountStatus.BLOCKED.name())) {
|
||||
LOGGER.warn("Account " + userName + " is locked, cannot initialize password reset");
|
||||
return false;
|
||||
}
|
||||
|
||||
String randomString = RandomStringUtils.random(40, true, true);
|
||||
|
||||
Date validTo = new Date(); // TODO now in UTC
|
||||
validTo = new Date(validTo.getTime() + 1000 * 600); // 10 minutes to react
|
||||
|
||||
// TODO rework password reset
|
||||
// account.setPasswordResetHash(randomString);
|
||||
// account.setPasswordResetOngoing(true);
|
||||
// account.setPasswordResetValidTo(validTo);
|
||||
mailService.sendPasswortResetStartEmail(account, randomString);
|
||||
|
||||
em.merge(account);
|
||||
return true;
|
||||
} catch (MailException ex) {
|
||||
LOGGER.error("Error while sending password reset mail. " + ex.toString());
|
||||
if (LOGGER.isDebugEnabled()) {
|
||||
LOGGER.debug("Error while sending password reset mail.", ex);
|
||||
}
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
public boolean resetPassword(String userName, String newPassword, String resetPasswordToken) {
|
||||
AccountEntity account = getAccountEntity(userName, false);
|
||||
|
||||
if (account == null) {
|
||||
LOGGER.warn("Error while resetting password, no account with username " + userName + " found");
|
||||
// TODO add extra logging for intrusion protection system like fail2ban
|
||||
return false;
|
||||
}
|
||||
|
||||
/*
|
||||
if (account.getPasswordResetOngoing() && (account.getPasswordResetHash() != null) && (account.getPasswordResetValidTo() != null)) {
|
||||
Date now = new Date(); // TODO now in UTC
|
||||
String storedHash = account.getPasswordResetHash().trim();
|
||||
if (account.getPasswordResetValidTo().after(now)) {
|
||||
if (storedHash.equals(resetPasswordToken)) {
|
||||
// everything ok, reset password
|
||||
executePasswordReset(account, newPassword);
|
||||
LOGGER.info("Updated password for user " + userName);
|
||||
return true;
|
||||
} else {
|
||||
// token is not valid, refuse to change password
|
||||
LOGGER.warn("Trying to reset password for user " + userName + " but wrong token " + resetPasswordToken + " provided");
|
||||
addLoginError(account);
|
||||
return false;
|
||||
}
|
||||
} else {
|
||||
// password reset token no longer valid
|
||||
LOGGER.warn("Trying to reset password for user " + userName + " but token is no longer valid");
|
||||
addLoginError(account);
|
||||
return false;
|
||||
}
|
||||
} else {
|
||||
// user is not is password reset mode
|
||||
LOGGER.warn("Trying to reset password for user " + userName + " but password reset was not requested");
|
||||
addLoginError(account);
|
||||
return false;
|
||||
}
|
||||
*/
|
||||
return false; // FIMXE re-implement password reset
|
||||
}
|
||||
|
||||
private void executePasswordReset(AccountEntity account, String newPassword) {
|
||||
Date now = new Date(); // TODO now in UTC
|
||||
|
||||
String hashedPassword = SecurityUtil.createPassword(newPassword);
|
||||
// account.setAccountPassword(hashedPassword);
|
||||
//
|
||||
// account.setPasswordResetOngoing(false);
|
||||
// account.setPasswordResetHash(null);
|
||||
// account.setPasswordResetValidTo(null);
|
||||
|
||||
account.setLastUpdatedBy(account.getUsername());
|
||||
account.setLastUpdatedOn(now);
|
||||
em.merge(account);
|
||||
|
||||
}
|
||||
|
||||
public AccountLoginEntity updateSuccessFullLogin(AccountLoginEntity login, String byUser) {
|
||||
Date now = DateUtil.getCurrentTimeInUTC();
|
||||
// a scucessful login ends a password reset procedure
|
||||
if (login.getPasswordResetOngoing()) {
|
||||
login.setPasswordResetOngoing(false);
|
||||
login.setPasswordResetHash(null);
|
||||
login.setPasswordResetValidTo(null);
|
||||
login.setLastUpdatedOn(now);
|
||||
login.setLastUpdatedBy(byUser);
|
||||
}
|
||||
|
||||
login.setLastLogin(now);
|
||||
login.setFailureCount(0);
|
||||
return updateLogin(login);
|
||||
}
|
||||
|
||||
public AccountLoginEntity updateLogin(AccountLoginEntity login) {
|
||||
return em.merge(login);
|
||||
}
|
||||
|
||||
public void updateLogin(AccountEntity account) {
|
||||
if (account.getAccountLogin() == null) {
|
||||
// TODO connect to IPRS - how can an account ask for an updated login if the user cannot login
|
||||
} else {
|
||||
updateSuccessFullLogin(account.getAccountLogin(), account.getUsername());
|
||||
}
|
||||
}
|
||||
|
||||
public void addLoginError(AccountEntity account) {
|
||||
// TODO reimplement
|
||||
// try {
|
||||
// Date now = new Date(); // TODO now in UTC
|
||||
// account.setLastFailedLogin(now);
|
||||
// account.setFailureCount(account.getFailureCount() + 1);
|
||||
//
|
||||
// int maxFailedLogins = Integer.parseInt(configService.getConfigValue( "account.maxFailedLogins"));
|
||||
// if ((account.getFailureCount() >= maxFailedLogins) && (!account.getStatus().equals("LOCKED"))) { // TOD add status enum
|
||||
// // max failed logins reached, disabling user
|
||||
// LOGGER.info("Locking account " + account.getUsername() + " due to " + account.getFailureCount() + " failed logins");
|
||||
// account.setStatus(AccountStatus.BLOCKED.name());
|
||||
// }
|
||||
//
|
||||
// // on a failed login request, disable password reset
|
||||
// account.setPasswordResetOngoing(false);
|
||||
// account.setPasswordResetHash(null);
|
||||
// account.setPasswordResetValidTo(null);
|
||||
//
|
||||
// account.setLastUpdatedBy("system");
|
||||
// account.setLastUpdatedOn(now);
|
||||
// em.merge(account);
|
||||
// } catch (ConfigException ex) {
|
||||
// if (LOGGER.isDebugEnabled()) {
|
||||
// LOGGER.debug(ex.toString(), ex);
|
||||
// } else {
|
||||
// LOGGER.error(ex.toString());
|
||||
// }
|
||||
// }
|
||||
}
|
||||
|
||||
public AccountLoginEntity createLoginWithRandomPassword() {
|
||||
AccountLoginEntity login = new AccountLoginEntity();
|
||||
String randomPassword = RandomStringUtils.random(20, true, true);
|
||||
String hashedPassword = SecurityUtil.createPassword(randomPassword);
|
||||
login.setAccountPassword(hashedPassword);
|
||||
login.setLastLogin(null);
|
||||
login.setLastFailedLogin(null);
|
||||
login.setFailureCount(0);
|
||||
|
||||
return login;
|
||||
}
|
||||
|
||||
public String getHashedPassword(String password) {
|
||||
String hashedPassword = SecurityUtil.createPassword(password);
|
||||
return hashedPassword;
|
||||
}
|
||||
|
||||
@Transactional
|
||||
public void addLogin(AccountEntity accountToAdd, AccountLoginEntity accountLogin) {
|
||||
Date now = DateUtil.getCurrentTimeInUTC();
|
||||
Subject currentUser = SecurityUtils.getSubject();
|
||||
String currentLoggedInUser = currentUser.getPrincipal().toString();
|
||||
|
||||
AccountEntity account = em.merge(accountToAdd);
|
||||
accountLogin.setAccount(account);
|
||||
accountLogin.setCreatedBy(currentLoggedInUser);
|
||||
accountLogin.setCreatedOn(now);
|
||||
accountLogin.setLastUpdatedBy(currentLoggedInUser);
|
||||
accountLogin.setLastUpdatedOn(now);
|
||||
em.persist(accountLogin);
|
||||
|
||||
account.setAccountLogin(accountLogin);
|
||||
em.merge(account);
|
||||
|
||||
}
|
||||
|
||||
@Transactional
|
||||
public void deleteLogin(AccountEntity accountToDelete) {
|
||||
AccountEntity account = em.merge(accountToDelete);
|
||||
AccountLoginEntity login = account.getAccountLogin();
|
||||
login.setAccount(null);
|
||||
account.setAccountLogin(null);
|
||||
em.remove(login);
|
||||
em.merge(account);
|
||||
}
|
||||
|
||||
}
|
||||
package de.muehlencord.shared.account.business.account.control;
|
||||
|
||||
import de.muehlencord.shared.account.business.account.entity.AccountException;
|
||||
import de.muehlencord.shared.account.business.account.entity.AccountStatus;
|
||||
import de.muehlencord.shared.account.business.mail.entity.MailException;
|
||||
import de.muehlencord.shared.account.business.mail.boundary.MailService;
|
||||
import de.muehlencord.shared.account.business.account.entity.AccountEntity;
|
||||
import de.muehlencord.shared.account.business.account.entity.AccountLoginEntity;
|
||||
import de.muehlencord.shared.account.business.application.entity.ApplicationRoleEntity;
|
||||
import de.muehlencord.shared.account.business.application.entity.ApplicationEntity;
|
||||
import de.muehlencord.shared.account.util.AccountPU;
|
||||
import de.muehlencord.shared.account.util.SecurityUtil;
|
||||
import de.muehlencord.shared.util.DateUtil;
|
||||
import java.io.Serializable;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Date;
|
||||
import java.util.List;
|
||||
import javax.ejb.EJB;
|
||||
import javax.ejb.Stateless;
|
||||
import javax.inject.Inject;
|
||||
import javax.persistence.EntityManager;
|
||||
import javax.persistence.NoResultException;
|
||||
import javax.persistence.Query;
|
||||
import javax.transaction.Transactional;
|
||||
import org.apache.commons.lang3.RandomStringUtils;
|
||||
import org.slf4j.Logger;
|
||||
import org.slf4j.LoggerFactory;
|
||||
import org.apache.shiro.SecurityUtils;
|
||||
import org.apache.shiro.subject.Subject;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author joern.muehlencord
|
||||
*/
|
||||
@Stateless
|
||||
public class AccountControl implements Serializable {
|
||||
|
||||
private static final Logger LOGGER = LoggerFactory.getLogger(AccountControl.class.getName());
|
||||
private static final long serialVersionUID = 3424816272598108101L;
|
||||
|
||||
@EJB
|
||||
private MailService mailService;
|
||||
|
||||
@Inject
|
||||
private ApplicationEntity application;
|
||||
|
||||
@Inject
|
||||
@AccountPU
|
||||
EntityManager em;
|
||||
|
||||
/**
|
||||
* returns a list of active accounts
|
||||
*
|
||||
* @return a list of active accounts
|
||||
*/
|
||||
public List<AccountEntity> getActiveAccounts() {
|
||||
Query query = em.createQuery("SELECT a FROM AccountEntity a WHERE a.status <> :status", AccountEntity.class);
|
||||
query.setParameter("status", AccountStatus.DISABLED.name());
|
||||
return query.getResultList();
|
||||
}
|
||||
|
||||
/**
|
||||
* returns a list of active accounts
|
||||
*
|
||||
* @return a list of active accounts
|
||||
*/
|
||||
public List<AccountEntity> getAllAccounts() {
|
||||
Query query = em.createNamedQuery("AccountEntity.findAll");
|
||||
return query.getResultList();
|
||||
}
|
||||
|
||||
public List<AccountEntity> getAccounts(boolean includeDisabled) {
|
||||
if (includeDisabled) {
|
||||
return getAllAccounts();
|
||||
} else {
|
||||
return getActiveAccounts();
|
||||
}
|
||||
}
|
||||
|
||||
public AccountEntity getAccountEntity(String userName, boolean loadRoles) {
|
||||
StringBuilder queryBuilder = new StringBuilder();
|
||||
queryBuilder.append("SELECT a FROM AccountEntity a ");
|
||||
if (loadRoles) {
|
||||
queryBuilder.append("LEFT JOIN FETCH a.applicationRoleList ");
|
||||
}
|
||||
queryBuilder.append("WHERE a.username = :username");
|
||||
Query query = em.createQuery(queryBuilder.toString());
|
||||
query.setParameter("username", userName);
|
||||
try {
|
||||
return (AccountEntity) query.getSingleResult();
|
||||
} catch (NoResultException ex) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
@Transactional
|
||||
public AccountEntity saveAccount(AccountEntity account, ApplicationEntity app, List<ApplicationRoleEntity> applicationRoles) {
|
||||
Date now = DateUtil.getCurrentTimeInUTC();
|
||||
Subject currentUser = SecurityUtils.getSubject();
|
||||
String currentLoggedInUser = currentUser.getPrincipal().toString();
|
||||
|
||||
account.setLastUpdatedBy(currentLoggedInUser);
|
||||
account.setLastUpdatedOn(now);
|
||||
|
||||
boolean newAccount = (account.getCreatedOn() == null);
|
||||
|
||||
// new account
|
||||
if (newAccount) {
|
||||
account.setCreatedOn(now);
|
||||
account.setCreatedBy(currentLoggedInUser);
|
||||
em.persist(account);
|
||||
} else {
|
||||
em.merge(account);
|
||||
|
||||
// reload account from db and join roles
|
||||
account = getAccountEntity(account.getUsername(), true);
|
||||
}
|
||||
|
||||
// assign roles to account
|
||||
if (account.getApplicationRoleList() == null) {
|
||||
account.setApplicationRoleList(new ArrayList<>());
|
||||
}
|
||||
|
||||
boolean roleSetupChanged = false;
|
||||
// remove roles which are no longer listed
|
||||
// ensure this is only done for the given application - keep the other applications untouched
|
||||
List<ApplicationRoleEntity> assignedRoles = new ArrayList<>();
|
||||
assignedRoles.addAll(account.getApplicationRoleList());
|
||||
for (ApplicationRoleEntity currentlyAssignedRole : assignedRoles) {
|
||||
if ((currentlyAssignedRole.getApplication().equals(app) && (!applicationRoles.contains(currentlyAssignedRole)))) {
|
||||
account.getApplicationRoleList().remove(currentlyAssignedRole);
|
||||
roleSetupChanged = true;
|
||||
if (LOGGER.isDebugEnabled()) {
|
||||
LOGGER.debug("Removed role {} ({}) from user {}", currentlyAssignedRole.getRoleName(), application.getApplicationName(), account.getUsername());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// add newly added roles to role list
|
||||
for (ApplicationRoleEntity applicationRole : applicationRoles) {
|
||||
if (!account.getApplicationRoleList().contains(applicationRole)) {
|
||||
account.addApplicationRole(applicationRole);
|
||||
roleSetupChanged = true;
|
||||
if (LOGGER.isDebugEnabled()) {
|
||||
LOGGER.debug("Added role {} ({}) to account {}", applicationRole.getRoleName(), application.getApplicationName(), account.getUsername());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// update account in database if roles changed
|
||||
if (roleSetupChanged) {
|
||||
em.merge(account);
|
||||
}
|
||||
return account;
|
||||
}
|
||||
|
||||
@Transactional
|
||||
public void deleteAccount(AccountEntity account) throws AccountException {
|
||||
Date now = new Date(); // Todo now in UTC
|
||||
Subject currentUser = SecurityUtils.getSubject();
|
||||
String currentUserName = currentUser.getPrincipal().toString();
|
||||
|
||||
if (account.getUsername().equals(currentUserName)) {
|
||||
throw new AccountException("Cannot delete own account");
|
||||
} else {
|
||||
account.setStatus(AccountStatus.DISABLED.name());
|
||||
account.setLastUpdatedBy(currentUserName);
|
||||
account.setLastUpdatedOn(now);
|
||||
em.merge(account);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
public boolean initPasswordReset(String userName) {
|
||||
try {
|
||||
AccountEntity account = getAccountEntity(userName, false);
|
||||
if (account == null) {
|
||||
LOGGER.warn("Account with name " + userName + " not found");
|
||||
return false;
|
||||
}
|
||||
|
||||
if (account.getStatus().equals(AccountStatus.BLOCKED.name())) {
|
||||
LOGGER.warn("Account " + userName + " is locked, cannot initialize password reset");
|
||||
return false;
|
||||
}
|
||||
|
||||
String randomString = RandomStringUtils.random(40, true, true);
|
||||
|
||||
Date validTo = new Date(); // TODO now in UTC
|
||||
validTo = new Date(validTo.getTime() + 1000 * 600); // 10 minutes to react
|
||||
|
||||
// TODO rework password reset
|
||||
// account.setPasswordResetHash(randomString);
|
||||
// account.setPasswordResetOngoing(true);
|
||||
// account.setPasswordResetValidTo(validTo);
|
||||
mailService.sendPasswortResetStartEmail(account, randomString);
|
||||
|
||||
em.merge(account);
|
||||
return true;
|
||||
} catch (MailException ex) {
|
||||
LOGGER.error("Error while sending password reset mail. " + ex.toString());
|
||||
if (LOGGER.isDebugEnabled()) {
|
||||
LOGGER.debug("Error while sending password reset mail.", ex);
|
||||
}
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
public boolean resetPassword(String userName, String newPassword, String resetPasswordToken) {
|
||||
AccountEntity account = getAccountEntity(userName, false);
|
||||
|
||||
if (account == null) {
|
||||
LOGGER.warn("Error while resetting password, no account with username " + userName + " found");
|
||||
// TODO add extra logging for intrusion protection system like fail2ban
|
||||
return false;
|
||||
}
|
||||
|
||||
/*
|
||||
if (account.getPasswordResetOngoing() && (account.getPasswordResetHash() != null) && (account.getPasswordResetValidTo() != null)) {
|
||||
Date now = new Date(); // TODO now in UTC
|
||||
String storedHash = account.getPasswordResetHash().trim();
|
||||
if (account.getPasswordResetValidTo().after(now)) {
|
||||
if (storedHash.equals(resetPasswordToken)) {
|
||||
// everything ok, reset password
|
||||
executePasswordReset(account, newPassword);
|
||||
LOGGER.info("Updated password for user " + userName);
|
||||
return true;
|
||||
} else {
|
||||
// token is not valid, refuse to change password
|
||||
LOGGER.warn("Trying to reset password for user " + userName + " but wrong token " + resetPasswordToken + " provided");
|
||||
addLoginError(account);
|
||||
return false;
|
||||
}
|
||||
} else {
|
||||
// password reset token no longer valid
|
||||
LOGGER.warn("Trying to reset password for user " + userName + " but token is no longer valid");
|
||||
addLoginError(account);
|
||||
return false;
|
||||
}
|
||||
} else {
|
||||
// user is not is password reset mode
|
||||
LOGGER.warn("Trying to reset password for user " + userName + " but password reset was not requested");
|
||||
addLoginError(account);
|
||||
return false;
|
||||
}
|
||||
*/
|
||||
return false; // FIMXE re-implement password reset
|
||||
}
|
||||
|
||||
private void executePasswordReset(AccountEntity account, String newPassword) {
|
||||
Date now = new Date(); // TODO now in UTC
|
||||
|
||||
String hashedPassword = SecurityUtil.createPassword(newPassword);
|
||||
// account.setAccountPassword(hashedPassword);
|
||||
//
|
||||
// account.setPasswordResetOngoing(false);
|
||||
// account.setPasswordResetHash(null);
|
||||
// account.setPasswordResetValidTo(null);
|
||||
|
||||
account.setLastUpdatedBy(account.getUsername());
|
||||
account.setLastUpdatedOn(now);
|
||||
em.merge(account);
|
||||
|
||||
}
|
||||
|
||||
public AccountLoginEntity updateSuccessFullLogin(AccountLoginEntity login, String byUser) {
|
||||
Date now = DateUtil.getCurrentTimeInUTC();
|
||||
// a scucessful login ends a password reset procedure
|
||||
if (login.getPasswordResetOngoing()) {
|
||||
login.setPasswordResetOngoing(false);
|
||||
login.setPasswordResetHash(null);
|
||||
login.setPasswordResetValidTo(null);
|
||||
login.setLastUpdatedOn(now);
|
||||
login.setLastUpdatedBy(byUser);
|
||||
}
|
||||
|
||||
login.setLastLogin(now);
|
||||
login.setFailureCount(0);
|
||||
return updateLogin(login);
|
||||
}
|
||||
|
||||
public AccountLoginEntity updateLogin(AccountLoginEntity login) {
|
||||
return em.merge(login);
|
||||
}
|
||||
|
||||
public void updateLogin(AccountEntity account) {
|
||||
if (account.getAccountLogin() == null) {
|
||||
// TODO connect to IPRS - how can an account ask for an updated login if the user cannot login
|
||||
} else {
|
||||
updateSuccessFullLogin(account.getAccountLogin(), account.getUsername());
|
||||
}
|
||||
}
|
||||
|
||||
public void addLoginError(AccountEntity account) {
|
||||
// TODO reimplement
|
||||
// try {
|
||||
// Date now = new Date(); // TODO now in UTC
|
||||
// account.setLastFailedLogin(now);
|
||||
// account.setFailureCount(account.getFailureCount() + 1);
|
||||
//
|
||||
// int maxFailedLogins = Integer.parseInt(configService.getConfigValue( "account.maxFailedLogins"));
|
||||
// if ((account.getFailureCount() >= maxFailedLogins) && (!account.getStatus().equals("LOCKED"))) { // TOD add status enum
|
||||
// // max failed logins reached, disabling user
|
||||
// LOGGER.info("Locking account " + account.getUsername() + " due to " + account.getFailureCount() + " failed logins");
|
||||
// account.setStatus(AccountStatus.BLOCKED.name());
|
||||
// }
|
||||
//
|
||||
// // on a failed login request, disable password reset
|
||||
// account.setPasswordResetOngoing(false);
|
||||
// account.setPasswordResetHash(null);
|
||||
// account.setPasswordResetValidTo(null);
|
||||
//
|
||||
// account.setLastUpdatedBy("system");
|
||||
// account.setLastUpdatedOn(now);
|
||||
// em.merge(account);
|
||||
// } catch (ConfigException ex) {
|
||||
// if (LOGGER.isDebugEnabled()) {
|
||||
// LOGGER.debug(ex.toString(), ex);
|
||||
// } else {
|
||||
// LOGGER.error(ex.toString());
|
||||
// }
|
||||
// }
|
||||
}
|
||||
|
||||
public AccountLoginEntity createLoginWithRandomPassword() {
|
||||
AccountLoginEntity login = new AccountLoginEntity();
|
||||
String randomPassword = RandomStringUtils.random(20, true, true);
|
||||
String hashedPassword = SecurityUtil.createPassword(randomPassword);
|
||||
login.setAccountPassword(hashedPassword);
|
||||
login.setLastLogin(null);
|
||||
login.setLastFailedLogin(null);
|
||||
login.setFailureCount(0);
|
||||
|
||||
return login;
|
||||
}
|
||||
|
||||
public String getHashedPassword(String password) {
|
||||
String hashedPassword = SecurityUtil.createPassword(password);
|
||||
return hashedPassword;
|
||||
}
|
||||
|
||||
@Transactional
|
||||
public void addLogin(AccountEntity accountToAdd, AccountLoginEntity accountLogin) {
|
||||
Date now = DateUtil.getCurrentTimeInUTC();
|
||||
Subject currentUser = SecurityUtils.getSubject();
|
||||
String currentLoggedInUser = currentUser.getPrincipal().toString();
|
||||
|
||||
AccountEntity account = em.merge(accountToAdd);
|
||||
accountLogin.setAccount(account);
|
||||
accountLogin.setCreatedBy(currentLoggedInUser);
|
||||
accountLogin.setCreatedOn(now);
|
||||
accountLogin.setLastUpdatedBy(currentLoggedInUser);
|
||||
accountLogin.setLastUpdatedOn(now);
|
||||
em.persist(accountLogin);
|
||||
|
||||
account.setAccountLogin(accountLogin);
|
||||
em.merge(account);
|
||||
|
||||
}
|
||||
|
||||
@Transactional
|
||||
public void deleteLogin(AccountEntity accountToDelete) {
|
||||
AccountEntity account = em.merge(accountToDelete);
|
||||
AccountLoginEntity login = account.getAccountLogin();
|
||||
login.setAccount(null);
|
||||
account.setAccountLogin(null);
|
||||
em.remove(login);
|
||||
em.merge(account);
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user