boolean handleLoggedInUser( FilterChain chain, HttpServletRequest httpRequest, HttpServletResponse httpResponse, ServiceAccess serviceAccess, AuthorizationRequestData rdo) throws ServletException, IOException { VOUserDetails userDetails = rdo.getUserDetails(); if (userDetails != null) { httpRequest.getSession().setAttribute(PORTAL_HAS_BEEN_REQUESTED, !rdo.isMarketplace()); // if the user wants to use another organization he must login // again (the service sessions are destroyed as well) // don't let a user with status PASSWORD_MUST_BE_CHANGED see any // site but the one to change the pwd if (!authSettings.isServiceProvider()) { if (userDetails.getStatus() == UserAccountStatus.PASSWORD_MUST_BE_CHANGED && !rdo.isRequestedToChangePwd()) { forwardToPwdPage(userDetails.getUserId(), httpRequest, httpResponse); return true; } } // TODO stavreva: check this again if (authSettings.isServiceProvider() || !rdo.isRequestedToChangePwd()) { long t = System.currentTimeMillis(); if (ADMStringUtils.isBlank(httpRequest.getServletPath()) || httpRequest.getServletPath().startsWith(MenuBean.LINK_DEFAULT)) { String defaultUrl = getDefaultUrl(serviceAccess, rdo, httpRequest); forward(defaultUrl, httpRequest, httpResponse); } if (loginPage.equalsIgnoreCase(httpRequest.getServletPath())) { sendRedirect(httpRequest, httpResponse, MenuBean.LINK_DEFAULT); } if (isPageForbiddenToAccess(httpRequest, rdo, serviceAccess)) { forward(insufficientAuthoritiesUrl, httpRequest, httpResponse); } chain.doFilter(httpRequest, httpResponse); if (logger.isDebugLoggingEnabled()) { logger.logDebug( "URL='" + rdo.getRelativePath() + "' processed in " + (System.currentTimeMillis() - t) + "ms"); } return true; } } return false; }
/** * Invokes the validators and bean actions specified in the xhtml file to change the user's * password. * * @throws ServletException * @throws IOException * @throws DatatypeConfigurationException * @throws SAML2AuthnRequestException */ protected boolean handleChangeUserPasswordRequest( FilterChain chain, HttpServletRequest httpRequest, HttpServletResponse httpResponse, AuthorizationRequestData rdo, IdentityService identityService) throws IOException, ServletException { if (rdo.isRequestedToChangePwd()) { if (!PasswordValidator.validPasswordLength(rdo.getNewPassword()) || !PasswordValidator.validPasswordLength(rdo.getNewPassword2()) || !PasswordValidator.passwordsAreEqual(rdo.getNewPassword(), rdo.getNewPassword2())) { // Let JSF run the validators and return the response! chain.doFilter(httpRequest, httpResponse); return false; } // Run the validators and bean methods. Prevent JSF // from writing content to the response, otherwise the following // redirect's wouldn't work. HttpServletResponse resp = new HttpServletResponseWrapper(httpResponse) { @Override public void flushBuffer() throws IOException {} @Override public PrintWriter getWriter() throws IOException { return new PrintWriter(getOutputStream()); } @Override public ServletOutputStream getOutputStream() throws IOException { return new ServletOutputStream() { @Override public void write(int b) throws IOException {} }; } }; chain.doFilter(httpRequest, resp); httpResponse.reset(); } VOUser voUser = new VOUser(); voUser.setUserId(rdo.getUserId()); try { voUser = identityService.getUser(voUser); } catch (ObjectNotFoundException e) { handleUserNotRegistered(chain, httpRequest, httpResponse, rdo); return false; } catch (SaaSApplicationException e) { setErrorAttributesAndForward(errorPage, httpRequest, httpResponse, e); return false; } if (httpRequest.getAttribute(Constants.REQ_ATTR_ERROR_KEY) != null) { // Error occurred - check if user is locked now if (voUser.getStatus() != null && voUser.getStatus().getLockLevel() > UserAccountStatus.LOCK_LEVEL_LOGIN) { httpRequest.setAttribute(Constants.REQ_ATTR_ERROR_KEY, BaseBean.ERROR_USER_LOCKED); sendRedirect(httpRequest, httpResponse, errorPage); } else { // Run it again to get error result on current response chain.doFilter(httpRequest, httpResponse); } return false; } if (voUser.getStatus() != UserAccountStatus.ACTIVE) { // the password change request failed // set the REQ_ATTR_ERROR_KEY to avoid an infinite loop httpRequest .getSession() .setAttribute(Constants.SESS_ATTR_USER, identityService.getCurrentUserDetails()); httpRequest.setAttribute(Constants.REQ_ATTR_ERROR_KEY, ""); if (rdo.isMarketplace()) { forward(BaseBean.MARKETPLACE_LOGIN, httpRequest, httpResponse); } else { forward(pwdPage, httpRequest, httpResponse); } return false; } rdo.setPassword(httpRequest.getParameter(BesServletRequestReader.REQ_PARAM_PASSWORD_NEW)); rdo.getUserDetails().setStatus(UserAccountStatus.ACTIVE); return true; }
protected void handleProtectedUrlAndChangePwdCase( FilterChain chain, HttpServletRequest httpRequest, HttpServletResponse httpResponse, AuthorizationRequestData rdo) throws IOException, ServletException { if (logger.isDebugLoggingEnabled()) { logger.logDebug("Access to protected URL='" + rdo.getRelativePath() + "'"); } ServiceAccess serviceAccess = ServiceAccess.getServiceAcccessFor(httpRequest.getSession()); try { if (rdo.isAccessToServiceUrl()) { /* * We must NOT read the request parameters for service URLs * because this would cause a state switch of the request. * Afterwards the rewriting of a POST request may fail because * the parameters can't be accessed via the request input * stream. */ httpRequest = handleServiceUrl(chain, httpRequest, httpResponse, rdo); if (httpRequest == null) { return; } } else if (ADMStringUtils.isBlank(rdo.getUserId())) { if (authSettings.isServiceProvider()) { if (isSamlForward(httpRequest)) { SAMLCredentials samlCredentials = new SAMLCredentials(httpRequest); rdo.setUserId(samlCredentials.getUserId()); if (rdo.getUserId() == null) { httpRequest.setAttribute( Constants.REQ_ATTR_ERROR_KEY, BaseBean.ERROR_INVALID_SAML_RESPONSE); forward(errorPage, httpRequest, httpResponse); } } } else { rdo.setUserId(httpRequest.getParameter(Constants.REQ_PARAM_USER_ID)); } } // continue if user is already logged-in if (handleLoggedInUser(chain, httpRequest, httpResponse, serviceAccess, rdo)) { return; } // the httpRequest was already processed and we forwarded to the // corresponding page therefore we must not try to login again if (httpRequest.getAttribute(Constants.REQ_ATTR_ERROR_KEY) != null) { chain.doFilter(httpRequest, httpResponse); return; } refreshData(authSettings, rdo, httpRequest, httpResponse); // user not logged in, check user-name and password before login // don't do a trim on password because it may have // leading/trailing/only blanks if (authSettings.isServiceProvider()) { rollbackDefaultTimeout(httpRequest); if (ADMStringUtils.isBlank(rdo.getUserId())) { httpRequest.setAttribute( Constants.REQ_ATTR_ERROR_KEY, BaseBean.ERROR_INVALID_SAML_RESPONSE); if (isSamlForward(httpRequest)) { forward(errorPage, httpRequest, httpResponse); } else { forwardToLoginPage(rdo.getRelativePath(), true, httpRequest, httpResponse, chain); } return; } } else { if (ADMStringUtils.isBlank(rdo.getUserId()) || !rdo.isPasswordSet()) { if (!rdo.isMarketplace() && (!ADMStringUtils.isBlank(rdo.getUserId()) || rdo.isPasswordSet())) { // login data not complete, user or password empty httpRequest.setAttribute(Constants.REQ_ATTR_ERROR_KEY, BaseBean.ERROR_LOGIN); } forwardToLoginPage(rdo.getRelativePath(), true, httpRequest, httpResponse, chain); return; } } IdentityService identityService = serviceAccess.getService(IdentityService.class); VOUser voUser; try { voUser = readTechnicalUserFromDb(identityService, rdo); } catch (ObjectNotFoundException e) { handleUserNotRegistered(chain, httpRequest, httpResponse, rdo); return; } catch (SaaSApplicationException e) { setErrorAttributesAndForward(errorPage, httpRequest, httpResponse, e); return; } if (!authSettings.isServiceProvider()) { if (isAccountLocked(httpRequest, httpResponse, voUser)) { return; } } final boolean operationSucceeded; if (!authSettings.isServiceProvider() && rdo.isRequestedToChangePwd()) { operationSucceeded = handleChangeUserPasswordRequest(chain, httpRequest, httpResponse, rdo, identityService); } else { operationSucceeded = loginUser(chain, httpRequest, httpResponse, voUser, rdo, identityService); } if (!operationSucceeded) { return; } rdo.setUserDetails(identityService.getCurrentUserDetails()); // read user details value object and store it in the session, DON'T // use old session, because it might have been invalidated httpRequest.getSession().setAttribute(Constants.SESS_ATTR_USER, rdo.getUserDetails()); if (isPageForbiddenToAccess(httpRequest, rdo, serviceAccess)) { forward(insufficientAuthoritiesUrl, httpRequest, httpResponse); } // check if user must change his password if (!authSettings.isServiceProvider() && (rdo.getUserDetails().getStatus() == UserAccountStatus.PASSWORD_MUST_BE_CHANGED)) { forwardToPwdPage(rdo.getUserDetails().getUserId(), httpRequest, httpResponse); } else { redirectToPrimarilyRequestedUrl(chain, httpRequest, httpResponse, serviceAccess, rdo); } } catch (NumberFormatException e) { handleNumberFormatException(chain, httpRequest, httpResponse, e, rdo); } catch (ServletException e) { handleServletException(httpRequest, httpResponse, e); } catch (MarketplaceRemovedException e) { handleMarketplaceRemovedException(httpRequest, httpResponse); } }