Examples with ProtectedStringType com.evolveum.prism.xml.ns._public.types_3.ProtectedStringType used on opensource projects

Example 61 with ProtectedStringType

use of com.evolveum.prism.xml.ns._public.types_3.ProtectedStringType in project midpoint by Evolveum.

the class ConnIdConvertor method fromGuardedString.

private ProtectedStringType fromGuardedString(GuardedString icfValue) {
    final ProtectedStringType ps = new ProtectedStringType();
    icfValue.access(new GuardedString.Accessor() {

        @Override
        public void access(char[] passwordChars) {
            try {
                ps.setClearValue(new String(passwordChars));
                protector.encrypt(ps);
            } catch (EncryptionException e) {
                throw new IllegalStateException("Protector failed to encrypt password");
            }
        }
    });
    return ps;
}

Example 62 with ProtectedStringType

use of com.evolveum.prism.xml.ns._public.types_3.ProtectedStringType in project midpoint by Evolveum.

the class ConnIdConvertor method convertToResourceObject.

/**
	 * Converts ICF ConnectorObject to the midPoint ResourceObject.
	 * <p/>
	 * All the attributes are mapped using the same way as they are mapped in
	 * the schema (which is actually no mapping at all now).
	 * <p/>
	 * If an optional ResourceObjectDefinition was provided, the resulting
	 * ResourceObject is schema-aware (getDefinition() method works). If no
	 * ResourceObjectDefinition was provided, the object is schema-less. TODO:
	 * this still needs to be implemented.
	 * 
	 * @param co
	 *            ICF ConnectorObject to convert
	 * @param def
	 *            ResourceObjectDefinition (from the schema) or null
	 * @param full
	 *            if true it describes if the returned resource object should
	 *            contain all of the attributes defined in the schema, if false
	 *            the returned resource object will contain only attributed with
	 *            the non-null values.
	 * @return new mapped ResourceObject instance.
	 * @throws SchemaException
	 */
<T extends ShadowType> PrismObject<T> convertToResourceObject(ConnectorObject co, PrismObjectDefinition<T> objectDefinition, boolean full, boolean caseIgnoreAttributeNames, boolean legacySchema) throws SchemaException {
    PrismObject<T> shadowPrism = null;
    if (objectDefinition != null) {
        shadowPrism = objectDefinition.instantiate();
    } else {
        throw new SchemaException("No definition");
    }
    // LOGGER.trace("Instantiated prism object {} from connector object.",
    // shadowPrism.debugDump());
    T shadow = shadowPrism.asObjectable();
    ResourceAttributeContainer attributesContainer = (ResourceAttributeContainer) shadowPrism.findOrCreateContainer(ShadowType.F_ATTRIBUTES);
    ResourceAttributeContainerDefinition attributesContainerDefinition = attributesContainer.getDefinition();
    shadow.setObjectClass(attributesContainerDefinition.getTypeName());
    List<ObjectClassComplexTypeDefinition> auxiliaryObjectClassDefinitions = new ArrayList<>();
    for (Attribute icfAttr : co.getAttributes()) {
        if (icfAttr.is(PredefinedAttributes.AUXILIARY_OBJECT_CLASS_NAME)) {
            List<QName> auxiliaryObjectClasses = shadow.getAuxiliaryObjectClass();
            for (Object auxiliaryIcfObjectClass : icfAttr.getValue()) {
                QName auxiliaryObjectClassQname = icfNameMapper.objectClassToQname(new ObjectClass((String) auxiliaryIcfObjectClass), resourceSchemaNamespace, legacySchema);
                auxiliaryObjectClasses.add(auxiliaryObjectClassQname);
                ObjectClassComplexTypeDefinition auxiliaryObjectClassDefinition = icfNameMapper.getResourceSchema().findObjectClassDefinition(auxiliaryObjectClassQname);
                if (auxiliaryObjectClassDefinition == null) {
                    throw new SchemaException("Resource object " + co + " refers to auxiliary object class " + auxiliaryObjectClassQname + " which is not in the schema");
                }
                auxiliaryObjectClassDefinitions.add(auxiliaryObjectClassDefinition);
            }
            break;
        }
    }
    for (Attribute icfAttr : co.getAttributes()) {
        if (LOGGER.isTraceEnabled()) {
            LOGGER.trace("Reading ICF attribute {}: {}", icfAttr.getName(), icfAttr.getValue());
        }
        if (icfAttr.getName().equals(Uid.NAME)) {
            // UID is handled specially (see above)
            continue;
        }
        if (icfAttr.is(PredefinedAttributes.AUXILIARY_OBJECT_CLASS_NAME)) {
            // Already processed
            continue;
        }
        if (icfAttr.getName().equals(OperationalAttributes.PASSWORD_NAME)) {
            // password has to go to the credentials section
            ProtectedStringType password = getSingleValue(icfAttr, ProtectedStringType.class);
            if (password == null) {
                // equals() instead of == is needed. The AttributeValueCompleteness enum may be loaded by different classloader
                if (!AttributeValueCompleteness.INCOMPLETE.equals(icfAttr.getAttributeValueCompleteness())) {
                    continue;
                }
                // There is no password value in the ConnId attribute. But it was indicated that
                // that attribute is incomplete. Therefore we can assume that there in fact is a value.
                // We just do not know it.
                ShadowUtil.setPasswordIncomplete(shadow);
                LOGGER.trace("Converted password: (incomplete)");
            } else {
                ShadowUtil.setPassword(shadow, password);
                LOGGER.trace("Converted password: {}", password);
            }
            continue;
        }
        if (icfAttr.getName().equals(OperationalAttributes.ENABLE_NAME)) {
            Boolean enabled = getSingleValue(icfAttr, Boolean.class);
            if (enabled == null) {
                continue;
            }
            ActivationType activationType = ShadowUtil.getOrCreateActivation(shadow);
            ActivationStatusType activationStatusType;
            if (enabled) {
                activationStatusType = ActivationStatusType.ENABLED;
            } else {
                activationStatusType = ActivationStatusType.DISABLED;
            }
            activationType.setAdministrativeStatus(activationStatusType);
            activationType.setEffectiveStatus(activationStatusType);
            LOGGER.trace("Converted activation administrativeStatus: {}", activationStatusType);
            continue;
        }
        if (icfAttr.getName().equals(OperationalAttributes.ENABLE_DATE_NAME)) {
            Long millis = getSingleValue(icfAttr, Long.class);
            if (millis == null) {
                continue;
            }
            ActivationType activationType = ShadowUtil.getOrCreateActivation(shadow);
            activationType.setValidFrom(XmlTypeConverter.createXMLGregorianCalendar(millis));
            continue;
        }
        if (icfAttr.getName().equals(OperationalAttributes.DISABLE_DATE_NAME)) {
            Long millis = getSingleValue(icfAttr, Long.class);
            if (millis == null) {
                continue;
            }
            ActivationType activationType = ShadowUtil.getOrCreateActivation(shadow);
            activationType.setValidTo(XmlTypeConverter.createXMLGregorianCalendar(millis));
            continue;
        }
        if (icfAttr.getName().equals(OperationalAttributes.LOCK_OUT_NAME)) {
            Boolean lockOut = getSingleValue(icfAttr, Boolean.class);
            if (lockOut == null) {
                continue;
            }
            ActivationType activationType = ShadowUtil.getOrCreateActivation(shadow);
            LockoutStatusType lockoutStatusType;
            if (lockOut) {
                lockoutStatusType = LockoutStatusType.LOCKED;
            } else {
                lockoutStatusType = LockoutStatusType.NORMAL;
            }
            activationType.setLockoutStatus(lockoutStatusType);
            LOGGER.trace("Converted activation lockoutStatus: {}", lockoutStatusType);
            continue;
        }
        QName qname = icfNameMapper.convertAttributeNameToQName(icfAttr.getName(), attributesContainerDefinition);
        ResourceAttributeDefinition attributeDefinition = attributesContainerDefinition.findAttributeDefinition(qname, caseIgnoreAttributeNames);
        if (attributeDefinition == null) {
            // Try to locate definition in auxiliary object classes
            for (ObjectClassComplexTypeDefinition auxiliaryObjectClassDefinition : auxiliaryObjectClassDefinitions) {
                attributeDefinition = auxiliaryObjectClassDefinition.findAttributeDefinition(qname, caseIgnoreAttributeNames);
                if (attributeDefinition != null) {
                    break;
                }
            }
            if (attributeDefinition == null) {
                throw new SchemaException("Unknown attribute " + qname + " in definition of object class " + attributesContainerDefinition.getTypeName() + ". Original ICF name: " + icfAttr.getName(), qname);
            }
        }
        if (caseIgnoreAttributeNames) {
            // normalized version
            qname = attributeDefinition.getName();
        }
        ResourceAttribute<Object> resourceAttribute = attributeDefinition.instantiate(qname);
        // resource object also with the null-values attributes
        if (full) {
            if (icfAttr.getValue() != null) {
                // of them may need it (e.g. GuardedString)
                for (Object icfValue : icfAttr.getValue()) {
                    Object value = convertValueFromIcf(icfValue, qname);
                    resourceAttribute.add(new PrismPropertyValue<>(value));
                }
            }
            LOGGER.trace("Converted attribute {}", resourceAttribute);
            attributesContainer.getValue().add(resourceAttribute);
        // in this case when false, we need only the attributes with the
        // non-null values.
        } else {
            if (icfAttr.getValue() != null && !icfAttr.getValue().isEmpty()) {
                // Convert the values. While most values do not need
                // conversions, some of them may need it (e.g. GuardedString)
                boolean empty = true;
                for (Object icfValue : icfAttr.getValue()) {
                    if (icfValue != null) {
                        Object value = convertValueFromIcf(icfValue, qname);
                        empty = false;
                        resourceAttribute.add(new PrismPropertyValue<>(value));
                    }
                }
                if (!empty) {
                    LOGGER.trace("Converted attribute {}", resourceAttribute);
                    attributesContainer.getValue().add(resourceAttribute);
                }
            }
        }
    }
    // Add Uid if it is not there already. It can be already present, 
    // e.g. if Uid and Name represent the same attribute
    Uid uid = co.getUid();
    ObjectClassComplexTypeDefinition ocDef = attributesContainerDefinition.getComplexTypeDefinition();
    ResourceAttributeDefinition<String> uidDefinition = ConnIdUtil.getUidDefinition(ocDef);
    if (uidDefinition == null) {
        throw new SchemaException("No definition for ConnId UID attribute found in definition " + ocDef);
    }
    if (attributesContainer.getValue().findItem(uidDefinition.getName()) == null) {
        ResourceAttribute<String> uidRoa = uidDefinition.instantiate();
        uidRoa.setValue(new PrismPropertyValue<String>(uid.getUidValue()));
        attributesContainer.getValue().add(uidRoa);
    }
    return shadowPrism;
}

Example 63 with ProtectedStringType

use of com.evolveum.prism.xml.ns._public.types_3.ProtectedStringType in project midpoint by Evolveum.

the class ConnectorInstanceConnIdImpl method convertFromPassword.

private void convertFromPassword(Set<Attribute> attributes, PropertyDelta<ProtectedStringType> passwordDelta) throws SchemaException {
    if (passwordDelta == null) {
        throw new IllegalArgumentException("No password was provided");
    }
    QName elementName = passwordDelta.getElementName();
    if (StringUtils.isBlank(elementName.getNamespaceURI())) {
        if (!QNameUtil.match(elementName, PasswordType.F_VALUE)) {
            return;
        }
    } else if (!passwordDelta.getElementName().equals(PasswordType.F_VALUE)) {
        return;
    }
    PrismProperty<ProtectedStringType> newPassword = passwordDelta.getPropertyNewMatchingPath();
    if (newPassword == null || newPassword.isEmpty()) {
        // This is the case of setting no password. E.g. removing existing password
        LOGGER.debug("Setting null password.");
        attributes.add(AttributeBuilder.build(OperationalAttributes.PASSWORD_NAME, Collections.EMPTY_LIST));
    } else if (newPassword.getRealValue().canGetCleartext()) {
        // We have password and we can get a cleartext value of the passowrd. This is normal case
        GuardedString guardedPassword = ConnIdUtil.toGuardedString(newPassword.getRealValue(), "new password", protector);
        attributes.add(AttributeBuilder.build(OperationalAttributes.PASSWORD_NAME, guardedPassword));
    } else {
        // We have password, but we cannot get a cleartext value. Just to nothing.
        LOGGER.debug("We would like to set password, but we do not have cleartext value. Skipping the opearation.");
    }
}

Example 64 with ProtectedStringType

use of com.evolveum.prism.xml.ns._public.types_3.ProtectedStringType in project midpoint by Evolveum.

the class PageForgotPassword method saveUserNonce.

private OperationResult saveUserNonce(final UserType user, final NonceCredentialsPolicyType noncePolicy) {
    return runPrivileged(new Producer<OperationResult>() {

        @Override
        public OperationResult run() {
            Task task = createAnonymousTask("generateUserNonce");
            task.setChannel(SchemaConstants.CHANNEL_GUI_RESET_PASSWORD_URI);
            task.setOwner(user.asPrismObject());
            OperationResult result = new OperationResult("generateUserNonce");
            ProtectedStringType nonceCredentials = new ProtectedStringType();
            try {
                nonceCredentials.setClearValue(generateNonce(noncePolicy, task, user.asPrismObject(), result));
                NonceType nonceType = new NonceType();
                nonceType.setValue(nonceCredentials);
                ObjectDelta<UserType> nonceDelta;
                nonceDelta = ObjectDelta.createModificationReplaceContainer(UserType.class, user.getOid(), SchemaConstants.PATH_NONCE, getPrismContext(), nonceType);
                WebModelServiceUtils.save(nonceDelta, result, task, PageForgotPassword.this);
            } catch (SchemaException | ExpressionEvaluationException | ObjectNotFoundException e) {
                result.recordFatalError("Failed to generate nonce for user");
                LoggingUtils.logException(LOGGER, "Failed to generate nonce for user: " + e.getMessage(), e);
            }
            result.computeStatusIfUnknown();
            return result;
        }
    });
}

Example 65 with ProtectedStringType

use of com.evolveum.prism.xml.ns._public.types_3.ProtectedStringType in project midpoint by Evolveum.

the class PageSecurityQuestions method resetPassword.

private void resetPassword(UserType user, AjaxRequestTarget target) {
    Task task = createAnonymousTask(OPERATION_RESET_PASSWORD);
    OperationResult result = task.getResult();
    LOGGER.debug("Resetting password for {}", user);
    ProtectedStringType password = new ProtectedStringType();
    Collection<SelectorOptions<GetOperationOptions>> options = SelectorOptions.createCollection(GetOperationOptions.createResolve(), SystemConfigurationType.F_DEFAULT_USER_TEMPLATE, SystemConfigurationType.F_GLOBAL_PASSWORD_POLICY);
    PrismObject<SystemConfigurationType> systemConfig = null;
    String newPassword = "";
    PageBase page = (PageBase) getPage();
    ModelService modelService = page.getModelService();
    try {
        systemConfig = modelService.getObject(SystemConfigurationType.class, SystemObjectsType.SYSTEM_CONFIGURATION.value(), options, task, result);
        LOGGER.trace("system config {}", systemConfig);
        if (systemConfig.asObjectable().getNotificationConfiguration() != null) {
            // Security policy with the minumum number of chars
            if (systemConfig.asObjectable().getGlobalPasswordPolicyRef() != null) {
                PrismObject<ValuePolicyType> valPolicy = modelService.getObject(ValuePolicyType.class, systemConfig.asObjectable().getGlobalPasswordPolicyRef().getOid(), options, task, result);
                LOGGER.trace("password policy {}", valPolicy);
                newPassword = getModelInteractionService().generateValue(valPolicy.asObjectable().getStringPolicy(), valPolicy.asObjectable().getStringPolicy().getLimitations().getMinLength(), false, user.asPrismObject(), "security questions password generation", task, result);
            } else {
                // TODO What if there is no policy? What should be done to
                // provide a new automatic password
                warn(getString("pageSecurityQuestions.message.noPolicySet"));
                target.add(getFeedbackPanel());
                return;
            }
        } else {
            // TODO localization
            getSession().error(getString("pageSecurityQuestions.message.notificationsNotSet"));
            LOGGER.trace("Notificatons not set, returning to login page");
            throw new RestartResponseException(PageLogin.class);
        }
    } catch (ObjectNotFoundException | ExpressionEvaluationException e1) {
        LoggingUtils.logUnexpectedException(LOGGER, "Couldn't reset password", e1);
    } catch (SchemaException e1) {
        LoggingUtils.logUnexpectedException(LOGGER, "Couldn't reset password", e1);
        e1.printStackTrace();
    } catch (SecurityViolationException e1) {
        LoggingUtils.logUnexpectedException(LOGGER, "Couldn't reset password", e1);
    } catch (CommunicationException e1) {
        LoggingUtils.logUnexpectedException(LOGGER, "Couldn't reset password", e1);
    } catch (ConfigurationException e1) {
        LoggingUtils.logUnexpectedException(LOGGER, "Couldn't reset password", e1);
    }
    password.setClearValue(newPassword);
    WebComponentUtil.encryptProtectedString(password, true, getMidpointApplication());
    final ItemPath valuePath = new ItemPath(SchemaConstantsGenerated.C_CREDENTIALS, CredentialsType.F_PASSWORD, PasswordType.F_VALUE);
    SchemaRegistry registry = getPrismContext().getSchemaRegistry();
    Collection<ObjectDelta<? extends ObjectType>> deltas = new ArrayList<ObjectDelta<? extends ObjectType>>();
    PrismObjectDefinition objDef = registry.findObjectDefinitionByCompileTimeClass(UserType.class);
    PropertyDelta delta = PropertyDelta.createModificationReplaceProperty(valuePath, objDef, password);
    Class<? extends ObjectType> type = UserType.class;
    deltas.add(ObjectDelta.createModifyDelta(user.getOid(), delta, type, getPrismContext()));
    try {
        modelService.executeChanges(deltas, null, task, result);
        OperationResult parentResult = new OperationResult(OPERATION_LOAD_RESET_PASSWORD_POLICY);
        try {
            if (getModelInteractionService().getCredentialsPolicy(null, null, parentResult).getSecurityQuestions().getResetMethod().getResetType().equals(CredentialsResetTypeType.SECURITY_QUESTIONS)) {
                getSession().setAttribute("pwdReset", newPassword);
                setResponsePage(PageShowPassword.class);
            } else if (getModelInteractionService().getCredentialsPolicy(null, null, parentResult).getSecurityQuestions().getResetMethod().getResetType().equals(CredentialsResetTypeType.SECURITY_QUESTIONS_EMAIL)) {
                if (systemConfig.asObjectable().getNotificationConfiguration() != null && systemConfig.asObjectable().getNotificationConfiguration().getMail() != null) {
                    MailConfigurationType mailConfig = systemConfig.asObjectable().getNotificationConfiguration().getMail();
                    if (mailConfig.getServer() != null) {
                        List serverList = mailConfig.getServer();
                        if (serverList.size() > 0) {
                            MailServerConfigurationType mailServerType = mailConfig.getServer().get(0);
                            sendMailToUser(mailServerType.getUsername(), getMidpointApplication().getProtector().decryptString(mailServerType.getPassword()), newPassword, mailServerType.getHost(), mailServerType.getPort().toString(), mailConfig.getDefaultFrom(), user.getEmailAddress());
                        } else {
                            getSession().error(getString("pageLogin.message.ForgetPasswordSettingsWrong"));
                            throw new RestartResponseException(PageLogin.class);
                        }
                    } else {
                        getSession().error(getString("pageLogin.message.ForgetPasswordSettingsWrong"));
                        throw new RestartResponseException(PageLogin.class);
                    }
                } else {
                    // System.out.println("ifff4");
                    getSession().error(getString("pageLogin.message.ForgetPasswordSettingsWrong"));
                    throw new RestartResponseException(PageLogin.class);
                }
            }
        } catch (ObjectNotFoundException | SchemaException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
    // TODO ASAP a message should be shown as the result of the process
    // MailMessage mailMessage=new MailMessage(, port);
    // mailTransport.send(mailMessage, transportName, task,
    // parentResult);
    } catch (ObjectAlreadyExistsException | ObjectNotFoundException | SchemaException | ExpressionEvaluationException | CommunicationException | ConfigurationException | PolicyViolationException | SecurityViolationException | EncryptionException e) {
        LoggingUtils.logUnexpectedException(LOGGER, "reset password exception", e);
    }
}