Search in sources :

Example 1 with NotFoundException

use of com.serotonin.m2m2.vo.exception.NotFoundException in project ma-core-public by infiniteautomation.

the class MangoTokenAuthenticationProvider method authenticate.

@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    if (!(authentication instanceof BearerAuthenticationToken)) {
        return null;
    }
    String bearerToken = (String) authentication.getCredentials();
    User user;
    Jws<Claims> jws;
    try {
        jws = tokenAuthenticationService.parse(bearerToken);
        user = tokenAuthenticationService.verify(jws);
    } catch (ExpiredJwtException e) {
        throw new CredentialsExpiredException(e.getMessage(), e);
    } catch (UnsupportedJwtException | MalformedJwtException | IllegalArgumentException e) {
        // assume that this is not a JWT, allow the next AuthenticationProvider to process it
        return null;
    } catch (SignatureException | MissingClaimException | IncorrectClaimException e) {
        throw new BadCredentialsException(e.getMessage(), e);
    } catch (NotFoundException e) {
        throw new BadCredentialsException("Invalid username", e);
    } catch (Exception e) {
        throw new InternalAuthenticationServiceException(e.getMessage(), e);
    }
    userDetailsChecker.check(user);
    if (log.isDebugEnabled()) {
        log.debug("Successfully authenticated user using JWT token, header: " + jws.getHeader() + ", body: " + jws.getBody());
    }
    return new PreAuthenticatedAuthenticationToken(user, bearerToken, user.getAuthorities());
}
Also used : User(com.serotonin.m2m2.vo.User) Claims(io.jsonwebtoken.Claims) ExpiredJwtException(io.jsonwebtoken.ExpiredJwtException) CredentialsExpiredException(org.springframework.security.authentication.CredentialsExpiredException) NotFoundException(com.serotonin.m2m2.vo.exception.NotFoundException) InternalAuthenticationServiceException(org.springframework.security.authentication.InternalAuthenticationServiceException) PreAuthenticatedAuthenticationToken(org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken) SignatureException(io.jsonwebtoken.SignatureException) IncorrectClaimException(io.jsonwebtoken.IncorrectClaimException) BadCredentialsException(org.springframework.security.authentication.BadCredentialsException) BadCredentialsException(org.springframework.security.authentication.BadCredentialsException) NotFoundException(com.serotonin.m2m2.vo.exception.NotFoundException) UnsupportedJwtException(io.jsonwebtoken.UnsupportedJwtException) InternalAuthenticationServiceException(org.springframework.security.authentication.InternalAuthenticationServiceException) MissingClaimException(io.jsonwebtoken.MissingClaimException) IncorrectClaimException(io.jsonwebtoken.IncorrectClaimException) CredentialsExpiredException(org.springframework.security.authentication.CredentialsExpiredException) MalformedJwtException(io.jsonwebtoken.MalformedJwtException) ExpiredJwtException(io.jsonwebtoken.ExpiredJwtException) SignatureException(io.jsonwebtoken.SignatureException) AuthenticationException(org.springframework.security.core.AuthenticationException) MissingClaimException(io.jsonwebtoken.MissingClaimException) MalformedJwtException(io.jsonwebtoken.MalformedJwtException) UnsupportedJwtException(io.jsonwebtoken.UnsupportedJwtException)

Example 2 with NotFoundException

use of com.serotonin.m2m2.vo.exception.NotFoundException in project ma-core-public by infiniteautomation.

the class PasswordResetService method verifyClaims.

@Override
protected User verifyClaims(Jws<Claims> token) {
    Claims claims = token.getBody();
    String username = claims.getSubject();
    User user = UserDao.instance.getUser(username);
    if (user == null) {
        throw new NotFoundException();
    }
    Integer userId = user.getId();
    this.verifyClaim(token, USER_ID_CLAIM, userId);
    Integer pwVersion = user.getPasswordVersion();
    this.verifyClaim(token, USER_PASSWORD_VERSION_CLAIM, pwVersion);
    return user;
}
Also used : Claims(io.jsonwebtoken.Claims) User(com.serotonin.m2m2.vo.User) NotFoundException(com.serotonin.m2m2.vo.exception.NotFoundException)

Example 3 with NotFoundException

use of com.serotonin.m2m2.vo.exception.NotFoundException in project ma-core-public by infiniteautomation.

the class TokenAuthenticationService method verifyClaims.

@Override
protected User verifyClaims(Jws<Claims> token) {
    Claims claims = token.getBody();
    String username = claims.getSubject();
    if (username == null) {
        throw new NotFoundException();
    }
    UserDetails userDetails = userDetailsService.loadUserByUsername(username);
    if (!(userDetails instanceof User)) {
        throw new RuntimeException("Expected user details to be instance of User");
    }
    User user = (User) userDetails;
    Integer userId = user.getId();
    this.verifyClaim(token, USER_ID_CLAIM, userId);
    Integer tokenVersion = user.getTokenVersion();
    this.verifyClaim(token, USER_TOKEN_VERSION_CLAIM, tokenVersion);
    return user;
}
Also used : Claims(io.jsonwebtoken.Claims) UserDetails(org.springframework.security.core.userdetails.UserDetails) User(com.serotonin.m2m2.vo.User) NotFoundException(com.serotonin.m2m2.vo.exception.NotFoundException)

Example 4 with NotFoundException

use of com.serotonin.m2m2.vo.exception.NotFoundException in project ma-modules-public by infiniteautomation.

the class DataPointEventsByWatchlistQueryDefinition method createQuery.

/* (non-Javadoc)
     * @see com.serotonin.m2m2.module.ModuleQueryDefinition#createQuery(com.fasterxml.jackson.databind.JsonNode)
     */
@Override
public ASTNode createQuery(User user, JsonNode parameters) throws IOException {
    // Lookup data points by watchlist
    WatchListVO vo = WatchListDao.instance.getByXid(parameters.get("watchListXid").asText());
    if (vo == null)
        throw new NotFoundException();
    if (!WatchListRestController.hasReadPermission(user, vo))
        throw new PermissionException(new TranslatableMessage("common.default", "Unauthorized access"), user);
    List<Object> args = new ArrayList<>();
    args.add("typeRef1");
    WatchListDao.instance.getPoints(vo.getId(), new MappedRowCallback<DataPointVO>() {

        @Override
        public void row(DataPointVO dp, int index) {
            if (Permissions.hasDataPointReadPermission(user, dp)) {
                args.add(Integer.toString(dp.getId()));
            }
        }
    });
    // Create Event Query for these Points
    ASTNode query = new ASTNode("in", args);
    query = addAndRestriction(query, new ASTNode("eq", "userId", user.getId()));
    query = addAndRestriction(query, new ASTNode("eq", "typeName", "DATA_POINT"));
    // TODO Should we force a limit if none is supplied?
    if (parameters.has("limit")) {
        int offset = 0;
        int limit = parameters.get("limit").asInt();
        if (parameters.has("offset"))
            offset = parameters.get("offset").asInt();
        query = addAndRestriction(query, new ASTNode("limit", limit, offset));
    }
    return query;
}
Also used : PermissionException(com.serotonin.m2m2.vo.permission.PermissionException) DataPointVO(com.serotonin.m2m2.vo.DataPointVO) ArrayList(java.util.ArrayList) ASTNode(net.jazdw.rql.parser.ASTNode) NotFoundException(com.serotonin.m2m2.vo.exception.NotFoundException) TranslatableMessage(com.serotonin.m2m2.i18n.TranslatableMessage)

Example 5 with NotFoundException

use of com.serotonin.m2m2.vo.exception.NotFoundException in project ma-core-public by infiniteautomation.

the class UserDao method updateUser.

void updateUser(User user) {
    // Potential fix for "An attempt was made to get a data value of type 'VARCHAR' from a data value of type 'null'"
    if (user.getPhone() == null)
        user.setPhone("");
    if (user.getHomeUrl() == null)
        user.setHomeUrl("");
    if (user.getTimezone() == null)
        user.setTimezone("");
    if (user.getName() == null)
        user.setName("");
    if (user.getLocale() == null)
        user.setLocale("");
    int originalPwVersion = user.getPasswordVersion();
    try {
        User old = getTransactionTemplate().execute(new TransactionCallback<User>() {

            @Override
            public User doInTransaction(TransactionStatus status) {
                User old = getUser(user.getId());
                if (old == null) {
                    return null;
                }
                boolean passwordChanged = !old.getPassword().equals(user.getPassword());
                if (passwordChanged) {
                    user.setPasswordVersion(old.getPasswordVersion() + 1);
                } else {
                    user.setPasswordVersion(old.getPasswordVersion());
                }
                ejt.update(USER_UPDATE, new Object[] { user.getUsername(), user.getPassword(), user.getEmail(), user.getPhone(), boolToChar(user.isDisabled()), user.getHomeUrl(), user.getReceiveAlarmEmails(), boolToChar(user.isReceiveOwnAuditEvents()), user.getTimezone(), boolToChar(user.isMuted()), user.getPermissions(), user.getName(), user.getLocale(), user.getPasswordVersion(), user.getId() }, new int[] { Types.VARCHAR, Types.VARCHAR, Types.VARCHAR, Types.VARCHAR, Types.VARCHAR, Types.VARCHAR, Types.INTEGER, Types.VARCHAR, Types.VARCHAR, Types.VARCHAR, Types.VARCHAR, Types.VARCHAR, Types.VARCHAR, Types.INTEGER, Types.INTEGER });
                return old;
            }
        });
        if (old == null) {
            throw new NotFoundException();
        }
        AuditEventType.raiseChangedEvent(AuditEventType.TYPE_USER, old, user);
        boolean permissionsChanged = !old.getPermissions().equals(user.getPermissions());
        if (user.getPasswordVersion() > originalPwVersion || permissionsChanged || user.isDisabled()) {
            MangoSecurityConfiguration.sessionRegistry.exireSessionsForUser(old);
        }
        userCache.remove(old.getUsername());
        if (handler != null)
            handler.notify("update", user);
    } catch (DataIntegrityViolationException e) {
        // Log some information about the user object.
        LOG.error("Error updating user: " + user, e);
        throw e;
    }
}
Also used : User(com.serotonin.m2m2.vo.User) TransactionStatus(org.springframework.transaction.TransactionStatus) NotFoundException(com.serotonin.m2m2.vo.exception.NotFoundException) DataIntegrityViolationException(org.springframework.dao.DataIntegrityViolationException)

Aggregations

NotFoundException (com.serotonin.m2m2.vo.exception.NotFoundException)5 User (com.serotonin.m2m2.vo.User)4 Claims (io.jsonwebtoken.Claims)3 TranslatableMessage (com.serotonin.m2m2.i18n.TranslatableMessage)1 DataPointVO (com.serotonin.m2m2.vo.DataPointVO)1 PermissionException (com.serotonin.m2m2.vo.permission.PermissionException)1 ExpiredJwtException (io.jsonwebtoken.ExpiredJwtException)1 IncorrectClaimException (io.jsonwebtoken.IncorrectClaimException)1 MalformedJwtException (io.jsonwebtoken.MalformedJwtException)1 MissingClaimException (io.jsonwebtoken.MissingClaimException)1 SignatureException (io.jsonwebtoken.SignatureException)1 UnsupportedJwtException (io.jsonwebtoken.UnsupportedJwtException)1 ArrayList (java.util.ArrayList)1 ASTNode (net.jazdw.rql.parser.ASTNode)1 DataIntegrityViolationException (org.springframework.dao.DataIntegrityViolationException)1 BadCredentialsException (org.springframework.security.authentication.BadCredentialsException)1 CredentialsExpiredException (org.springframework.security.authentication.CredentialsExpiredException)1 InternalAuthenticationServiceException (org.springframework.security.authentication.InternalAuthenticationServiceException)1 AuthenticationException (org.springframework.security.core.AuthenticationException)1 UserDetails (org.springframework.security.core.userdetails.UserDetails)1