Examples with PasswordResetRequest com.tremolosecurity.proxy.auth.passwordreset.PasswordResetRequest used on opensource projects

Example 1 with PasswordResetRequest

use of com.tremolosecurity.proxy.auth.passwordreset.PasswordResetRequest in project OpenUnison by TremoloSecurity.

the class SendMessageThread method finishLogin.

private void finishLogin(HttpServletRequest request, HttpServletResponse response, HttpSession session, AuthChainType act, int step, AuthMechType amt, int minValidKey, String key, org.hibernate.Session con, RequestHolder reqHolder, AuthStep as) throws SQLException, ServletException, IOException {
    if (!this.enabled) {
        throw new ServletException("Operation Not Supported");
    }
    HashMap<String, Attribute> authParams = (HashMap<String, Attribute>) session.getAttribute(ProxyConstants.AUTH_MECH_PARAMS);
    int maxChecks = 0;
    if (authParams.containsKey("maxChecks")) {
        maxChecks = Integer.parseInt(authParams.get("maxChecks").getValues().get(0));
    } else {
        maxChecks = 1;
    }
    DateTime now = new DateTime().minusMinutes(minValidKey);
    Query query = con.createQuery("FROM PasswordResetRequest r WHERE r.resetKey = :resetkey AND r.ts > :ts AND r.numRequests < :numRequests");
    query.setParameter("resetkey", key);
    query.setParameter("ts", new Timestamp(now.getMillis()));
    query.setParameter("numRequests", maxChecks);
    List<PasswordResetRequest> resetRequests = query.list();
    if (resetRequests == null || resetRequests.isEmpty()) {
        as.setSuccess(false);
    } else {
        PasswordResetRequest req = resetRequests.get(0);
        String email = req.getEmail();
        try {
            LDAPSearchResults res = this.cfgMgr.getMyVD().search(AuthUtil.getChainRoot(cfgMgr, act), 2, equal(this.lookupAttributeName, email).toString(), new ArrayList<String>());
            if (res.hasMore()) {
                LDAPEntry entry = res.next();
                Iterator<LDAPAttribute> it = entry.getAttributeSet().iterator();
                AuthInfo authInfo = new AuthInfo(entry.getDN(), (String) session.getAttribute(ProxyConstants.AUTH_MECH_NAME), act.getName(), act.getLevel());
                ((AuthController) session.getAttribute(ProxyConstants.AUTH_CTL)).setAuthInfo(authInfo);
                while (it.hasNext()) {
                    LDAPAttribute attrib = it.next();
                    Attribute attr = new Attribute(attrib.getName());
                    String[] vals = attrib.getStringValueArray();
                    for (int i = 0; i < vals.length; i++) {
                        attr.getValues().add(vals[i]);
                    }
                    authInfo.getAttribs().put(attr.getName(), attr);
                }
                as.setSuccess(true);
            } else {
                as.setSuccess(false);
            }
        } catch (LDAPException e) {
            logger.error("Could not authenticate user", e);
            as.setSuccess(false);
        }
        con.beginTransaction();
        req.setNumRequests(req.getNumRequests() + 1);
        if (req.getNumRequests() < maxChecks) {
            con.save(req);
        } else {
            con.delete(req);
        }
        con.getTransaction().commit();
    }
    String redirectToURL = null;
    if (as.isSuccess()) {
        reqHolder.setURL(this.getFinalURL(request, response));
    } else {
        request.getParameter("target");
        if (redirectToURL != null && !redirectToURL.isEmpty()) {
            reqHolder.setURL(redirectToURL);
        }
    }
    this.cfgMgr.getAuthManager().nextAuth(request, response, session, false);
}

Example 2 with PasswordResetRequest

use of com.tremolosecurity.proxy.auth.passwordreset.PasswordResetRequest in project OpenUnison by TremoloSecurity.

the class SendMessageThread method sendPasswordReset.

private void sendPasswordReset(org.hibernate.Session con, String uid, String emailAddress) throws SQLException, Exception {
    GenPasswd gp = new GenPasswd(30);
    String key = gp.getPassword();
    DateTime now = new DateTime();
    PasswordResetRequest req = new PasswordResetRequest();
    req.setEmail(uid);
    req.setResetKey(key);
    req.setTs(new Timestamp(now.getMillis()));
    con.beginTransaction();
    con.save(req);
    con.getTransaction().commit();
    this.sendEmail(emailAddress, key);
}