Examples with PasswordChangeType eu.bcvsolutions.idm.core.api.domain.PasswordChangeType used on opensource projects

Example 1 with PasswordChangeType

use of eu.bcvsolutions.idm.core.api.domain.PasswordChangeType in project CzechIdMng by bcvsolutions.

the class IdentityPasswordValidateProcessor method process.

@Override
public EventResult<IdmIdentityDto> process(EntityEvent<IdmIdentityDto> event) {
    PasswordChangeDto passwordChangeDto = (PasswordChangeDto) event.getProperties().get(IdentityPasswordProcessor.PROPERTY_PASSWORD_CHANGE_DTO);
    IdmIdentityDto identity = event.getContent();
    // 
    Assert.notNull(passwordChangeDto, "Password change dto is required.");
    Assert.notNull(identity, "Identity is required.");
    // 
    LOG.debug("Call validate password for systems and default password policy for identity username [{}]", event.getContent().getUsername());
    // 
    List<IdmPasswordPolicyDto> passwordPolicyList = validateDefinition(identity, passwordChangeDto);
    // 
    // Find user accounts
    AccIdentityAccountFilter filter = new AccIdentityAccountFilter();
    filter.setIdentityId(identity.getId());
    List<AccIdentityAccountDto> identityAccounts = identityAccountService.find(filter, null).getContent();
    // 
    if (!securityService.isAdmin()) {
        // check accounts and property all_only
        PasswordChangeType passwordChangeType = identityConfiguration.getPasswordChangeType();
        if (passwordChangeType == PasswordChangeType.ALL_ONLY) {
            // get distinct account ids from identity accounts
            List<String> accountIds = identityAccounts.stream().filter(identityAccount -> {
                // filter by ownership
                return (identityAccount.isOwnership());
            }).map(AccIdentityAccountDto::getAccount).map(UUID::toString).collect(Collectors.toList());
            // 
            if (!accountIds.isEmpty() && !passwordChangeDto.getAccounts().isEmpty()) {
                // size of the found accounts must match the account size in the password change - ALL_ONLY
                boolean containsAll = accountIds.size() == passwordChangeDto.getAccounts().size();
                if (!containsAll) {
                    throw new ResultCodeException(CoreResultCode.PASSWORD_CHANGE_ALL_ONLY);
                }
            }
        }
    }
    // 
    // validate
    IdmPasswordValidationDto passwordValidationDto = new IdmPasswordValidationDto();
    // get old password for validation - till, from and password history
    IdmPasswordDto oldPassword = this.passwordService.findOneByIdentity(identity.getId());
    passwordValidationDto.setOldPassword(oldPassword == null ? null : oldPassword.getId());
    passwordValidationDto.setIdentity(identity);
    passwordValidationDto.setPassword(passwordChangeDto.getNewPassword());
    this.passwordPolicyService.validate(passwordValidationDto, passwordPolicyList);
    // 
    return new DefaultEventResult<>(event, this);
}

Example 2 with PasswordChangeType

use of eu.bcvsolutions.idm.core.api.domain.PasswordChangeType in project CzechIdMng by bcvsolutions.

the class AbstractIdentityPasswordValidateProcessor method process.

@Override
public EventResult<IdmIdentityDto> process(EntityEvent<IdmIdentityDto> event) {
    IdmIdentityDto identity = event.getContent();
    PasswordChangeDto passwordChangeDto = (PasswordChangeDto) event.getProperties().get(IdentityPasswordProcessor.PROPERTY_PASSWORD_CHANGE_DTO);
    Assert.notNull(passwordChangeDto, "Password change dto is required.");
    // 
    if (requiresOriginalPassword()) {
        PasswordChangeType passwordChangeType = identityConfiguration.getPasswordChangeType();
        if (passwordChangeType == PasswordChangeType.DISABLED) {
            // check if isn't disable password change
            throw new ResultCodeException(CoreResultCode.PASSWORD_CHANGE_DISABLED);
        } else if (passwordChangeType == PasswordChangeType.ALL_ONLY && !passwordChangeDto.isAll()) {
            // for all only must change also password for czechidm
            throw new ResultCodeException(CoreResultCode.PASSWORD_CHANGE_ALL_ONLY);
        }
        // checkAccess(identity, IdentityBasePermission.PASSWORDCHANGE) is called before event publishing
        if (identity.getId().equals(securityService.getCurrentId()) && identityConfiguration.isRequireOldPassword()) {
            if (passwordChangeDto.getOldPassword() == null) {
                throw new ResultCodeException(CoreResultCode.PASSWORD_CHANGE_CURRENT_FAILED_IDM);
            }
            // authentication trough chain
            LoginDto loginDto = new LoginDto();
            loginDto.setUsername(identity.getUsername());
            loginDto.setPassword(passwordChangeDto.getOldPassword());
            // password is changed => prevent to validate this flag again
            loginDto.setSkipMustChange(true);
            // 
            boolean successChainValidation = authenticationManager.validate(loginDto);
            if (!successChainValidation) {
                throw new ResultCodeException(CoreResultCode.PASSWORD_CHANGE_CURRENT_FAILED_IDM);
            }
        }
    }
    if (passwordChangeDto.isAll() || passwordChangeDto.isIdm()) {
        // change identity's password
        // validate password
        IdmPasswordValidationDto passwordValidationDto = new IdmPasswordValidationDto();
        // set old password for validation - valid till, from and history check
        IdmPasswordDto oldPassword = this.passwordService.findOneByIdentity(identity.getId());
        passwordValidationDto.setOldPassword(oldPassword == null ? null : oldPassword.getId());
        passwordValidationDto.setPassword(passwordChangeDto.getNewPassword());
        passwordValidationDto.setIdentity(identity);
        this.passwordPolicyService.validate(passwordValidationDto);
    }
    return new DefaultEventResult<>(event, this);
}