use of org.apache.wiki.auth.user.DuplicateUserException in project jspwiki by apache.
the class UserManagerTest method testSetCollidingUserProfile.
@Test
public void testSetCollidingUserProfile() throws Exception {
// First, count the number of users in the db now.
int oldUserCount = m_db.getWikiNames().length;
// Create a new user with random name
WikiSession session = m_engine.guestSession();
String loginName = "TestUser" + String.valueOf(System.currentTimeMillis());
UserProfile profile = m_db.newProfile();
profile.setEmail("jspwiki.tests@mailinator.com");
profile.setLoginName(loginName);
profile.setFullname("FullName" + loginName);
profile.setPassword("password");
// Set the login name to collide with Janne's: should prohibit saving
profile.setLoginName("janne");
try {
m_mgr.setUserProfile(session, profile);
Assert.fail("UserManager allowed saving of user with login name 'janne', but it shouldn't have.");
} catch (DuplicateUserException e) {
// Good! That's what we expected; reset for next test
profile.setLoginName(loginName);
}
// Set the login name to collide with Janne's: should prohibit saving
profile.setFullname("Janne Jalkanen");
try {
m_mgr.setUserProfile(session, profile);
Assert.fail("UserManager allowed saving of user with login name 'janne', but it shouldn't have.");
} catch (DuplicateUserException e) {
// Good! That's what we expected
}
// There shouldn't have been any users added
Assert.assertEquals(oldUserCount, m_db.getWikiNames().length);
}
use of org.apache.wiki.auth.user.DuplicateUserException in project jspwiki by apache.
the class UserManager method setUserProfile.
/**
* <p>
* Saves the {@link org.apache.wiki.auth.user.UserProfile}for the user in
* a wiki session. This method verifies that a user profile to be saved
* doesn't collide with existing profiles; that is, the login name
* or full name is already used by another profile. If the profile
* collides, a <code>DuplicateUserException</code> is thrown. After saving
* the profile, the user database changes are committed, and the user's
* credential set is refreshed; if custom authentication is used, this means
* the user will be automatically be logged in.
* </p>
* <p>
* When the user's profile is saved successfully, this method fires a
* {@link WikiSecurityEvent#PROFILE_SAVE} event with the WikiSession as the
* source and the UserProfile as target. For existing profiles, if the
* user's full name changes, this method also fires a "name changed"
* event ({@link WikiSecurityEvent#PROFILE_NAME_CHANGED}) with the
* WikiSession as the source and an array containing the old and new
* UserProfiles, respectively. The <code>NAME_CHANGED</code> event allows
* the GroupManager and PageManager can change group memberships and
* ACLs if needed.
* </p>
* <p>
* Note that WikiSessions normally attach event listeners to the
* UserManager, so changes to the profile will automatically cause the
* correct Principals to be reloaded into the current WikiSession's Subject.
* </p>
* @param session the wiki session, which may not be <code>null</code>
* @param profile the user profile, which may not be <code>null</code>
* @throws DuplicateUserException if the proposed profile's login name or full name collides with another
* @throws WikiException if the save fails for some reason. If the current user does not have
* permission to save the profile, this will be a {@link org.apache.wiki.auth.WikiSecurityException};
* if if the user profile must be approved before it can be saved, it will be a
* {@link org.apache.wiki.workflow.DecisionRequiredException}. All other WikiException
* indicate a condition that is not normal is probably due to mis-configuration
*/
public void setUserProfile(WikiSession session, UserProfile profile) throws DuplicateUserException, WikiException {
// Verify user is allowed to save profile!
final Permission p = new WikiPermission(m_engine.getApplicationName(), WikiPermission.EDIT_PROFILE_ACTION);
if (!m_engine.getAuthorizationManager().checkPermission(session, p)) {
throw new WikiSecurityException("You are not allowed to save wiki profiles.");
}
// Check if profile is new, and see if container allows creation
final boolean newProfile = profile.isNew();
// Check if another user profile already has the fullname or loginname
final UserProfile oldProfile = getUserProfile(session);
final boolean nameChanged = (oldProfile == null || oldProfile.getFullname() == null) ? false : !(oldProfile.getFullname().equals(profile.getFullname()) && oldProfile.getLoginName().equals(profile.getLoginName()));
UserProfile otherProfile;
try {
otherProfile = getUserDatabase().findByLoginName(profile.getLoginName());
if (otherProfile != null && !otherProfile.equals(oldProfile)) {
throw new DuplicateUserException("security.error.login.taken", profile.getLoginName());
}
} catch (final NoSuchPrincipalException e) {
}
try {
otherProfile = getUserDatabase().findByFullName(profile.getFullname());
if (otherProfile != null && !otherProfile.equals(oldProfile)) {
throw new DuplicateUserException("security.error.fullname.taken", profile.getFullname());
}
} catch (final NoSuchPrincipalException e) {
}
// For new accounts, create approval workflow for user profile save.
if (newProfile && oldProfile != null && oldProfile.isNew()) {
final WorkflowBuilder builder = WorkflowBuilder.getBuilder(m_engine);
final Principal submitter = session.getUserPrincipal();
final Task completionTask = new SaveUserProfileTask(m_engine, session.getLocale());
// Add user profile attribute as Facts for the approver (if required)
final boolean hasEmail = profile.getEmail() != null;
final Fact[] facts = new Fact[hasEmail ? 4 : 3];
facts[0] = new Fact(PREFS_FULL_NAME, profile.getFullname());
facts[1] = new Fact(PREFS_LOGIN_NAME, profile.getLoginName());
facts[2] = new Fact(FACT_SUBMITTER, submitter.getName());
if (hasEmail) {
facts[3] = new Fact(PREFS_EMAIL, profile.getEmail());
}
final Workflow workflow = builder.buildApprovalWorkflow(submitter, SAVE_APPROVER, null, SAVE_DECISION_MESSAGE_KEY, facts, completionTask, null);
workflow.setAttribute(SAVED_PROFILE, profile);
m_engine.getWorkflowManager().start(workflow);
final boolean approvalRequired = workflow.getCurrentStep() instanceof Decision;
// If the profile requires approval, redirect user to message page
if (approvalRequired) {
throw new DecisionRequiredException("This profile must be approved before it becomes active");
}
try {
final AuthenticationManager mgr = m_engine.getAuthenticationManager();
if (newProfile && !mgr.isContainerAuthenticated()) {
mgr.login(session, null, profile.getLoginName(), profile.getPassword());
}
} catch (final WikiException e) {
throw new WikiSecurityException(e.getMessage(), e);
}
// Alert all listeners that the profile changed...
// ...this will cause credentials to be reloaded in the wiki session
fireEvent(WikiSecurityEvent.PROFILE_SAVE, session, profile);
} else // For existing accounts, just save the profile
{
// If login name changed, rename it first
if (nameChanged && oldProfile != null && !oldProfile.getLoginName().equals(profile.getLoginName())) {
getUserDatabase().rename(oldProfile.getLoginName(), profile.getLoginName());
}
// Now, save the profile (userdatabase will take care of timestamps for us)
getUserDatabase().save(profile);
if (nameChanged) {
// Fire an event if the login name or full name changed
final UserProfile[] profiles = new UserProfile[] { oldProfile, profile };
fireEvent(WikiSecurityEvent.PROFILE_NAME_CHANGED, session, profiles);
} else {
// Fire an event that says we have new a new profile (new principals)
fireEvent(WikiSecurityEvent.PROFILE_SAVE, session, profile);
}
}
}
Aggregations