Examples with Authorization org.bimserver.webservices.authorization.Authorization used on opensource projects

Example 1 with Authorization

use of org.bimserver.webservices.authorization.Authorization in project BIMserver by opensourceBIM.

the class PublicInterfaceFactory method get.

public synchronized ServiceMap get(String token, AccessMethod accessMethod) throws UserException {
    try {
        Authorization authorization = Authorization.fromToken(bimServer.getEncryptionKey(), token);
        DatabaseSession session = bimServer.getDatabase().createSession();
        try {
            User user = session.get(authorization.getUoid(), OldQuery.getDefault());
            if (user == null) {
                throw new UserException("No user found with uoid " + authorization.getUoid());
            }
            if (user.getState() == ObjectState.DELETED) {
                throw new UserException("User has been deleted");
            }
        } finally {
            session.close();
        }
        return get(authorization, accessMethod);
    } catch (Exception e) {
        if (e instanceof UserException) {
            throw (UserException) e;
        } else {
            throw new UserException(e);
        }
    }
}

Example 2 with Authorization

use of org.bimserver.webservices.authorization.Authorization in project BIMserver by opensourceBIM.

the class AutologinDatabaseAction method execute.

@Override
public String execute() throws UserException, BimserverLockConflictException, BimserverDatabaseException {
    try {
        Authorization authorization = Authorization.fromToken(bimServer.getEncryptionKey(), token);
        User user = getDatabaseSession().get(authorization.getUoid(), OldQuery.getDefault());
        if (user.getState() == ObjectState.DELETED) {
            throw new UserException("User account has been deleted");
        } else if (user.getUserType() == UserType.SYSTEM) {
            throw new UserException("System user cannot login");
        }
        if (bimServer.getServerSettingsCache().getServerSettings().isStoreLastLogin()) {
            user.setLastSeen(new Date());
            getDatabaseSession().store(user);
        }
        authorization.setUoid(user.getOid());
        String asHexToken = authorization.asHexToken(bimServer.getEncryptionKey());
        serviceMap.setAuthorization(authorization);
        return asHexToken;
    } catch (AuthenticationException e) {
        LOGGER.error("", e);
    }
    try {
        // Adding a random sleep to prevent timing attacks
        Thread.sleep(LoginDatabaseAction.DEFAULT_LOGIN_ERROR_TIMEOUT + new java.security.SecureRandom().nextInt(1000));
    } catch (InterruptedException e) {
        LOGGER.error("", e);
    }
    throw new UserException("User not found or inccorrect autologin token");
}

Example 3 with Authorization

use of org.bimserver.webservices.authorization.Authorization in project BIMserver by opensourceBIM.

the class NewRevisionNotification method sendEmail.

private void sendEmail(DatabaseSession session, Project project, Revision revision) throws UserException {
    Set<User> users = getUsers(session, project);
    for (User user : users) {
        String body = null;
        try {
            if (MailSystem.isValidEmailAddress(user.getUsername())) {
                EmailMessage message = getBimServer().getMailSystem().createMessage();
                ServerSettings serverSettings = getBimServer().getServerSettingsCache().getServerSettings();
                String emailSenderAddress = serverSettings.getEmailSenderAddress();
                InternetAddress addressFrom = new InternetAddress(emailSenderAddress);
                message.setFrom(addressFrom);
                InternetAddress[] addressTo = new InternetAddress[1];
                addressTo[0] = new InternetAddress(user.getUsername());
                message.setRecipients(Message.RecipientType.TO, addressTo);
                Map<String, Object> context = new HashMap<String, Object>();
                context.put("name", user.getName());
                context.put("username", user.getUsername());
                context.put("siteaddress", serverSettings.getSiteAddress());
                context.put("revisionId", revision.getId());
                Authorization authorization = null;
                if (user.getUserType() == UserType.ADMIN) {
                    authorization = new AdminAuthorization(getBimServer().getServerSettingsCache().getServerSettings().getSessionTimeOutSeconds(), TimeUnit.SECONDS);
                } else {
                    authorization = new UserAuthorization(getBimServer().getServerSettingsCache().getServerSettings().getSessionTimeOutSeconds(), TimeUnit.SECONDS);
                }
                authorization.setUoid(user.getOid());
                String asHexToken = authorization.asHexToken(getBimServer().getEncryptionKey());
                context.put("token", asHexToken);
                context.put("roid", revision.getOid());
                context.put("comment", revision.getComment());
                context.put("projectName", project.getName());
                String subject = null;
                body = getBimServer().getTemplateEngine().process(context, TemplateIdentifier.NEW_REVISION_EMAIL_BODY);
                subject = getBimServer().getTemplateEngine().process(context, TemplateIdentifier.NEW_REVISION_EMAIL_SUBJECT);
                message.setContent(body, "text/html");
                message.setSubject(subject.trim());
                LOGGER.info("Sending new revision e-mail to " + user.getUsername());
                message.send();
            }
        } catch (Exception e) {
            LOGGER.error(body);
            LOGGER.error("", e);
            throw new UserException(e);
        }
    }
}

Example 4 with Authorization

use of org.bimserver.webservices.authorization.Authorization in project BIMserver by opensourceBIM.

the class LoginUserTokenDatabaseAction method execute.

@Override
public String execute() throws UserException, BimserverLockConflictException, BimserverDatabaseException, ServerException {
    BimDatabaseAction<User> action = new GetUserByUserTokenDatabaseAction(getDatabaseSession(), getAccessMethod(), userToken);
    User user = action.execute();
    if (user != null) {
        if (user.getState() == ObjectState.DELETED) {
            throw new UserException("User account has been deleted");
        } else if (user.getUserType() == UserType.SYSTEM) {
            throw new UserException("System user cannot login");
        }
        Authorization authorization = null;
        if (user.getUserType() == UserType.ADMIN) {
            authorization = new AdminAuthorization(bimServer.getServerSettingsCache().getServerSettings().getSessionTimeOutSeconds(), TimeUnit.SECONDS);
        } else {
            authorization = new UserAuthorization(bimServer.getServerSettingsCache().getServerSettings().getSessionTimeOutSeconds(), TimeUnit.SECONDS);
        }
        authorization.setUoid(user.getOid());
        String asHexToken = authorization.asHexToken(bimServer.getEncryptionKey());
        serviceMap.setAuthorization(authorization);
        if (bimServer.getServerSettingsCache().getServerSettings().isStoreLastLogin()) {
            user.setLastSeen(new Date());
            getDatabaseSession().store(user);
        }
        return asHexToken;
    }
    try {
        // Adding a random sleep to prevent timing attacks
        Thread.sleep(DEFAULT_LOGIN_ERROR_TIMEOUT + new java.security.SecureRandom().nextInt(1000));
    } catch (InterruptedException e) {
        LOGGER.error("", e);
    }
    throw new UserException("Invalid token");
}

Example 5 with Authorization

use of org.bimserver.webservices.authorization.Authorization in project BIMserver by opensourceBIM.

the class LoginDatabaseAction method execute.

@Override
public String execute() throws UserException, BimserverLockConflictException, BimserverDatabaseException, ServerException {
    BimDatabaseAction<User> action = new GetUserByUserNameDatabaseAction(getDatabaseSession(), getAccessMethod(), username);
    User user = action.execute();
    if (user != null) {
        if (user.getPasswordHash() == null || user.getPasswordHash().length == 0) {
            throw new UserException("Your email address has not been validated yet");
        }
        if (new Authenticator().validate(password, user.getPasswordHash(), user.getPasswordSalt())) {
            if (user.getState() == ObjectState.DELETED) {
                throw new UserException("User account has been deleted");
            } else if (user.getUserType() == UserType.SYSTEM) {
                throw new UserException("System user cannot login");
            }
            Authorization authorization = null;
            if (user.getUserType() == UserType.ADMIN) {
                authorization = new AdminAuthorization(bimServer.getServerSettingsCache().getServerSettings().getSessionTimeOutSeconds(), TimeUnit.SECONDS);
            } else {
                authorization = new UserAuthorization(bimServer.getServerSettingsCache().getServerSettings().getSessionTimeOutSeconds(), TimeUnit.SECONDS);
            }
            authorization.setUoid(user.getOid());
            String asHexToken = authorization.asHexToken(bimServer.getEncryptionKey());
            serviceMap.setAuthorization(authorization);
            if (bimServer.getServerSettingsCache().getServerSettings().isStoreLastLogin()) {
                user.setLastSeen(new Date());
                getDatabaseSession().store(user);
            }
            return asHexToken;
        }
    }
    try {
        // Adding a random sleep to prevent timing attacks
        Thread.sleep(DEFAULT_LOGIN_ERROR_TIMEOUT + new java.security.SecureRandom().nextInt(1000));
    } catch (InterruptedException e) {
        LOGGER.error("", e);
    }
    throw new UserException("Invalid username/password combination");
}