Examples with ResourceException org.forgerock.json.resource.ResourceException used on opensource projects

Example 11 with ResourceException

use of org.forgerock.json.resource.ResourceException in project OpenAM by OpenRock.

the class IdentityResourceV2 method generateNewPasswordEmail.

/**
     * Generates the e-mail contents based on the incoming request.
     *
     * Will only send the e-mail if all the following conditions are true:
     *
     * - Forgotten Password service is enabled
     * - User exists
     * - User has an e-mail address in their profile
     * - E-mail service is correctly configured.
     *
     * @param context Non null.
     * @param request Non null.
     * @param realm Used as part of user lookup.
     * @param restSecurity Non null.
     */
private Promise<ActionResponse, ResourceException> generateNewPasswordEmail(final Context context, final ActionRequest request, final String realm, final RestSecurity restSecurity) {
    JsonValue result = new JsonValue(new LinkedHashMap<String, Object>(1));
    final JsonValue jsonBody = request.getContent();
    try {
        // Check to make sure forgotPassword enabled
        if (restSecurity == null) {
            if (debug.warningEnabled()) {
                debug.warning("Rest Security not created. restSecurity={}", restSecurity);
            }
            throw getException(UNAVAILABLE, "Rest Security Service not created");
        }
        if (!restSecurity.isSelfServiceRestEndpointEnabled()) {
            if (debug.warningEnabled()) {
                debug.warning("Forgot Password set to : {}", restSecurity.isSelfServiceRestEndpointEnabled());
            }
            throw getException(UNAVAILABLE, "Legacy Self Service REST Endpoint is not enabled.");
        }
        if (!restSecurity.isForgotPassword()) {
            if (debug.warningEnabled()) {
                debug.warning("Forgot Password set to : {}", restSecurity.isForgotPassword());
            }
            throw getException(UNAVAILABLE, "Forgot password is not accessible.");
        }
        // Generate Admin Token
        SSOToken adminToken = getSSOToken(RestUtils.getToken().getTokenID().toString());
        Map<String, Set<String>> searchAttributes = getIdentityServicesAttributes(realm, objectType);
        searchAttributes.putAll(getAttributeFromRequest(jsonBody));
        List<String> searchResults = identityServices.search(new CrestQuery("*"), searchAttributes, adminToken);
        if (searchResults.isEmpty()) {
            throw new NotFoundException("User not found");
        } else if (searchResults.size() > 1) {
            throw new ConflictException("Multiple users found");
        } else {
            String username = searchResults.get(0);
            IdentityDetails identityDetails = identityServices.read(username, getIdentityServicesAttributes(realm, objectType), adminToken);
            String email = null;
            String uid = null;
            for (Map.Entry<String, Set<String>> attribute : asMap(identityDetails.getAttributes()).entrySet()) {
                String attributeName = attribute.getKey();
                if (MAIL.equalsIgnoreCase(attributeName)) {
                    if (attribute.getValue() != null && !attribute.getValue().isEmpty()) {
                        email = attribute.getValue().iterator().next();
                    }
                } else if (UNIVERSAL_ID.equalsIgnoreCase(attributeName)) {
                    if (attribute.getValue() != null && !attribute.getValue().isEmpty()) {
                        uid = attribute.getValue().iterator().next();
                    }
                }
            }
            // Check to see if user is Active/Inactive
            if (!isUserActive(uid)) {
                throw new ForbiddenException("Request is forbidden for this user");
            }
            // Check if email is provided
            if (email == null || email.isEmpty()) {
                throw new BadRequestException("No email provided in profile.");
            }
            // Get full deployment URL
            HttpContext header = context.asContext(HttpContext.class);
            String baseURL = baseURLProviderFactory.get(realm).getRootURL(header);
            String subject = jsonBody.get("subject").asString();
            String message = jsonBody.get("message").asString();
            // Retrieve email registration token life time
            if (restSecurity == null) {
                if (debug.warningEnabled()) {
                    debug.warning("Rest Security not created. restSecurity={}", restSecurity);
                }
                throw new NotFoundException("Rest Security Service not created");
            }
            Long tokenLifeTime = restSecurity.getForgotPassTLT();
            // Generate Token
            org.forgerock.openam.cts.api.tokens.Token ctsToken = generateToken(email, username, tokenLifeTime, realm);
            // Store token in datastore
            CTSHolder.getCTS().createAsync(ctsToken);
            // Create confirmationId
            String confirmationId = Hash.hash(ctsToken.getTokenId() + username + SystemProperties.get(AM_ENCRYPTION_PWD));
            // Build Confirmation URL
            String confURL = restSecurity.getForgotPasswordConfirmationUrl();
            StringBuilder confURLBuilder = new StringBuilder(100);
            if (StringUtils.isEmpty(confURL)) {
                confURLBuilder.append(baseURL).append("/json/confirmation/forgotPassword");
            } else if (confURL.startsWith("/")) {
                confURLBuilder.append(baseURL).append(confURL);
            } else {
                confURLBuilder.append(confURL);
            }
            String confirmationLink = confURLBuilder.append("?confirmationId=").append(requestParamEncode(confirmationId)).append("&tokenId=").append(requestParamEncode(ctsToken.getTokenId())).append("&username=").append(requestParamEncode(username)).append("&realm=").append(realm).toString();
            // Send Registration
            sendNotification(email, subject, message, realm, confirmationLink);
            String principalName = PrincipalRestUtils.getPrincipalNameFromServerContext(context);
            if (debug.messageEnabled()) {
                debug.message("IdentityResource.generateNewPasswordEmail :: ACTION of generate new password email " + " for username={} in realm={} performed by principalName={}", username, realm, principalName);
            }
        }
        return newResultPromise(newActionResponse(result));
    } catch (ResourceException re) {
        // Service not available, Neither or both Username/Email provided, User inactive
        debug.warning(re.getMessage(), re);
        return re.asPromise();
    } catch (Exception e) {
        // Intentional - all other errors are considered Internal Error.
        debug.error("Internal error", e);
        return new InternalServerErrorException("Failed to send mail", e).asPromise();
    }
}

Example 12 with ResourceException

use of org.forgerock.json.resource.ResourceException in project OpenAM by OpenRock.

the class IdentityResourceV2 method anonymousCreate.

private Promise<ActionResponse, ResourceException> anonymousCreate(final Context context, final ActionRequest request, final String realm, RestSecurity restSecurity) {
    final JsonValue jVal = request.getContent();
    String tokenID = null;
    String confirmationId;
    String email;
    try {
        if (!restSecurity.isSelfRegistration()) {
            throw new BadRequestException("Self-registration disabled");
        }
        tokenID = jVal.get(TOKEN_ID).asString();
        jVal.remove(TOKEN_ID);
        confirmationId = jVal.get(CONFIRMATION_ID).asString();
        jVal.remove(CONFIRMATION_ID);
        email = jVal.get(EMAIL).asString();
        if (email == null || email.isEmpty()) {
            throw new BadRequestException("Email not provided");
        }
        // Convert to IDRepo Attribute schema
        jVal.put("mail", email);
        if (confirmationId == null || confirmationId.isEmpty()) {
            throw new BadRequestException("confirmationId not provided");
        }
        if (tokenID == null || tokenID.isEmpty()) {
            throw new BadRequestException("tokenId not provided");
        }
        validateToken(tokenID, realm, email, confirmationId);
        // create an Identity
        SSOToken admin = RestUtils.getToken();
        final String finalTokenID = tokenID;
        return createInstance(admin, jVal, realm).thenAsync(new AsyncFunction<ActionResponse, ActionResponse, ResourceException>() {

            @Override
            public Promise<ActionResponse, ResourceException> apply(ActionResponse response) {
                // Only remove the token if the create was successful, errors will be set in the handler.
                try {
                    // Even though the generated token will eventually timeout, delete it after a successful read
                    // so that the completed registration request cannot be made again using the same token.
                    CTSHolder.getCTS().deleteAsync(finalTokenID);
                } catch (DeleteFailedException e) {
                    // reading and deleting, the token has expired.
                    if (debug.messageEnabled()) {
                        debug.message("IdentityResource.anonymousCreate: Deleting token " + finalTokenID + " after a successful read failed due to " + e.getMessage(), e);
                    }
                } catch (CoreTokenException cte) {
                    // For any unexpected CTS error
                    debug.error("IdentityResource.anonymousCreate(): CTS Error : " + cte.getMessage());
                    return new InternalServerErrorException(cte.getMessage(), cte).asPromise();
                }
                return newResultPromise(response);
            }
        });
    } catch (BadRequestException bre) {
        debug.warning("IdentityResource.anonymousCreate() :: Invalid Parameter", bre);
        return bre.asPromise();
    } catch (ResourceException re) {
        debug.warning("IdentityResource.anonymousCreate() :: Resource error", re);
        return re.asPromise();
    } catch (CoreTokenException cte) {
        // For any unexpected CTS error
        debug.error("IdentityResource.anonymousCreate() :: CTS error", cte);
        return new InternalServerErrorException(cte).asPromise();
    } catch (ServiceNotFoundException snfe) {
        // Failure from RestSecurity
        debug.error("IdentityResource.anonymousCreate() :: Internal error", snfe);
        return new InternalServerErrorException(snfe).asPromise();
    }
}

Example 13 with ResourceException

use of org.forgerock.json.resource.ResourceException in project OpenAM by OpenRock.

the class IdentityResourceV3 method patchInstance.

/**
     * Patch the user's password and only the password.  No other value may be patched.  The old value of the
     * password does not have to be known.  Admin only.  The only patch operation supported is "replace", i.e. not
     * "add" or "move", etc.
     *
     * @param context The context
     * @param resourceId The username we're patching
     * @param request The patch request
     */
@Override
public Promise<ResourceResponse, ResourceException> patchInstance(final Context context, final String resourceId, final PatchRequest request) {
    if (!objectType.equals(IdentityRestUtils.USER_TYPE)) {
        return new BadRequestException("Cannot patch object type " + objectType).asPromise();
    }
    RealmContext realmContext = context.asContext(RealmContext.class);
    final String realm = realmContext.getResolvedRealm();
    try {
        if (!isAdmin(context)) {
            return new ForbiddenException("Only admin can patch user values").asPromise();
        }
        SSOToken ssoToken = getSSOToken(RestUtils.getToken().getTokenID().toString());
        IdentityServicesImpl identityServices = getIdentityServices();
        IdentityDetails identityDetails = identityServices.read(resourceId, getIdentityServicesAttributes(realm, objectType), ssoToken);
        Attribute[] existingAttributes = identityDetails.getAttributes();
        Map<String, Set<String>> existingAttributeMap = attributesToMap(existingAttributes);
        Map<String, Set<String>> newAttributeMap = new HashMap<>();
        if (existingAttributeMap.containsKey(IdentityRestUtils.UNIVERSAL_ID)) {
            Set<String> values = existingAttributeMap.get(IdentityRestUtils.UNIVERSAL_ID);
            if (isNotEmpty(values) && !isUserActive(values.iterator().next())) {
                return new ForbiddenException("User " + resourceId + " is not active: Request is forbidden").asPromise();
            }
        }
        boolean updateNeeded = false;
        for (PatchOperation patchOperation : request.getPatchOperations()) {
            switch(patchOperation.getOperation()) {
                case PatchOperation.OPERATION_REPLACE:
                    {
                        String name = getFieldName(patchOperation.getField());
                        if (!patchableAttributes.contains(name)) {
                            return new BadRequestException("For the object type " + IdentityRestUtils.USER_TYPE + ", field \"" + name + "\" cannot be altered by PATCH").asPromise();
                        }
                        JsonValue value = patchOperation.getValue();
                        newAttributeMap.put(name, identityAttributeJsonToSet(value));
                        updateNeeded = true;
                        break;
                    }
                default:
                    return new BadRequestException("PATCH of " + IdentityRestUtils.USER_TYPE + " does not support operation " + patchOperation.getOperation()).asPromise();
            }
        }
        if (updateNeeded) {
            identityDetails.setAttributes(mapToAttributes(newAttributeMap));
            identityServices.update(identityDetails, ssoToken);
            // re-read the altered identity details from the repo.
            identityDetails = identityServices.read(resourceId, getIdentityServicesAttributes(realm, objectType), ssoToken);
        }
        return newResultPromise(newResourceResponse("result", "1", identityDetailsToJsonValue(identityDetails)));
    } catch (final ObjectNotFound notFound) {
        logger.error("IdentityResourceV3.patchInstance cannot find resource " + resourceId, notFound);
        return new NotFoundException("Resource cannot be found.", notFound).asPromise();
    } catch (final TokenExpired tokenExpired) {
        logger.error("IdentityResourceV3.patchInstance, token expired", tokenExpired);
        return new PermanentException(401, "Unauthorized", null).asPromise();
    } catch (final AccessDenied accessDenied) {
        logger.error("IdentityResourceV3.patchInstance, access denied", accessDenied);
        return new ForbiddenException(accessDenied.getMessage(), accessDenied).asPromise();
    } catch (final GeneralFailure generalFailure) {
        logger.error("IdentityResourceV3.patchInstance, general failure " + generalFailure.getMessage());
        return new BadRequestException(generalFailure.getMessage(), generalFailure).asPromise();
    } catch (ForbiddenException fex) {
        logger.warning("IdentityResourceV3.patchInstance, insufficient privileges.", fex);
        return fex.asPromise();
    } catch (NotFoundException notFound) {
        logger.warning("IdentityResourceV3.patchInstance " + resourceId + " not found", notFound);
        return new NotFoundException("Resource " + resourceId + " cannot be found.", notFound).asPromise();
    } catch (ResourceException resourceException) {
        logger.warning("IdentityResourceV3.patchInstance caught ResourceException", resourceException);
        return resourceException.asPromise();
    } catch (Exception exception) {
        logger.error("IdentityResourceV3.patchInstance caught exception", exception);
        return new InternalServerErrorException(exception.getMessage(), exception).asPromise();
    }
}

Example 14 with ResourceException

use of org.forgerock.json.resource.ResourceException in project OpenAM by OpenRock.

the class IdentityResourceV3 method queryCollection.

/*******************************************************************************************************************
     * {@inheritDoc}
     */
public Promise<QueryResponse, ResourceException> queryCollection(final Context context, final QueryRequest request, final QueryResourceHandler handler) {
    RealmContext realmContext = context.asContext(RealmContext.class);
    final String realm = realmContext.getResolvedRealm();
    try {
        SSOToken admin = getSSOToken(RestUtils.getToken().getTokenID().toString());
        IdentityServicesImpl identityServices = getIdentityServices();
        List<IdentityDetails> userDetails = null;
        // If the user specified _queryFilter, then (convert and) use that, otherwise look for _queryID
        // and if that isn't there either, pretend the user gave a _queryID of "*"
        //
        QueryFilter<JsonPointer> queryFilter = request.getQueryFilter();
        if (queryFilter != null) {
            CrestQuery crestQuery = new CrestQuery(queryFilter);
            userDetails = identityServices.searchIdentityDetails(crestQuery, getIdentityServicesAttributes(realm, objectType), admin);
        } else {
            String queryId = request.getQueryId();
            if (queryId == null || queryId.isEmpty()) {
                queryId = "*";
            }
            CrestQuery crestQuery = new CrestQuery(queryId);
            userDetails = identityServices.searchIdentityDetails(crestQuery, getIdentityServicesAttributes(realm, objectType), admin);
        }
        String principalName = PrincipalRestUtils.getPrincipalNameFromServerContext(context);
        logger.message("IdentityResourceV3.queryCollection :: QUERY performed on realm " + realm + " by " + principalName);
        for (IdentityDetails userDetail : userDetails) {
            ResourceResponse resource;
            resource = newResourceResponse(userDetail.getName(), "0", identityResourceV2.addRoleInformation(context, userDetail.getName(), identityDetailsToJsonValue(userDetail)));
            handler.handleResource(resource);
        }
    } catch (ResourceException resourceException) {
        logger.warning("IdentityResourceV3.queryCollection caught ResourceException", resourceException);
        return resourceException.asPromise();
    } catch (Exception exception) {
        logger.error("IdentityResourceV3.queryCollection caught exception", exception);
        return new InternalServerErrorException(exception.getMessage(), exception).asPromise();
    }
    return newResultPromise(newQueryResponse());
}

Example 15 with ResourceException

use of org.forgerock.json.resource.ResourceException in project OpenAM by OpenRock.

the class RealmResource method updateInstance.

/**
     * {@inheritDoc}
     */
@Override
public Promise<ResourceResponse, ResourceException> updateInstance(Context context, String resourceId, UpdateRequest request) {
    RealmContext realmContext = context.asContext(RealmContext.class);
    String realmPath = realmContext.getResolvedRealm();
    final JsonValue realmDetails = request.getContent();
    ResourceResponse resource;
    String realm;
    OrganizationConfigManager ocm;
    OrganizationConfigManager realmCreatedOcm;
    String principalName = PrincipalRestUtils.getPrincipalNameFromServerContext(context);
    try {
        hasPermission(context);
        realm = checkForTopLevelRealm(resourceId);
        if (realm != null && !realm.startsWith("/")) {
            realm = "/" + realm;
        }
        if (!realmPath.equalsIgnoreCase("/")) {
            realm = realmPath + realm;
        }
        // Update a realm - if it's not found, error out.
        ocm = new OrganizationConfigManager(getSSOToken(), realm);
        List newServiceNames;
        // update ID_REPO attributes
        updateConfiguredServices(ocm, createServicesMap(realmDetails));
        newServiceNames = realmDetails.get(SERVICE_NAMES).asList();
        if (newServiceNames == null || newServiceNames.isEmpty()) {
            debug.error("RealmResource.updateInstance() : No Services defined.");
        } else {
            //assign services to realm
            assignServices(ocm, newServiceNames);
        }
        // READ THE REALM
        realmCreatedOcm = new OrganizationConfigManager(getSSOToken(), realm);
        debug.message("RealmResource.updateInstance :: UPDATE of realm " + realm + " performed by " + principalName);
        // create a resource for handler to return
        resource = newResourceResponse(realm, String.valueOf(System.currentTimeMillis()), createJsonMessage("realmUpdated", realmCreatedOcm.getOrganizationName()));
        return newResultPromise(resource);
    } catch (SMSException e) {
        try {
            configureErrorMessage(e);
            return new NotFoundException(e.getMessage(), e).asPromise();
        } catch (ForbiddenException fe) {
            // User does not have authorization
            debug.error("RealmResource.updateInstance() : Cannot UPDATE " + resourceId, fe);
            return fe.asPromise();
        } catch (PermanentException pe) {
            debug.error("RealmResource.updateInstance() : Cannot UPDATE " + resourceId, pe);
            // Cannot recover from this exception
            return pe.asPromise();
        } catch (ConflictException ce) {
            debug.error("RealmResource.updateInstance() : Cannot UPDATE " + resourceId, ce);
            return ce.asPromise();
        } catch (BadRequestException be) {
            debug.error("RealmResource.updateInstance() : Cannot UPDATE " + resourceId, be);
            return be.asPromise();
        } catch (Exception ex) {
            debug.error("RealmResource.updateInstance() : Cannot UPDATE " + resourceId, ex);
            return new NotFoundException("Cannot update realm.", ex).asPromise();
        }
    } catch (SSOException sso) {
        debug.error("RealmResource.updateInstance() : Cannot UPDATE " + resourceId, sso);
        return new PermanentException(401, "Access Denied", null).asPromise();
    } catch (ForbiddenException fe) {
        debug.error("RealmResource.updateInstance() : Cannot UPDATE " + resourceId, fe);
        return fe.asPromise();
    } catch (PermanentException pe) {
        debug.error("RealmResource.Instance() : Cannot UPDATE " + resourceId, pe);
        // Cannot recover from this exception
        return pe.asPromise();
    } catch (Exception ex) {
        debug.error("RealmResource.updateInstance() : Cannot UPDATE " + resourceId, ex);
        return new NotFoundException("Cannot update realm.", ex).asPromise();
    }
}