Examples with ChangePasswordRequest org.graylog2.rest.models.users.requests.ChangePasswordRequest used on opensource projects

Example 1 with ChangePasswordRequest

use of org.graylog2.rest.models.users.requests.ChangePasswordRequest in project graylog2-server by Graylog2.

the class UsersResource method changePassword.

@PUT
@Path("{userId}/password")
@ApiOperation("Update the password for a user.")
@ApiResponses({ @ApiResponse(code = 204, message = "The password was successfully updated. Subsequent requests must be made with the new password."), @ApiResponse(code = 400, message = "The new password is missing, or the old password is missing or incorrect."), @ApiResponse(code = 403, message = "The requesting user has insufficient privileges to update the password for the given user."), @ApiResponse(code = 404, message = "User does not exist.") })
@AuditEvent(type = AuditEventTypes.USER_PASSWORD_UPDATE)
public void changePassword(@ApiParam(name = "userId", value = "The id of the user whose password to change.", required = true) @PathParam("userId") String userId, @ApiParam(name = "JSON body", value = "The old and new passwords.", required = true) @Valid ChangePasswordRequest cr) throws ValidationException {
    final User user = loadUserById(userId);
    final String username = user.getName();
    if (!getSubject().isPermitted(RestPermissions.USERS_PASSWORDCHANGE + ":" + username)) {
        throw new ForbiddenException("Not allowed to change password for user " + username);
    }
    if (user.isExternalUser()) {
        final String msg = "Cannot change password for external user.";
        LOG.error(msg);
        throw new ForbiddenException(msg);
    }
    boolean checkOldPassword = true;
    // the rationale is to prevent accidental or malicious change of admin passwords (e.g. to prevent locking out legitimate admins)
    if (getSubject().isPermitted(RestPermissions.USERS_PASSWORDCHANGE + ":*")) {
        if (username.equals(getSubject().getPrincipal())) {
            LOG.debug("User {} is allowed to change the password of any user, but attempts to change own password. Must supply the old password.", getSubject().getPrincipal());
            checkOldPassword = true;
        } else {
            LOG.debug("User {} is allowed to change the password for any user, including {}, ignoring old password", getSubject().getPrincipal(), username);
            checkOldPassword = false;
        }
    }
    boolean changeAllowed = false;
    if (checkOldPassword) {
        if (userManagementService.isUserPassword(user, cr.oldPassword())) {
            changeAllowed = true;
        }
    } else {
        changeAllowed = true;
    }
    if (changeAllowed) {
        if (checkOldPassword) {
            userManagementService.changePassword(user, cr.oldPassword(), cr.password());
        } else {
            userManagementService.changePassword(user, cr.password());
        }
    } else {
        throw new BadRequestException("Old password is missing or incorrect.");
    }
}