Examples with WhitespaceRule org.passay.WhitespaceRule used on opensource projects

Example 1 with WhitespaceRule

use of org.passay.WhitespaceRule in project thingsboard by thingsboard.

the class DefaultSystemSecurityService method validatePassword.

@Override
public void validatePassword(TenantId tenantId, String password, UserCredentials userCredentials) throws DataValidationException {
    SecuritySettings securitySettings = self.getSecuritySettings(tenantId);
    UserPasswordPolicy passwordPolicy = securitySettings.getPasswordPolicy();
    List<Rule> passwordRules = new ArrayList<>();
    passwordRules.add(new LengthRule(passwordPolicy.getMinimumLength(), Integer.MAX_VALUE));
    if (isPositiveInteger(passwordPolicy.getMinimumUppercaseLetters())) {
        passwordRules.add(new CharacterRule(EnglishCharacterData.UpperCase, passwordPolicy.getMinimumUppercaseLetters()));
    }
    if (isPositiveInteger(passwordPolicy.getMinimumLowercaseLetters())) {
        passwordRules.add(new CharacterRule(EnglishCharacterData.LowerCase, passwordPolicy.getMinimumLowercaseLetters()));
    }
    if (isPositiveInteger(passwordPolicy.getMinimumDigits())) {
        passwordRules.add(new CharacterRule(EnglishCharacterData.Digit, passwordPolicy.getMinimumDigits()));
    }
    if (isPositiveInteger(passwordPolicy.getMinimumSpecialCharacters())) {
        passwordRules.add(new CharacterRule(EnglishCharacterData.Special, passwordPolicy.getMinimumSpecialCharacters()));
    }
    if (passwordPolicy.getAllowWhitespaces() != null && !passwordPolicy.getAllowWhitespaces()) {
        passwordRules.add(new WhitespaceRule());
    }
    PasswordValidator validator = new PasswordValidator(passwordRules);
    PasswordData passwordData = new PasswordData(password);
    RuleResult result = validator.validate(passwordData);
    if (!result.isValid()) {
        String message = String.join("\n", validator.getMessages(result));
        throw new DataValidationException(message);
    }
    if (userCredentials != null && isPositiveInteger(passwordPolicy.getPasswordReuseFrequencyDays())) {
        long passwordReuseFrequencyTs = System.currentTimeMillis() - TimeUnit.DAYS.toMillis(passwordPolicy.getPasswordReuseFrequencyDays());
        User user = userService.findUserById(tenantId, userCredentials.getUserId());
        JsonNode additionalInfo = user.getAdditionalInfo();
        if (additionalInfo instanceof ObjectNode && additionalInfo.has(UserServiceImpl.USER_PASSWORD_HISTORY)) {
            JsonNode userPasswordHistoryJson = additionalInfo.get(UserServiceImpl.USER_PASSWORD_HISTORY);
            Map<String, String> userPasswordHistoryMap = JacksonUtil.convertValue(userPasswordHistoryJson, new TypeReference<>() {
            });
            for (Map.Entry<String, String> entry : userPasswordHistoryMap.entrySet()) {
                if (encoder.matches(password, entry.getValue()) && Long.parseLong(entry.getKey()) > passwordReuseFrequencyTs) {
                    throw new DataValidationException("Password was already used for the last " + passwordPolicy.getPasswordReuseFrequencyDays() + " days");
                }
            }
        }
    }
}