Examples with UserRecoveryDataStore org.wso2.carbon.identity.recovery.store.UserRecoveryDataStore used on opensource projects

Example 16 with UserRecoveryDataStore

use of org.wso2.carbon.identity.recovery.store.UserRecoveryDataStore in project identity-governance by wso2-extensions.

the class SecurityQuestionPasswordRecoveryManager method validateUserChallengeQuestions.

public ChallengeQuestionResponse validateUserChallengeQuestions(UserChallengeAnswer[] userChallengeAnswer, String code, org.wso2.carbon.identity.recovery.model.Property[] properties) throws IdentityRecoveryException {
    UserRecoveryDataStore userRecoveryDataStore = JDBCRecoveryDataStore.getInstance();
    UserRecoveryData userRecoveryData = userRecoveryDataStore.load(code);
    // if return data from load, it means the code is validated. Otherwise it returns exceptions.
    User user = userRecoveryData.getUser();
    validateFunctionalityForUser(user);
    try {
        boolean isRecoveryEnable = Boolean.parseBoolean(Utils.getRecoveryConfigs(IdentityRecoveryConstants.ConnectorConfig.QUESTION_BASED_PW_RECOVERY, userRecoveryData.getUser().getTenantDomain()));
        if (!isRecoveryEnable) {
            throw Utils.handleClientException(IdentityRecoveryConstants.ErrorMessages.ERROR_CODE_QUESTION_BASED_RECOVERY_NOT_ENABLE, null);
        }
        verifyUserExists(user);
        if (Utils.isAccountDisabled(user)) {
            throw Utils.handleClientException(IdentityRecoveryConstants.ErrorMessages.ERROR_CODE_DISABLED_ACCOUNT, user.getUserName());
        } else if (Utils.isAccountLocked(user)) {
            throw Utils.handleClientException(IdentityRecoveryConstants.ErrorMessages.ERROR_CODE_LOCKED_ACCOUNT, user.getUserName());
        }
        if (userChallengeAnswer == null) {
            String error = "Challenge answers cannot be found for user: " + userRecoveryData.getUser();
            throw Utils.handleClientException(IdentityRecoveryConstants.ErrorMessages.ERROR_CODE_CHALLENGE_QUESTION_NOT_FOUND, error);
        }
        String challengeQuestionSeparator = IdentityUtil.getProperty(IdentityRecoveryConstants.ConnectorConfig.QUESTION_CHALLENGE_SEPARATOR);
        if (StringUtils.isEmpty(challengeQuestionSeparator)) {
            challengeQuestionSeparator = IdentityRecoveryConstants.DEFAULT_CHALLENGE_QUESTION_SEPARATOR;
        }
        if (RecoverySteps.VALIDATE_CHALLENGE_QUESTION.equals(userRecoveryData.getRecoveryStep())) {
            if (userChallengeAnswer.length > 1) {
                throw Utils.handleClientException(IdentityRecoveryConstants.ErrorMessages.ERROR_CODE_MULTIPLE_QUESTION_NOT_ALLOWED, null);
            }
            ChallengeQuestionManager challengeQuestionManager = ChallengeQuestionManager.getInstance();
            boolean verified = challengeQuestionManager.verifyUserChallengeAnswer(userRecoveryData.getUser(), userChallengeAnswer[0]);
            if (verified) {
                boolean resetFailedLoginCount = false;
                userRecoveryDataStore.invalidate(code);
                String remainingSetIds = userRecoveryData.getRemainingSetIds();
                ChallengeQuestionResponse challengeQuestionResponse = new ChallengeQuestionResponse();
                String secretKey = UUIDGenerator.generateUUID();
                challengeQuestionResponse.setCode(secretKey);
                UserRecoveryData recoveryData = new UserRecoveryData(userRecoveryData.getUser(), secretKey, RecoveryScenarios.QUESTION_BASED_PWD_RECOVERY);
                if (StringUtils.isNotBlank(remainingSetIds)) {
                    String[] ids = remainingSetIds.split(challengeQuestionSeparator);
                    ChallengeQuestion challengeQuestion = challengeQuestionManager.getUserChallengeQuestion(userRecoveryData.getUser(), ids[0]);
                    challengeQuestionResponse.setQuestion(challengeQuestion);
                    recoveryData.setRecoveryStep(RecoverySteps.VALIDATE_CHALLENGE_QUESTION);
                    challengeQuestionResponse.setStatus(IdentityRecoveryConstants.RECOVERY_STATUS_INCOMPLETE);
                    if (ids.length > 1) {
                        for (int i = 1; i < ids.length; i++) {
                            if (i == 1) {
                                remainingSetIds = ids[1];
                            } else {
                                remainingSetIds = remainingSetIds + challengeQuestionSeparator + ids[i];
                            }
                        }
                        recoveryData.setRemainingSetIds(remainingSetIds);
                    }
                } else {
                    resetFailedLoginCount = true;
                    recoveryData.setRecoveryStep(RecoverySteps.UPDATE_PASSWORD);
                    challengeQuestionResponse.setStatus(IdentityRecoveryConstants.RECOVERY_STATUS_COMPLETE);
                }
                userRecoveryDataStore.store(recoveryData);
                // Reset password recovery failed attempts
                if (isPerUserFunctionalityLockingEnabled) {
                    resetRecoveryPasswordProperties(userRecoveryData.getUser(), resetFailedLoginCount);
                } else {
                    resetRecoveryPasswordFailedAttempts(userRecoveryData.getUser(), resetFailedLoginCount);
                }
                return challengeQuestionResponse;
            } else {
                throw Utils.handleClientException(IdentityRecoveryConstants.ErrorMessages.ERROR_CODE_INVALID_ANSWER_FOR_SECURITY_QUESTION, null);
            }
        } else if (RecoverySteps.VALIDATE_ALL_CHALLENGE_QUESTION.equals(userRecoveryData.getRecoveryStep())) {
            String allChallengeQuestions = userRecoveryData.getRemainingSetIds();
            if (StringUtils.isNotBlank(allChallengeQuestions)) {
                String[] requestedQuestions = allChallengeQuestions.split(challengeQuestionSeparator);
                if (requestedQuestions.length != userChallengeAnswer.length) {
                    throw Utils.handleClientException(IdentityRecoveryConstants.ErrorMessages.ERROR_CODE_NEED_TO_ANSWER_TO_REQUESTED_QUESTIONS, null);
                }
                validateQuestion(requestedQuestions, userChallengeAnswer);
            // Validate whether user answered all the requested questions
            } else {
                String error = "Could not find requested challenge questions for user: " + userRecoveryData.getUser();
                throw Utils.handleClientException(IdentityRecoveryConstants.ErrorMessages.ERROR_CODE_CHALLENGE_QUESTION_NOT_FOUND, error);
            }
            ChallengeQuestionManager challengeQuestionManager = ChallengeQuestionManager.getInstance();
            for (int i = 0; i < userChallengeAnswer.length; i++) {
                boolean verified = challengeQuestionManager.verifyUserChallengeAnswer(userRecoveryData.getUser(), userChallengeAnswer[i]);
                if (!verified) {
                    // handleAnswerVerificationFail(userRecoveryData.getUser());
                    throw Utils.handleClientException(IdentityRecoveryConstants.ErrorMessages.ERROR_CODE_INVALID_ANSWER_FOR_SECURITY_QUESTION, null);
                }
            }
            // Reset password recovery failed attempts
            if (isPerUserFunctionalityLockingEnabled) {
                resetRecoveryPasswordProperties(userRecoveryData.getUser(), true);
            } else {
                resetRecoveryPasswordFailedAttempts(userRecoveryData.getUser(), true);
            }
            userRecoveryDataStore.invalidate(code);
            ChallengeQuestionResponse challengeQuestionResponse = new ChallengeQuestionResponse();
            String secretKey = UUIDGenerator.generateUUID();
            challengeQuestionResponse.setCode(secretKey);
            challengeQuestionResponse.setStatus(IdentityRecoveryConstants.RECOVERY_STATUS_COMPLETE);
            UserRecoveryData recoveryData = new UserRecoveryData(userRecoveryData.getUser(), secretKey, RecoveryScenarios.QUESTION_BASED_PWD_RECOVERY);
            recoveryData.setRecoveryStep(RecoverySteps.UPDATE_PASSWORD);
            userRecoveryDataStore.store(recoveryData);
            return challengeQuestionResponse;
        } else {
            throw Utils.handleClientException(IdentityRecoveryConstants.ErrorMessages.ERROR_CODE_INVALID_CODE, null);
        }
    } catch (IdentityRecoveryClientException e) {
        if (isPerUserFunctionalityLockingEnabled) {
            handleAnswerVerificationFailInFunctionalityLockMode(userRecoveryData.getUser());
            throw e;
        }
        handleAnswerVerificationFail(userRecoveryData.getUser());
        throw e;
    }
}

Example 17 with UserRecoveryDataStore

use of org.wso2.carbon.identity.recovery.store.UserRecoveryDataStore in project identity-governance by wso2-extensions.

the class SecurityQuestionPasswordRecoveryManager method initiateUserChallengeQuestion.

public ChallengeQuestionResponse initiateUserChallengeQuestion(User user) throws IdentityRecoveryException {
    Utils.validateEmailUsername(user.getUserName());
    if (StringUtils.isBlank(user.getTenantDomain())) {
        user.setTenantDomain(MultitenantConstants.SUPER_TENANT_DOMAIN_NAME);
        log.info("initiateUserChallengeQuestion :Tenant domain is not in the request. set to default for user : " + user.getUserName());
    }
    if (StringUtils.isBlank(user.getUserStoreDomain())) {
        user.setUserStoreDomain(IdentityUtil.getPrimaryDomainName());
        log.info("initiateUserChallengeQuestion :User store domain is not in the request. set to default for user" + " : " + user.getUserName());
    }
    boolean isNotificationInternallyManaged = Boolean.parseBoolean(Utils.getRecoveryConfigs(IdentityRecoveryConstants.ConnectorConfig.NOTIFICATION_INTERNALLY_MANAGE, user.getTenantDomain()));
    boolean isRecoveryEnable = Boolean.parseBoolean(Utils.getRecoveryConfigs(IdentityRecoveryConstants.ConnectorConfig.QUESTION_BASED_PW_RECOVERY, user.getTenantDomain()));
    if (!isRecoveryEnable) {
        throw Utils.handleClientException(IdentityRecoveryConstants.ErrorMessages.ERROR_CODE_QUESTION_BASED_RECOVERY_NOT_ENABLE, null);
    }
    verifyUserExists(user);
    validateFunctionalityForUser(user);
    UserRecoveryDataStore userRecoveryDataStore = JDBCRecoveryDataStore.getInstance();
    userRecoveryDataStore.invalidate(user);
    String challengeQuestionSeparator = IdentityUtil.getProperty(IdentityRecoveryConstants.ConnectorConfig.QUESTION_CHALLENGE_SEPARATOR);
    if (StringUtils.isEmpty(challengeQuestionSeparator)) {
        challengeQuestionSeparator = IdentityRecoveryConstants.DEFAULT_CHALLENGE_QUESTION_SEPARATOR;
    }
    if (Utils.isAccountDisabled(user)) {
        throw Utils.handleClientException(IdentityRecoveryConstants.ErrorMessages.ERROR_CODE_DISABLED_ACCOUNT, user.getUserName());
    } else if (Utils.isAccountLocked(user)) {
        throw Utils.handleClientException(IdentityRecoveryConstants.ErrorMessages.ERROR_CODE_LOCKED_ACCOUNT, user.getUserName());
    }
    boolean isNotificationSendWhenInitiatingPWRecovery = Boolean.parseBoolean(Utils.getRecoveryConfigs(IdentityRecoveryConstants.ConnectorConfig.NOTIFICATION_SEND_RECOVERY_SECURITY_START, user.getTenantDomain()));
    if (isNotificationInternallyManaged && isNotificationSendWhenInitiatingPWRecovery) {
        try {
            triggerNotification(user, IdentityRecoveryConstants.NOTIFICATION_TYPE_PASSWORD_RESET_INITIATE, null);
        } catch (Exception e) {
            log.warn("Error while sending password reset initiating notification to user :" + user.getUserName());
        }
    }
    int minNoOfQuestionsToAnswer = Integer.parseInt(Utils.getRecoveryConfigs(IdentityRecoveryConstants.ConnectorConfig.QUESTION_MIN_NO_ANSWER, user.getTenantDomain()));
    ChallengeQuestionManager challengeQuestionManager = ChallengeQuestionManager.getInstance();
    String[] ids = challengeQuestionManager.getUserChallengeQuestionIds(user);
    if (ids == null || ids.length == 0) {
        throw Utils.handleClientException(IdentityRecoveryConstants.ErrorMessages.ERROR_CODE_CHALLENGE_QUESTION_NOT_FOUND, user.getUserName());
    }
    if (ids.length > minNoOfQuestionsToAnswer) {
        ids = getRandomQuestionIds(ids, minNoOfQuestionsToAnswer);
    }
    String metaData = null;
    for (int i = 1; i < ids.length; i++) {
        if (i == 1) {
            metaData = ids[1];
        } else {
            metaData = metaData + challengeQuestionSeparator + ids[i];
        }
    }
    ChallengeQuestion userChallengeQuestion = challengeQuestionManager.getUserChallengeQuestion(user, ids[0]);
    ChallengeQuestionResponse challengeQuestionResponse = new ChallengeQuestionResponse(userChallengeQuestion);
    String secretKey = UUIDGenerator.generateUUID();
    UserRecoveryData recoveryData = new UserRecoveryData(user, secretKey, RecoveryScenarios.QUESTION_BASED_PWD_RECOVERY, RecoverySteps.VALIDATE_CHALLENGE_QUESTION);
    recoveryData.setRemainingSetIds(metaData);
    challengeQuestionResponse.setCode(secretKey);
    if (ids.length > 1) {
        challengeQuestionResponse.setStatus(IdentityRecoveryConstants.RECOVERY_STATUS_INCOMPLETE);
    }
    userRecoveryDataStore.store(recoveryData);
    return challengeQuestionResponse;
}

Example 18 with UserRecoveryDataStore

use of org.wso2.carbon.identity.recovery.store.UserRecoveryDataStore in project identity-governance by wso2-extensions.

the class UserSelfRegistrationManager method preValidatePasswordWithConfirmationKey.

/**
 * Pre validate password against the policies defined in the Identity Server during password recovery instance.
 *
 * @param confirmationKey Confirmation code for password recovery.
 * @param password        Password to be pre-validated against the policies defined in IS.
 * @throws IdentityEventException    Error handling the event.
 * @throws IdentityRecoveryException Error getting the userstore manager.
 */
public void preValidatePasswordWithConfirmationKey(String confirmationKey, String password) throws IdentityEventException, IdentityRecoveryException {
    UserRecoveryDataStore userRecoveryDataStore = JDBCRecoveryDataStore.getInstance();
    UserRecoveryData recoveryData = userRecoveryDataStore.load(confirmationKey);
    User user = recoveryData.getUser();
    String userStoreDomain = user.getUserStoreDomain();
    String username = user.getUserName();
    preValidatePassword(username, password, userStoreDomain);
}

Example 19 with UserRecoveryDataStore

use of org.wso2.carbon.identity.recovery.store.UserRecoveryDataStore in project identity-governance by wso2-extensions.

the class UserSelfRegistrationManager method confirmUserSelfRegistration.

/**
 * This method is deprecated.
 *
 * @since 1.1.37
 * @deprecated Additional properties cannot be passed in to the method.
 * Use
 * {@link
 * org.wso2.carbon.identity.recovery.signup.UserSelfRegistrationManager#confirmUserSelfRegistration
 * (String, Map, String, String)}
 */
public void confirmUserSelfRegistration(String code) throws IdentityRecoveryException {
    UserRecoveryDataStore userRecoveryDataStore = JDBCRecoveryDataStore.getInstance();
    UserRecoveryData recoveryData = userRecoveryDataStore.load(code);
    User user = recoveryData.getUser();
    String contextTenantDomain = PrivilegedCarbonContext.getThreadLocalCarbonContext().getTenantDomain();
    String userTenantDomain = user.getTenantDomain();
    if (!StringUtils.equalsIgnoreCase(contextTenantDomain, userTenantDomain)) {
        throw Utils.handleClientException(IdentityRecoveryConstants.ErrorMessages.ERROR_CODE_INVALID_TENANT, contextTenantDomain);
    }
    if (!RecoverySteps.CONFIRM_SIGN_UP.equals(recoveryData.getRecoveryStep()) && !RecoverySteps.CONFIRM_LITE_SIGN_UP.equals(recoveryData.getRecoveryStep())) {
        throw Utils.handleClientException(IdentityRecoveryConstants.ErrorMessages.ERROR_CODE_INVALID_CODE, null);
    }
    try {
        RealmService realmService = IdentityRecoveryServiceDataHolder.getInstance().getRealmService();
        UserStoreManager userStoreManager;
        try {
            userStoreManager = realmService.getTenantUserRealm(IdentityTenantUtil.getTenantId(user.getTenantDomain())).getUserStoreManager();
        } catch (UserStoreException e) {
            throw Utils.handleServerException(IdentityRecoveryConstants.ErrorMessages.ERROR_CODE_UNEXPECTED, user.getUserName(), e);
        }
        PrivilegedCarbonContext.startTenantFlow();
        PrivilegedCarbonContext carbonContext = PrivilegedCarbonContext.getThreadLocalCarbonContext();
        carbonContext.setTenantId(IdentityTenantUtil.getTenantId(user.getTenantDomain()));
        carbonContext.setTenantDomain(user.getTenantDomain());
        HashMap<String, String> userClaims = new HashMap<>();
        // Need to lock user account
        userClaims.put(IdentityRecoveryConstants.ACCOUNT_LOCKED_CLAIM, Boolean.FALSE.toString());
        userClaims.put(IdentityRecoveryConstants.EMAIL_VERIFIED_CLAIM, Boolean.TRUE.toString());
        try {
            userStoreManager.setUserClaimValues(IdentityUtil.addDomainToName(user.getUserName(), user.getUserStoreDomain()), userClaims, null);
        } catch (UserStoreException e) {
            throw Utils.handleServerException(IdentityRecoveryConstants.ErrorMessages.ERROR_CODE_UNLOCK_USER_USER, user.getUserName(), e);
        }
        // Invalidate code
        userRecoveryDataStore.invalidate(code);
    } finally {
        PrivilegedCarbonContext.endTenantFlow();
    }
}

Example 20 with UserRecoveryDataStore

use of org.wso2.carbon.identity.recovery.store.UserRecoveryDataStore in project identity-governance by wso2-extensions.

the class UserSelfRegistrationManager method confirmVerificationCodeMe.

/**
 * Validates the verification code and update verified claims of the authenticated user.
 *
 * @param code                 Confirmation code.
 * @param properties           Properties sent with the validate code request.
 * @throws IdentityRecoveryException Error validating the confirmation code.
 */
public void confirmVerificationCodeMe(String code, Map<String, String> properties) throws IdentityRecoveryException {
    Utils.unsetThreadLocalToSkipSendingSmsOtpVerificationOnUpdate();
    UserRecoveryDataStore userRecoveryDataStore = JDBCRecoveryDataStore.getInstance();
    // If the code is validated, the load method will return data. Otherwise method will throw exceptions.
    UserRecoveryData recoveryData = userRecoveryDataStore.load(code);
    // Validate the recovery step to verify mobile claim scenario.
    if (!RecoverySteps.VERIFY_MOBILE_NUMBER.equals(recoveryData.getRecoveryStep())) {
        auditRecoveryConfirm(recoveryData, IdentityRecoveryConstants.ErrorMessages.ERROR_CODE_INVALID_CODE.getMessage(), AUDIT_FAILED);
        throw Utils.handleClientException(IdentityRecoveryConstants.ErrorMessages.ERROR_CODE_INVALID_CODE, null);
    }
    User user = recoveryData.getUser();
    // Validate context username and tenant domain name with user from recovery data.
    validateUser(user);
    // Get the userstore manager for the user.
    UserStoreManager userStoreManager = getUserStoreManager(user);
    HashMap<String, String> userClaims = new HashMap<>();
    if (RecoverySteps.VERIFY_MOBILE_NUMBER.equals(recoveryData.getRecoveryStep())) {
        String pendingMobileNumberClaimValue = recoveryData.getRemainingSetIds();
        if (StringUtils.isNotBlank(pendingMobileNumberClaimValue)) {
            userClaims.put(IdentityRecoveryConstants.MOBILE_NUMBER_PENDING_VALUE_CLAIM, StringUtils.EMPTY);
            userClaims.put(IdentityRecoveryConstants.MOBILE_NUMBER_CLAIM, pendingMobileNumberClaimValue);
            userClaims.put(NotificationChannels.SMS_CHANNEL.getVerifiedClaimUrl(), Boolean.TRUE.toString());
            Utils.setThreadLocalToSkipSendingSmsOtpVerificationOnUpdate(IdentityRecoveryConstants.SkipMobileNumberVerificationOnUpdateStates.SKIP_ON_CONFIRM.toString());
        }
    }
    // Update the user claims.
    updateUserClaims(userStoreManager, user, userClaims);
    // Invalidate code.
    userRecoveryDataStore.invalidate(code);
    auditRecoveryConfirm(recoveryData, null, AUDIT_SUCCESS);
}