Examples with RequireCurrentPasswordMode password.pwm.config.option.RequireCurrentPasswordMode used on opensource projects

Example 1 with RequireCurrentPasswordMode

use of password.pwm.config.option.RequireCurrentPasswordMode in project pwm by pwm-project.

the class ChangePasswordServletUtil method determineIfCurrentPasswordRequired.

static boolean determineIfCurrentPasswordRequired(final PwmApplication pwmApplication, final PwmSession pwmSession) throws PwmUnrecoverableException {
    final RequireCurrentPasswordMode currentSetting = pwmApplication.getConfig().readSettingAsEnum(PwmSetting.PASSWORD_REQUIRE_CURRENT, RequireCurrentPasswordMode.class);
    if (currentSetting == RequireCurrentPasswordMode.FALSE) {
        return false;
    }
    if (pwmSession.getLoginInfoBean().getType() == AuthenticationType.AUTH_FROM_PUBLIC_MODULE) {
        LOGGER.debug(pwmSession, "skipping user current password requirement, authentication type is " + AuthenticationType.AUTH_FROM_PUBLIC_MODULE);
        return false;
    }
    {
        final PasswordData currentPassword = pwmSession.getLoginInfoBean().getUserCurrentPassword();
        if (currentPassword == null) {
            LOGGER.debug(pwmSession, "skipping user current password requirement, current password is not known to application");
            return false;
        }
    }
    if (currentSetting == RequireCurrentPasswordMode.TRUE) {
        return true;
    }
    final PasswordStatus passwordStatus = pwmSession.getUserInfo().getPasswordStatus();
    return currentSetting == RequireCurrentPasswordMode.NOTEXPIRED && !passwordStatus.isExpired() && !passwordStatus.isPreExpired() && !passwordStatus.isViolatesPolicy() && !pwmSession.getUserInfo().isRequiresNewPassword();
}