Examples with PwmSession password.pwm.http.PwmSession used on opensource projects

Example 36 with PwmSession

use of password.pwm.http.PwmSession in project pwm by pwm-project.

the class Validator method validatePwmFormID.

public static void validatePwmFormID(final PwmRequest pwmRequest) throws PwmUnrecoverableException {
    final PwmSession pwmSession = pwmRequest.getPwmSession();
    final PwmApplication pwmApplication = pwmRequest.getPwmApplication();
    final String submittedPwmFormID = pwmRequest.readParameterAsString(PwmConstants.PARAM_FORM_ID);
    if (pwmApplication.getConfig().readSettingAsBoolean(PwmSetting.SECURITY_ENABLE_FORM_NONCE)) {
        final FormNonce formNonce = pwmRequest.getPwmApplication().getSecureService().decryptObject(submittedPwmFormID, FormNonce.class);
        if (formNonce == null) {
            throw new PwmUnrecoverableException(new ErrorInformation(PwmError.ERROR_INVALID_FORMID, "form nonce missing"));
        }
        if (!pwmSession.getLoginInfoBean().getGuid().equals(formNonce.getSessionGUID())) {
            throw new PwmUnrecoverableException(new ErrorInformation(PwmError.ERROR_INVALID_FORMID, "form nonce incorrect"));
        }
    }
}

Example 37 with PwmSession

use of password.pwm.http.PwmSession in project pwm by pwm-project.

the class Validator method validatePwmRequestCounter.

public static void validatePwmRequestCounter(final PwmRequest pwmRequest) throws PwmOperationalException, PwmUnrecoverableException {
    final PwmSession pwmSession = pwmRequest.getPwmSession();
    final boolean enforceRequestSequencing = Boolean.parseBoolean(pwmRequest.getConfig().readAppProperty(AppProperty.SECURITY_HTTP_FORCE_REQUEST_SEQUENCING));
    if (enforceRequestSequencing) {
        final String requestVerificationKey = String.valueOf(pwmSession.getLoginInfoBean().getReqCounter());
        final String submittedPwmFormID = pwmRequest.readParameterAsString(PwmConstants.PARAM_FORM_ID);
        if (submittedPwmFormID == null || submittedPwmFormID.isEmpty()) {
            return;
        }
        try {
            final FormNonce formNonce = pwmRequest.getPwmApplication().getSecureService().decryptObject(submittedPwmFormID, FormNonce.class);
            final String submittedRequestVerificationKey = String.valueOf(formNonce.getReqCounter());
            if (!requestVerificationKey.equals(submittedRequestVerificationKey)) {
                final String debugMsg = "expectedPageID=" + requestVerificationKey + ", submittedPageID=" + submittedRequestVerificationKey + ", url=" + pwmRequest.getURL().toString();
                throw new PwmOperationalException(PwmError.ERROR_INCORRECT_REQ_SEQUENCE, debugMsg);
            }
        } catch (StringIndexOutOfBoundsException | NumberFormatException e) {
            throw new PwmOperationalException(PwmError.ERROR_INCORRECT_REQ_SEQUENCE);
        }
    }
}

Example 38 with PwmSession

use of password.pwm.http.PwmSession in project pwm by pwm-project.

the class CASFilterAuthenticationProvider method authUserUsingCASClearPass.

private static boolean authUserUsingCASClearPass(final PwmRequest pwmRequest) throws UnsupportedEncodingException, PwmUnrecoverableException, ChaiUnavailableException, PwmOperationalException {
    final PwmSession pwmSession = pwmRequest.getPwmSession();
    final PwmApplication pwmApplication = pwmRequest.getPwmApplication();
    final HttpSession session = pwmRequest.getHttpServletRequest().getSession();
    // make sure user session isn't already authenticated
    if (pwmSession.isAuthenticated()) {
        return false;
    }
    // read CAS assertion out of the header (if it exists);
    final Assertion assertion = (Assertion) session.getAttribute(AbstractCasFilter.CONST_CAS_ASSERTION);
    if (assertion == null) {
        LOGGER.trace(pwmSession, "no CAS assertion header present, skipping CAS authentication attempt");
        return false;
    }
    final String username = assertion.getPrincipal().getName();
    PasswordData password = null;
    final AttributePrincipal attributePrincipal = assertion.getPrincipal();
    final Map<String, Object> casAttributes = attributePrincipal.getAttributes();
    final String encodedPsw = (String) casAttributes.get("credential");
    if (encodedPsw == null) {
        LOGGER.trace("No credential");
    } else {
        final Map<FileInformation, FileContent> privatekey = pwmRequest.getConfig().readSettingAsFile(PwmSetting.CAS_CLEARPASS_KEY);
        final String alg = pwmRequest.getConfig().readSettingAsString(PwmSetting.CAS_CLEARPASS_ALGORITHM);
        password = decryptPassword(alg, privatekey, encodedPsw);
    }
    // If using the old method
    final String clearPassUrl = pwmRequest.getConfig().readSettingAsString(PwmSetting.CAS_CLEAR_PASS_URL);
    if ((clearPassUrl != null && clearPassUrl.length() > 0) && (password == null || password.getStringValue().length() < 1)) {
        LOGGER.trace(pwmSession, "Using CAS clearpass via proxy");
        // read cas proxy ticket
        final String proxyTicket = assertion.getPrincipal().getProxyTicketFor(clearPassUrl);
        if (proxyTicket == null) {
            LOGGER.trace(pwmSession, "no CAS proxy ticket available, skipping CAS authentication attempt");
            return false;
        }
        final String clearPassRequestUrl = clearPassUrl + "?" + "ticket=" + proxyTicket + "&" + "service=" + StringUtil.urlEncode(clearPassUrl);
        try {
            final String response = CommonUtils.getResponseFromServer(new URL(clearPassRequestUrl), new HttpsURLConnectionFactory(), "UTF-8");
            password = new PasswordData(XmlUtils.getTextForElement(response, "credentials"));
        } catch (MalformedURLException e) {
            LOGGER.error(pwmSession, "Invalid CAS clearPassUrl");
        }
    }
    if (password == null || password.getStringValue().length() < 1) {
        final String errorMsg = "CAS server did not return credentials for user '" + username + "'";
        LOGGER.trace(pwmSession, errorMsg);
        final ErrorInformation errorInformation = new ErrorInformation(PwmError.ERROR_WRONGPASSWORD, errorMsg);
        throw new PwmOperationalException(errorInformation);
    }
    // user isn't already authenticated and has CAS assertion and password, so try to auth them.
    LOGGER.debug(pwmSession, "attempting to authenticate user '" + username + "' using CAS assertion and password");
    final SessionAuthenticator sessionAuthenticator = new SessionAuthenticator(pwmApplication, pwmSession, PwmAuthenticationSource.CAS);
    sessionAuthenticator.searchAndAuthenticateUser(username, password, null, null);
    return true;
}

Example 39 with PwmSession

use of password.pwm.http.PwmSession in project pwm by pwm-project.

the class SessionTrackService method getDebugData.

public Map<DebugKey, String> getDebugData() {
    try {
        final Collection<PwmSession> sessionCopy = copyOfSessionSet();
        int sessionCounter = 0;
        long sizeTotal = 0;
        for (final PwmSession pwmSession : sessionCopy) {
            try {
                sizeTotal += pwmSession.size();
                sessionCounter++;
            } catch (Exception e) {
                LOGGER.error("error during session size calculation: " + e.getMessage());
            }
        }
        final Map<DebugKey, String> returnMap = new HashMap<>();
        returnMap.put(DebugKey.HttpSessionCount, String.valueOf(sessionCounter));
        returnMap.put(DebugKey.HttpSessionTotalSize, String.valueOf(sizeTotal));
        returnMap.put(DebugKey.HttpSessionAvgSize, sessionCounter < 1 ? "0" : String.valueOf((int) (sizeTotal / sessionCounter)));
        return returnMap;
    } catch (Exception e) {
        LOGGER.error("error during session debug generation: " + e.getMessage());
    }
    return Collections.emptyMap();
}

Example 40 with PwmSession

use of password.pwm.http.PwmSession in project pwm by pwm-project.

the class UserInfoTag method doEndTag.

public int doEndTag() throws JspTagException {
    try {
        final PwmRequest pwmRequest = JspUtility.getPwmRequest(pageContext);
        final PwmSession pwmSession = pwmRequest.getPwmSession();
        if (pwmSession.isAuthenticated()) {
            final String ldapValue = pwmSession.getUserInfo().readStringAttribute(attribute);
            pageContext.getOut().write(StringUtil.escapeHtml(ldapValue == null ? "" : ldapValue));
        }
    } catch (Exception e) {
        throw new JspTagException(e.getMessage());
    }
    return EVAL_PAGE;
}