Examples with PwmSession password.pwm.http.PwmSession used on opensource projects

Example 41 with PwmSession

use of password.pwm.http.PwmSession in project pwm by pwm-project.

the class PasswordRequirementsTag method doEndTag.

public int doEndTag() throws javax.servlet.jsp.JspTagException {
    try {
        final PwmRequest pwmRequest = PwmRequest.forRequest((HttpServletRequest) pageContext.getRequest(), (HttpServletResponse) pageContext.getResponse());
        final PwmSession pwmSession = pwmRequest.getPwmSession();
        final PwmApplication pwmApplication = pwmRequest.getPwmApplication();
        final Configuration config = pwmApplication.getConfig();
        final Locale locale = pwmSession.getSessionStateBean().getLocale();
        pwmSession.getSessionManager().getMacroMachine(pwmApplication);
        final PwmPasswordPolicy passwordPolicy;
        if (getForm() != null && getForm().equalsIgnoreCase("newuser")) {
            final NewUserProfile newUserProfile = NewUserServlet.getNewUserProfile(pwmRequest);
            passwordPolicy = newUserProfile.getNewUserPasswordPolicy(pwmApplication, locale);
        } else {
            passwordPolicy = pwmSession.getUserInfo().getPasswordPolicy();
        }
        final String configuredRuleText = passwordPolicy.getRuleText();
        if (configuredRuleText != null && configuredRuleText.length() > 0) {
            pageContext.getOut().write(configuredRuleText);
        } else {
            final MacroMachine macroMachine = pwmSession.getSessionManager().getMacroMachine(pwmApplication);
            final String pre = prepend != null && prepend.length() > 0 ? prepend : "";
            final String sep = separator != null && separator.length() > 0 ? separator : "<br/>";
            final List<String> requirementsList = getPasswordRequirementsStrings(passwordPolicy, config, locale, macroMachine);
            final StringBuilder requirementsText = new StringBuilder();
            for (final String requirementStatement : requirementsList) {
                requirementsText.append(pre);
                requirementsText.append(requirementStatement);
                requirementsText.append(sep);
            }
            pageContext.getOut().write(requirementsText.toString());
        }
    } catch (IOException | PwmException e) {
        LOGGER.error("unexpected error during password requirements generation: " + e.getMessage(), e);
        throw new JspTagException(e.getMessage());
    }
    return EVAL_PAGE;
}

Example 42 with PwmSession

use of password.pwm.http.PwmSession in project pwm by pwm-project.

the class PwmLogger method doPwmRequestLogEvent.

private void doPwmRequestLogEvent(final PwmLogLevel level, final PwmRequest pwmRequest, final Object message, final Throwable e) {
    final PwmSession pwmSession = pwmRequest != null ? pwmRequest.getPwmSession() : null;
    doPwmSessionLogEvent(level, pwmSession, message, e);
}

Example 43 with PwmSession

use of password.pwm.http.PwmSession in project pwm by pwm-project.

the class AbstractUriCertImportFunction method provideFunction.

@Override
public String provideFunction(final PwmRequest pwmRequest, final StoredConfigurationImpl storedConfiguration, final PwmSetting setting, final String profile, final String extraData) throws PwmOperationalException, PwmUnrecoverableException {
    final PwmSession pwmSession = pwmRequest.getPwmSession();
    final List<X509Certificate> certs;
    final String urlString = getUri(storedConfiguration, setting, profile, extraData);
    try {
        certs = X509Utils.readRemoteCertificates(URI.create(urlString));
    } catch (Exception e) {
        if (e instanceof PwmException) {
            throw new PwmOperationalException(((PwmException) e).getErrorInformation());
        }
        final ErrorInformation errorInformation = new ErrorInformation(PwmError.CONFIG_FORMAT_ERROR, "error importing certificates: " + e.getMessage());
        throw new PwmOperationalException(errorInformation);
    }
    final UserIdentity userIdentity = pwmSession.isAuthenticated() ? pwmSession.getUserInfo().getUserIdentity() : null;
    store(certs, storedConfiguration, setting, profile, extraData, userIdentity);
    final StringBuffer returnStr = new StringBuffer();
    for (final X509Certificate loopCert : certs) {
        returnStr.append(X509Utils.makeDebugText(loopCert));
        returnStr.append("\n\n");
    }
    return returnStr.toString();
}

Example 44 with PwmSession

use of password.pwm.http.PwmSession in project pwm by pwm-project.

the class SessionFilter method handleStandardRequestOperations.

private ProcessStatus handleStandardRequestOperations(final PwmRequest pwmRequest) throws PwmUnrecoverableException, IOException, ServletException {
    final PwmApplication pwmApplication = pwmRequest.getPwmApplication();
    final Configuration config = pwmRequest.getConfig();
    final PwmSession pwmSession = pwmRequest.getPwmSession();
    final LocalSessionStateBean ssBean = pwmSession.getSessionStateBean();
    final PwmResponse resp = pwmRequest.getPwmResponse();
    // debug the http session headers
    if (!pwmSession.getSessionStateBean().isDebugInitialized()) {
        LOGGER.trace(pwmSession, pwmRequest.debugHttpHeaders());
        pwmSession.getSessionStateBean().setDebugInitialized(true);
    }
    try {
        pwmApplication.getSessionStateService().readLoginSessionState(pwmRequest);
    } catch (PwmUnrecoverableException e) {
        LOGGER.warn(pwmRequest, "error while reading login session state: " + e.getMessage());
    }
    // mark last url
    if (!new PwmURL(pwmRequest.getHttpServletRequest()).isCommandServletURL()) {
        ssBean.setLastRequestURL(pwmRequest.getHttpServletRequest().getRequestURI());
    }
    // mark last request time.
    ssBean.setSessionLastAccessedTime(Instant.now());
    // check the page leave notice
    if (checkPageLeaveNotice(pwmSession, config)) {
        LOGGER.warn("invalidating session due to dirty page leave time greater then configured timeout");
        pwmRequest.invalidateSession();
        resp.sendRedirect(pwmRequest.getHttpServletRequest().getRequestURI());
        return ProcessStatus.Halt;
    }
    // override session locale due to parameter
    handleLocaleParam(pwmRequest);
    // set the session's theme
    handleThemeParam(pwmRequest);
    // check the sso override flag
    handleSsoOverrideParam(pwmRequest);
    // check for session verification failure
    if (!ssBean.isSessionVerified()) {
        // ignore resource requests
        final SessionVerificationMode mode = config.readSettingAsEnum(PwmSetting.ENABLE_SESSION_VERIFICATION, SessionVerificationMode.class);
        if (mode == SessionVerificationMode.OFF) {
            ssBean.setSessionVerified(true);
        } else {
            if (verifySession(pwmRequest, mode) == ProcessStatus.Halt) {
                return ProcessStatus.Halt;
            }
        }
    }
    {
        final String forwardURLParamName = config.readAppProperty(AppProperty.HTTP_PARAM_NAME_FORWARD_URL);
        final String forwardURL = pwmRequest.readParameterAsString(forwardURLParamName);
        if (forwardURL != null && forwardURL.length() > 0) {
            try {
                checkUrlAgainstWhitelist(pwmApplication, pwmRequest.getSessionLabel(), forwardURL);
            } catch (PwmOperationalException e) {
                LOGGER.error(pwmRequest, e.getErrorInformation());
                pwmRequest.respondWithError(e.getErrorInformation());
                return ProcessStatus.Halt;
            }
            ssBean.setForwardURL(forwardURL);
            LOGGER.debug(pwmRequest, "forwardURL parameter detected in request, setting session forward url to " + forwardURL);
        }
    }
    {
        final String logoutURLParamName = config.readAppProperty(AppProperty.HTTP_PARAM_NAME_LOGOUT_URL);
        final String logoutURL = pwmRequest.readParameterAsString(logoutURLParamName);
        if (logoutURL != null && logoutURL.length() > 0) {
            try {
                checkUrlAgainstWhitelist(pwmApplication, pwmRequest.getSessionLabel(), logoutURL);
            } catch (PwmOperationalException e) {
                LOGGER.error(pwmRequest, e.getErrorInformation());
                pwmRequest.respondWithError(e.getErrorInformation());
                return ProcessStatus.Halt;
            }
            ssBean.setLogoutURL(logoutURL);
            LOGGER.debug(pwmRequest, "logoutURL parameter detected in request, setting session logout url to " + logoutURL);
        }
    }
    {
        final String expireParamName = pwmRequest.getConfig().readAppProperty(AppProperty.HTTP_PARAM_NAME_PASSWORD_EXPIRED);
        if ("true".equalsIgnoreCase(pwmRequest.readParameterAsString(expireParamName))) {
            LOGGER.debug(pwmSession, "detected param '" + expireParamName + "'=true in request, will force pw change");
            pwmSession.getLoginInfoBean().getLoginFlags().add(LoginInfoBean.LoginFlag.forcePwChange);
        }
    }
    // update last request time.
    ssBean.setSessionLastAccessedTime(Instant.now());
    if (pwmApplication.getStatisticsManager() != null) {
        pwmApplication.getStatisticsManager().incrementValue(Statistic.HTTP_REQUESTS);
    }
    return ProcessStatus.Continue;
}

Example 45 with PwmSession

use of password.pwm.http.PwmSession in project pwm by pwm-project.

the class GuestRegistrationServlet method processAction.

protected void processAction(final PwmRequest pwmRequest) throws ServletException, ChaiUnavailableException, IOException, PwmUnrecoverableException {
    // Fetch the session state bean.
    final PwmSession pwmSession = pwmRequest.getPwmSession();
    final PwmApplication pwmApplication = pwmRequest.getPwmApplication();
    final GuestRegistrationBean guestRegistrationBean = pwmApplication.getSessionStateService().getBean(pwmRequest, GuestRegistrationBean.class);
    final Configuration config = pwmApplication.getConfig();
    if (!config.readSettingAsBoolean(PwmSetting.GUEST_ENABLE)) {
        pwmRequest.respondWithError(PwmError.ERROR_SERVICE_NOT_AVAILABLE.toInfo());
        return;
    }
    if (!pwmSession.getSessionManager().checkPermission(pwmApplication, Permission.GUEST_REGISTRATION)) {
        pwmRequest.respondWithError(PwmError.ERROR_UNAUTHORIZED.toInfo());
        return;
    }
    checkConfiguration(config);
    final GuestRegistrationAction action = readProcessAction(pwmRequest);
    if (action != null) {
        pwmRequest.validatePwmFormID();
        switch(action) {
            case create:
                handleCreateRequest(pwmRequest, guestRegistrationBean);
                return;
            case search:
                handleSearchRequest(pwmRequest, guestRegistrationBean);
                return;
            case update:
                handleUpdateRequest(pwmRequest, guestRegistrationBean);
                return;
            case selectPage:
                handleSelectPageRequest(pwmRequest, guestRegistrationBean);
                return;
            default:
                JavaHelper.unhandledSwitchStatement(action);
        }
    }
    this.forwardToJSP(pwmRequest, guestRegistrationBean);
}