Examples with ForgottenPasswordBean password.pwm.http.bean.ForgottenPasswordBean used on opensource projects

Example 1 with ForgottenPasswordBean

use of password.pwm.http.bean.ForgottenPasswordBean in project pwm by pwm-project.

the class ForgottenPasswordUtil method doActionSendNewPassword.

static void doActionSendNewPassword(final PwmRequest pwmRequest) throws ChaiUnavailableException, IOException, ServletException, PwmUnrecoverableException {
    final PwmApplication pwmApplication = pwmRequest.getPwmApplication();
    final ForgottenPasswordBean forgottenPasswordBean = ForgottenPasswordServlet.forgottenPasswordBean(pwmRequest);
    final ForgottenPasswordProfile forgottenPasswordProfile = forgottenPasswordProfile(pwmRequest.getPwmApplication(), forgottenPasswordBean);
    final RecoveryAction recoveryAction = ForgottenPasswordUtil.getRecoveryAction(pwmApplication.getConfig(), forgottenPasswordBean);
    LOGGER.trace(pwmRequest, "beginning process to send new password to user");
    if (!forgottenPasswordBean.getProgress().isAllPassed()) {
        return;
    }
    final UserIdentity userIdentity = forgottenPasswordBean.getUserIdentity();
    final ChaiUser theUser = pwmRequest.getPwmApplication().getProxiedChaiUser(userIdentity);
    try {
        // try unlocking user
        theUser.unlockPassword();
        LOGGER.trace(pwmRequest, "unlock account succeeded");
    } catch (ChaiOperationException e) {
        final String errorMsg = "unable to unlock user " + theUser.getEntryDN() + " error: " + e.getMessage();
        final ErrorInformation errorInformation = new ErrorInformation(PwmError.ERROR_UNLOCK_FAILURE, errorMsg);
        LOGGER.error(pwmRequest.getPwmSession(), errorInformation.toDebugStr());
        pwmRequest.respondWithError(errorInformation);
        return;
    }
    try {
        final UserInfo userInfo = UserInfoFactory.newUserInfoUsingProxy(pwmApplication, pwmRequest.getSessionLabel(), userIdentity, pwmRequest.getLocale());
        LOGGER.info(pwmRequest, "user successfully supplied password recovery responses, emailing new password to: " + theUser.getEntryDN());
        // add post change actions
        ForgottenPasswordServlet.addPostChangeAction(pwmRequest, userIdentity);
        // create new password
        final PasswordData newPassword = RandomPasswordGenerator.createRandomPassword(pwmRequest.getSessionLabel(), userInfo.getPasswordPolicy(), pwmApplication);
        LOGGER.trace(pwmRequest, "generated random password value based on password policy for " + userIdentity.toDisplayString());
        // set the password
        try {
            theUser.setPassword(newPassword.getStringValue());
            LOGGER.trace(pwmRequest, "set user " + userIdentity.toDisplayString() + " password to system generated random value");
        } catch (ChaiException e) {
            throw PwmUnrecoverableException.fromChaiException(e);
        }
        if (recoveryAction == RecoveryAction.SENDNEWPW_AND_EXPIRE) {
            LOGGER.debug(pwmRequest, "marking user " + userIdentity.toDisplayString() + " password as expired");
            theUser.expirePassword();
        }
        // mark the event log
        {
            final AuditRecord auditRecord = new AuditRecordFactory(pwmApplication).createUserAuditRecord(AuditEvent.RECOVER_PASSWORD, userIdentity, pwmRequest.getSessionLabel());
            pwmApplication.getAuditManager().submit(auditRecord);
        }
        final MessageSendMethod messageSendMethod = forgottenPasswordProfile.readSettingAsEnum(PwmSetting.RECOVERY_SENDNEWPW_METHOD, MessageSendMethod.class);
        // send email or SMS
        final String toAddress = PasswordUtility.sendNewPassword(userInfo, pwmApplication, newPassword, pwmRequest.getLocale(), messageSendMethod);
        pwmRequest.getPwmResponse().forwardToSuccessPage(Message.Success_PasswordSend, toAddress);
    } catch (PwmException e) {
        LOGGER.warn(pwmRequest, "unexpected error setting new password during recovery process for user: " + e.getMessage());
        pwmRequest.respondWithError(e.getErrorInformation());
    } catch (ChaiOperationException e) {
        final ErrorInformation errorInformation = new ErrorInformation(PwmError.ERROR_UNKNOWN, "unexpected ldap error while processing recovery action " + recoveryAction + ", error: " + e.getMessage());
        LOGGER.warn(pwmRequest, errorInformation.toDebugStr());
        pwmRequest.respondWithError(errorInformation);
    } finally {
        ForgottenPasswordServlet.clearForgottenPasswordBean(pwmRequest);
        // the user should not be authenticated, this is a safety method
        pwmRequest.getPwmSession().unauthenticateUser(pwmRequest);
        // the password set flag should not have been set, this is a safety method
        pwmRequest.getPwmSession().getSessionStateBean().setPasswordModified(false);
    }
}

Example 2 with ForgottenPasswordBean

use of password.pwm.http.bean.ForgottenPasswordBean in project pwm by pwm-project.

the class ForgottenPasswordUtil method initBogusForgottenPasswordBean.

static void initBogusForgottenPasswordBean(final PwmRequest pwmRequest) throws PwmUnrecoverableException {
    final ForgottenPasswordBean forgottenPasswordBean = ForgottenPasswordServlet.forgottenPasswordBean(pwmRequest);
    forgottenPasswordBean.setUserIdentity(null);
    forgottenPasswordBean.setPresentableChallengeSet(null);
    final List<Challenge> challengeList = new ArrayList<>();
    {
        final String firstProfile = pwmRequest.getConfig().getChallengeProfileIDs().iterator().next();
        final ChallengeSet challengeSet = pwmRequest.getConfig().getChallengeProfile(firstProfile, PwmConstants.DEFAULT_LOCALE).getChallengeSet();
        challengeList.addAll(challengeSet.getRequiredChallenges());
        for (int i = 0; i < challengeSet.getMinRandomRequired(); i++) {
            challengeList.add(challengeSet.getRandomChallenges().get(i));
        }
    }
    final List<FormConfiguration> formData = new ArrayList<>();
    {
        int counter = 0;
        for (Challenge challenge : challengeList) {
            final FormConfiguration formConfiguration = FormConfiguration.builder().name("challenge" + counter++).type(FormConfiguration.Type.text).labels(Collections.singletonMap("", challenge.getChallengeText())).minimumLength(challenge.getMinLength()).maximumLength(challenge.getMaxLength()).source(FormConfiguration.Source.bogus).build();
            formData.add(formConfiguration);
        }
    }
    forgottenPasswordBean.setAttributeForm(formData);
    forgottenPasswordBean.setBogusUser(true);
    {
        final String profileID = pwmRequest.getConfig().getForgottenPasswordProfiles().keySet().iterator().next();
        forgottenPasswordBean.setForgottenPasswordProfileID(profileID);
    }
    final ForgottenPasswordBean.RecoveryFlags recoveryFlags = new ForgottenPasswordBean.RecoveryFlags(false, Collections.singleton(IdentityVerificationMethod.ATTRIBUTES), Collections.emptySet(), 0);
    forgottenPasswordBean.setRecoveryFlags(recoveryFlags);
}

Example 3 with ForgottenPasswordBean

use of password.pwm.http.bean.ForgottenPasswordBean in project pwm by pwm-project.

the class ForgottenPasswordServlet method processEnterRemoteResponse.

@ActionHandler(action = "enterRemoteResponse")
private ProcessStatus processEnterRemoteResponse(final PwmRequest pwmRequest) throws PwmUnrecoverableException, IOException, ServletException {
    final String prefix = "remote-";
    final ForgottenPasswordBean forgottenPasswordBean = forgottenPasswordBean(pwmRequest);
    final VerificationMethodSystem remoteRecoveryMethod = forgottenPasswordBean.getProgress().getRemoteRecoveryMethod();
    final Map<String, String> remoteResponses = new LinkedHashMap<>();
    {
        final Map<String, String> inputMap = pwmRequest.readParametersAsMap();
        for (final Map.Entry<String, String> entry : inputMap.entrySet()) {
            final String name = entry.getKey();
            if (name != null && name.startsWith(prefix)) {
                final String strippedName = name.substring(prefix.length(), name.length());
                final String value = entry.getValue();
                remoteResponses.put(strippedName, value);
            }
        }
    }
    final ErrorInformation errorInformation = remoteRecoveryMethod.respondToPrompts(remoteResponses);
    if (remoteRecoveryMethod.getVerificationState() == VerificationMethodSystem.VerificationState.COMPLETE) {
        forgottenPasswordBean.getProgress().getSatisfiedMethods().add(IdentityVerificationMethod.REMOTE_RESPONSES);
    }
    if (remoteRecoveryMethod.getVerificationState() == VerificationMethodSystem.VerificationState.FAILED) {
        forgottenPasswordBean.getProgress().setRemoteRecoveryMethod(null);
        pwmRequest.respondWithError(errorInformation, true);
        handleUserVerificationBadAttempt(pwmRequest, forgottenPasswordBean, errorInformation);
        LOGGER.debug(pwmRequest, "unsuccessful remote response verification input: " + errorInformation.toDebugStr());
        return ProcessStatus.Continue;
    }
    if (errorInformation != null) {
        setLastError(pwmRequest, errorInformation);
        handleUserVerificationBadAttempt(pwmRequest, forgottenPasswordBean, errorInformation);
    }
    return ProcessStatus.Continue;
}

Example 4 with ForgottenPasswordBean

use of password.pwm.http.bean.ForgottenPasswordBean in project pwm by pwm-project.

the class ForgottenPasswordServlet method processTokenChoice.

@ActionHandler(action = "tokenChoice")
private ProcessStatus processTokenChoice(final PwmRequest pwmRequest) throws PwmUnrecoverableException {
    final ForgottenPasswordBean forgottenPasswordBean = forgottenPasswordBean(pwmRequest);
    final List<TokenDestinationItem> items = ForgottenPasswordUtil.figureAvailableTokenDestinations(pwmRequest, forgottenPasswordBean);
    final String requestedID = pwmRequest.readParameterAsString("choice", PwmHttpRequestWrapper.Flag.BypassValidation);
    if (!StringUtil.isEmpty(requestedID)) {
        for (final TokenDestinationItem item : items) {
            if (requestedID.equals(item.getId())) {
                forgottenPasswordBean.getProgress().setTokenDestination(item);
            }
        }
    }
    return ProcessStatus.Continue;
}

Example 5 with ForgottenPasswordBean

use of password.pwm.http.bean.ForgottenPasswordBean in project pwm by pwm-project.

the class ForgottenPasswordServlet method processEnterCode.

@ActionHandler(action = "enterCode")
private ProcessStatus processEnterCode(final PwmRequest pwmRequest) throws ChaiUnavailableException, PwmUnrecoverableException, IOException, ServletException {
    final ForgottenPasswordBean forgottenPasswordBean = forgottenPasswordBean(pwmRequest);
    final String userEnteredCode = pwmRequest.readParameterAsString(PwmConstants.PARAM_TOKEN);
    ErrorInformation errorInformation = null;
    try {
        final TokenPayload tokenPayload = TokenUtil.checkEnteredCode(pwmRequest, userEnteredCode, forgottenPasswordBean.getProgress().getTokenDestination(), null, TokenType.FORGOTTEN_PW, TokenService.TokenEntryType.unauthenticated);
        // token correct
        if (forgottenPasswordBean.getUserIdentity() == null) {
            // clean session, user supplied token (clicked email, etc) and this is first request
            ForgottenPasswordUtil.initForgottenPasswordBean(pwmRequest, tokenPayload.getUserIdentity(), forgottenPasswordBean);
        }
        forgottenPasswordBean.getProgress().getSatisfiedMethods().add(IdentityVerificationMethod.TOKEN);
        StatisticsManager.incrementStat(pwmRequest.getPwmApplication(), Statistic.RECOVERY_TOKENS_PASSED);
        if (pwmRequest.getConfig().readSettingAsBoolean(PwmSetting.DISPLAY_TOKEN_SUCCESS_BUTTON)) {
            pwmRequest.setAttribute(PwmRequestAttribute.TokenDestItems, tokenPayload.getDestination());
            pwmRequest.forwardToJsp(JspUrl.RECOVER_PASSWORD_TOKEN_SUCCESS);
            return ProcessStatus.Halt;
        }
    } catch (PwmUnrecoverableException e) {
        LOGGER.debug(pwmRequest, "error while checking entered token: ");
        errorInformation = e.getErrorInformation();
    } catch (PwmOperationalException e) {
        final String errorMsg = "token incorrect: " + e.getMessage();
        errorInformation = new ErrorInformation(PwmError.ERROR_TOKEN_INCORRECT, errorMsg);
    }
    if (!forgottenPasswordBean.getProgress().getSatisfiedMethods().contains(IdentityVerificationMethod.TOKEN)) {
        if (errorInformation == null) {
            errorInformation = new ErrorInformation(PwmError.ERROR_TOKEN_INCORRECT);
        }
        handleUserVerificationBadAttempt(pwmRequest, forgottenPasswordBean, errorInformation);
    }
    return ProcessStatus.Continue;
}