Strolch
/
strolch
mirror of https://github.com/strolch-li/strolch.git
1
1
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[New] Allow to pass password encoding in REST API Request

This commit is contained in:
Robert von Burg 2019-03-13 19:54:24 +01:00
parent 104add7035
commit 97bd81542a
2 changed files with 63 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
li.strolch.rest/src/main/java/li/strolch/rest/endpoint/AuthenticationService.java
View File

@ -62,38 +62,42 @@ public class AuthenticationService {
try { try {
StringBuilder sb = new StringBuilder(); if (!login.has("username") || login.get("username").getAsString().length() < 2) {
JsonElement usernameE = login.get("username"); logger.error("Authentication failed: Username was not given or is too short!");
if (usernameE == null || usernameE.getAsString().length() < 2) { loginResult.addProperty("msg", MessageFormat.format("Could not log in due to: {0}",
sb.append("Username was not given or is too short!"); //$NON-NLS-1$ "Username was not given or is too short!")); //$NON-NLS-2$
return Response.status(Status.BAD_REQUEST).entity(loginResult.toString()).build();
} }
JsonElement passwordE = login.get("password"); if (!login.has("password") || login.get("password").getAsString().length() < 3) {
if (passwordE == null) { logger.error("Authentication failed: Password was not given or is too short!");
if (sb.length() > 0) loginResult.addProperty("msg", MessageFormat.format("Could not log in due to: {0}",
sb.append("\n"); "Password was not given or is too short!")); //$NON-NLS-2$
sb.append("Password was not given!"); //$NON-NLS-1$ return Response.status(Status.BAD_REQUEST).entity(loginResult.toString()).build();
} }
char[] password = passwordE == null ? String username = login.get("username").getAsString();
new char[] {} : String passwordEncoded = login.get("password").getAsString();
new String(Base64.getDecoder().decode(passwordE.getAsString())).toCharArray();
byte[] decode = Base64.getDecoder().decode(passwordEncoded);
String passwordString;
if (login.has("encoding") && !login.get("encoding").getAsString().isEmpty()) {
passwordString = new String(decode, login.get("encoding").getAsString());
} else {
passwordString = new String(decode);
}
char[] password = passwordString.toCharArray();
if (password.length < 3) { if (password.length < 3) {
if (sb.length() > 0) logger.error("Authentication failed: Password was not given or is too short!");
sb.append("\n"); loginResult.addProperty("msg", MessageFormat.format("Could not log in due to: {0}",
sb.append("Password not given or too short!"); //$NON-NLS-1$ "Password was not given or is too short!")); //$NON-NLS-2$
}
if (sb.length() != 0) {
logger.error("Authentication failed due to: " + sb.toString());
loginResult.addProperty("msg",
MessageFormat.format("Could not log in due to: {0}", sb.toString())); //$NON-NLS-2$
return Response.status(Status.BAD_REQUEST).entity(loginResult.toString()).build(); return Response.status(Status.BAD_REQUEST).entity(loginResult.toString()).build();
} }
StrolchSessionHandler sessionHandler = RestfulStrolchComponent.getInstance().getSessionHandler(); StrolchSessionHandler sessionHandler = RestfulStrolchComponent.getInstance().getSessionHandler();
String source = getRemoteIp(request); String source = getRemoteIp(request);
Certificate certificate = sessionHandler.authenticate(usernameE.getAsString(), password, source); Certificate certificate = sessionHandler.authenticate(username, password, source);
return getAuthenticationResponse(request, loginResult, certificate, source); return getAuthenticationResponse(request, loginResult, certificate, source);

53
li.strolch.rest/src/main/java/li/strolch/rest/endpoint/PrivilegeUsersService.java
View File

@ -48,6 +48,8 @@ import li.strolch.service.JsonServiceArgument;
import li.strolch.service.api.ServiceHandler; import li.strolch.service.api.ServiceHandler;
import li.strolch.service.api.ServiceResult; import li.strolch.service.api.ServiceResult;
import li.strolch.service.privilege.users.*; import li.strolch.service.privilege.users.*;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
/** /**
* @author Robert von Burg <eitch@eitchnet.ch> * @author Robert von Burg <eitch@eitchnet.ch>
@ -55,6 +57,8 @@ import li.strolch.service.privilege.users.*;
@Path("strolch/privilege/users") @Path("strolch/privilege/users")
public class PrivilegeUsersService { public class PrivilegeUsersService {
private static final Logger logger = LoggerFactory.getLogger(PrivilegeUsersService.class);
private PrivilegeHandler getPrivilegeHandler() { private PrivilegeHandler getPrivilegeHandler() {
ComponentContainer container = RestfulStrolchComponent.getInstance().getContainer(); ComponentContainer container = RestfulStrolchComponent.getInstance().getContainer();
return container.getPrivilegeHandler().getPrivilegeHandler(); return container.getPrivilegeHandler().getPrivilegeHandler();
@ -270,26 +274,43 @@ public class PrivilegeUsersService {
@Context HttpServletRequest request) { @Context HttpServletRequest request) {
Certificate cert = (Certificate) request.getAttribute(StrolchRestfulConstants.STROLCH_CERTIFICATE); Certificate cert = (Certificate) request.getAttribute(StrolchRestfulConstants.STROLCH_CERTIFICATE);
String password = new JsonParser().parse(data).getAsJsonObject().get("password").getAsString(); try {
char[] passwordChars = new String(Base64.getDecoder().decode(password)).toCharArray();
ServiceHandler svcHandler = RestfulStrolchComponent.getInstance().getComponent(ServiceHandler.class); JsonObject jsonObject = new JsonParser().parse(data).getAsJsonObject();
PrivilegeSetUserPasswordService svc = new PrivilegeSetUserPasswordService();
PrivilegeSetUserPasswordArgument arg = new PrivilegeSetUserPasswordArgument();
arg.username = username;
arg.password = passwordChars;
ServiceResult svcResult = svcHandler.doService(cert, svc, arg); String passwordEncoded = jsonObject.get("password").getAsString();
if (svcResult.isNok()) byte[] decode = Base64.getDecoder().decode(passwordEncoded);
return ResponseUtil.toResponse(svcResult); String passwordString;
if (jsonObject.has("encoding") && !jsonObject.get("encoding").getAsString().isEmpty()) {
passwordString = new String(decode, jsonObject.get("encoding").getAsString());
} else {
passwordString = new String(decode);
}
// if user changes their own password, then invalidate the session ServiceHandler svcHandler = RestfulStrolchComponent.getInstance().getComponent(ServiceHandler.class);
if (cert.getUsername().equals(username)) { PrivilegeSetUserPasswordService svc = new PrivilegeSetUserPasswordService();
StrolchSessionHandler sessionHandler = RestfulStrolchComponent.getInstance().getSessionHandler(); PrivilegeSetUserPasswordArgument arg = new PrivilegeSetUserPasswordArgument();
sessionHandler.invalidate(cert); arg.username = username;
arg.password = passwordString.toCharArray();
ServiceResult svcResult = svcHandler.doService(cert, svc, arg);
if (svcResult.isNok())
return ResponseUtil.toResponse(svcResult);
// if user changes their own password, then invalidate the session
if (cert.getUsername().equals(username)) {
StrolchSessionHandler sessionHandler = RestfulStrolchComponent.getInstance().getSessionHandler();
sessionHandler.invalidate(cert);
}
return ResponseUtil.toResponse();
} catch (Exception e) {
logger.error(e.getMessage(), e);
String msg = e.getMessage();
return ResponseUtil.toResponse("Failed to set password: ",
MessageFormat.format("{0}: {1}", e.getClass().getName(), msg));
} }
return ResponseUtil.toResponse();
} }
private Response handleServiceResult(PrivilegeUserResult svcResult) { private Response handleServiceResult(PrivilegeUserResult svcResult) {