/*******************************************************************************
* Cloud Foundry
* Copyright (c) [2009-2016] Pivotal Software, Inc. All Rights Reserved.
*
* This product is licensed to you under the Apache License, Version 2.0 (the "License").
* You may not use this product except in compliance with the License.
*
* This product includes a number of subcomponents with
* separate copyright notices and license terms. Your use of these
* subcomponents is subject to the terms and conditions of the
* subcomponent's license, as noted in the LICENSE file.
*******************************************************************************/
package org.cloudfoundry.identity.uaa.account;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.cloudfoundry.identity.uaa.web.ConvertingExceptionView;
import org.cloudfoundry.identity.uaa.web.ExceptionReport;
import org.cloudfoundry.identity.uaa.resources.ActionResult;
import org.cloudfoundry.identity.uaa.scim.ScimUserProvisioning;
import org.cloudfoundry.identity.uaa.scim.exception.InvalidPasswordException;
import org.cloudfoundry.identity.uaa.scim.exception.ScimException;
import org.cloudfoundry.identity.uaa.scim.exception.ScimResourceNotFoundException;
import org.cloudfoundry.identity.uaa.scim.validate.NullPasswordValidator;
import org.cloudfoundry.identity.uaa.scim.validate.PasswordValidator;
import org.cloudfoundry.identity.uaa.security.DefaultSecurityContextAccessor;
import org.cloudfoundry.identity.uaa.security.SecurityContextAccessor;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.http.converter.HttpMessageConverter;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.stereotype.Controller;
import org.springframework.util.StringUtils;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.client.RestTemplate;
import org.springframework.web.servlet.View;
import static org.springframework.http.HttpStatus.UNPROCESSABLE_ENTITY;
@Controller
public class PasswordChangeEndpoint {
private final Log logger = LogFactory.getLog(getClass());
private ScimUserProvisioning dao;
private PasswordValidator passwordValidator = new NullPasswordValidator();
private SecurityContextAccessor securityContextAccessor = new DefaultSecurityContextAccessor();
private HttpMessageConverter<?>[] messageConverters = new RestTemplate().getMessageConverters().toArray(
new HttpMessageConverter<?>[0]);
public void setScimUserProvisioning(ScimUserProvisioning provisioning) {
this.dao = provisioning;
}
public void setPasswordValidator(PasswordValidator passwordValidator) {
this.passwordValidator = passwordValidator;
}
/**
* Set the message body converters to use.
* <p>
* These converters are used to convert from and to HTTP requests and
* responses.
*/
public void setMessageConverters(HttpMessageConverter<?>[] messageConverters) {
this.messageConverters = messageConverters;
}
void setSecurityContextAccessor(SecurityContextAccessor securityContextAccessor) {
this.securityContextAccessor = securityContextAccessor;
}
@RequestMapping(value = "/Users/{userId}/password", method = RequestMethod.PUT)
@ResponseBody
public ActionResult changePassword(@PathVariable String userId, @RequestBody PasswordChangeRequest change) {
checkPasswordChangeIsAllowed(userId, change.getOldPassword());
if (dao.checkPasswordMatches(userId, change.getPassword())) {
throw new InvalidPasswordException("Your new password cannot be the same as the old password.", UNPROCESSABLE_ENTITY);
}
passwordValidator.validate(change.getPassword());
dao.changePassword(userId, change.getOldPassword(), change.getPassword());
return new ActionResult("ok", "password updated");
}
@ExceptionHandler
public View handleException(ScimResourceNotFoundException e) {
// There's no point throwing BadCredentialsException here because it is
// caught and
// logged (then ignored) by the caller.
return new ConvertingExceptionView(
new ResponseEntity<>(new ExceptionReport(
new BadCredentialsException("Invalid password change request"), false),
HttpStatus.UNAUTHORIZED),
messageConverters);
}
@ExceptionHandler(ScimException.class)
public View handleException(ScimException e) {
// No need to log the underlying exception (it will be logged by the
// caller)
return makeConvertingExceptionView(new BadCredentialsException("Invalid password change request"), e.getStatus());
}
@ExceptionHandler(InvalidPasswordException.class)
public View handleException(InvalidPasswordException t) throws ScimException {
return makeConvertingExceptionView(t, t.getStatus());
}
private ConvertingExceptionView makeConvertingExceptionView(Exception exceptionToWrap, HttpStatus status) {
return new ConvertingExceptionView(new ResponseEntity<>(new ExceptionReport(
exceptionToWrap, false), status),
messageConverters);
}
private void checkPasswordChangeIsAllowed(String userId, String oldPassword) {
if (securityContextAccessor.isClient()) {
// Trusted client (not acting on behalf of user)
return;
}
// Call is by or on behalf of end user
String currentUser = securityContextAccessor.getUserId();
if (securityContextAccessor.isAdmin()) {
// even an admin needs to provide the old value to change his
// password
if (userId.equals(currentUser) && !StringUtils.hasText(oldPassword)) {
throw new InvalidPasswordException("Previous password is required even for admin");
}
}
else {
if (!userId.equals(currentUser)) {
logger.warn("User with id " + currentUser + " attempting to change password for user " + userId);
// TODO: This should be audited when we have non-authentication
// events in the log
throw new InvalidPasswordException("Not permitted to change another user's password");
}
// User is changing their own password, old password is required
if (!StringUtils.hasText(oldPassword)) {
throw new InvalidPasswordException("Previous password is required");
}
}
}
}