Skip to content

Commit fffbdde

Browse files
mjabascal10mjabascal10
authored
Merge pull request #1304 from utmstack/backlog/google-tfa
Backlog/google tfa
2 parents 79bb466 + 4bd61fc commit fffbdde

23 files changed

+800
-154
lines changed

‎backend/src/main/java/com/park/utmstack/config/SecurityConfiguration.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ public void configure(HttpSecurity http) throws Exception {
108108
.antMatchers("/api/account/reset-password/init").permitAll()
109109
.antMatchers("/api/account/reset-password/finish").permitAll()
110110
.antMatchers("/api/images/all").permitAll()
111-
.antMatchers("/api/tfa/**").hasAuthority(AuthoritiesConstants.PRE_VERIFICATION_USER)
111+
.antMatchers("/api/tfa/**").hasAnyAuthority(AuthoritiesConstants.PRE_VERIFICATION_USER, AuthoritiesConstants.ADMIN, AuthoritiesConstants.USER)
112112
.antMatchers("/api/utm-incident-jobs").hasAuthority(AuthoritiesConstants.ADMIN)
113113
.antMatchers("/api/utm-incident-jobs/**").hasAuthority(AuthoritiesConstants.ADMIN)
114114
.antMatchers("/api/utm-incident-variables/**").hasAuthority(AuthoritiesConstants.ADMIN)

‎backend/src/main/java/com/park/utmstack/domain/User.java‎

Lines changed: 5 additions & 119 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
import com.fasterxml.jackson.annotation.JsonIgnore;
44
import com.park.utmstack.config.Constants;
5+
import lombok.Data;
56
import org.apache.commons.lang3.StringUtils;
67
import org.hibernate.annotations.BatchSize;
78

@@ -21,6 +22,7 @@
2122
* A user.
2223
*/
2324
@Entity
25+
@Data
2426
@Table(name = "jhi_user")
2527
public class User extends AbstractAuditingEntity implements Serializable {
2628

@@ -83,6 +85,9 @@ public class User extends AbstractAuditingEntity implements Serializable {
8385
@Column(name = "tfa_secret")
8486
private String tfaSecret;
8587

88+
@Column(name = "tfa_method")
89+
private String tfaMethod;
90+
8691
@Column(name = "fs_manager")
8792
private Boolean fsManager;
8893

@@ -96,135 +101,16 @@ public class User extends AbstractAuditingEntity implements Serializable {
96101
@BatchSize(size = 20)
97102
private Set<Authority> authorities = new HashSet<>();
98103

99-
public Long getId() {
100-
return id;
101-
}
102-
103-
public void setId(Long id) {
104-
this.id = id;
105-
}
106-
107-
public String getLogin() {
108-
return login;
109-
}
110104

111105
// Lowercase the login before saving it in database
112106
public void setLogin(String login) {
113107
this.login = StringUtils.lowerCase(login, Locale.ENGLISH);
114108
}
115109

116-
public String getPassword() {
117-
return password;
118-
}
119-
120-
public void setPassword(String password) {
121-
this.password = password;
122-
}
123-
124-
public String getFirstName() {
125-
return firstName;
126-
}
127-
128-
public void setFirstName(String firstName) {
129-
this.firstName = firstName;
130-
}
131-
132-
public String getLastName() {
133-
return lastName;
134-
}
135-
136-
public void setLastName(String lastName) {
137-
this.lastName = lastName;
138-
}
139-
140-
public String getEmail() {
141-
return email;
142-
}
143-
144-
public void setEmail(String email) {
145-
this.email = email;
146-
}
147-
148-
public String getImageUrl() {
149-
return imageUrl;
150-
}
151-
152-
public void setImageUrl(String imageUrl) {
153-
this.imageUrl = imageUrl;
154-
}
155-
156110
public boolean getActivated() {
157111
return activated;
158112
}
159113

160-
public void setActivated(boolean activated) {
161-
this.activated = activated;
162-
}
163-
164-
public String getActivationKey() {
165-
return activationKey;
166-
}
167-
168-
public void setActivationKey(String activationKey) {
169-
this.activationKey = activationKey;
170-
}
171-
172-
public String getResetKey() {
173-
return resetKey;
174-
}
175-
176-
public void setResetKey(String resetKey) {
177-
this.resetKey = resetKey;
178-
}
179-
180-
public Instant getResetDate() {
181-
return resetDate;
182-
}
183-
184-
public void setResetDate(Instant resetDate) {
185-
this.resetDate = resetDate;
186-
}
187-
188-
public String getLangKey() {
189-
return langKey;
190-
}
191-
192-
public void setLangKey(String langKey) {
193-
this.langKey = langKey;
194-
}
195-
196-
public Set<Authority> getAuthorities() {
197-
return authorities;
198-
}
199-
200-
public void setAuthorities(Set<Authority> authorities) {
201-
this.authorities = authorities;
202-
}
203-
204-
public String getTfaSecret() {
205-
return tfaSecret;
206-
}
207-
208-
public void setTfaSecret(String tfaSecret) {
209-
this.tfaSecret = tfaSecret;
210-
}
211-
212-
public Boolean getFsManager() {
213-
return fsManager;
214-
}
215-
216-
public void setFsManager(Boolean fsManager) {
217-
this.fsManager = fsManager;
218-
}
219-
220-
public Boolean getDefaultPassword() {
221-
return defaultPassword;
222-
}
223-
224-
public void setDefaultPassword(Boolean defaultPassword) {
225-
this.defaultPassword = defaultPassword;
226-
}
227-
228114
@Override
229115
public boolean equals(Object o) {
230116
if (this == o) {

‎backend/src/main/java/com/park/utmstack/service/UserService.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -213,13 +213,13 @@ public Optional<UserDTO> updateUser(UserDTO userDTO) {
213213
}).map(UserDTO::new);
214214
}
215215

216-
public User updateUserTfaSecret(String userLogin, String tfaSecret) throws Exception {
216+
public void updateUserTfaSecret(String userLogin, String tfaSecret, String tfaMethod) throws Exception {
217217
final String ctx = CLASS_NAME + ".updateUserTfaSecret";
218218
try {
219219
User user = userRepository.findOneByLogin(userLogin)
220220
.orElseThrow(() -> new Exception(String.format("User %1$s not found", userLogin)));
221+
user.setTfaMethod(tfaMethod);
221222
user.setTfaSecret(tfaSecret);
222-
return userRepository.save(user);
223223
} catch (Exception e) {
224224
throw new Exception(ctx + ": " + e.getMessage());
225225
}

‎backend/src/main/java/com/park/utmstack/service/UtmConfigurationParameterQueryService.java‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,12 @@
11
package com.park.utmstack.service;
22

3+
import com.park.utmstack.config.Constants;
4+
import com.park.utmstack.domain.User;
35
import com.park.utmstack.domain.UtmConfigurationParameter;
46
import com.park.utmstack.domain.UtmConfigurationParameter_;
57
import com.park.utmstack.repository.UtmConfigurationParameterRepository;
68
import com.park.utmstack.service.dto.UtmConfigurationParameterCriteria;
9+
import lombok.RequiredArgsConstructor;
710
import org.slf4j.Logger;
811
import org.slf4j.LoggerFactory;
912
import org.springframework.data.domain.Page;
@@ -22,16 +25,15 @@
2225
* It returns a {@link List} of {@link UtmConfigurationParameter} or a {@link Page} of {@link UtmConfigurationParameter} which fulfills the criteria.
2326
*/
2427
@Service
28+
@RequiredArgsConstructor
2529
@Transactional(readOnly = true)
2630
public class UtmConfigurationParameterQueryService extends QueryService<UtmConfigurationParameter> {
2731

2832
private final Logger log = LoggerFactory.getLogger(UtmConfigurationParameterQueryService.class);
2933

3034
private final UtmConfigurationParameterRepository utmConfigurationParameterRepository;
35+
private final UserService userService;
3136

32-
public UtmConfigurationParameterQueryService(UtmConfigurationParameterRepository utmConfigurationParameterRepository) {
33-
this.utmConfigurationParameterRepository = utmConfigurationParameterRepository;
34-
}
3537

3638
/**
3739
* Return a {@link List} of {@link UtmConfigurationParameter} which matches the criteria from the database
@@ -57,6 +59,16 @@ public List<UtmConfigurationParameter> findByCriteria(UtmConfigurationParameterC
5759
public Page<UtmConfigurationParameter> findByCriteria(UtmConfigurationParameterCriteria criteria, Pageable page) {
5860
log.debug("find by criteria : {}, page: {}", criteria, page);
5961
final Specification<UtmConfigurationParameter> specification = createSpecification(criteria);
62+
Page<UtmConfigurationParameter> result = utmConfigurationParameterRepository.findAll(specification, page);
63+
64+
if (criteria.getSectionId().getEquals().equals(Constants.TFA_SETTING_ID)) {
65+
User user = userService.getCurrentUserLogin();
66+
result.getContent().forEach(utmConfigurationParameter -> {
67+
if(utmConfigurationParameter.getConfParamShort().equals(Constants.PROP_TFA_METHOD)){
68+
utmConfigurationParameter.setConfParamValue(user.getTfaMethod());
69+
}
70+
});
71+
}
6072
return utmConfigurationParameterRepository.findAll(specification, page);
6173
}
6274

‎backend/src/main/java/com/park/utmstack/service/tfa/EmailTfaService.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ public void persistConfiguration(User user) throws Exception {
7777
String secret = cache.getState(user.getLogin(), TfaMethod.EMAIL)
7878
.orElseThrow(() -> new IllegalStateException("No TFA setup found for user: " + user.getLogin()))
7979
.getSecret();
80-
userService.updateUserTfaSecret(user.getLogin(), secret);
80+
userService.updateUserTfaSecret(user.getLogin(), secret, TfaMethod.EMAIL.toString());
8181
cache.clear(user.getLogin(), TfaMethod.EMAIL);
8282
}
8383

‎backend/src/main/java/com/park/utmstack/service/tfa/TfaService.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ public void persistConfiguration(TfaMethod method) throws Exception {
4444

4545
public void generateChallenge(User user) throws Exception {
4646

47-
TfaMethod method = TfaMethod.valueOf(Constants.CFG.get(Constants.PROP_TFA_METHOD));
47+
TfaMethod method = TfaMethod.valueOf(user.getTfaMethod());
4848

4949
TfaMethodService selected = getMethodService(method);
5050
selected.generateChallenge(user);

‎backend/src/main/java/com/park/utmstack/service/tfa/TotpTfaService.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ public void persistConfiguration(User user) throws Exception {
7979
String secret = cache.getState(user.getLogin(), TfaMethod.TOTP)
8080
.orElseThrow(() -> new IllegalStateException("No TFA setup found for user: " + user.getLogin()))
8181
.getSecret();
82-
userService.updateUserTfaSecret(user.getLogin(), secret);
82+
userService.updateUserTfaSecret(user.getLogin(), secret, TfaMethod.TOTP.toString());
8383
cache.clear(user.getLogin(), TfaMethod.TOTP);
8484
}
8585

‎backend/src/main/java/com/park/utmstack/web/rest/UserJWTController.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,6 @@ public ResponseEntity<LoginResponseDTO> authorize(@Valid @RequestBody LoginVM lo
8686
throw new TooMuchLoginAttemptsException(String.format("Client IP %1$s blocked due to too many failed login attempts", loginAttemptService.getClientIP()));
8787

8888
boolean isTfaEnabled = Boolean.parseBoolean(Constants.CFG.get(Constants.PROP_TFA_ENABLE));
89-
String method = Constants.CFG.get(Constants.PROP_TFA_METHOD);
9089

9190
UsernamePasswordAuthenticationToken authenticationToken =
9291
new UsernamePasswordAuthenticationToken(loginVM.getUsername(), loginVM.getPassword());
@@ -95,15 +94,16 @@ public ResponseEntity<LoginResponseDTO> authorize(@Valid @RequestBody LoginVM lo
9594
SecurityContextHolder.getContext().setAuthentication(authentication);
9695
String tempToken = tokenProvider.createToken(authentication, false, false);
9796

98-
if (isTfaEnabled) {
99-
User user = userService.getUserWithAuthoritiesByLogin(loginVM.getUsername())
97+
User user = userService.getUserWithAuthoritiesByLogin(loginVM.getUsername())
10098
.orElseThrow(() -> new BadCredentialsException("User " + loginVM.getUsername() + " not found"));
99+
100+
if (isTfaEnabled && (user.getTfaMethod() != null && !user.getTfaMethod().isEmpty())) {
101101
tfaService.generateChallenge(user);
102102
}
103103

104104
return new ResponseEntity<>( LoginResponseDTO.builder()
105105
.token(tempToken)
106-
.method(method)
106+
.method(user.getTfaMethod())
107107
.success(true)
108108
.tfaRequired(isTfaEnabled)
109109
.build(), HttpStatus.OK);

‎backend/src/main/java/com/park/utmstack/web/rest/UtmConfigurationParameterResource.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,6 @@ public ResponseEntity<UtmConfigurationParameter> getUtmConfigurationParameter(@P
142142
public ResponseEntity<Void> checkEmailConfiguration(@Valid @RequestBody List<UtmConfigurationParameter> parameters) {
143143
final String ctx = CLASSNAME + ".checkEmailConfiguration";
144144
try {
145-
146145
utmStackService.checkEmailConfiguration(this.mailConfigService.getMailConfigFromParameters(parameters));
147146
return ResponseEntity.ok().build();
148147
} catch (MessagingException e) {

‎backend/src/main/java/com/park/utmstack/web/rest/tfa/TfaController.java‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ public ResponseEntity<Void> completeTfa(@RequestBody TfaSaveRequest request) {
8787
final String ctx = CLASSNAME + ".completeTfa";
8888
try {
8989

90-
List<UtmConfigurationParameter> tfaParams = utmConfigurationParameterService.getConfigParameterBySectionId(Constants.TFA_SETTING_ID);
90+
/*List<UtmConfigurationParameter> tfaParams = utmConfigurationParameterService.getConfigParameterBySectionId(Constants.TFA_SETTING_ID);
9191
9292
for (UtmConfigurationParameter param : tfaParams) {
9393
switch (param.getConfParamShort()) {
@@ -98,9 +98,11 @@ public ResponseEntity<Void> completeTfa(@RequestBody TfaSaveRequest request) {
9898
param.setConfParamValue(String.valueOf(request.isEnable()));
9999
break;
100100
}
101-
}
101+
}*/
102+
103+
102104

103-
utmConfigurationParameterService.saveAll(tfaParams);
105+
tfaService.persistConfiguration(request.getMethod());
104106
User user = userService.getCurrentUserLogin();
105107
tfaService.generateChallenge(user);
106108
return ResponseEntity.ok().build();
@@ -127,7 +129,7 @@ public ResponseEntity<JWTToken> verifyCode(@RequestBody String code) {
127129
final String ctx = CLASSNAME + ".verifyCode";
128130
try {
129131
User user = userService.getCurrentUserLogin();
130-
TfaMethod method = TfaMethod.valueOf(Constants.CFG.get(Constants.PROP_TFA_METHOD));
132+
TfaMethod method = TfaMethod.valueOf(user.getTfaMethod());
131133
TfaVerifyRequest request = new TfaVerifyRequest(method, code);
132134
TfaVerifyResponse response = tfaService.verifyCode(user, request);
133135

0 commit comments

Comments
 (0)