Package org.cyclos.impl.access

Interface PasswordHandler

public interface PasswordHandler

Contains methods used to validate passwords

Field Summary

Fields

Modifier and Type	Field	Description
static String	ATTR_PASSWORD	Script attribute: the password value to check
static String	ATTR_PASSWORD_TYPE	Script attribute: the password type being checked
static String	ATTR_USER	Script attribute: the user to check password
static String	CONFIRMATION_PASSWORD	Property name for confirmation password

Method Summary

Modifier and Type	Method	Description
CredentialAccessor	accessor(@NotNull CredentialUsage usage)	Return a new CredentialAccessor for the given (required) credential usage. The returned accessor will be associated to the logged user and the current session's channel.
CredentialType	checkCredential(ChannelAccessAccessor channelAccess, CredentialUsage usage, UserPrincipal userPrincipal, CreateDeviceConfirmationParams params, boolean allowExpired, String value)	Checks the password / device confirmation for the given configuration, usage and user identification (i.e UserPrincipal). The given CreateDeviceConfirmationParams object is required only when the password value represents a device confirmation.
void	checkPassword(PasswordType passwordType, BasicUser user, boolean forLogin, String password)	Use with caution: this method doesn't take into account the trusted devices. Checks the password for the given type and user. NOTE: In case of checking the confirmation / login confirmation for the logged user use accessor(CredentialUsage) or checkCredential(ChannelAccessAccessor, CredentialUsage, UserPrincipal, CreateDeviceConfirmationParams, boolean, String)
String	encode(BasicUser user, PasswordType passwordType, String value)	Encodes the password according to its type
CredentialInputDTO	getCredentialInput(ChannelAccessAccessor channelAccessAccessor, CredentialUsage usage, BasicUser basicUser)	Returns the credential input information for the given user, usage and channel configuration.
Map<PasswordType,Boolean>	getPasswordTypesAtRegistration(Group group, UserRegistration registration, PasswordMode mode)	Returns a map of PasswordType marked to be saved at registration for the specified group and registration type, and a flag indicating if the password type is also used for access.
void	ignoreNextConfirmationPasswords()	Sets the current transaction to ignore confirmation passwords from this point onwards
boolean	matches(Password password, String plainPassword)	Returns whether the given plain password matches the stored password
void	notifyPasswordStatusChanged(PasswordType type, BasicUser user, PasswordStatus status)	Notifies the user that a password has changed its status
PinInputDTO	toPinInput(ChannelAccessAccessor channelAccess)	Returns a PinInputDTO compatible with the given channel access
boolean	wasConfirmedWithDevice()	Returns whether a confirmation was performed in the current invocation with a trusted device

Field Detail

ATTR_USER

static final String ATTR_USER

Script attribute: the user to check password

See Also:

Constant Field Values

ATTR_PASSWORD_TYPE

static final String ATTR_PASSWORD_TYPE

Script attribute: the password type being checked

See Also:

Constant Field Values

ATTR_PASSWORD

static final String ATTR_PASSWORD

Script attribute: the password value to check

See Also:

Constant Field Values

CONFIRMATION_PASSWORD

static final String CONFIRMATION_PASSWORD

Property name for confirmation password

See Also:

Constant Field Values

Method Detail

accessor

CredentialAccessor accessor(@NotNull
                            @NotNull CredentialUsage usage)

Return a new CredentialAccessor for the given (required) credential usage.
The returned accessor will be associated to the logged user and the current session's channel.

checkCredential

CredentialType checkCredential(ChannelAccessAccessor channelAccess,
                               CredentialUsage usage,
                               UserPrincipal userPrincipal,
                               CreateDeviceConfirmationParams params,
                               boolean allowExpired,
                               String value)
                        throws PasswordException

Checks the password / device confirmation for the given configuration, usage and user identification (i.e UserPrincipal).
The given CreateDeviceConfirmationParams object is required only when the password value represents a device confirmation. In that case it's used to make sure that the operation the user confirmed is the same for which the password is being checked for.
Also:
- if the password is valid and corresponds to an OTP not allowing reuse then it's removed.
- if the channel confirmation says the confirmation is once per session then mark the session (if any) as validated (only if confirming with a password)

Throws:

PasswordException

checkPassword

void checkPassword(PasswordType passwordType,
                   BasicUser user,
                   boolean forLogin,
                   String password)
            throws PasswordException

Use with caution: this method doesn't take into account the trusted devices.

Checks the password for the given type and user.
NOTE: In case of checking the confirmation / login confirmation for the logged user use accessor(CredentialUsage) or checkCredential(ChannelAccessAccessor, CredentialUsage, UserPrincipal, CreateDeviceConfirmationParams, boolean, String)

Throws:

PasswordException

encode

String encode(BasicUser user,
              PasswordType passwordType,
              String value)

Encodes the password according to its type

getCredentialInput

CredentialInputDTO getCredentialInput(ChannelAccessAccessor channelAccessAccessor,
                                      CredentialUsage usage,
                                      BasicUser basicUser)

Returns the credential input information for the given user, usage and channel configuration.

getPasswordTypesAtRegistration

Map<PasswordType,Boolean> getPasswordTypesAtRegistration(Group group,
                                                               UserRegistration registration,
                                                               PasswordMode mode)

Returns a map of PasswordType marked to be saved at registration for the specified group and registration type, and a flag indicating if the password type is also used for access.

Parameters:

group - the group the user will be registered

registration - if UserRegistration.PUBLIC then it will read from the group's product. Otherwise it will read from the logged user's products.

mode - a filter (Optional) Only PasswordMode.MANUAL and PasswordMode.GENERATED are supported.

ignoreNextConfirmationPasswords

void ignoreNextConfirmationPasswords()

Sets the current transaction to ignore confirmation passwords from this point onwards

matches

boolean matches(Password password,
                String plainPassword)

Returns whether the given plain password matches the stored password

notifyPasswordStatusChanged

void notifyPasswordStatusChanged(PasswordType type,
                                 BasicUser user,
                                 PasswordStatus status)

Notifies the user that a password has changed its status

toPinInput

PinInputDTO toPinInput(ChannelAccessAccessor channelAccess)

Returns a PinInputDTO compatible with the given channel access

wasConfirmedWithDevice

boolean wasConfirmedWithDevice()

Returns whether a confirmation was performed in the current invocation with a trusted device