diff --git a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/security/AuthenticationEvaluatorImpl.java b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/security/AuthenticationEvaluatorImpl.java index 1f0525de8de..f57b1f0dc5b 100644 --- a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/security/AuthenticationEvaluatorImpl.java +++ b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/security/AuthenticationEvaluatorImpl.java @@ -94,7 +94,7 @@ public UsernamePasswordAuthenticationToken authenticate(ConnectionEnvironment co UserType userType = principal.getUser(); CredentialsType credentials = userType.getCredentials(); - if (credentials == null) { + if (credentials == null || getCredential(credentials) == null) { recordAuthenticationFailure(principal, connEnv, "no credentials in user"); throw new AuthenticationCredentialsNotFoundException("web.security.provider.invalid"); } diff --git a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/security/SecurityQuestionAuthneticationEvaluatorImpl.java b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/security/SecurityQuestionAuthneticationEvaluatorImpl.java index 757e29309c7..1f59bf2042d 100644 --- a/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/security/SecurityQuestionAuthneticationEvaluatorImpl.java +++ b/model/model-impl/src/main/java/com/evolveum/midpoint/model/impl/security/SecurityQuestionAuthneticationEvaluatorImpl.java @@ -2,6 +2,7 @@ import java.util.List; import java.util.Map; +import java.util.Set; import org.apache.commons.collections.MapUtils; import org.apache.commons.lang.StringUtils; @@ -31,6 +32,19 @@ protected void checkEnteredCredentials(ConnectionEnvironment connEnv, recordAuthenticationFailure(authCtx.getUsername(), connEnv, "empty password provided"); throw new BadCredentialsException("web.security.provider.password.encoding"); } + + Map enteredQuestionAnswer = authCtx.getQuestionAnswerMap(); + boolean allBlank = false; + for (String enteredAnswers : enteredQuestionAnswer.values()) { + if (StringUtils.isBlank(enteredAnswers)){ + allBlank = true; + } + } + + if (allBlank) { + recordAuthenticationFailure(authCtx.getUsername(), connEnv, "empty password provided"); + throw new BadCredentialsException("web.security.provider.password.encoding"); + } } @Override diff --git a/model/model-impl/src/test/resources/common/security-policy.xml b/model/model-impl/src/test/resources/common/security-policy.xml index 6a2b4a0fff2..62c2f07bf8d 100644 --- a/model/model-impl/src/test/resources/common/security-policy.xml +++ b/model/model-impl/src/test/resources/common/security-policy.xml @@ -36,6 +36,7 @@ 3 PT3M PT15M + 1 http://midpoint.evolveum.com/xml/ns/public/security/question-2#q001 true diff --git a/testing/rest/src/test/java/com/evolveum/midpoint/testing/rest/TestAbstractRestService.java b/testing/rest/src/test/java/com/evolveum/midpoint/testing/rest/TestAbstractRestService.java index 97f55ff4cc9..8de2bd0487c 100644 --- a/testing/rest/src/test/java/com/evolveum/midpoint/testing/rest/TestAbstractRestService.java +++ b/testing/rest/src/test/java/com/evolveum/midpoint/testing/rest/TestAbstractRestService.java @@ -151,6 +151,7 @@ public abstract class TestAbstractRestService { public static final File VALUE_POLICY_GENERAL = new File(BASE_REPO_DIR, "value-policy-general.xml"); public static final File VALUE_POLICY_NUMERIC = new File(BASE_REPO_DIR, "value-policy-numeric.xml"); + public static final File SECURITY_POLICY = new File(BASE_REPO_DIR, "security-policy.xml"); private static final Trace LOGGER = TraceManager.getTrace(TestAbstractRestService.class); @@ -181,6 +182,8 @@ public abstract class TestAbstractRestService { protected abstract File getRepoFile(String fileBaseName); protected abstract File getRequestFile(String fileBaseName); + public static final String QUESTION_ID = "http://midpoint.evolveum.com/xml/ns/public/security/question-2#q001"; + ApplicationContext applicationContext = null; @BeforeClass @@ -227,6 +230,7 @@ private void startServer() throws Exception { addObject(USER_SOMEBODY_FILE, result); addObject(VALUE_POLICY_GENERAL, result); addObject(VALUE_POLICY_NUMERIC, result); + addObject(SECURITY_POLICY, result); addObject(SYSTEM_CONFIGURATION_FILE, result); dummyAuditService = DummyAuditService.getInstance(); @@ -1159,13 +1163,17 @@ private WebClient prepareClient(String username, String password) { client.accept(getAcceptHeader()); client.type(getContentType()); + createAuthorizationHeader(client, username, password); + return client; + + } + + protected void createAuthorizationHeader(WebClient client, String username, String password){ if (username != null) { String authorizationHeader = "Basic " + org.apache.cxf.common.util.Base64Utility.encode((username+":"+(password==null?"":password)).getBytes()); client.header("Authorization", authorizationHeader); } - return client; - } private void assertStatus(Response response, int expStatus) { diff --git a/testing/rest/src/test/java/com/evolveum/midpoint/testing/rest/TestRestServiceJson.java b/testing/rest/src/test/java/com/evolveum/midpoint/testing/rest/TestRestServiceJson.java index 133af4b187a..19ad19bebf8 100644 --- a/testing/rest/src/test/java/com/evolveum/midpoint/testing/rest/TestRestServiceJson.java +++ b/testing/rest/src/test/java/com/evolveum/midpoint/testing/rest/TestRestServiceJson.java @@ -20,6 +20,8 @@ import javax.ws.rs.core.MediaType; +import org.apache.cxf.jaxrs.client.WebClient; + import com.evolveum.midpoint.model.impl.rest.MidpointAbstractProvider; //@ContextConfiguration(locations = { "classpath:ctx-rest-test.xml" }) @@ -52,5 +54,4 @@ protected MidpointAbstractProvider getProvider() { return jsonProvider; } - } diff --git a/testing/rest/src/test/java/com/evolveum/midpoint/testing/rest/TestRestServiceJsonSecQ.java b/testing/rest/src/test/java/com/evolveum/midpoint/testing/rest/TestRestServiceJsonSecQ.java new file mode 100644 index 00000000000..58f00e35b5c --- /dev/null +++ b/testing/rest/src/test/java/com/evolveum/midpoint/testing/rest/TestRestServiceJsonSecQ.java @@ -0,0 +1,30 @@ +package com.evolveum.midpoint.testing.rest; + +import org.apache.cxf.jaxrs.client.WebClient; + +public class TestRestServiceJsonSecQ extends TestRestServiceJson{ + + + @Override + protected void createAuthorizationHeader(WebClient client, String username, String password) { + + if (username == null) { + return; + } + + String authzHeader = "{" + + "\"user\" : \""+ username +"\"," + + "\"answer\" : [" + + "{ " + + "\"qid\" : \"http://midpoint.evolveum.com/xml/ns/public/security/question-2#q001\"," + + "\"qans\" : \"" + (password == null ? "" : password) + "\"" + + "}" + + "]" + + "}"; + + String authorizationHeader = "SecQ " + + org.apache.cxf.common.util.Base64Utility.encode((authzHeader).getBytes()); + client.header("Authorization", authorizationHeader); + + } +} diff --git a/testing/rest/src/test/resources/repo/json/user-darthadder.json b/testing/rest/src/test/resources/repo/json/user-darthadder.json index f0aa30de9ec..3571b5e74c2 100644 --- a/testing/rest/src/test/resources/repo/json/user-darthadder.json +++ b/testing/rest/src/test/resources/repo/json/user-darthadder.json @@ -35,6 +35,15 @@ "@ns" : "http://prism.evolveum.com/xml/ns/public/types-3", "clearValue" : "iamyouruncle" } + }, + "securityQuestions" : { + "questionAnswer" : [{ + "questionIdentifier" : "http://midpoint.evolveum.com/xml/ns/public/security/question-2#q001", + "questionAnswer" : { + "@ns" : "http://prism.evolveum.com/xml/ns/public/types-3", + "clearValue": "iamyouruncle" + } + }] } } } diff --git a/testing/rest/src/test/resources/repo/security-policy.xml b/testing/rest/src/test/resources/repo/security-policy.xml new file mode 100644 index 00000000000..116a6cd7332 --- /dev/null +++ b/testing/rest/src/test/resources/repo/security-policy.xml @@ -0,0 +1,61 @@ + + + + + Security Policy + + + P30D + 3 + PT3M + PT15M + + + P30D + 3 + PT3M + PT15M + + + P30D + 3 + PT3M + PT15M + 1 + + http://midpoint.evolveum.com/xml/ns/public/security/question-2#q001 + true + How much wood would a woodchuck chuck if woodchuck could chuck wood? + + + http://midpoint.evolveum.com/xml/ns/public/security/question-2#q002 + What is your mother's best friend's uncle's grandaughter's dog's mother maiden name? + + + http://midpoint.evolveum.com/xml/ns/public/security/question-2#q003 + true + What's your favorite color? + + + http://midpoint.evolveum.com/xml/ns/public/security/question-2#q004 + false + What's your favorite film? + + + + diff --git a/testing/rest/src/test/resources/repo/system-configuration.xml b/testing/rest/src/test/resources/repo/system-configuration.xml index 4b618321f9a..23c83dcff97 100644 --- a/testing/rest/src/test/resources/repo/system-configuration.xml +++ b/testing/rest/src/test/resources/repo/system-configuration.xml @@ -53,4 +53,5 @@ INFO + diff --git a/testing/rest/src/test/resources/repo/user-administrator.xml b/testing/rest/src/test/resources/repo/user-administrator.xml index 603ec000f1c..02f71571ce9 100644 --- a/testing/rest/src/test/resources/repo/user-administrator.xml +++ b/testing/rest/src/test/resources/repo/user-administrator.xml @@ -15,6 +15,7 @@ ~ limitations under the License. --> administrator @@ -33,5 +34,19 @@ 5ecr3t + + + http://midpoint.evolveum.com/xml/ns/public/security/question-2#q001 + + 5ecr3t + + + + http://midpoint.evolveum.com/xml/ns/public/security/question-2#q003 + + black + + + \ No newline at end of file diff --git a/testing/rest/src/test/resources/repo/user-cyclops.xml b/testing/rest/src/test/resources/repo/user-cyclops.xml index 3d42c688363..d18ceaa1eb9 100644 --- a/testing/rest/src/test/resources/repo/user-cyclops.xml +++ b/testing/rest/src/test/resources/repo/user-cyclops.xml @@ -15,6 +15,7 @@ ~ limitations under the License. --> cyclops @@ -32,5 +33,13 @@ cyclopassword + + + http://midpoint.evolveum.com/xml/ns/public/security/question-2#q001 + + cyclopassword + + + \ No newline at end of file diff --git a/testing/rest/src/test/resources/repo/user-nobody.xml b/testing/rest/src/test/resources/repo/user-nobody.xml index 2417609ceba..c4f11f0bbf0 100644 --- a/testing/rest/src/test/resources/repo/user-nobody.xml +++ b/testing/rest/src/test/resources/repo/user-nobody.xml @@ -15,6 +15,7 @@ ~ limitations under the License. --> nobody @@ -29,5 +30,13 @@ nopassword + + + http://midpoint.evolveum.com/xml/ns/public/security/question-2#q001 + + nopassword + + + \ No newline at end of file diff --git a/testing/rest/src/test/resources/repo/user-somebody.xml b/testing/rest/src/test/resources/repo/user-somebody.xml index 373b5e2c1b6..e72424639f3 100644 --- a/testing/rest/src/test/resources/repo/user-somebody.xml +++ b/testing/rest/src/test/resources/repo/user-somebody.xml @@ -15,6 +15,7 @@ ~ limitations under the License. --> somebody @@ -35,5 +36,13 @@ somepassword + + + http://midpoint.evolveum.com/xml/ns/public/security/question-2#q001 + + somepassword + + + \ No newline at end of file diff --git a/testing/rest/src/test/resources/repo/xml/user-darthadder.xml b/testing/rest/src/test/resources/repo/xml/user-darthadder.xml index f507d800c06..faa4eb67a57 100644 --- a/testing/rest/src/test/resources/repo/xml/user-darthadder.xml +++ b/testing/rest/src/test/resources/repo/xml/user-darthadder.xml @@ -15,6 +15,7 @@ ~ limitations under the License. --> darthadder @@ -48,5 +49,13 @@ iamyouruncle + + + http://midpoint.evolveum.com/xml/ns/public/security/question-2#q001 + + iamyouruncle + + + \ No newline at end of file diff --git a/testing/rest/src/test/resources/repo/yaml/user-darthadder.yml b/testing/rest/src/test/resources/repo/yaml/user-darthadder.yml index f9f7ef8596d..fb7d7f97f55 100644 --- a/testing/rest/src/test/resources/repo/yaml/user-darthadder.yml +++ b/testing/rest/src/test/resources/repo/yaml/user-darthadder.yml @@ -53,4 +53,10 @@ user: password: value: '@ns': "http://prism.evolveum.com/xml/ns/public/types-3" - clearValue: "iamyouruncle" \ No newline at end of file + clearValue: "iamyouruncle" + securityQuestions: + - questionAnswer: + questionIdentifier: "http://midpoint.evolveum.com/xml/ns/public/security/question-2#q001" + questionAnswer: + '@ns': "http://prism.evolveum.com/xml/ns/public/types-3" + clearValue: "iamyouruncle" \ No newline at end of file diff --git a/testing/rest/testng-integration.xml b/testing/rest/testng-integration.xml index 91e48b15302..d8001077572 100644 --- a/testing/rest/testng-integration.xml +++ b/testing/rest/testng-integration.xml @@ -22,6 +22,7 @@ +