Skip to content

Commit

Permalink
Password history hashing. Fixes.
Browse files Browse the repository at this point in the history
  • Loading branch information
@semancik
semancik committed Mar 9, 2017
1 parent e21fb20 commit f07569f
Show file tree
Hide file tree
Showing 11 changed files with 241 additions and 81 deletions.
29 changes: 29 additions & 0 deletions infra/schema/src/main/resources/xml/ns/public/common/common-core-3.xsd
View file
Expand Up @@ -11585,6 +11585,16 @@
</xsd:annotation>
<xsd:sequence>
<xsd:element name="storageMethod" type="c:CredentialsStorageMethodType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>
Method used to store the values of this credential (encrypted, hashed, ...)
If storage method is not specified it defaults to encryption
(due to compatibility and convenience reasons).
</xsd:documentation>
<xsd:appinfo>
<a:since>3.6</a:since>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
<xsd:element name="resetMethod" type="c:CredentialsResetMethodType" minOccurs="0" maxOccurs="1">
</xsd:element>
Expand Down Expand Up @@ -11655,6 +11665,18 @@
</xsd:documentation>
</xsd:annotation>
</xsd:element>
<xsd:element name="historyStorageMethod" type="c:CredentialsStorageMethodType" minOccurs="0" maxOccurs="1">
<xsd:annotation>
<xsd:documentation>
Method used to store historical values of the credential (encrypted, hashed, ...)
If storage type is not specified then it defaults to hashing.
</xsd:documentation>
<xsd:appinfo>
<a:since>3.6</a:since>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>

<!-- TODO: similarity criteria (history vs new password) -->
</xsd:sequence>
</xsd:complexType>
Expand Down Expand Up @@ -11839,6 +11861,13 @@
MidPoitn will only work with credential in the memory
while it is needed to complete current operation.
The credential will be discarded after the operation.

THIS IS ONLY PARTIALLY SUPPORTED

MidPoint should be able not to store the credentials when
this setting is used. But there may be side effects.
This is not entirelly tests and not supported.
Use at your own risk.
</xsd:documentation>
<xsd:appinfo>
<jaxb:typesafeEnumMember name="NONE"/>
Expand Down
9 changes: 3 additions & 6 deletions ...l/src/main/java/com/evolveum/midpoint/model/impl/lens/projector/CredentialsProcessor.java
View file
Expand Up @@ -40,6 +40,7 @@
import com.evolveum.midpoint.schema.constants.ExpressionConstants;
import com.evolveum.midpoint.schema.constants.SchemaConstants;
import com.evolveum.midpoint.schema.result.OperationResult;
import com.evolveum.midpoint.security.api.SecurityUtil;
import com.evolveum.midpoint.task.api.Task;
import com.evolveum.midpoint.util.SchemaFailableProcessor;
import com.evolveum.midpoint.util.exception.ExpressionEvaluationException;
Expand Down Expand Up @@ -433,12 +434,8 @@ private <O extends ObjectType> void transformFocusExectionDeltaCredential(LensCo
return;
}
CredentialPolicyType defaltCredPolicyType = credsType.getDefault();
CredentialsStorageMethodType storageMethod = null;
if (credPolicyType != null && credPolicyType.getStorageMethod() != null) {
storageMethod = credPolicyType.getStorageMethod();
} else if (defaltCredPolicyType != null && defaltCredPolicyType.getStorageMethod() != null) {
storageMethod = defaltCredPolicyType.getStorageMethod();
}
CredentialsStorageMethodType storageMethod =
SecurityUtil.getCredPolicyItem(defaltCredPolicyType, credPolicyType, pol -> pol.getStorageMethod());
if (storageMethod == null) {
return;
}
Expand Down
60 changes: 54 additions & 6 deletions ...rc/main/java/com/evolveum/midpoint/model/impl/lens/projector/PasswordPolicyProcessor.java
View file
Expand Up @@ -59,6 +59,7 @@
import com.evolveum.midpoint.schema.result.OperationResult;
import com.evolveum.midpoint.schema.result.OperationResultStatus;
import com.evolveum.midpoint.schema.util.ObjectTypeUtil;
import com.evolveum.midpoint.security.api.SecurityUtil;
import com.evolveum.midpoint.task.api.Task;
import com.evolveum.midpoint.util.exception.ExpressionEvaluationException;
import com.evolveum.midpoint.util.exception.ObjectNotFoundException;
Expand All @@ -70,6 +71,8 @@
import com.evolveum.midpoint.xml.ns._public.common.common_3.CharacterClassType;
import com.evolveum.midpoint.xml.ns._public.common.common_3.CheckExpressionType;
import com.evolveum.midpoint.xml.ns._public.common.common_3.CredentialsPolicyType;
import com.evolveum.midpoint.xml.ns._public.common.common_3.CredentialsStorageMethodType;
import com.evolveum.midpoint.xml.ns._public.common.common_3.CredentialsStorageTypeType;
import com.evolveum.midpoint.xml.ns._public.common.common_3.CredentialsType;
import com.evolveum.midpoint.xml.ns._public.common.common_3.ExpressionType;
import com.evolveum.midpoint.xml.ns._public.common.common_3.FocusType;
Expand Down Expand Up @@ -709,7 +712,6 @@ private String determinePasswordValue(ProtectedStringType passValue) {
return passwordStr;
}


public <F extends FocusType> void processPasswordHistoryDeltas(LensFocusContext<F> focusContext,
LensContext<F> context, SecurityPolicyType securityPolicy, XMLGregorianCalendar now, Task task, OperationResult result)
throws SchemaException {
Expand All @@ -729,7 +731,7 @@ public <F extends FocusType> void processPasswordHistoryDeltas(LensFocusContext<
List<PasswordHistoryEntryType> historyEntryValues = getSortedHistoryList(historyEntries, true);
int newHistoryEntries = 0;
if (maxPasswordsToSave > 0) {
newHistoryEntries = createAddHistoryDelta(context, password, now);
newHistoryEntries = createAddHistoryDelta(context, password, securityPolicy, now);
}
createDeleteHistoryDeltasIfNeeded(historyEntryValues, maxPasswordsToSave, newHistoryEntries, context, task, result);
}
Expand Down Expand Up @@ -794,18 +796,33 @@ private <F extends FocusType> int getMaxPasswordsToSave(LensFocusContext<F> focu


private <F extends FocusType> int createAddHistoryDelta(LensContext<F> context,
PrismContainer<PasswordType> password, XMLGregorianCalendar now) throws SchemaException {
PrismContainer<PasswordType> password, SecurityPolicyType securityPolicy, XMLGregorianCalendar now) throws SchemaException {
PrismContainerValue<PasswordType> passwordValue = password.getValue();
PasswordType passwordRealValue = passwordValue.asContainerable();
PasswordType passwordType = passwordValue.asContainerable();
if (passwordType == null || passwordType.getValue() == null) {
return 0;
}
ProtectedStringType passwordPsForStorage = passwordType.getValue().clone();

CredentialsStorageTypeType storageType = CredentialsStorageTypeType.HASHING;
CredentialsPolicyType creds = securityPolicy.getCredentials();
if (creds != null) {
CredentialsStorageMethodType storageMethod =
SecurityUtil.getCredPolicyItem(creds.getDefault(), creds.getPassword(), pol -> pol.getStorageMethod());
if (storageMethod != null && storageMethod.getStorageType() != null) {
storageType = storageMethod.getStorageType();
}
}
prepareProtectedStringForStorage(passwordPsForStorage, storageType);

PrismContainerDefinition<PasswordHistoryEntryType> historyEntryDefinition = password.getDefinition().findContainerDefinition(PasswordType.F_HISTORY_ENTRY);
PrismContainer<PasswordHistoryEntryType> historyEntry = historyEntryDefinition.instantiate();

PrismContainerValue<PasswordHistoryEntryType> hisotryEntryValue = historyEntry.createNewValue();

PasswordHistoryEntryType entryType = hisotryEntryValue.asContainerable();
entryType.setValue(passwordRealValue.getValue());
entryType.setMetadata(passwordRealValue.getMetadata());
entryType.setValue(passwordPsForStorage);
entryType.setMetadata(passwordType.getMetadata());
entryType.setChangeTimestamp(now);

ContainerDelta<PasswordHistoryEntryType> addHisotryDelta = ContainerDelta
Expand All @@ -815,6 +832,37 @@ private <F extends FocusType> int createAddHistoryDelta(LensContext<F> context,
return 1;

}

private void prepareProtectedStringForStorage(ProtectedStringType ps, CredentialsStorageTypeType storageType) throws SchemaException {
try {
switch (storageType) {
case ENCRYPTION:
if (ps.isEncrypted()) {
break;
}
if (ps.isHashed()) {
throw new SchemaException("Cannot store hashed value in an encrypted form");
}
protector.encrypt(ps);
break;

case HASHING:
if (ps.isHashed()) {
break;
}
protector.hash(ps);
break;

case NONE:
throw new SchemaException("Cannot store value on NONE storage form");

default:
throw new SchemaException("Unknown storage type: "+storageType);
}
} catch (EncryptionException e) {
throw new SystemException(e.getMessage(), e);
}
}

private <F extends FocusType> void createDeleteHistoryDeltasIfNeeded(
List<PasswordHistoryEntryType> historyEntryValues, int maxPasswordsToSave, int newHistoryEntries, LensContext<F> context, Task task,
Expand Down
19 changes: 11 additions & 8 deletions ...ntest/src/test/java/com/evolveum/midpoint/model/intest/password/AbstractPasswordTest.java
View file
Expand Up @@ -721,7 +721,10 @@ public void test202ReconcileUserJack() throws Exception {
// GIVEN
Task task = taskManager.createTaskInstance(AbstractPasswordTest.class.getName() + "." + TEST_NAME);
OperationResult result = task.getResult();
assumeAssignmentPolicy(AssignmentPolicyEnforcementType.FULL);

PrismObject<UserType> userBefore = getUser(USER_JACK_OID);
display("User before", userBefore);
assertLinks(userBefore, 4);

// WHEN
reconcileUser(USER_JACK_OID, task, result);
Expand All @@ -730,27 +733,27 @@ public void test202ReconcileUserJack() throws Exception {
result.computeStatus();
TestUtil.assertSuccess(result);

PrismObject<UserType> userJack = getUser(USER_JACK_OID);
display("User after change execution", userJack);
assertLinks(userJack, 4);
accountYellowOid = getLinkRefOid(userJack, RESOURCE_DUMMY_YELLOW_OID);
PrismObject<UserType> userAfter = getUser(USER_JACK_OID);
display("User after", userAfter);
assertLinks(userAfter, 4);
accountYellowOid = getLinkRefOid(userAfter, RESOURCE_DUMMY_YELLOW_OID);

// Check account in dummy resource (yellow): password is too short for this, original password should remain there
assertDummyAccount(RESOURCE_DUMMY_YELLOW_NAME, ACCOUNT_JACK_DUMMY_USERNAME, ACCOUNT_JACK_DUMMY_FULLNAME, true);
assertDummyPassword(RESOURCE_DUMMY_YELLOW_NAME, ACCOUNT_JACK_DUMMY_USERNAME, USER_PASSWORD_1_CLEAR);
assertDummyPasswordConditional(RESOURCE_DUMMY_YELLOW_NAME, ACCOUNT_JACK_DUMMY_USERNAME, USER_PASSWORD_1_CLEAR);

// Check account in dummy resource (red)
assertDummyAccount(RESOURCE_DUMMY_RED_NAME, ACCOUNT_JACK_DUMMY_USERNAME, ACCOUNT_JACK_DUMMY_FULLNAME, true);
assertDummyPassword(RESOURCE_DUMMY_RED_NAME, ACCOUNT_JACK_DUMMY_USERNAME, USER_PASSWORD_A_CLEAR);

// User and default dummy account should have unchanged passwords
assertUserPassword(userJack, USER_PASSWORD_A_CLEAR);
assertUserPassword(userAfter, USER_PASSWORD_A_CLEAR);
assertDummyPassword(ACCOUNT_JACK_DUMMY_USERNAME, USER_PASSWORD_A_CLEAR);

// this one is not changed
assertDummyPassword(RESOURCE_DUMMY_UGLY_NAME, ACCOUNT_JACK_DUMMY_USERNAME, USER_JACK_EMPLOYEE_NUMBER_NEW_GOOD);

assertPasswordHistoryEntries(userJack);
assertPasswordHistoryEntries(userAfter);
}

/**
Expand Down
2 changes: 1 addition & 1 deletion ...src/test/java/com/evolveum/midpoint/model/intest/password/TestPasswordDefaultHashing.java
View file
Expand Up @@ -49,6 +49,6 @@ protected String getSecurityPolicyOid() {
@Override
protected CredentialsStorageTypeType getPasswordStorageType() {
return CredentialsStorageTypeType.HASHING;
}
}

}
7 changes: 6 additions & 1 deletion ...el-intest/src/test/java/com/evolveum/midpoint/model/intest/password/TestPasswordNone.java
View file
Expand Up @@ -29,6 +29,12 @@
/**
* Password test with NONE password storage (default storage for other types)
*
* This test is only partially working.
* IT IS NOT PART OF THE TEST SUITE. It is NOT executed automatically.
*
* E.g. new password will be generated on every recompute because the
* weak inbound mapping is activated.
*
* @author semancik
*
*/
Expand All @@ -50,5 +56,4 @@ protected String getSecurityPolicyOid() {
protected CredentialsStorageTypeType getPasswordStorageType() {
return CredentialsStorageTypeType.NONE;
}

}
2 changes: 1 addition & 1 deletion model/model-intest/src/test/resources/logback-test.xml
View file
Expand Up @@ -46,7 +46,7 @@
if any of the following is set to "TRACE" then it was changed by mistake and should be changed back -->
<logger name="com.evolveum.midpoint.model.impl.lens.Clockwork" level="TRACE" />
<logger name="com.evolveum.midpoint.model.impl.lens.projector" level="DEBUG" />
<logger name="com.evolveum.midpoint.model.impl.lens.projector.Projector" level="DEBUG" />
<logger name="com.evolveum.midpoint.model.impl.lens.projector.Projector" level="TRACE" />
<logger name="com.evolveum.midpoint.model.impl.lens.projector.ContextLoader" level="DEBUG" />
<logger name="com.evolveum.midpoint.model.impl.lens.projector.FocusProcessor" level="DEBUG" />
<logger name="com.evolveum.midpoint.model.impl.lens.projector.InboundProcessor" level="DEBUG" />
Expand Down
3 changes: 2 additions & 1 deletion model/model-intest/testng-integration.xml
View file
Expand Up @@ -95,7 +95,8 @@
<classes>
<class name="com.evolveum.midpoint.model.intest.password.TestPasswordDefault"/>
<class name="com.evolveum.midpoint.model.intest.password.TestPasswordDefaultHashing"/>
<class name="com.evolveum.midpoint.model.intest.password.TestPasswordNone"/>
<!-- TestPasswordNone works only partially. It needs to be updated. -->
<!-- <class name="com.evolveum.midpoint.model.intest.password.TestPasswordNone"/> -->
</classes>
</test>
<!--
Expand Down
47 changes: 0 additions & 47 deletions ...del-test/src/main/java/com/evolveum/midpoint/model/test/AbstractModelIntegrationTest.java
View file
Expand Up @@ -3662,53 +3662,6 @@ protected void assertRoleTypes(RoleSelectionSpecification roleSpec, String... ex
}
}
}

protected void assertEncryptedUserPassword(String userOid, String expectedClearPassword) throws EncryptionException, ObjectNotFoundException, SchemaException {
OperationResult result = new OperationResult(AbstractIntegrationTest.class.getName()+".assertEncryptedUserPassword");
PrismObject<UserType> user = repositoryService.getObject(UserType.class, userOid, null, result);
result.computeStatus();
TestUtil.assertSuccess(result);
assertEncryptedUserPassword(user, expectedClearPassword);
}

protected void assertEncryptedUserPassword(PrismObject<UserType> user, String expectedClearPassword) throws EncryptionException, SchemaException {
assertUserPassword(user, expectedClearPassword, CredentialsStorageTypeType.ENCRYPTION);
}

protected void assertUserPassword(PrismObject<UserType> user, String expectedClearPassword) throws EncryptionException, SchemaException {
assertUserPassword(user, expectedClearPassword, getPasswordStorageType());
}

protected CredentialsStorageTypeType getPasswordStorageType() {
return CredentialsStorageTypeType.ENCRYPTION;
}

protected void assertUserPassword(PrismObject<UserType> user, String expectedClearPassword, CredentialsStorageTypeType storageType) throws EncryptionException, SchemaException {
UserType userType = user.asObjectable();
ProtectedStringType protectedActualPassword = userType.getCredentials().getPassword().getValue();
switch (storageType) {

case NONE:
assertNull("Unexpected stored password "+protectedActualPassword+" in "+user, protectedActualPassword);
break;

case ENCRYPTION:
assertNotNull("No password for "+user, protectedActualPassword);
assertTrue("Unenctypted password for "+user+": "+protectedActualPassword, protectedActualPassword.isEncrypted());
String actualClearPassword = protector.decryptString(protectedActualPassword);
assertEquals("Wrong password for "+user, expectedClearPassword, actualClearPassword);
break;

case HASHING:
assertNotNull("No password for "+user, protectedActualPassword);
assertTrue("Not hashed password for "+user+": "+protectedActualPassword, protectedActualPassword.isHashed());
ProtectedStringType expectedPs = new ProtectedStringType();
expectedPs.setClearValue(expectedClearPassword);
assertTrue("Wrong password for "+user+", expected "+expectedClearPassword+", but was "+protectedActualPassword,
protector.compare(protectedActualPassword, expectedPs));
}

}

protected void assertPasswordMetadata(PrismObject<UserType> user, boolean create, XMLGregorianCalendar start, XMLGregorianCalendar end, String actorOid, String channel) {
PrismContainer<MetadataType> metadataContainer = user.findContainer(new ItemPath(UserType.F_CREDENTIALS, CredentialsType.F_PASSWORD, PasswordType.F_METADATA));
Expand Down

0 comments on commit f07569f

Please sign in to comment.