* Checks the users password against SecureAuth Datastore *
- * + * * @param userId the userid of the identity * @param password The password of the user to validate * @return {@link ResponseObject} */ BaseResponse validateUserPassword(String userId, String password) throws SARestAPIException; + /** + *+ * Checks the users password against SecureAuth Datastore + *
+ * + * @param userId the userid of the identity + * @param password The password of the user to validate + * @param enduserIp the enduser's ip address + * @return {@link ResponseObject} + */ + BaseResponse validateUserPassword(String userId, String password, String enduserIp) throws SARestAPIException; + + /** ** Checks the users pin against SecureAuth Datastore diff --git a/src/main/java/org/secureauth/sarestapi/SAAccess.java b/src/main/java/org/secureauth/sarestapi/SAAccess.java index 20761e4..0f39d22 100644 --- a/src/main/java/org/secureauth/sarestapi/SAAccess.java +++ b/src/main/java/org/secureauth/sarestapi/SAAccess.java @@ -100,7 +100,7 @@ public class SAAccess implements ISAAccess { * This should be the default object used when setting up connectivity to the * SecureAuth Appliance *
- * + * * @param host FQDN of the SecureAuth Appliance * @param port The port used to access the web application on the * Appliance. @@ -127,7 +127,7 @@ public SAAccess(String host, String port, boolean ssl, String realm, String appl * SecureAuth Appliance * This Object will allow users to support selfSigned Certificates * - * + * * @param host FQDN of the SecureAuth Appliance * @param port The port used to access the web application on the * Appliance. @@ -157,7 +157,7 @@ public SAAccess(String host, String port, boolean ssl, boolean selfSigned, Strin * SecureAuth Appliance * This Object will allow users to support selfSigned Certificates * - * + * * @param host FQDN of the SecureAuth Appliance * @param port The port used to access the web application on the * Appliance. @@ -189,7 +189,7 @@ public SAAccess(String host, String port, boolean ssl, boolean selfSigned, Strin * SecureAuth Appliance * This Object will allow users to support selfSigned Certificates * - * + * * @param saBaseURL {@link org.secureauth.sarestapi.data.SABaseURL} * @param saAuth {@link org.secureauth.sarestapi.data.SAAuth} * @param saExecuter {@link org.secureauth.sarestapi.resources.SAExecuter} @@ -210,7 +210,7 @@ public void updateConfig(Hashtable* Returns IP Risk Evaluation from the Rest API *
- * + * * @param userId The User ID that you want to validate from * @param ipAddress The IP Address of the user making the request for access * @return {@link org.secureauth.sarestapi.data.IPEval} @@ -244,7 +244,7 @@ public IPEval iPEvaluation(String userId, String ipAddress) { * Returns the list of Factors available for the specified user * Used for both /v1/users/factors and /v2/users/factors * - * + * * @param userId the userid of the identity you wish to have a list of possible * second factors * @return {@link FactorsResponse} @@ -264,14 +264,14 @@ public FactorsResponse factorsByUser(String userId) { } return null; } - + /** ** Returns the list of Factors available for the specified user. * Used for /v3/users/factors * Includes Preferred MFA configured/set by the admin/user. *
- * + * * @param userId the userid of the identity you wish to have a list of possible * second factors * @return {@link FactorsResponse} @@ -297,7 +297,7 @@ public FactorsResponse factorsByUserV3(String userId) { * Returns the list of Factors available for the specified user supporting special characters * Used for both /v1/users/factors and /v2/users/factors * - * + * * @param userId the userid of the identity you wish to have a list of possible * second factors. This method supports special characters for * userId since it uses QP (Query Params) in order to create the @@ -320,14 +320,14 @@ public FactorsResponse factorsByUserQP(String userId) { } return null; } - + /** ** Returns the list of Factors available for the specified user supporting special characters * Used for /v3/users/factors * Includes Preferred MFA configured/set by the admin/user. *
- * + * * @param userId the userid of the identity you wish to have a list of possible * second factors. This method supports special characters for * userId since it uses QP (Query Params) in order to create the @@ -468,7 +468,7 @@ public StatefulResponseObject sendPushBiometricReqStateful(String biometricType, ** Perform adaptive auth query *
- * + * * @param userId the user id of the identity * @param endUserIP the IP of requesting client * @return {@link FactorsResponse} @@ -524,7 +524,7 @@ private String makePushNotificationQueryURI(String refId) { ** Checks if the Username exists within the datastore within SecureAuth *
- * + * * @param userId the userid of the identity * @return {@link ResponseObject} */ @@ -552,7 +552,7 @@ public BaseResponse validateUser(String userId) { * the OTP throttling count to 0 after the end-user successfully authenticates; * the attempt count is stored in a directory attribute configured in the Web * Admin - * + * * @param userId id of user * @return base answer */ @@ -576,7 +576,7 @@ public ThrottleResponse resetThrottleReq(String userId) { * the OTP throttling count to 0 after the end-user successfully authenticates; * the attempt count is stored in a directory attribute configured in the Web * Admin - * + * * @param userId id of user. This method supports special characters for userId * since it uses QP (Query Params) in order to create the request. * @return base answer @@ -599,7 +599,7 @@ public ThrottleResponse resetThrottleReqQP(String userId) { /** * GET the end-user's current count of OTP usage attempts - * + * * @param userId id of user * @return base answer */ @@ -619,7 +619,7 @@ public ThrottleResponse getThrottleReq(String userId) { /** * GET the end-user's current count of OTP usage attempts - * + * * @param userId id of user. This method supports special characters for userId * since it uses QP (Query Params) in order to create the request. * @return base answer @@ -642,18 +642,32 @@ public ThrottleResponse getThrottleReqQP(String userId) { ** Checks the users password against SecureAuth Datastore *
- * + * * @param userId the userid of the identity * @param password The password of the user to validate * @return {@link ResponseObject} */ public BaseResponse validateUserPassword(String userId, String password) { + return validateUserPassword(userId, password, ""); + } + /** + *+ * Checks the users password against SecureAuth Datastore + *
+ * + * @param userId the userid of the identity + * @param password The password of the user to validate + * @param enduserIp the enduser's IP Address + * @return {@link ResponseObject} + */ + public BaseResponse validateUserPassword(String userId, String password, String enduserIp) { String ts = getServerTime(); AuthRequest authRequest = new AuthRequest(); authRequest.setUser_id(userId); authRequest.setType(Resource.PASSWORD); authRequest.setToken(password); + authRequest.setEnduser_ip(enduserIp); String header = RestApiHeader.getAuthorizationHeader(saAuth, "POST", AuthQuery.queryAuth(saAuth.getRealm()), authRequest, ts); @@ -672,7 +686,7 @@ public BaseResponse validateUserPassword(String userId, String password) { ** Checks the users pin against SecureAuth Datastore *
- * + * * @param userId the userid of the identity * @param pin The pin of the user to validate * @return {@link ResponseObject} @@ -702,7 +716,7 @@ public BaseResponse validateUserPin(String userId, String pin) { ** Validate the users Answer to a KB Question *
- * + * * @param userId the userid of the identity * @param answer The answer to the KBA * @param factorId the KB Id to be compared against @@ -734,7 +748,7 @@ public BaseResponse validateKba(String userId, String answer, String factorId) { ** Validate the Oath Token *
- * + * * @param userId the userid of the identity * @param otp The One Time Passcode to validate * @param factorId The Device Identifier @@ -766,7 +780,7 @@ public BaseResponse validateOath(String userId, String otp, String factorId) { ** Send One Time Passcode by Phone *
- * + * * @param userId the userid of the identity * @param factorId Phone Property "Phone1" * @return {@link ResponseObject} @@ -796,7 +810,7 @@ public ResponseObject deliverOTPByPhone(String userId, String factorId) { ** Send One Time Passcode by Phone Ad Hoc *
- * + * * @param userId the userid of the identity * @param phoneNumber Phone Number to call * @return {@link ResponseObject} @@ -826,7 +840,7 @@ public ResponseObject deliverAdHocOTPByPhone(String userId, String phoneNumber) ** Send One Time Passcode by SMS to Registered User *
- * + * * @param userId the userid of the identity * @param factorId Phone Property "Phone1" * @return {@link ResponseObject} @@ -855,7 +869,7 @@ public ResponseObject deliverOTPBySMS(String userId, String factorId) { ** Validate One Time Passcode sent by SMS *
- * + * * @param userId the userid of the identity * @param otp OTP Value to compare against what was sent * @return {@link ValidateOTPResponse} @@ -885,7 +899,7 @@ public ValidateOTPResponse validateOTP(String userId, String otp) { ** Send One Time Passcode by SMS Ad Hoc *
- * + * * @param userId the userid of the identity * @param phoneNumber Phone Number to send SMS to * @return {@link ResponseObject} @@ -914,7 +928,7 @@ public ResponseObject deliverAdHocOTPBySMS(String userId, String phoneNumber) { ** Send yubikey validation *
- * + * * @param userId the userid of the identity * @param yubikeyToken the generated token by the yubikey * @return {@link BaseResponse} @@ -944,7 +958,7 @@ public BaseResponse validateYubicoToken(String userId, String yubikeyToken) { ** Send One Time Passcode by Email to Help Desk *
- * + * * @param userId the userid of the identity * @param factorId Help Desk Property "HelpDesk1" * @return {@link ResponseObject} @@ -973,7 +987,7 @@ public ResponseObject deliverHelpDeskOTPByEmail(String userId, String factorId) ** Send One Time Passcode by Email *
- * + * * @param userId the userid of the identity * @param factorId Email Property "Email1" * @return {@link ResponseObject} @@ -1002,7 +1016,7 @@ public ResponseObject deliverOTPByEmail(String userId, String factorId) { ** Send One Time Passcode by Email Ad Hoc *
- * + * * @param userId the userid of the identity * @param emailAddress Email Address * @return {@link ResponseObject} @@ -1031,7 +1045,7 @@ public ResponseObject deliverAdHocOTPByEmail(String userId, String emailAddress) ** Send One Time Passcode by Push *
- * + * * @param userId the userid of the identity * @param factorId Device Property "z0y9x87wv6u5t43srq2p1on" * @return {@link ResponseObject} @@ -1061,7 +1075,7 @@ public ResponseObject deliverOTPByPush(String userId, String factorId) { ** Send One Time Passcode by Helpdesk *
- * + * * @param userId the userid of the identity * @param factorId Help Desk Property "HelpDesk1" * @return {@link ResponseObject} @@ -1097,7 +1111,7 @@ public ResponseObject deliverOTPByHelpDesk(String userId, String factorId) { * "user_id": "xxxxxxxxxxx" * } * - * + * * @param userId the userid of the identity * @param factorId Email Property "Email1" * @return {@link StatefulResponseObject} @@ -1120,7 +1134,7 @@ public StatefulResponseObject emailLink(String userId, String factorId) { * "user_id": "xxxxxxxxxxx" * } * - * + * * @param userId the userid of the identity * @param factorId Phone Property "Phone1" * @return {@link StatefulResponseObject} @@ -1149,7 +1163,7 @@ private StatefulResponseObject getStatefulResponseObject(String ts, AuthRequest ** Verify Link to accept using code *
- * + * * @param linkId the id provided when making a link to accept request * @return {@link PushAcceptStatus} */ @@ -1171,7 +1185,7 @@ public PushAcceptStatus verifyLinkToAcceptStatus(String linkId, Cookie cookie) { ** Returns response to Access History Post Rest API *
- * + * * @param userId The User ID that you want to validate from * @param ipAddress The IP Address of the user to be stored in the Datastore for * use when evaluating Geo-Velocity @@ -1200,7 +1214,7 @@ public ResponseObject accessHistory(String userId, String ipAddress) { return null; } - + /** ** Update user access history @@ -1227,7 +1241,7 @@ public ResponseObject updateAccessHistory(String userid, String endUserIP){ *
* Confirm the DFP data from Client using the Rest API *
- * + * * @param userId The User ID that you want to validate from * @param fingerprintId The ID of the finger print to check against the data * store @@ -1260,7 +1274,7 @@ public DFPConfirmResponse DFPConfirm(String userId, String fingerprintId) { ** Validate the DFP data from Client using the Rest API *
- * + * * @param userId The User ID that you want to validate from * @param hostAddress The ID of the finger print to check against the data store * @param jsonString The JSON String provided by the Java Script @@ -1371,7 +1385,7 @@ public DFPValidateResponse DFPSaveFingerprint(String userId, String hostAddress, ** Returns the url for the JavaScript Source for DFP *
- * + * * @return {@link JSObjectResponse} */ public JSObjectResponse javaScriptSrc() { @@ -1398,7 +1412,7 @@ public JSObjectResponse javaScriptSrc() { ** Returns the url for the JavaScript Source for BehaveBioMetrics *
- * + * * @return {@link JSObjectResponse} */ public JSObjectResponse BehaveBioJSSrc() { @@ -1422,7 +1436,7 @@ public JSObjectResponse BehaveBioJSSrc() { ** Submit Behave Bio Profile using the Rest API *
- * + * * @param userId The User ID that you want to validate from * @param behaviorProfile The Behavioral Profile of the user * @param hostAddress The IP Address of the user @@ -1461,7 +1475,7 @@ public BehaveBioResponse BehaveBioProfileSubmit(String userId, String behaviorPr ** Submit Reset Request to Behave Bio Profile using the Rest API *
- * + * * @param userId The User ID that you want to validate from * @param fieldName The Behavioral FieldName to Reset * @param fieldType The Behavioral FieldType to Reset @@ -1508,7 +1522,7 @@ public ResponseObject BehaveBioProfileReset(String userId, String fieldName, Str ** Creates User / Profile *
- * + * * @param newUserProfile The newUserProfile Object * @return {@link ResponseObject} */ @@ -1548,7 +1562,7 @@ private void validateUser(NewUserProfile newUserProfile) { ** Update User / Profile *
- * + * * @param userId the UserID tied to the Profile Object * @param userProfile The User'sProfile Object to be updated * @return {@link ResponseObject} @@ -1588,7 +1602,7 @@ private void sortKBQKBAbyKey(NewUserProfile userProfile) { * This method supports special characters for userId since it uses QP (Query * Params) in order to create the request. * - * + * * @param userId the UserID tied to the Profile Object * @param userProfile The User'sProfile Object to be updated * @return {@link ResponseObject} @@ -1630,7 +1644,7 @@ public BaseResponse deleteUser(String userId, String domain, boolean deleteRelat ** Associate User to Group *
- * + * * @param userId the user id of the identity * @param groupName The Name of the group to associate the user to * @return {@link GroupAssociationResponse} @@ -1654,7 +1668,7 @@ public ResponseObject addUserToGroup(String userId, String groupName) { * This method supports special characters for userId since it uses QP (Query * Params) in order to create the request. * - * + * * @param userId the user id of the identity * @param groupName The Name of the group to associate the user to * @return {@link GroupAssociationResponse} @@ -1677,7 +1691,7 @@ public ResponseObject addUserToGroupQP(String userId, String groupName) { ** Associate Group to Users *
- * + * * @param usersToGroup The Users to Group object holding the userIds * @param groupName The Name of the group to associate the user to * @return {@link GroupAssociationResponse} @@ -1700,7 +1714,7 @@ public GroupAssociationResponse addUsersToGroup(UsersToGroup usersToGroup, Strin ** Associate Group to User *
- * + * * @param groupName the Group Name * @param userId The userId to associate to the group * @return {@link GroupAssociationResponse} @@ -1723,7 +1737,7 @@ public GroupAssociationResponse addGroupToUser(String groupName, String userId) ** Associate Group to User *
- * + * * @param groupName the Group Name * @param userId The userId to associate to the group * @return {@link GroupAssociationResponse} @@ -1747,7 +1761,7 @@ public GroupAssociationResponse addGroupToUserQP(String groupName, String userId ** Associate User To Groups *
- * + * * @param userId The UserId we are going to assign Groups to * @param userToGroups The UserToGroups Object holding the list of groups to * associate to the user @@ -1771,7 +1785,7 @@ public GroupAssociationResponse addUserToGroups(String userId, UserToGroups user ** Returns the UserProfile for the specified user *
- * + * * @param userId the userid of the identity you wish to have a list of possible * second factors * @return {@link UserProfileResponse} @@ -1796,7 +1810,7 @@ public UserProfileResponse getUserProfile(String userId) { ** Returns the UserProfile for the specified user supporting special characters *
- * + * * @param userId the userid of the identity you wish to have a list of possible * second factors. This method supports special characters for * userId since it uses QP (Query Params) in order to create the @@ -1823,7 +1837,7 @@ public UserProfileResponse getUserProfileQP(String userId) { ** Administrative Password Reset for the specified user *
- * + * * @param userId the userid of the identity you wish to have a list of * possible second factors * @param password the users new password @@ -1853,7 +1867,7 @@ public ResponseObject passwordReset(String userId, String password) { ** Administrative Password Reset for the specified user *
- * + * * @param userId the userid of the identity you wish to have a list of * possible second factors. This method supports special * characters for userId since it uses QP (Query Params) in @@ -1885,7 +1899,7 @@ public ResponseObject passwordResetQP(String userId, String password) { ** Self Service Password Reset for the specified user *
- * + * * @param userId the userid of the identity you wish to have a list of * possible second factors * @param currentPassword the users Current password @@ -1916,7 +1930,7 @@ public ResponseObject passwordChange(String userId, String currentPassword, Stri ** Self Service Password Reset for the specified user *
- * + * * @param userId the userid of the identity you wish to have a list of * possible second factors. This method supports special * characters for userId since it uses QP (Query Params) @@ -1993,7 +2007,7 @@ public BaseResponse notifyAuthenticated(String userId, String result, String mfa * Submit User Name and Phone Number to the Phone Number Profiling service using * the Rest API * - * + * * @param userId The User ID that you want to validate from * @param phoneNumber The Phone number to get a profile on * @@ -2027,7 +2041,7 @@ public NumberProfileResponse PhoneNumberProfileSubmit(String userId, String phon ** Submit Update to Phone Number Profiling Service using the Rest API *
- * + * * @param userId The User ID that you want to validate from * @param phoneNumber user phone number provided * @param portedStatus user phone status for the option to block phone numbers @@ -2073,7 +2087,7 @@ public BaseResponse UpdatePhoneNumberProfile(String userId, String phoneNumber, return null; } - + /** * Validate the yubico OTP token from userId. * @param userId @@ -2106,7 +2120,7 @@ public ResponseObject validateUserYubicoOTPToken(String userId, String token) { /** * Retrieves the user's status from the username in the endpoint URL and returns * a response. - * + * * @param userId The User ID that you want to validate * @return {@link BaseResponse} */ @@ -2128,7 +2142,7 @@ public BaseResponse getUserStatus(String userId) { /** * Retrieves the user's status from the username in the endpoint URL and returns * a response. - * + * * @param userId The User ID that you want to validate. This method supports * special characters for userId since it uses QP (Query Params) * in order to create the request. @@ -2152,7 +2166,7 @@ public BaseResponse getUserStatusQP(String userId) { /** * Method invokes a status to the user Id. - * + * * @param userId The User ID that you want to change status * @param status The new status [lock, unlock, enable, disable] * @return {@link BaseResponse} @@ -2180,7 +2194,7 @@ public BaseResponse setUserStatus(String userId, String status) { /** * Method invokes a status to the user Id. - * + * * @param userId The User ID that you want to change status. This method * supports special characters for userId since it uses QP (Query * Params) in order to create the request. @@ -2219,7 +2233,7 @@ public BaseResponse setUserStatusQP(String userId, String status) { /** * Start Helper Methods * to fetch raw json - * + * * @param query url * @return raw response */ @@ -2244,7 +2258,7 @@ String getServerTime() { String getServerTime(Boolean oldIdpSupport) { return TimeUtils.getServerTime(oldIdpSupport); } - + private String getAuthUri() { return saAuth.getRealm() + "/api/"+ Resource.API_VERSION +"/auth"; } @@ -2255,7 +2269,7 @@ private ResponseObject buildInvalidResponseObjectWithMessage(String message) { response.setMessage( message ); return response; } - + public static class UpdateUserHistoryRequest extends AuthRequest { private String ip_address; @@ -2263,7 +2277,7 @@ public UpdateUserHistoryRequest(String userId, String ip) { this.setUser_id(userId); ip_address = ip; } - + public String getIp_address() { return ip_address; } diff --git a/src/main/java/org/secureauth/sarestapi/data/Requests/AuthRequest.java b/src/main/java/org/secureauth/sarestapi/data/Requests/AuthRequest.java index 2c2c06f..6ed3f3f 100755 --- a/src/main/java/org/secureauth/sarestapi/data/Requests/AuthRequest.java +++ b/src/main/java/org/secureauth/sarestapi/data/Requests/AuthRequest.java @@ -32,6 +32,7 @@ public class AuthRequest { private String type; private String token; private String factor_id; + private String enduser_ip; public String getUser_id() { @@ -66,6 +67,14 @@ public void setFactor_id(String factor_id) { this.factor_id = factor_id; } + public String getEnduser_ip() { + return enduser_ip; + } + + public void setEnduser_ip(String enduser_ip) { + this.enduser_ip = enduser_ip; + } + @Override public String toString(){ return JSONUtil.convertObjectToJSON(this); diff --git a/src/test/java/org/secureauth/restapi/test/SAAccessTDD.java b/src/test/java/org/secureauth/restapi/test/SAAccessTDD.java index d9383ed..37c65b1 100644 --- a/src/test/java/org/secureauth/restapi/test/SAAccessTDD.java +++ b/src/test/java/org/secureauth/restapi/test/SAAccessTDD.java @@ -51,6 +51,7 @@ public class SAAccessTDD { private static String validYubicoToken; private static String userDomain; private static String newUserPin; + private static String validIp; private final static String NEW_USERNAME = "new-user"; private final static String NEW_USER_PASSWORD = "password"; private final static String NEW_USERNAME_QP = "new-user" + "+~.!@$%^&*'_"; @@ -109,6 +110,7 @@ private void setupStrings() { validHostAddress = getValue(Property.VALID_HOST_ADDRESS); validFingerprintId = getValue(Property.VALID_FINGERPRINT_ID); validYubicoToken = getValue(Property.VALID_YUBICO_TOKEN); + validIp = getValue(Property.VALID_IP); assumeTest = Boolean.valueOf(getValue(Property.ASSUME_TEST)); } @@ -329,7 +331,7 @@ public void testValidateOathOTPWithInvalidCode() throws Exception { } @Test - public void testValidatePasswordWithValidCredentials() throws Exception { + public void testValidatePasswordWithValidCredentialsWithoutIp() throws Exception { /* * Response would return: * { @@ -344,6 +346,21 @@ public void testValidatePasswordWithValidCredentials() throws Exception { assertTrue(response.getMessage().isEmpty()); } + @Test + public void testValidatePasswordWithValidCredentials() throws Exception { + /* + * Response would return: + * { + * "status" : "valid", + * "message" : "" + * } + */ + BaseResponse response = saAccess.validateUserPassword(validUsername, validPassword, validIp); + assertNotNull(response); + assertEquals(VALID_MESSAGE, response.getStatus()); + assertTrue(response.getMessage().isEmpty()); + } + @Test public void testValidatePasswordWithInvalidPassword() throws Exception { /* diff --git a/src/test/java/org/secureauth/sarestapi/util/Property.java b/src/test/java/org/secureauth/sarestapi/util/Property.java index a731839..1536580 100644 --- a/src/test/java/org/secureauth/sarestapi/util/Property.java +++ b/src/test/java/org/secureauth/sarestapi/util/Property.java @@ -19,6 +19,7 @@ public enum Property { VALID_HOST_ADDRESS("valid.host.address"), VALID_FINGERPRINT_ID("valid.fingerprint.id"), VALID_YUBICO_TOKEN("valid.yubico.token"), + VALID_IP("user.ip"), ASSUME_TEST("assume.test"); private final String value;