int count = failures + 1;
if (count >= this.maxNumberOfAuthenticationFailures)
{
try
{
RequestContext rc = SecurityHelper.getRequestContext(actionRequest);
User user = userManager.getUser(userBean.getUsername());
PasswordCredential pwc = userManager.getPasswordCredential(user);
pwc.setEnabled(false);
userManager.storePasswordCredential(pwc);
SecurityHelper.updateCredentialInSession(rc, pwc);
userBean.setUser(user);
userAttributes = userBean.getUser().getSecurityAttributes().getAttributeMap();
user.getSecurityAttributes().getAttribute("user.question.failures", true).setStringValue("0");
userManager.updateUser(user);
audit.logUserActivity(userBean.getUsername(),
rc.getRequest().getRemoteAddr(),
AuditActivity.USER_DISABLE, "Failed question and answer limit reached");
}
catch (Exception e)
{
}
StatusMessage msg = new StatusMessage("Disabling user after too many failed questions.", StatusMessage.ERROR);
PortletMessaging.publish(actionRequest, STATUS_MESSAGE, msg);
setView(actionRequest, phase, FAILURE2);
}
else
{
try
{
userBean.getUser().getSecurityAttributes().getAttribute("user.question.failures", true).setStringValue(Integer.toString(count));
userManager.updateUser(userBean.getUser());
}
catch (SecurityException e)
{}
StatusMessage msg = new StatusMessage("Invalid answer to question.", StatusMessage.ERROR);
PortletMessaging.publish(actionRequest, STATUS_MESSAGE, msg);
setView(actionRequest, phase, FAILURE1);
}
}
else
{
try
{
userBean.setPassPhrase(getUserAttribute(userAttributes, "user.passphrase", ""));
userBean.getUser().getSecurityAttributes().getAttribute("user.question.failures", true).setStringValue("0");
userManager.updateUser(userBean.getUser());
}
catch (Exception e)
{}
setView(actionRequest, phase, SUCCESS1);
}
}
}
else if (phase.equals("enroll"))
{
boolean success = false;
String password = userBean.getPassword();
User user = userBean.getUser();
if (user != null && password != null)
{
AuthenticatedUser authUser = null;
try
{
authUser = authorization.authenticate(userBean.getUsername(), password);
}
catch (SecurityException e)
{
RequestContext rc = SecurityHelper.getRequestContext(actionRequest);
audit.logUserActivity(userBean.getUsername(), rc.getRequest().getRemoteAddr(),
AuditActivity.AUTHENTICATION_FAILURE, "PortalFilter");
}
if (authUser != null)
{
// validate request parameers, if valid update user preferences
String question1 = actionRequest.getParameter("question1");
String question2 = actionRequest.getParameter("question2");
String question3 = actionRequest.getParameter("question3");
String answer1 = actionRequest.getParameter("answer1");
String answer2 = actionRequest.getParameter("answer2");
String answer3 = actionRequest.getParameter("answer3");
String passPhrase = actionRequest.getParameter("passphrase");
// validation (SecurityHelper.isEmpty, unique questions)
if (SecurityHelper.isEmpty(answer1) || SecurityHelper.isEmpty(answer2) || SecurityHelper.isEmpty(answer3))
{
StatusMessage msg = new StatusMessage("Please enter a valid answer for all 3 questions.", StatusMessage.ERROR);
PortletMessaging.publish(actionRequest, STATUS_MESSAGE, msg);
setView(actionRequest, phase, FAILURE1);
return;
}
if (SecurityHelper.isEmpty(passPhrase))
{
StatusMessage msg = new StatusMessage("Please enter a valid pass phrase.", StatusMessage.ERROR);
PortletMessaging.publish(actionRequest, STATUS_MESSAGE, msg);
setView(actionRequest, phase, FAILURE1);
return;
}
if (question1.equals(question2) || question1.equals(question3) || question2.equals(question3))
{
StatusMessage msg = new StatusMessage("Please select a unique question in all cases.", StatusMessage.ERROR);
PortletMessaging.publish(actionRequest, STATUS_MESSAGE, msg);
setView(actionRequest, phase, FAILURE1);
return;
}
// update the prefs db (we are not logged in yet
user = userBean.getUser();
try
{
user.getSecurityAttributes().getAttribute("user.question.1", true).setStringValue(question1);
user.getSecurityAttributes().getAttribute("user.question.2", true).setStringValue(question2);
user.getSecurityAttributes().getAttribute("user.question.3", true).setStringValue(question3);
user.getSecurityAttributes().getAttribute("user.answer.1", true).setStringValue(answer1);
user.getSecurityAttributes().getAttribute("user.answer.2", true).setStringValue(answer2);
user.getSecurityAttributes().getAttribute("user.answer.3", true).setStringValue(answer3);
user.getSecurityAttributes().getAttribute("user.passphrase", true).setStringValue(passPhrase);
user.getSecurityAttributes().getAttribute("user.cookie", true).setStringValue(CaptchaImageResource.randomString(8, 16));
userManager.updateUser(user);
success = true;
}
catch (SecurityException e)
{
success = false;
RequestContext rc = SecurityHelper.getRequestContext(actionRequest);
audit.logUserActivity(userBean.getUsername(), rc.getRequest().getRemoteAddr(), AuditActivity.AUTHENTICATION_FAILURE, "Exception updating attributes" );
setView(actionRequest, phase, FAILURE2);
}
if (success)
{
String username = userBean.getUsername();
String redirect = actionRequest.getParameter("redirect");
RequestContext rc = SecurityHelper.getRequestContext(actionRequest);
audit.logUserActivity(username, rc.getRequest().getRemoteAddr(),
LOGIN_ENROLL_ACTIVITY, "enrolling user with questions and passphrase");
redirect(actionRequest, actionResponse, redirect, username, password);
}
}
}
if (success == false)
{
RequestContext rc = SecurityHelper.getRequestContext(actionRequest);
audit.logUserActivity(userBean.getUsername(), rc.getRequest().getRemoteAddr(), AuditActivity.AUTHENTICATION_FAILURE, "Unauthorized Attribute Modification Attempt.");
setView(actionRequest, phase, FAILURE2);
}
}
else if (phase.equals("enroll-login"))
{
String username = userBean.getUsername();
String password = actionRequest.getParameter(LoginConstants.PASSWORD);
if (SecurityHelper.isEmpty(password))
{
RequestContext rc = SecurityHelper.getRequestContext(actionRequest);
rc.setSessionAttribute(MFALogin.ERRORCODE, LoginConstants.ERROR_INVALID_PASSWORD);
setView(actionRequest, phase, FAILURE1);
return;
}
// are we in the enrollment phase?
if (SecurityHelper.isEmpty(userBean.getPassPhrase()))
{
AuthenticatedUser authUser = null;
boolean authenticated = false;
try
{
authUser = authorization.authenticate(username, password);
authenticated = true;
}
catch (SecurityException e)
{}
if (authenticated)
{
userBean.setPassword(password);
setView(actionRequest, phase, SUCCESS1);
clearLoginMessages(actionRequest);
}
else
{
failedLoginProcessing(actionRequest, phase, username, userBean);
}
}
}
else if (phase.equals("three"))
{
String redirect = actionRequest.getParameter("redirect");
String username = userBean.getUsername();
String password = actionRequest.getParameter(LoginConstants.PASSWORD);
if (SecurityHelper.isEmpty(password) || SecurityHelper.isEmpty(redirect))
{
RequestContext rc = SecurityHelper.getRequestContext(actionRequest);
rc.setSessionAttribute(MFALogin.ERRORCODE, LoginConstants.ERROR_INVALID_PASSWORD);
setView(actionRequest, phase, FAILURE1);
return;
}
// process authentication
AuthenticatedUser authUser = null;