} catch (IOException e) {
LOG.error("Error while parsing JSON", e);
throw new WebApplicationException(e, BAD_REQUEST);
}
final User user = userService.load(username);
if (user == null) {
return status(NOT_FOUND).build();
}
if (!getSubject().isPermitted(RestPermissions.USERS_PASSWORDCHANGE + ":" + user.getName())) {
return status(FORBIDDEN).build();
}
if (user.isExternalUser()) {
LOG.error("Cannot change password for LDAP user.");
return status(FORBIDDEN).build();
}
boolean checkOldPassword = true;
// users with the wildcard permission for password change do not have to supply the old password, unless they try to change their own password.
// the rationale is to prevent accidental or malicious change of admin passwords (e.g. to prevent locking out legitimate admins)
if (getSubject().isPermitted(RestPermissions.USERS_PASSWORDCHANGE + ":*")) {
if (username.equals(getSubject().getPrincipal())) {
LOG.debug("User {} is allowed to change the password of any user, but attempts to change own password. Must supply the old password.", getSubject().getPrincipal());
checkOldPassword = true;
} else {
LOG.debug("User {} is allowed to change the password for any user, including {}, ignoring old password", getSubject().getPrincipal(), username);
checkOldPassword = false;
}
}
boolean changeAllowed = false;
final String secret = configuration.getPasswordSecret();
if (checkOldPassword) {
if (cr.old_password == null) {
LOG.info("Changing password for user {} must supply the old password.", username);
return status(BAD_REQUEST).build();
}
if (user.isUserPassword(cr.old_password, secret)) {
changeAllowed = true;
}
} else {
changeAllowed = true;
}
if (changeAllowed) {
user.setPassword(cr.password, secret);
try {
userService.save(user);
} catch (ValidationException e) {
throw new BadRequestException("Validation error for " + username, e);
}