Please use the following link to reset your password:
") - val emailContent = EmailContent( - from = emailFrom, - to = List(u.getEmail), - bcc = bccEmail.toList, - subject = passwordResetEmailSubject + " - " + u.username, - textContent = textContent, - htmlContent = htmlContent - ) - sendHtmlEmail(emailContent) match { - case Full(messageId) => - logger.debug(s"Password reset email sent successfully with Message-ID: $messageId") - S.notice("Password reset email sent successfully. Please check your email.") - S.redirectTo(homePage) - case Empty => - logger.error("Failed to send password reset email") - S.error("Failed to send password reset email. Please try again.") - S.redirectTo(homePage) - } - case u => - sendValidationEmail(u) - } + // sendPasswordReset removed - legacy Lift method, replaced by API endpoint /obp/v6.0.0/users/password-reset-url + override def sendPasswordReset(name: String) = { + // No-op: Password reset now handled via RESTful API endpoints } // lostPasswordXhtml simplified - API-only mode, no portal pages @@ -790,7 +765,7 @@ import net.liftweb.util.Helpers._ case Full(user) if (user.getProvider() == Constant.localIdentityProvider) => if (!user.validated_?) { logger.info(s"getResourceUserId says: user not validated, username: $username, provider: $provider") - Empty + Full(userEmailNotValidatedStateCode) } else if (LoginAttempt.userIsLocked(user.getProvider(), username)) { logger.info(s"getResourceUserId says: user is locked, username: $username, provider: $provider") @@ -929,224 +904,6 @@ def restoreSomeSessions(): Unit = { Nil } - - //overridden to allow a redirection if login fails - /** - * Success cases: - * case1: user validated && user not locked && user.provider from localhost && password correct --> Login in - * case2: user validated && user not locked && user.provider not localhost && password correct --> Login in - * case3: user from remote && checked over connector --> Login in - * - * Error cases: - * case1: user is locked --> UsernameHasBeenLocked - * case2: user.validated_? --> account.validation.error - * case3: right username but wrong password --> Invalid Login Credentials - * case4: wrong username --> Invalid Login Credentials - * case5: UnKnow error --> UnexpectedErrorDuringLogin - */ - override def login: NodeSeq = { - // This query parameter is specific to ORY Hydra login request - val loginChallenge: Box[String] = ObpS.param("login_challenge").or(S.getSessionAttribute("login_challenge")) - def redirectUri(user: Box[ResourceUser]): String = { - val userId = user.map(_.userId).getOrElse("") - val hashedAgreementTextOfUser = - UserAgreementProvider.userAgreementProvider.vend.getLastUserAgreement(userId, "terms_and_conditions") - .map(_.agreementHash).getOrElse(HashUtil.Sha256Hash("not set")) - val agreementText = getWebUiPropsValue("webui_terms_and_conditions", "not set") - val hashedAgreementText = HashUtil.Sha256Hash(agreementText) - if(hashedAgreementTextOfUser == hashedAgreementText) { // Check terms and conditions - val hashedAgreementTextOfUser = - UserAgreementProvider.userAgreementProvider.vend.getLastUserAgreement(userId, "privacy_conditions") - .map(_.agreementHash).getOrElse(HashUtil.Sha256Hash("not set")) - val agreementText = getWebUiPropsValue("webui_privacy_policy", "not set") - val hashedAgreementText = HashUtil.Sha256Hash(agreementText) - if(hashedAgreementTextOfUser == hashedAgreementText) { // Check privacy policy - loginRedirect.get match { - case Full(url) => - loginRedirect(Empty) - url - case _ => - homePage - } - } else { - "/privacy-policy" - } - } else { - "/terms-and-conditions" - } - - } - //Check the internal redirect, in case for open redirect issue. - // variable redirect is from loginRedirect, it is set-up in OAuthAuthorisation.scala as following code: - // val currentUrl = ObpS.uriAndQueryString.getOrElse("/") - // AuthUser.loginRedirect.set(Full(Helpers.appendParams(currentUrl, List((LogUserOutParam, "false"))))) - def checkInternalRedirectAndLogUserIn(preLoginState: () => Unit, redirect: String, user: AuthUser) = { - if (Helper.isValidInternalRedirectUrl(redirect)) { - logUserIn(user, () => { - S.notice(S.?("logged.in")) - preLoginState() - if(emailDomainToSpaceMappings.nonEmpty){ - Future{ - tryo{AuthUser.grantEntitlementsToUseDynamicEndpointsInSpaces(user)} - .openOr(logger.error(s"${user} checkInternalRedirectAndLogUserIn.grantEntitlementsToUseDynamicEndpointsInSpaces throw exception! ")) - }} - if(emailDomainToEntitlementMappings.nonEmpty){ - Future{ - tryo{AuthUser.grantEmailDomainEntitlementsToUser(user)} - .openOr(logger.error(s"${user} checkInternalRedirectAndLogUserIn.grantEmailDomainEntitlementsToUser throw exception! ")) - }} - // We use Hydra as an Headless Identity Provider which implies OBP-API must provide User Management. - // If there is the query parameter login_challenge in a url we know it is tha Hydra request - // TODO Write standalone application for Login and Consent Request of Hydra as Identity Provider - integrateWithHydra match { - case true => - if (loginChallenge.isEmpty == false) { - val acceptLoginRequest = new AcceptLoginRequest - val adminApi: AdminApi = new AdminApi - acceptLoginRequest.setSubject(user.username.get) - val result = adminApi.acceptLoginRequest(loginChallenge.getOrElse(""), acceptLoginRequest) - S.redirectTo(result.getRedirectTo) - } else { - S.redirectTo(redirect) - } - case false => - S.redirectTo(redirect) - } - }) - } else { - S.error(S.?(ErrorMessages.InvalidInternalRedirectUrl)) - logger.info(ErrorMessages.InvalidInternalRedirectUrl + loginRedirect.get) - } - } - - def isObpProvider(user: AuthUser) = { - // TODO Consider does http://host should match https://host in development mode - user.getProvider() == Constant.localIdentityProvider - } - - def obpUserIsValidatedAndNotLocked(usernameFromGui: String, user: AuthUser) = { - user.validated_? && !LoginAttempt.userIsLocked(user.getProvider(), usernameFromGui) && - isObpProvider(user) - } - - def externalUserIsValidatedAndNotLocked(usernameFromGui: String, user: AuthUser) = { - user.validated_? && !LoginAttempt.userIsLocked(user.getProvider(), usernameFromGui) && - !isObpProvider(user) - } - - def loginAction = { - if (S.post_?) { - val usernameFromGui = ObpS.param("username").getOrElse("") - val passwordFromGui = ObpS.param("password").getOrElse("") - val usernameEmptyField = ObpS.param("username").map(_.isEmpty()).getOrElse(true) - val passwordEmptyField = ObpS.param("password").map(_.isEmpty()).getOrElse(true) - val emptyField = usernameEmptyField || passwordEmptyField - emptyField match { - case true => - if(usernameEmptyField) - S.error("login-form-username-error", Helper.i18n("please.enter.your.username")) - if(passwordEmptyField) - S.error("login-form-password-error", Helper.i18n("please.enter.your.password")) - case false => - findAuthUserByUsernameLocallyLegacy(usernameFromGui) match { - case Full(user) if !user.validated_? => - S.error(S.?("account.validation.error")) - - // Check if user comes from localhost and - case Full(user) if obpUserIsValidatedAndNotLocked(usernameFromGui, user) => - if(user.testPassword(Full(passwordFromGui))) { // if User is NOT locked and password is good - // Reset any bad attempt - LoginAttempt.resetBadLoginAttempts(user.getProvider(), usernameFromGui) - val preLoginState = capturePreLoginState() - // User init actions - AfterApiAuth.innerLoginUserInitAction(Full(user)) - logger.info("login redirect: " + loginRedirect.get) - val redirect = redirectUri(user.user.foreign) - checkInternalRedirectAndLogUserIn(preLoginState, redirect, user) - } else { // If user is NOT locked AND password is wrong => increment bad login attempt counter. - LoginAttempt.incrementBadLoginAttempts(user.getProvider(),usernameFromGui) - S.error(Helper.i18n("invalid.login.credentials")) - } - - // If user is locked, send the error to GUI - case Full(user) if LoginAttempt.userIsLocked(user.getProvider(), usernameFromGui) => - LoginAttempt.incrementBadLoginAttempts(user.getProvider(),usernameFromGui) - S.error(S.?(ErrorMessages.UsernameHasBeenLocked)) - loginRedirect(ObpS.param("Referer").or(S.param("Referer"))) - - // Check if user came from CBS and - // if User is NOT locked. Then check username and password - // from connector in case they changed on the south-side - case Full(user) if externalUserIsValidatedAndNotLocked(usernameFromGui, user) && testExternalPassword(usernameFromGui, passwordFromGui) => - // Reset any bad attempts - LoginAttempt.resetBadLoginAttempts(user.getProvider(), usernameFromGui) - val preLoginState = capturePreLoginState() - logger.info("login redirect: " + loginRedirect.get) - val redirect = redirectUri(user.user.foreign) - //This method is used for connector = cbs* || obpjvm* - //It will update the views and createAccountHolder .... - registeredUserHelper(user.getProvider(),user.username.get) - // User init actions - AfterApiAuth.innerLoginUserInitAction(Full(user)) - checkInternalRedirectAndLogUserIn(preLoginState, redirect, user) - - - // Error case: - // the username exist but provider cannot be matched - // It can happen via next scenario: - // - sign up user at some obp-api cluster - // - change a url of the cluster - // - try to log on user at the cluster - case Full(user) if !isObpProvider(user) => - S.error(S.?(s"${ErrorMessages.InvalidProviderUrl} Actual: ${Constant.localIdentityProvider}, Expected: ${user.provider}")) - - - // If user cannot be found locally, try to authenticate user via connector - case Empty if (APIUtil.getPropsAsBoolValue("connector.user.authentication", false)) => - - val preLoginState = capturePreLoginState() - logger.info("login redirect: " + loginRedirect.get) - val redirect = redirectUri(user.foreign) - externalUserHelper(usernameFromGui, passwordFromGui) match { - case Full(user: AuthUser) => - LoginAttempt.resetBadLoginAttempts(user.getProvider(), usernameFromGui) - // User init actions - AfterApiAuth.innerLoginUserInitAction(Full(user)) - checkInternalRedirectAndLogUserIn(preLoginState, redirect, user) - case _ => - LoginAttempt.incrementBadLoginAttempts(user.foreign.map(_.provider).getOrElse(Constant.HostName), username.get) - Empty - S.error(Helper.i18n("invalid.login.credentials")) - } - - //If there is NO the username, throw the error message. - case Empty => - S.error(Helper.i18n("invalid.login.credentials")) - case unhandledCase => - logger.error("------------------------------------------------------") - logger.error(s"username from GUI: $usernameFromGui") - logger.error("An unexpected login error occurred:") - logger.error(unhandledCase) - logger.error("------------------------------------------------------") - LoginAttempt.incrementBadLoginAttempts(user.foreign.map(_.provider).getOrElse(Constant.HostName), usernameFromGui) - S.error(S.?(ErrorMessages.UnexpectedErrorDuringLogin)) // Note we hit this if user has not clicked email validation link - } - } - } - } - - // In this function we bind submit button to loginAction function. - // In case that unique token of submit button cannot be paired submit action will be omitted. - // Implemented in order to prevent a CSRF attack - def insertSubmitButton = { - scala.xml.XML.loadString(loginSubmitButton(loginButtonText, loginAction _).toString().replace("type=\"submit\"","class=\"submit\" type=\"submit\"")) - } - - val bind = - "submit" #> insertSubmitButton - bind(loginXhtml) - } - override def logout = { logoutCurrentUser S.request match { @@ -1157,9 +914,7 @@ def restoreSomeSessions(): Unit = { case _ => S.redirectTo(homePage) } } - - - /** + /** * The user authentications is not exciting in obp side, it need get the user via connector */ def testExternalPassword(usernameFromGui: String, passwordFromGui: String): Boolean = { @@ -1473,41 +1228,21 @@ def restoreSomeSessions(): Unit = { │FIND A USER │ │AT MAPPER DB│ └──────┬─────┘ - ___________▽___________ ┌────────────────────────┐ - ╱ props: ╲ │FIND USER BY COMPOSITE │ - ╱ local_identity_provider ╲______________________│KEY (username, │ - ╲ ╱yes │local_identity_provider)│ - ╲_______________________╱ └────────────┬───────────┘ - │no │ - ___▽____ ┌────────────────────────┐ │ - ╱ props: ╲ │FIND USER BY COMPOSITE │ │ - ╱ hostname ╲___│KEY (username, hostname)│ │ - ╲ ╱yes└────────────┬───────────┘ │ - ╲________╱ │ │ - │no │ │ - ┌──▽──┐ │ │ - │ERROR│ │ │ - └─────┘ │ │ - └──────┬──────────────────┘ - ┌────▽────┐ - │BOX[USER]│ - └─────────┘ + │ + │ Find by composite key: + │ (username, provider) + │ + │ provider = parameter value + │ + ┌──▽──────────────────────┐ + │FIND USER BY COMPOSITE │ + │KEY (username, provider) │ + └──────┬──────────────────┘ + │ + ┌────▽────┐ + │BOX[USER]│ + └─────────┘ */ - /** - * Find the Auth User by the composite key (username, provider). - * Only search at the local database. - * Please note that provider is implicitly defined i.e. not provided via a parameter - */ - @deprecated("AuthUser unique key is username and provider, please use @findAuthUserByUsernameAndProvider instead.","06.06.2024") - def findAuthUserByUsernameLocallyLegacy(name: String): Box[TheUserType] = { - // 1st try is provider with local_identity_provider or hostname value - find(By(this.username, name), By(this.provider, Constant.localIdentityProvider)) - // 2nd try is provider with null value - .or(find(By(this.username, name), NullRef(this.provider))) - // 3rd try is provider with empty string value - .or(find(By(this.username, name), By(this.provider, ""))) - } - def findAuthUserByUsernameAndProvider(name: String, provider: String): Box[TheUserType] = { find(By(this.username, name), By(this.provider, provider)) } diff --git a/obp-api/src/test/scala/code/api/DirectLoginTest.scala b/obp-api/src/test/scala/code/api/DirectLoginTest.scala index 2cb1c92c3b..6546a99d7c 100644 --- a/obp-api/src/test/scala/code/api/DirectLoginTest.scala +++ b/obp-api/src/test/scala/code/api/DirectLoginTest.scala @@ -450,6 +450,37 @@ class DirectLoginTest extends ServerSetup with BeforeAndAfter { responseCurrentUserOldStyle.body.extract[ErrorMessage].message should include(ErrorMessages.UsernameHasBeenLocked) } + scenario("Login with correct credentials but user email is not validated", ApiEndpoint1, ApiEndpoint2) { + lazy val username = "unvalidated.user" + lazy val email = randomString(10).toLowerCase + "@example.com" + lazy val header = ("DirectLogin", "username=%s, password=%s, consumer_key=%s". + format(username, VALID_PW, KEY)) + + Given("A user exists but email is not validated") + // Delete the user if exists + AuthUser.findAll(By(AuthUser.username, username)).map(_.delete_!()) + // Create the user with validated = false + AuthUser.create. + email(email). + username(username). + password(VALID_PW). + validated(false). + firstName(randomString(10)). + lastName(randomString(10)). + saveMe + + When("we try to login with correct credentials but unvalidated email") + lazy val request = directLoginRequest + lazy val response = makePostRequestAdditionalHeader(request, "", List(accessControlOriginHeader, header)) + + Then("We should get a 401 - Unauthorized") + response.code should equal(401) + assertResponse(response, ErrorMessages.UserEmailNotValidated) + + // Clean up: delete the test user + AuthUser.findAll(By(AuthUser.username, username)).map(_.delete_!()) + } + scenario("Test the last issued token is valid as well as a previous one", ApiEndpoint2) { diff --git a/obp-api/src/test/scala/code/api/v6_0_0/VerifyUserCredentialsTest.scala b/obp-api/src/test/scala/code/api/v6_0_0/VerifyUserCredentialsTest.scala index 643184ba41..bb5ad4d290 100644 --- a/obp-api/src/test/scala/code/api/v6_0_0/VerifyUserCredentialsTest.scala +++ b/obp-api/src/test/scala/code/api/v6_0_0/VerifyUserCredentialsTest.scala @@ -612,5 +612,172 @@ class VerifyUserCredentialsTest extends V600ServerSetup with DefaultUsers { response.body.extract[ErrorMessage].message should include("OBP-10001") } + scenario("Successfully verify credentials with URL-encoded local provider", ApiEndpoint, VersionOfApi) { + // Test that URL-encoded local provider strings are correctly decoded + // The local provider constant might be URL-encoded in some scenarios + val urlEncodedLocalProvider = java.net.URLEncoder.encode(Constant.localIdentityProvider, "UTF-8") + val username = "encoded_local_test_" + randomString(8).toLowerCase + val password = "TestPassword123!" + val email = username + "@example.com" + + // Create a local user + val testUser = AuthUser.create + .email(email) + .username(username) + .password(password) + .validated(true) + .firstName("Test") + .lastName("EncodedLocal") + .provider(Constant.localIdentityProvider) + .saveMe() + + val addedEntitlement = Entitlement.entitlement.vend.addEntitlement("", resourceUser1.userId, CanVerifyUserCredentials.toString) + + try { + When("We verify credentials with URL-encoded local provider") + val postJson = Map( + "username" -> username, + "password" -> password, + "provider" -> urlEncodedLocalProvider // Send encoded version of local provider + ) + val request = (v6_0_0_Request / "users" / "verify-credentials").POST <@ (user1) + val response = makePostRequest(request, write(postJson)) + + Then("We should get a 200 because the local provider is decoded correctly") + response.code should equal(200) + + And("The response should contain user details with local provider") + (response.body \ "username").extract[String] should equal(username) + (response.body \ "provider").extract[String] should equal(Constant.localIdentityProvider) + } finally { + testUser.delete_! + Entitlement.entitlement.vend.deleteEntitlement(addedEntitlement) + } + } + + scenario("Successfully verify credentials with provider containing special characters", ApiEndpoint, VersionOfApi) { + // Test that the provider field correctly handles URL encoding/decoding + // In this test, we verify that empty provider (treated as local) works correctly + val username = "special_chars_test_" + randomString(8).toLowerCase + val password = "TestPassword123!" + val email = username + "@example.com" + + // Create a local user (empty provider is treated as local) + val testUser = AuthUser.create + .email(email) + .username(username) + .password(password) + .validated(true) + .firstName("Test") + .lastName("SpecialChars") + .provider(Constant.localIdentityProvider) + .saveMe() + + val addedEntitlement = Entitlement.entitlement.vend.addEntitlement("", resourceUser1.userId, CanVerifyUserCredentials.toString) + + try { + When("We verify credentials with empty provider (should be treated as local)") + val postJson = Map( + "username" -> username, + "password" -> password, + "provider" -> "" // Empty provider + ) + val request = (v6_0_0_Request / "users" / "verify-credentials").POST <@ (user1) + val response = makePostRequest(request, write(postJson)) + + Then("We should get a 200 because empty provider is treated as local") + response.code should equal(200) + + And("The response should contain user details") + (response.body \ "username").extract[String] should equal(username) + (response.body \ "provider").extract[String] should equal(Constant.localIdentityProvider) + } finally { + testUser.delete_! + Entitlement.entitlement.vend.deleteEntitlement(addedEntitlement) + } + } + + scenario("Verify credentials with non-encoded local provider should work", ApiEndpoint, VersionOfApi) { + // Test that non-encoded local provider (the normal case) still works correctly + val username = "non_encoded_test_" + randomString(8).toLowerCase + val password = "TestPassword123!" + val email = username + "@example.com" + + // Create a local user + val testUser = AuthUser.create + .email(email) + .username(username) + .password(password) + .validated(true) + .firstName("Test") + .lastName("NonEncoded") + .provider(Constant.localIdentityProvider) + .saveMe() + + val addedEntitlement = Entitlement.entitlement.vend.addEntitlement("", resourceUser1.userId, CanVerifyUserCredentials.toString) + + try { + When("We verify credentials with non-encoded local provider") + val postJson = Map( + "username" -> username, + "password" -> password, + "provider" -> Constant.localIdentityProvider // Send non-encoded local provider + ) + val request = (v6_0_0_Request / "users" / "verify-credentials").POST <@ (user1) + val response = makePostRequest(request, write(postJson)) + + Then("We should get a 200 because non-encoded local provider works normally") + response.code should equal(200) + + And("The response should contain user details") + (response.body \ "username").extract[String] should equal(username) + (response.body \ "provider").extract[String] should equal(Constant.localIdentityProvider) + } finally { + testUser.delete_! + Entitlement.entitlement.vend.deleteEntitlement(addedEntitlement) + } + } + + scenario("URL-encoded provider mismatch should fail with 401", ApiEndpoint, VersionOfApi) { + // Test that provider mismatch is detected even with URL encoding + // User has local provider, but request sends a different (encoded) provider + val wrongProvider = "https://github.com/login/oauth" + val urlEncodedWrongProvider = java.net.URLEncoder.encode(wrongProvider, "UTF-8") + val username = "encoded_mismatch_test_" + randomString(8).toLowerCase + val password = "TestPassword123!" + val email = username + "@example.com" + + // Create a local user + val testUser = AuthUser.create + .email(email) + .username(username) + .password(password) + .validated(true) + .firstName("Test") + .lastName("Mismatch") + .provider(Constant.localIdentityProvider) + .saveMe() + + val addedEntitlement = Entitlement.entitlement.vend.addEntitlement("", resourceUser1.userId, CanVerifyUserCredentials.toString) + + try { + When("We verify credentials with URL-encoded wrong provider") + val postJson = Map( + "username" -> username, + "password" -> password, + "provider" -> urlEncodedWrongProvider // Send encoded wrong provider + ) + val request = (v6_0_0_Request / "users" / "verify-credentials").POST <@ (user1) + val response = makePostRequest(request, write(postJson)) + + Then("We should get a 401 because this is treated as external provider auth (no connector)") + response.code should equal(401) + response.body.extract[ErrorMessage].message should include("OBP-20004") + } finally { + testUser.delete_! + Entitlement.entitlement.vend.deleteEntitlement(addedEntitlement) + } + } + } }