Package sk.iway.iwcm.common

Class LogonTools

java.lang.Object
sk.iway.iwcm.common.LogonTools
public class LogonTools extends Object

  • Constructor Summary

    Constructors
    Modifier
    Constructor
    Description
    protected
    LogonTools()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    static void
    afterLogon(Identity user, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)
    Deprecated, for removal: This API element is subject to removal in a future version.
    Scheduled for removal ú make it PRIVATE in WebJET CMS 2027.
    static void
    afterSuccessLogon(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)
    Runs post-login callbacks and browser recognition once for the current account and request.
    static void
    auditLogon(List<String> errors, Identity user, String username, jakarta.servlet.http.HttpServletRequest request)
     
    static boolean
    checkAllowLoginDates(ResultSet rs)
    Skontroluje ci sa moze pouzivatel prihlasit vzhladom na zadane datumy mozneho prihlasenia
    static int
    checkForAlarm(Identity user)
     
    static void
    clearUserFromSession(jakarta.servlet.http.HttpSession session)
    Removes both authentication contexts while a required login step is pending.
    static void
    disableAllAdminItems(int userId)
    For admin created for example by oauth2 you need to disable all admin items because perms will be mapped by perm groups
    static void
    invalidateSessionOnFirstPost(jakarta.servlet.http.HttpServletRequest request)
    Ochrana Session Fixation (MFSR pentesty) ktora zabezpeci pri PRVOM odoslani (POST) logon formularu invalidnutie session
    static boolean
    isLoginBlocked(jakarta.servlet.http.HttpServletRequest request)
    Test if login is not time/IP blocked
    static boolean
    isPasswordCorrect(String password, String salt, String passwordInDb)
    Verify if given password is correct including support for old Rijndael encryption
    static String
    logon(String username, String password, Identity user, Map<String,String> errors, jakarta.servlet.http.HttpServletRequest request, Prop prop)
    Description of the Method
    static List<String>
    logonUser(jakarta.servlet.http.HttpServletRequest request, String username, String password)
     
    static List<String>
    logonUserWithAllChecks(jakarta.servlet.http.HttpServletRequest request, String username, String password)
     
    static void
    logonUserWithAllChecks(Identity identity, jakarta.servlet.http.HttpServletRequest request)
    Load user perms, set user to session and spring context.
    static void
    saveAfterLogonRedirect(jakarta.servlet.http.HttpServletRequest request)
    Ulozi URL pred zobrazenim logon formu na ktoru sa po prihlaseni presmeruje
    static void
    setLoginBlocked(jakarta.servlet.http.HttpServletRequest request)
    Cache info about bad credentials/login to block for 10 seconds
    static void
    setUserPerms(Identity user)
    Nastavi userovi prava na adresare (editable groups a pages)
    static org.springframework.security.core.Authentication
    setUserToSession(jakarta.servlet.http.HttpSession session, Identity user)
    Nastavi usera do session a nastavi spring prava
    static void
    updateLastLogin(int userId)
    Update last_logon field in database to current date time

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • LogonTools

      protected LogonTools()

  • Method Details

    • checkAllowLoginDates

      public static boolean checkAllowLoginDates(ResultSet rs)
      Skontroluje ci sa moze pouzivatel prihlasit vzhladom na zadane datumy mozneho prihlasenia
      Parameters:
      rs -
      Returns:

    • logon

      public static String logon(String username, String password, Identity user, Map<String,String> errors, jakarta.servlet.http.HttpServletRequest request, Prop prop)
      Description of the Method
      Parameters:
      username - Description of the Parameter
      password - Description of the Parameter
      user - Description of the Parameter
      errors - Description of the Parameter
      request - Description of the Parameter
      Returns:
      Description of the Return Value

    • setUserPerms

      public static void setUserPerms(Identity user)
      Nastavi userovi prava na adresare (editable groups a pages)
      Parameters:
      user -

    • auditLogon

      public static void auditLogon(List<String> errors, Identity user, String username, jakarta.servlet.http.HttpServletRequest request)

    • logonUser

      public static List<String> logonUser(jakarta.servlet.http.HttpServletRequest request, String username, String password)

    • logonUserWithAllChecks

      public static List<String> logonUserWithAllChecks(jakarta.servlet.http.HttpServletRequest request, String username, String password)

    • logonUserWithAllChecks

      public static void logonUserWithAllChecks(Identity identity, jakarta.servlet.http.HttpServletRequest request)
      Load user perms, set user to session and spring context. You should call this method when you get Identity from custom logon method such as OAuth2 or PassKey or another provider.
      Parameters:
      identity -
      request -

    • afterSuccessLogon

      public static void afterSuccessLogon(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)
      Runs post-login callbacks and browser recognition once for the current account and request. Call after the session is established, password policy and all required authentication factors have succeeded, and before redirecting or forwarding. API token and HTTP Basic authentication must not call this browser-login hook.
      Parameters:
      request - completed authentication request containing the logged-in user's session
      response - response receiving login cookies

    • afterLogon

      @Deprecated(forRemoval=true) public static void afterLogon(Identity user, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)
      Deprecated, for removal: This API element is subject to removal in a future version.
      Scheduled for removal ú make it PRIVATE in WebJET CMS 2027. For completed browser logins, use afterSuccessLogon(HttpServletRequest, HttpServletResponse) after establishing the session and completing all required authentication steps. That method also runs login interceptors and browser recognition once per account and request.
      Invokes only the configured afterLogonMethod callback for legacy integrations. Uses the supplied identity independently of the session and preserves repeated callback calls.
      Parameters:
      user - identity passed to the configured callback
      request - login request passed to the configured callback
      response - login response passed to the configured callback

    • checkForAlarm

      public static int checkForAlarm(Identity user)

    • invalidateSessionOnFirstPost

      public static void invalidateSessionOnFirstPost(jakarta.servlet.http.HttpServletRequest request)
      Ochrana Session Fixation (MFSR pentesty) ktora zabezpeci pri PRVOM odoslani (POST) logon formularu invalidnutie session
      Parameters:
      request -

    • saveAfterLogonRedirect

      public static void saveAfterLogonRedirect(jakarta.servlet.http.HttpServletRequest request)
      Ulozi URL pred zobrazenim logon formu na ktoru sa po prihlaseni presmeruje
      Parameters:
      request -

    • setUserToSession

      public static org.springframework.security.core.Authentication setUserToSession(jakarta.servlet.http.HttpSession session, Identity user)
      Nastavi usera do session a nastavi spring prava
      Parameters:
      session -
      user -

    • clearUserFromSession

      public static void clearUserFromSession(jakarta.servlet.http.HttpSession session)
      Removes both authentication contexts while a required login step is pending.

    • isLoginBlocked

      public static boolean isLoginBlocked(jakarta.servlet.http.HttpServletRequest request)
      Test if login is not time/IP blocked
      Parameters:
      request -
      Returns:

    • setLoginBlocked

      public static void setLoginBlocked(jakarta.servlet.http.HttpServletRequest request)
      Cache info about bad credentials/login to block for 10 seconds
      Parameters:
      request -

    • isPasswordCorrect

      public static boolean isPasswordCorrect(String password, String salt, String passwordInDb)
      Verify if given password is correct including support for old Rijndael encryption
      Parameters:
      password -
      salt -
      passwordInDb -
      Returns:

    • disableAllAdminItems

      public static void disableAllAdminItems(int userId)
      For admin created for example by oauth2 you need to disable all admin items because perms will be mapped by perm groups
      Parameters:
      userId -

    • updateLastLogin

      public static void updateLastLogin(int userId)
      Update last_logon field in database to current date time
      Parameters:
      userId -