Package sk.iway.iwcm.common

Class LogonTools

java.lang.Object
sk.iway.iwcm.common.LogonTools
public class LogonTools extends Object

  • Constructor Summary

    Constructors
    Modifier
    Constructor
    Description
    protected
    LogonTools()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    static void
    afterLogon(Identity user, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)
     
    static void
    auditLogon(List<String> errors, Identity user, String username, jakarta.servlet.http.HttpServletRequest request)
     
    static boolean
    checkAllowLoginDates(ResultSet rs)
    Skontroluje ci sa moze pouzivatel prihlasit vzhladom na zadane datumy mozneho prihlasenia
    static int
    checkForAlarm(Identity user)
     
    static void
    disableAllAdminItems(int userId)
    For admin created for example by oauth2 you need to disable all admin items because perms will be mapped by perm groups
    static void
    invalidateSessionOnFirstPost(jakarta.servlet.http.HttpServletRequest request)
    Ochrana Session Fixation (MFSR pentesty) ktora zabezpeci pri PRVOM odoslani (POST) logon formularu invalidnutie session
    static boolean
    isLoginBlocked(jakarta.servlet.http.HttpServletRequest request)
    Test if login is not time/IP blocked
    static boolean
    isPasswordCorrect(String password, String salt, String passwordInDb)
    Verify if given password is correct including support for old Rijndael encryption
    static String
    logon(String username, String password, Identity user, Map<String,String> errors, jakarta.servlet.http.HttpServletRequest request, Prop prop)
    Description of the Method
    static List<String>
    logonUser(jakarta.servlet.http.HttpServletRequest request, String username, String password)
     
    static List<String>
    logonUserWithAllChecks(jakarta.servlet.http.HttpServletRequest request, String username, String password)
     
    static void
    logonUserWithAllChecks(Identity identity, jakarta.servlet.http.HttpServletRequest request)
    Load user perms, set user to session and spring context.
    static void
    saveAfterLogonRedirect(jakarta.servlet.http.HttpServletRequest request)
    Ulozi URL pred zobrazenim logon formu na ktoru sa po prihlaseni presmeruje
    static void
    setLoginBlocked(jakarta.servlet.http.HttpServletRequest request)
    Cache info about bad credentials/login to block for 10 seconds
    static void
    setUserPerms(Identity user)
    Nastavi userovi prava na adresare (editable groups a pages)
    static org.springframework.security.core.Authentication
    setUserToSession(jakarta.servlet.http.HttpSession session, Identity user)
    Nastavi usera do session a nastavi spring prava
    static void
    updateLastLogin(int userId)
    Update last_logon field in database to current date time

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • LogonTools

      protected LogonTools()

  • Method Details

    • checkAllowLoginDates

      public static boolean checkAllowLoginDates(ResultSet rs)
      Skontroluje ci sa moze pouzivatel prihlasit vzhladom na zadane datumy mozneho prihlasenia
      Parameters:
      rs -
      Returns:

    • logon

      public static String logon(String username, String password, Identity user, Map<String,String> errors, jakarta.servlet.http.HttpServletRequest request, Prop prop)
      Description of the Method
      Parameters:
      username - Description of the Parameter
      password - Description of the Parameter
      user - Description of the Parameter
      errors - Description of the Parameter
      request - Description of the Parameter
      Returns:
      Description of the Return Value

    • setUserPerms

      public static void setUserPerms(Identity user)
      Nastavi userovi prava na adresare (editable groups a pages)
      Parameters:
      user -

    • auditLogon

      public static void auditLogon(List<String> errors, Identity user, String username, jakarta.servlet.http.HttpServletRequest request)

    • logonUser

      public static List<String> logonUser(jakarta.servlet.http.HttpServletRequest request, String username, String password)

    • logonUserWithAllChecks

      public static List<String> logonUserWithAllChecks(jakarta.servlet.http.HttpServletRequest request, String username, String password)

    • logonUserWithAllChecks

      public static void logonUserWithAllChecks(Identity identity, jakarta.servlet.http.HttpServletRequest request)
      Load user perms, set user to session and spring context. You should call this method when you get Identity from custom logon method such as OAuth2 or PassKey or another provider.
      Parameters:
      identity -
      request -

    • afterLogon

      public static void afterLogon(Identity user, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)

    • checkForAlarm

      public static int checkForAlarm(Identity user)

    • invalidateSessionOnFirstPost

      public static void invalidateSessionOnFirstPost(jakarta.servlet.http.HttpServletRequest request)
      Ochrana Session Fixation (MFSR pentesty) ktora zabezpeci pri PRVOM odoslani (POST) logon formularu invalidnutie session
      Parameters:
      request -

    • saveAfterLogonRedirect

      public static void saveAfterLogonRedirect(jakarta.servlet.http.HttpServletRequest request)
      Ulozi URL pred zobrazenim logon formu na ktoru sa po prihlaseni presmeruje
      Parameters:
      request -

    • setUserToSession

      public static org.springframework.security.core.Authentication setUserToSession(jakarta.servlet.http.HttpSession session, Identity user)
      Nastavi usera do session a nastavi spring prava
      Parameters:
      session -
      user -

    • isLoginBlocked

      public static boolean isLoginBlocked(jakarta.servlet.http.HttpServletRequest request)
      Test if login is not time/IP blocked
      Parameters:
      request -
      Returns:

    • setLoginBlocked

      public static void setLoginBlocked(jakarta.servlet.http.HttpServletRequest request)
      Cache info about bad credentials/login to block for 10 seconds
      Parameters:
      request -

    • isPasswordCorrect

      public static boolean isPasswordCorrect(String password, String salt, String passwordInDb)
      Verify if given password is correct including support for old Rijndael encryption
      Parameters:
      password -
      salt -
      passwordInDb -
      Returns:

    • disableAllAdminItems

      public static void disableAllAdminItems(int userId)
      For admin created for example by oauth2 you need to disable all admin items because perms will be mapped by perm groups
      Parameters:
      userId -

    • updateLastLogin

      public static void updateLastLogin(int userId)
      Update last_logon field in database to current date time
      Parameters:
      userId -