Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for passwordExpiryTime in user claims on request #856

Prev Previous commit
Next Next commit
Change the exception type and refactor
PasinduYeshan committed Dec 13, 2024
commit 0886166caaef954c16e3cfa9fe74312634353f5e
Original file line number Diff line number Diff line change
@@ -25,6 +25,7 @@
import org.wso2.carbon.identity.core.AbstractIdentityUserOperationEventListener;
import org.wso2.carbon.identity.core.util.IdentityCoreConstants;
import org.wso2.carbon.identity.password.expiry.constants.PasswordPolicyConstants;
import org.wso2.carbon.identity.password.expiry.exceptions.ExpiredPasswordIdentificationException;
import org.wso2.carbon.identity.password.expiry.models.PasswordExpiryRule;
import org.wso2.carbon.identity.password.expiry.util.PasswordPolicyUtils;
import org.wso2.carbon.user.core.UserStoreException;
@@ -51,7 +52,7 @@ public int getExecutionOrderId() {
if (orderId != IdentityCoreConstants.EVENT_LISTENER_ORDER_ID) {
return orderId;
}
return 99; // TODO: Check the order ID.
return 102;
}

@Override
@@ -62,17 +63,15 @@ public boolean doPostGetUserClaimValues(String username, String[] claims, String
if (!isEnable() || !Arrays.asList(claims).contains(PasswordPolicyConstants.PASSWORD_EXPIRY_TIME_CLAIM)) {
return true;
}
if (log.isDebugEnabled()) {
log.debug("post get user claim values with id is called in PasswordExpiryEventListener");
}
log.debug("post get user claim values with id is called in PasswordExpiryEventListener");

try {
String userTenantDomain = PrivilegedCarbonContext.getThreadLocalCarbonContext().getTenantDomain();
Optional<Long> passwordExpiryTime =
PasswordPolicyUtils.getUserPasswordExpiryTime(userTenantDomain, username);
passwordExpiryTime.ifPresent(expiryTime -> claimMap.put(PasswordPolicyConstants.PASSWORD_EXPIRY_TIME_CLAIM,
String.valueOf(expiryTime)));
} catch (PostAuthenticationFailedException e) {
} catch (ExpiredPasswordIdentificationException e) {
throw new UserStoreException("Error while retrieving password expiry time.", e);
}
return true;
@@ -85,9 +84,7 @@ public boolean doPostGetUsersClaimValues(String[] userNames, String[] claims, St
if (!isEnable() || !Arrays.asList(claims).contains(PasswordPolicyConstants.PASSWORD_EXPIRY_TIME_CLAIM)) {
return true;
}
if (log.isDebugEnabled()) {
log.debug("Method doPostGetUsersClaimValues getting executed in the IdentityStoreEventListener.");
}
log.debug("Method doPostGetUsersClaimValues getting executed in the PasswordExpiryEventListener.");

try {
String tenantDomain = PrivilegedCarbonContext.getThreadLocalCarbonContext().getTenantDomain();
@@ -110,7 +107,7 @@ public boolean doPostGetUsersClaimValues(String[] userNames, String[] claims, St
passwordExpiryTime.ifPresent(expiryTime -> userClaimSearchEntry.getClaims()
.put(PasswordPolicyConstants.PASSWORD_EXPIRY_TIME_CLAIM, String.valueOf(expiryTime)));
}
} catch (PostAuthenticationFailedException e) {
} catch (PostAuthenticationFailedException | ExpiredPasswordIdentificationException e) {
throw new UserStoreException("Error while retrieving password expiry time.", e);
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Check if these are logged.

}
return true;
Original file line number Diff line number Diff line change
@@ -48,10 +48,10 @@
import org.wso2.carbon.user.core.util.UserCoreUtil;
import org.wso2.carbon.utils.multitenancy.MultitenantConstants;
import org.wso2.carbon.user.core.common.Group;
import org.wso2.carbon.identity.password.expiry.exceptions.ExpiredPasswordIdentificationException;

import java.util.ArrayList;
import java.util.EnumMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Optional;
@@ -302,10 +302,10 @@ private static boolean isPasswordExpiredUnderDefaultPolicy(String tenantDomain,
* @param tenantDomain The tenant domain.
* @param tenantAwareUsername The tenant aware username.
* @return Optional containing the password expiry time in milliseconds, or empty if not applicable.
* @throws PostAuthenticationFailedException If an error occurred while getting the password expiry time.
* @throws ExpiredPasswordIdentificationException If an error occurred while getting the password expiry time.
*/
public static Optional<Long> getUserPasswordExpiryTime(String tenantDomain, String tenantAwareUsername)
throws PostAuthenticationFailedException {
throws ExpiredPasswordIdentificationException {

return getUserPasswordExpiryTime(tenantDomain, tenantAwareUsername, null,
null, null, null);
@@ -321,15 +321,15 @@ public static Optional<Long> getUserPasswordExpiryTime(String tenantDomain, Stri
* @param passwordExpiryRules Password expiry rules.
* @param defaultPasswordExpiryInDays Default password expiry in days.
* @return Optional containing the password expiry time in milliseconds, or empty if not applicable.
* @throws PostAuthenticationFailedException If an error occurred while getting the password expiry time.
* @throws ExpiredPasswordIdentificationException If an error occurred while getting the password expiry time.
*/
public static Optional<Long> getUserPasswordExpiryTime(String tenantDomain,
String tenantAwareUsername,
Boolean isPasswordExpiryEnabled,
Boolean isSkipIfNoApplicableRulesEnabled,
List<PasswordExpiryRule> passwordExpiryRules,
Integer defaultPasswordExpiryInDays)
throws PostAuthenticationFailedException {
throws ExpiredPasswordIdentificationException {

try {
if (isPasswordExpiryEnabled == null) {
@@ -397,8 +397,8 @@ public static Optional<Long> getUserPasswordExpiryTime(String tenantDomain,
}
return Optional.of(
lastPasswordUpdatedTimeInMillis + getDaysTimeInMillis(defaultPasswordExpiryInDays));
} catch (UserStoreException e) {
throw new PostAuthenticationFailedException(PasswordPolicyConstants.ErrorMessages.
} catch (UserStoreException | PostAuthenticationFailedException e) {
throw new ExpiredPasswordIdentificationException(PasswordPolicyConstants.ErrorMessages.
ERROR_WHILE_GETTING_USER_STORE_DOMAIN.getCode(),
PasswordPolicyConstants.ErrorMessages.ERROR_WHILE_GETTING_USER_STORE_DOMAIN.getMessage());
}
Original file line number Diff line number Diff line change
@@ -24,6 +24,7 @@
import org.wso2.carbon.identity.core.ServiceURLBuilder;
import org.wso2.carbon.identity.core.URLBuilderException;
import org.wso2.carbon.identity.password.expiry.constants.PasswordPolicyConstants;
import org.wso2.carbon.identity.password.expiry.exceptions.ExpiredPasswordIdentificationException;
import org.wso2.carbon.identity.password.expiry.internal.EnforcePasswordResetComponentDataHolder;
import org.wso2.carbon.identity.password.expiry.models.PasswordExpiryRuleAttributeEnum;
import org.wso2.carbon.identity.governance.bean.ConnectorConfig;
@@ -357,7 +358,7 @@ public Object[][] passwordExpiryTimeTestCases() {
@Test(dataProvider = "passwordExpiryTimeTestCases")
public void testGetUserPasswordExpiryTime(Integer daysAgo, String[] roles, String[] groups, Integer expiryDays,
String description)
throws IdentityGovernanceException, UserStoreException, PostAuthenticationFailedException,
throws IdentityGovernanceException, UserStoreException, ExpiredPasswordIdentificationException,
IdentityRoleManagementException {

when(IdentityTenantUtil.getTenantId(anyString())).thenReturn(3);
@@ -413,7 +414,7 @@ public void testGetUserPasswordExpiryTime(Integer daysAgo, String[] roles, Strin

@Test
public void testGetUserPasswordExpiryTime()
throws IdentityGovernanceException, UserStoreException, PostAuthenticationFailedException {
throws IdentityGovernanceException, UserStoreException, ExpiredPasswordIdentificationException {

// Case 1: Password expiry disabled.
Optional<Long> expiryTime = PasswordPolicyUtils.getUserPasswordExpiryTime(
@@ -460,7 +461,7 @@ public void testGetUserPasswordExpiryTime()
DEFAULT_EXPIRY_DAYS);
Assert.fail("Expected PostAuthenticationFailedException was not thrown");
} catch (Exception e) {
Assert.assertTrue(e instanceof PostAuthenticationFailedException);
Assert.assertTrue(e instanceof ExpiredPasswordIdentificationException);
}
}

Original file line number Diff line number Diff line change
@@ -19,8 +19,8 @@
package org.wso2.carbon.identity.password.expiry.listener;

import org.wso2.carbon.context.PrivilegedCarbonContext;
import org.wso2.carbon.identity.application.authentication.framework.exception.PostAuthenticationFailedException;
import org.wso2.carbon.identity.password.expiry.constants.PasswordPolicyConstants;
import org.wso2.carbon.identity.password.expiry.exceptions.ExpiredPasswordIdentificationException;
import org.wso2.carbon.identity.password.expiry.util.PasswordPolicyUtils;
import org.mockito.Mock;
import org.mockito.MockedStatic;
@@ -92,7 +92,7 @@ public void close() {
@Test
public void testGetExecutionOrderId() {

Assert.assertEquals(passwordExpiryEventListener.getExecutionOrderId(), 99); // TODO: Change the order id accordingly.
Assert.assertEquals(passwordExpiryEventListener.getExecutionOrderId(), 102);
}

@Test
@@ -115,7 +115,7 @@ public void testDoPostGetUserClaimValuesWithPasswordExpiryClaim() throws UserSto
// Case 2: PostAuthenticationFailedException is thrown.
mockedPasswordPolicyUtils.when(() ->
PasswordPolicyUtils.getUserPasswordExpiryTime(eq(TENANT_DOMAIN), eq(username)))
.thenThrow(new PostAuthenticationFailedException("test-error", "test-error"));
.thenThrow(new ExpiredPasswordIdentificationException("test-error", "test-error"));
try {
passwordExpiryEventListener.doPostGetUserClaimValues(username, claims, profileName, claimMap, userStoreManager);
} catch (Exception e) {
@@ -170,7 +170,7 @@ public void testDoPostGetUsersClaimValuesWithPasswordExpiryClaim() throws UserSt
// Case 2: PostAuthenticationFailedException is thrown.
mockedPasswordPolicyUtils.when(() -> PasswordPolicyUtils.getUserPasswordExpiryTime(
eq(TENANT_DOMAIN), anyString(), eq(true), eq(false), any(), eq(30)))
.thenThrow(new PostAuthenticationFailedException("test-error", "test-error"));
.thenThrow(new ExpiredPasswordIdentificationException("test-error", "test-error"));
try {
passwordExpiryEventListener.doPostGetUsersClaimValues(userNames, claims,
profileName, userClaimSearchEntries);