Changeset 1752 for trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases

Timestamp:

04/24/16 13:59:54 (8 years ago)

Author:

nanardon

Message:

bannedPassword feature (denied password for a user)

Location:

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Sql

Files:

• User.pm (modified) (2 diffs)
• objects.pm (modified) (1 diff)

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Sql/User.pm

@@ -1220 +1220 @@
                 label => l('Password set'),
             },
+            oldPassword => {
+                multiple => 1,
+            },
+            bannedPassword => {
+                multiple => 1,
+            },
             currentEmployment => {
                 managed => 1,
@@ -1599 +1605 @@
 }
 
+=head2 storeBannedPassword($epassword)
+
+Add an encrypted password to untrust list
+
+=cut
+
+sub storeBannedPassword {
+    my ($self, $EncPass) = @_;
+
+    my @banned = sort { $b cmp $a } $self->_get_attributes('bannedPassword');
+    my $now = DateTime->now; 
+    unshift(@banned, $now->iso8601 . ';' . $EncPass);
+    $self->set_fields('bannedPassword', [ grep { $_ } @banned ]);
+
+}
+
+=head2 banCurrentPassword
+
+Store the current password as banned
+
+=cut
+
+sub banCurrentPassword {
+    my ($self) = @_;
+    
+    my $old = $self->get_field('userPassword') or return;
+    $self->storeBannedPassword($old);
+}
+
+sub check_password {
+    my ( $self, $password ) = @_;
+
+    if (my $res = $self->SUPER::check_password($password)) {
+        return $res;
+    }
+
+    foreach my $banned ($self->_get_attributes('bannedPassword')) {
+        my ($date, $oldPassword) = $banned =~ /^([^;]*);(.*)/;
+        warn $password;
+        if (crypt($oldPassword, $password) eq $password) {
+            return "Banned password, cannot be used anymore";
+        }
+    }
+
+    return;
+}
+
+sub _set_password {
+    my ($self, $clear_pass) = @_;
+    if (my $attr = $self->base->attribute($self->type, 'userPassword')) {
+        my $field = $attr->iname;
+
+        # Storing as old password
+        my @olds = sort { $b cmp $a } $self->_get_attributes('oldPassword');
+        my $old = $self->get_field('userPassword');
+        my $now = DateTime->now; 
+        unshift(@olds, $now->iso8601 . ';' . $old);
+        $self->set_fields('oldPassword', [ grep { $_ } @olds[0 .. 14] ]);
+
+        my @salt_char = (('a' .. 'z'), ('A' .. 'Z'), (0 .. 9), '/', '.');
+        my $salt = join('', map { $salt_char[rand(scalar(@salt_char))] } (1 .. 8));
+        my $res = $self->set_fields($field, crypt($clear_pass, '$1$' . $salt));
+        if ($res) {
+            if ($self->base->get_global_value('rsa_public_key')) {
+                $self->setCryptPassword($clear_pass) or return;
+            }
+        }
+
+        $self->set_fields('passwordLastSet', DateTime->now->datetime);
+        $self->base->log(LA_NOTICE,
+            'Mot de passe changé pour %s',
+            $self->id
+        );
+
+
+        return $res;
+    } else {
+        $self->log(LA_WARN,
+            "Cannot set password: userPassword attributes is unsupported");
+    }
+}
+
+=head2 setCryptPassword($clear_pass)
+
+Store password encrypted using RSA encryption.
+
+=cut
+
+sub setCryptPassword {
+    my ($self, $clear_pass) = @_;
+    if (my $serialize = $self->base->get_global_value('rsa_public_key')) {
+        my $public = Crypt::RSA::Key::Public->new;
+        $public = $public->deserialize(String => [ $serialize ]);
+        my $rsa = new Crypt::RSA ES => 'PKCS1v15';
+        my $rsa_password = $rsa->encrypt (
+            Message    => $clear_pass,
+            Key        => $public,
+            Armour     => 1,
+        ) || die $rsa->errstr();
+        if (!$self->_set_c_fields('encryptedPassword', $rsa_password)) {
+            $self->log(LA_ERR,
+                "Cannot set 'encryptedPassword' attribute for object %s/%s",
+                $self->type, $self->id,
+            );
+            return;
+        }
+    }
+    $self->ReportChange('Password', 'Password stored using internal key');
+    return 1;
+}
+
+
 =head2 GenPasswordResetId
 

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Sql/objects.pm

@@ -733 +733 @@
 }
 
-sub _set_password {
-    my ($self, $clear_pass) = @_;
-    if (my $attr = $self->base->attribute($self->type, 'userPassword')) {
-        my $field = $attr->iname;
-        my @salt_char = (('a' .. 'z'), ('A' .. 'Z'), (0 .. 9), '/', '.');
-        my $salt = join('', map { $salt_char[rand(scalar(@salt_char))] } (1 .. 8));
-        my $res = $self->set_fields($field, crypt($clear_pass, '$1$' . $salt));
-        if ($res) {
-            if ($self->base->get_global_value('rsa_public_key')) {
-                $self->setCryptPassword($clear_pass) or return;
-            }
-        }
-
-        $self->set_fields('passwordLastSet', DateTime->now->datetime);
-        $self->base->log(LA_NOTICE,
-            'Mot de passe changé pour %s',
-            $self->id
-        );
-        return $res;
-    } else {
-        $self->log(LA_WARN,
-            "Cannot set password: userPassword attributes is unsupported");
-    }
-}
-
-=head2 setCryptPassword($clear_pass)
-
-Store password encrypted using RSA encryption.
-
-=cut
-
-sub setCryptPassword {
-    my ($self, $clear_pass) = @_;
-    if (my $serialize = $self->base->get_global_value('rsa_public_key')) {
-        my $public = Crypt::RSA::Key::Public->new;
-        $public = $public->deserialize(String => [ $serialize ]);
-        my $rsa = new Crypt::RSA ES => 'PKCS1v15';
-        my $rsa_password = $rsa->encrypt (
-            Message    => $clear_pass,
-            Key        => $public,
-            Armour     => 1,
-        ) || die $rsa->errstr();
-        if (!$self->_set_c_fields('encryptedPassword', $rsa_password)) {
-            $self->log(LA_ERR,
-                "Cannot set 'encryptedPassword' attribute for object %s/%s",
-                $self->type, $self->id,
-            );
-            return;
-        }
-    }
-    $self->ReportChange('Password', 'Password stored using internal key');
-    return 1;
-}
-
-
 sub search {
     my ($class, $base, @filter) = @_;