Skip to content

Audit-log LinOTP login success/failure (REST and RADIUS) #462

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
terryozaki-wq wants to merge 1 commit into
base: dev
Choose a base branch
from
Open

Audit-log LinOTP login success/failure (REST and RADIUS) #462

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 34 additions & 4 deletions src/prerna/semoss/web/services/local/UserResource.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1567,8 +1567,14 @@ public Response changeADPassword(@Context HttpServletRequest request, @Context H
public Response loginLinOTP(@Context HttpServletRequest request, @Context HttpServletResponse response)
throws ClientProtocolException, IOException {
Map<String, Object> returnMap = new HashMap<>();
String attemptedUsername = request.getParameter("username");
String clientIp = WebUtility.getClientIp(request);
String authMode = socialData.getProperty("linotp_auth_mode", "rest");

if (socialData.getLoginsAllowed().get("linotp") == null || !socialData.getLoginsAllowed().get("linotp")) {
returnMap.put(Constants.ERROR_MESSAGE, "LinOTP login is not allowed");
UserAuditTrailUtils.recordLoginFailed(attemptedUsername, AuthProvider.LINOTP.getLabel(),
AuditErrorCode.LOGIN_METHOD_DISABLED, "LinOTP login is not allowed", clientIp, 400);
return WebUtility.getResponse(returnMap, 400);
}

Expand All @@ -1577,23 +1583,47 @@ public Response loginLinOTP(@Context HttpServletRequest request, @Context HttpSe
Boolean disableRedirect = Boolean.parseBoolean(request.getParameter("disableRedirect") + "");
boolean autoAdd = Boolean.parseBoolean(socialData.getProperty("linotp_auto_add", "true"));

LinOTPResponse linotpResponse = LinOTPUtil.login(request);
LinOTPResponse linotpResponse;
try {
linotpResponse = LinOTPUtil.login(request);
} catch (IOException e) {
classLogger.error("Unexpected error in loginLinOTP (auth mode=" + authMode + ")", e);
UserAuditTrailUtils.recordLoginFailed(attemptedUsername, AuthProvider.LINOTP.getLabel(),
AuditErrorCode.INTERNAL_ERROR, e.getMessage(), clientIp, 500);
returnMap.put(Constants.ERROR_MESSAGE, "An unexpected error happened. Please try again.");
return WebUtility.getResponse(returnMap, 500);
}
returnMap = linotpResponse.getReturnMap();
int responseCode = linotpResponse.getResponseCode();
if (responseCode != 200) {
// we just throw the error
// a genuine failure: invalid credentials/OTP, RADIUS/LinOTP server
// unreachable, misconfiguration, etc. - the specific reason is already in
// returnMap's error message, which must never contain the submitted
// pin/password/OTP (LinOTPUtil never puts them there).
Object errorMessage = returnMap.get(Constants.ERROR_MESSAGE);
UserAuditTrailUtils.recordLoginFailed(attemptedUsername, AuthProvider.LINOTP.getLabel(),
AuditErrorCode.INVALID_CREDENTIALS, errorMessage == null ? null : errorMessage.toString(),
clientIp, responseCode);
return WebUtility.getResponse(returnMap, responseCode);
} else {
// are we logged in?
AccessToken token = linotpResponse.getToken();
if (token == null) {
// it is a 200 but we are not logged in
// you likely need to enter otp in 2nd response
// it is a 200 but we are not logged in: a challenge-response step (the
// pin/first factor checked out and the server is asking for an OTP next).
// This is neither a success nor a failure, so it is deliberately not
// written to the audit trail - only the eventual accept/reject outcome is.
classLogger.debug("LinOTP login ({}) for user='{}' is awaiting a second-factor OTP", authMode,
attemptedUsername);
return WebUtility.getResponse(returnMap, responseCode);
}

// we have a login
// addAccessToken() -> userTrackingLogin() already calls
// UserAuditTrailUtils.recordLogin for every provider, LinOTP included, so
// there is nothing further to add to the audit trail on this path.
addAccessToken(token, request, autoAdd);
classLogger.info("LinOTP login ({}) succeeded for user='{}'", authMode, token.getUsername());
// log the log in
if (!disableRedirect) {
setMainPageRedirect(request, response, redirect);
Expand Down
Loading