D-Net

{

  "type_source": "SVN", 

  "goal": "package -U source:jar", 

  "url": "http://svn-public.driver.research-infrastructures.eu/driver/dnet45/modules/dnet-openaire-users/trunk", 

  "deploy_repository": "dnet45-snapshots", 

  "version": "4", 

  "mail": "antleb@di.uoa.gr, kiatrop@di.uoa.gr, sbaltzi@di.uoa.gr", 

  "deploy_repository_url": "https://maven.d4science.org/nexus/content/repositories/dnet45-snapshots", 

  "name": "dnet-openaire-users"

}

package eu.dnetlib.openaire.usermanagement;

public class RefreshToken {

    private String value;

    private int id;

    private String[] scopes;

    private String clientId;

    private String userId;

    private String expliration;

    public String getValue() {

        return value;

    }

    public void setValue(String value) {

        this.value = value;

    }

    public int getId() {

        return id;

    }

    public void setId(int id) {

        this.id = id;

    }

    public String[] getScopes() {

        return scopes;

    }

    public void setScopes(String[] scopes) {

        this.scopes = scopes;

    }

    public String getClientId() {

        return clientId;

    }

    public void setClientId(String clientId) {

        this.clientId = clientId;

    }

    public String getUserId() {

        return userId;

    }

    public void setUserId(String userId) {

        this.userId = userId;

    }

    public String getExpliration() {

        return expliration;

    }

    public void setExpliration(String expliration) {

        this.expliration = expliration;

    }

}

package eu.dnetlib.openaire.usermanagement;

import eu.dnetlib.openaire.user.utils.InputValidator;

import eu.dnetlib.openaire.user.utils.LDAPActions;

import eu.dnetlib.openaire.user.utils.VerificationActions;

import eu.dnetlib.openaire.usermanagement.utils.UrlConstructor;

import org.apache.log4j.Logger;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.web.context.support.SpringBeanAutowiringSupport;

import javax.servlet.ServletConfig;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import java.io.IOException;

import java.io.PrintWriter;

/**

 * Created by sofia on 21/5/2018.

 */

public class VerifyToDeleteServlet extends HttpServlet {

    public void init(ServletConfig config) throws ServletException {

        super.init(config);

        SpringBeanAutowiringSupport.processInjectionBasedOnServletContext(this,

                config.getServletContext());

    }

    @Autowired

    private VerificationActions verificationActions;

    @Autowired

    private LDAPActions ldapActions;

    private Logger logger = Logger.getLogger(VerificationCodeServlet.class);

    @Override

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException {

        response.setContentType("text/html");

        PrintWriter printWriter = response.getWriter();

        String formUsername = request.getParameter("username").trim();

        String formVerificationCode = request.getParameter("verification_code").trim();

        try {

            if (InputValidator.isFilled(formUsername) && InputValidator.isFilled(formVerificationCode)) {

                if (verificationActions.verificationEntryExists(formUsername) && verificationActions.verificationCodeIsCorrect(formUsername, formVerificationCode)) {

                    if (!verificationActions.verificationCodeHasExpired(formUsername)) {

                        Boolean isRegistered = false;

                        Boolean isZombie = false;

                        if (ldapActions.usernameExists(formUsername)) {

                            logger.info("User " + formUsername + " is activated user!");

                            isRegistered = true;

                        } else if (ldapActions.isZombieUsersUsername(formUsername)) {

                            logger.info("User " + formUsername + " is zombie user!");

                            isZombie = true;

                        }

                        if (!isRegistered && !isZombie) {

                            request.getSession().setAttribute("message", "Username or verification code are not valid.");

                            response.sendRedirect("./verifyToDelete.jsp");

                        } else {

                            if (isRegistered) {

                                ldapActions.deleteUser(formUsername);

                            } else if (isZombie) {

                                ldapActions.deleteZombieUser(formUsername);

                            }

                            verificationActions.deleteVerificationEntry(formUsername);

                            response.sendRedirect(UrlConstructor.getRedirectUrl(request,"successDeleteAccount.jsp"));

                        }

                    } else {

                        logger.info("Verification code has expired!");

                        response.sendRedirect(UrlConstructor.getRedirectUrl(request, "expiredVerificationCode.jsp"));

                    }

                } else {

                    logger.info("Username or verification code are not valid!");

                    request.getSession().setAttribute("message", "Username or verification code are not valid.");

                    response.sendRedirect("./verifyToDelete.jsp");

                }

            } else {

                if (!InputValidator.isFilled(formUsername)) {

                    logger.info("No username");

                    request.getSession().setAttribute("msg_username_error", "Please enter your username.");

                }

                if (!InputValidator.isFilled(formVerificationCode)) {

                    logger.info("No verification code");

                    request.getSession().setAttribute("msg_verification_code_error", "Please enter your verification code.");

                }

                response.sendRedirect("./verifyToDelete.jsp");

            }

        } catch (Exception ldape) {

            logger.error("Could not remove user with username " + formUsername, ldape);

            response.sendRedirect(UrlConstructor.getRedirectUrl(request, "error.jsp"));

        }

        printWriter.close();

    }

}

package eu.dnetlib.openaire.usermanagement;

import eu.dnetlib.openaire.user.utils.EmailSender;

import eu.dnetlib.openaire.user.utils.LDAPActions;

import eu.dnetlib.openaire.user.utils.VerificationActions;

import eu.dnetlib.openaire.user.utils.VerifyRecaptcha;

import eu.dnetlib.openaire.usermanagement.utils.UrlConstructor;

import org.apache.commons.validator.routines.EmailValidator;

import org.apache.log4j.Logger;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.beans.factory.annotation.Value;

import org.springframework.web.context.support.SpringBeanAutowiringSupport;

import javax.mail.MessagingException;

import javax.servlet.ServletConfig;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import javax.servlet.http.HttpSession;

import java.io.IOException;

import java.sql.Timestamp;

import java.util.Date;

import java.util.UUID;

/**

 * Created by sofia on 21/5/2018.

 */

public class RequestToDeleteAccountServlet extends HttpServlet {

    @Autowired

    private VerificationActions verificationActions;

    @Autowired

    private LDAPActions ldapActions;

    @Autowired

    private EmailSender emailSender;

    @Value("${oidc.home}")

    private String oidcHomeUrl;

    @Value("${google.recaptcha.secret}")

    private String secret;

    @Value("${google.recaptcha.key}")

    private String sitekey;

    private static final Logger logger = Logger.getLogger(RequestActivationCodeServlet.class);

    public void init(ServletConfig config) throws ServletException {

        super.init(config);

        SpringBeanAutowiringSupport.processInjectionBasedOnServletContext(this,

                config.getServletContext());

        config.getServletContext().setAttribute("sitekey", sitekey);

    }

    @Override

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException {

        String formEmail = request.getParameter("email").trim();

        String gRecaptchaResponse = request.getParameter("g-recaptcha-response");

        HttpSession session = request.getSession();

        session.setAttribute("homeUrl", oidcHomeUrl);

        if (formEmail == null) {

            request.getSession().setAttribute("message", "Error reading email.");

            response.sendRedirect("./requestToDeleteAccount.jsp");

        } else if (formEmail.isEmpty()) {

            request.getSession().setAttribute("message", "Please enter your email.");

            response.sendRedirect("./requestToDeleteAccount.jsp");

        } else if (!EmailValidator.getInstance().isValid(formEmail)) {

            request.getSession().setAttribute("message", "Please enter a valid email.");

            response.sendRedirect("./requestToDeleteAccount.jsp");

        } else if (!VerifyRecaptcha.verify(gRecaptchaResponse, secret)) {

            request.getSession().setAttribute("reCAPTCHA_message", "You missed the reCAPTCHA validation!");

            response.sendRedirect("./requestToDeleteAccount.jsp");

        } else {

            try {

                Boolean isRegistered = false;

                Boolean isZombie = false;

                if (ldapActions.emailExists(formEmail)) {

                    logger.info("User with email: " + formEmail + " is activated user!");

                    isRegistered = true;

                } else if (ldapActions.isZombieUsersEmail(formEmail)) {

                    logger.info("User with email: " + formEmail + " is zombie user!");

                    isZombie = true;

                }

                if (!isRegistered && !isZombie) {

                    request.getSession().setAttribute("message", "There is no user with that email.");

                    response.sendRedirect("./requestToDeleteAccount.jsp");

                } else {

                    String username = null;

                    if (isRegistered) {

                        username = ldapActions.getUsername(formEmail);

                    } else if (isZombie) {

                        username = ldapActions.getZombieUsersUserName(formEmail);

                    }

                    UUID verificationCode = UUID.randomUUID();

                    Date creationDate = new Date();

                    String vCode = verificationCode.toString();

                    Timestamp timestamp = new Timestamp(creationDate.getTime());

                    if (!verificationActions.verificationEntryExists(username)) {

                        verificationActions.addVerificationEntry(username, vCode, timestamp);

                    } else {

                        verificationActions.updateVerificationEntry(username, vCode, timestamp);

                    }

                    String resultPath = UrlConstructor.getRedirectUrl(request, "verifyToDelete.jsp");

                    String resultPathWithVCode = UrlConstructor.getVerificationLink(resultPath, vCode);

                    String verificationCodeMsg = "<p>Hello " + username + ",</p>" +

                            "<p> A request has been made to get a verification code to delete your OpenAIRE account. To delete your " +

                            "account, you will need to submit your username and this verification code in order to verify that the " +

                            "request was legitimate.</p>" +

                            "<p>" +

                            "The verification code is " + vCode +

                            "</p>" +

                            "Click the URL below and proceed with deleting your account." +

                            "<p><a href=" + resultPathWithVCode + ">" + resultPathWithVCode + "</a></p>" +

                            "<p>The verification code is valid for 24 hours.</p>" +

                            "<p>Thank you,</p>" +

                            "<p>OpenAIRE technical team</p>";

                    String verificationCodeSubject = "Request to delete your OpenAIRE account";

                    emailSender.sendEmail(formEmail, verificationCodeSubject, verificationCodeMsg);

                    logger.info("Sending verification code to user: " + formEmail);

                    response.sendRedirect("./verifyToDelete.jsp");

                }

            } catch (MessagingException e) {

                logger.error("Error in sending email", e);

                request.getSession().setAttribute("message", "Error sending email");

                response.sendRedirect("./requestActivationCode.jsp");

            } catch (Exception ldape) {

                logger.error("Could not user with email " + formEmail, ldape);

                response.sendRedirect(UrlConstructor.getRedirectUrl(request, "error.jsp"));

            }

        }

    }

    public String getOidcHomeUrl() {

        return oidcHomeUrl;

    }

    public void setOidcHomeUrl(String oidcHomeUrl) {

        this.oidcHomeUrl = oidcHomeUrl;

    }

}

package eu.dnetlib.openaire.usermanagement;

import eu.dnetlib.openaire.user.utils.InputValidator;

import eu.dnetlib.openaire.user.utils.LDAPActions;

import eu.dnetlib.openaire.user.utils.VerificationActions;

import eu.dnetlib.openaire.usermanagement.utils.UrlConstructor;

import org.apache.log4j.Logger;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.beans.factory.annotation.Value;

import org.springframework.web.context.support.SpringBeanAutowiringSupport;

import javax.servlet.ServletConfig;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import javax.servlet.http.HttpSession;

import java.io.IOException;

import java.io.PrintWriter;

/**

 * Created by sofia on 23/10/2017.

 */

public class ActivationCodeServlet extends HttpServlet{

    public void init(ServletConfig config) throws ServletException {

        super.init(config);

        SpringBeanAutowiringSupport.processInjectionBasedOnServletContext(this,

                config.getServletContext());

    }

    @Autowired

    private VerificationActions verificationActions;

    @Autowired

    private LDAPActions ldapActions;

    @Value("${oidc.home}")

    private String oidcHomeUrl;

    private Logger logger = Logger.getLogger(ActivationCodeServlet.class);

    @Override

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException {

        response.setContentType("text/html");

        PrintWriter printWriter = response.getWriter();

        String formUsername = request.getParameter("username").trim();

        String formVerificationCode = request.getParameter("verification_code").trim();

        if (InputValidator.isFilled(formUsername) && InputValidator.isFilled(formVerificationCode)) {

            if (verificationActions.verificationEntryExists(formUsername) && verificationActions.verificationCodeIsCorrect(formUsername, formVerificationCode)) {

                if (!verificationActions.verificationCodeHasExpired(formUsername)) {

                    HttpSession session = request.getSession();

                    session.setAttribute("username", formUsername);

                    session.setAttribute("homeUrl", oidcHomeUrl);

                    try {

                        ldapActions.moveUser(formUsername);

                    } catch (Exception e) {

                        logger.error("LDAP error in moving user", e);

                        response.sendRedirect(UrlConstructor.getRedirectUrl(request, "error.jsp"));

                    }

                    response.sendRedirect(UrlConstructor.getRedirectUrl(request, "registerSuccess.jsp"));

                } else {

                    logger.info("Verification code has expired!");

                    response.sendRedirect(UrlConstructor.getRedirectUrl(request, "expiredVerificationCode.jsp"));

                }

            } else {

                logger.info("Username or activation code are not valid!");

                request.getSession().setAttribute("message", "Username or activation code are not valid.");

                response.sendRedirect("./activate.jsp");

            }

        } else {

            if (!InputValidator.isFilled(formUsername)) {

                logger.info("No username");

                request.getSession().setAttribute("msg_username_error", "Please enter your username.");

            }

            if (!InputValidator.isFilled(formVerificationCode)) {

                logger.info("No activation code");

                request.getSession().setAttribute("msg_activation_code_error", "Please enter your activation code.");

            }

            response.sendRedirect("./activate.jsp");

        }

        printWriter.close();

    }

    public String getOidcHomeUrl() {

        return oidcHomeUrl;

    }

    public void setOidcHomeUrl(String oidcHomeUrl) {

        this.oidcHomeUrl = oidcHomeUrl;

    }

}

package eu.dnetlib.openaire.usermanagement;

import com.google.gson.Gson;

import com.google.gson.GsonBuilder;

import eu.dnetlib.openaire.user.pojos.RegisteredService;

import eu.dnetlib.openaire.usermanagement.utils.RegisteredServicesUtils;

import eu.dnetlib.openaire.usermanagement.utils.TokenUtils;

import org.apache.http.HttpResponse;

import org.apache.log4j.Logger;

import org.mitre.openid.connect.model.OIDCAuthenticationToken;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.security.core.context.SecurityContextHolder;

import org.springframework.web.context.support.SpringBeanAutowiringSupport;

import javax.servlet.ServletConfig;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import java.io.IOException;

import java.sql.SQLException;

import java.util.HashMap;

import java.util.List;

import java.util.Map;

public class RegisteredServicesServlet extends HttpServlet {

    private Logger logger = Logger.getLogger(RegisteredServicesServlet.class);

    @Autowired

    private RegisteredServicesUtils registeredServicesUtils;

    @Autowired

    private TokenUtils tokenUtils;

    public void init(ServletConfig config) throws ServletException {

        super.init(config);

        SpringBeanAutowiringSupport.processInjectionBasedOnServletContext(this,

                config.getServletContext());

    }

    public void doGet(HttpServletRequest request, HttpServletResponse response)

            throws ServletException, IOException {

        request.getSession().setAttribute("authenticated",

                !SecurityContextHolder.getContext().getAuthentication().getPrincipal().toString()

                        .equals("anonymousUser"));

        OIDCAuthenticationToken authentication = (OIDCAuthenticationToken) SecurityContextHolder.

                getContext().getAuthentication();

        String userId = authentication.getSub();

        List<RegisteredService> registeredServices = null;

        try {

            registeredServices = registeredServicesUtils.

                    getRegisteredServiceDao().fetchAllRegisteredServicesByOwner(userId);

            System.out.println("LOAD REGISTERED SERVICES. " + registeredServices.size());

            if (registeredServices.isEmpty()) {

                request.getSession().setAttribute("showEmptyList", true);

            } else {

                Map<String, ServiceResponse> serviceResponses = new HashMap<>();

                Map<String, String> serviceKey = new HashMap<>();

                for (RegisteredService registeredService:registeredServices) {

                    ServiceResponse serviceResponse = tokenUtils.getRegisteredService(registeredService.getClientId(),registeredService.getRegistrationAccessToken());

                    serviceResponses.put(registeredService.getId(), serviceResponse);

                    serviceKey.put(registeredService.getId(), extractPublicKeySet(serviceResponse));

                }

                boolean reachedLimit = reachedMaximumNumberOfServices(registeredServices);

                StringBuilder name = new StringBuilder().append(authentication.getUserInfo().getGivenName().charAt(0));

                name.append(authentication.getUserInfo().getFamilyName().charAt(0));

                request.getSession().setAttribute("name", name.toString());

                request.getSession().setAttribute("reachedLimit", reachedLimit);

                System.out.println("REACHED LIMIT??? " + reachedLimit);

                request.getSession().setAttribute("services", serviceResponses);

                request.getSession().setAttribute("keys", serviceKey);

            }

            request.getSession().setAttribute("registeredServices", registeredServices);

        } catch (SQLException sqle) {

            logger.error("Error fetching registered services for user " + userId , sqle);

            request.getSession().setAttribute("message", "Error fetching registered services. " +

                    "Please try again later.");

            request.getSession().setAttribute("showEmptyList", false);

            request.getRequestDispatcher("./registeredServices.jsp").include(request, response);

        }

        response.setContentType("text/html");

        request.getRequestDispatcher("./registeredServices.jsp").include(request, response);

    }

    private String extractPublicKeySet(ServiceResponse serviceResponse) {

        if (serviceResponse.getJwksUri()!=null && !serviceResponse.getJwksUri().isEmpty())

            return serviceResponse.getJwksUri();

        return extractJSONJwk(serviceResponse.getJwks());

    }

    private String extractJSONJwk(Jwks jwks) {

        Gson gson = new GsonBuilder().setPrettyPrinting().create();

        System.out.println(gson.toJson(jwks));

        return gson.toJson(jwks);

    }

    @Override

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

        OIDCAuthenticationToken authentication = (OIDCAuthenticationToken) SecurityContextHolder.

                getContext().getAuthentication();

        String id = request.getParameter("id");

        System.out.println("POST " +id);

        if (id!=null && !id.isEmpty()) {

            try {

                RegisteredService registeredService = registeredServicesUtils.getRegisteredServiceDao().fetchRegisteredServiceById(Integer.parseInt(id));

                if (!registeredService.getOwner().equals(authentication.getSub())) {

                    request.getSession().setAttribute("message", "You are not allowed to delete the service.");

                    System.out.println("BLOCKED " + registeredService.getOwner() + " >> " + authentication.getSub());

                    response.sendRedirect("./registeredServices");

                    return;

                }

                HttpResponse resp = tokenUtils.deleteService(registeredService.getClientId(), registeredService.getRegistrationAccessToken());

                int statusCode = resp.getStatusLine().getStatusCode();

                System.out.println("STATUS CODE " + statusCode);

                if (statusCode != 204) {

                    logger.error("Unable to delete the service. Status code was " + statusCode);

                    request.getSession().setAttribute("message", "Fail to delete the service. Status " + statusCode);

                    System.out.println("AAI blocked");

                    response.sendRedirect("./registeredServices");

                    return;

                } else {

                    registeredServicesUtils.getRegisteredServiceDao().delete(Integer.parseInt(id));

                    request.getSession().setAttribute("success", "The service was successfully deleted.");

                    System.out.println("HERE HERE");

                }

            } catch (SQLException sqle) {

                logger.error("Unable to contact db.", sqle);

                request.getSession().setAttribute("message", "Fail to delete the service. Please try again later.");

            }

        } else {

            request.getSession().setAttribute("message", "Error selecting service to delete. Please try again.");

        }

        response.sendRedirect("./registeredServices");

    }

    private boolean reachedMaximumNumberOfServices(List<RegisteredService> registeredServices) {

        return registeredServices.size() >= 5;

    }

}

package eu.dnetlib.openaire.usermanagement.dto;

import javax.xml.bind.annotation.XmlRootElement;

@XmlRootElement

public class Role {

    String name;

    String description;

    public Role() {}

    public Role(String name, String description) {

        this.name = name;

        this.description = description;

    }

    public String getName() {

        return name;

    }

    public void setName(String name) {

        this.name = name;

    }

    public String getDescription() {

        return description;

    }

    public void setDescription(String description) {

        this.description = description;

    }

}

package eu.dnetlib.openaire.usermanagement;

import java.io.Serializable;

public class ServiceRequest {

    String client_name;

    String client_id;

    String logo_uri;

    String policy_uri;

    String[] contacts;

    String[] redirect_uris = new String[]{};

    String[] grant_types = new String[] {"client_credentials"};

    String token_endpoint_auth_method = "private_key_jwt";

    String token_endpoint_auth_signing_alg = "RS256";

    String jwks_uri;

    Jwks jwks;

    public String getClientName() {

        return client_name;

    }

    public void setClientName(String clientName) {

        this.client_name = clientName;

    }

    public String getClientId() {

        return client_id;

    }

    public void setClientId(String clientId) {

        this.client_id = clientId;

    }

    public String[] getRedirectUris() {

        return redirect_uris;

    }

    public void setRedirectUris(String[] redirectUris) {

        this.redirect_uris = redirectUris;

    }

    public String getLogoUri() {

        return logo_uri;

    }

    public void setLogoUri(String logoUri) {

        this.logo_uri = logoUri;

    }

    public String getPolicyUri() {

        return policy_uri;

    }

    public void setPolicyUri(String policyUri) {

        this.policy_uri = policyUri;

    }

    public String[] getContacts() {

        return contacts;

    }

    public void setContacts(String[] contacts) {

        this.contacts = contacts;

    }

    public String[] getGrantTypes() {

        return grant_types;

    }

    public void setGrantTypes(String[] grantTypes) {

        this.grant_types = grantTypes;

    }

    public String getToken_endpoint_auth_method() {

        return token_endpoint_auth_method;

    }

    public void setToken_endpoint_auth_method(String token_endpoint_auth_method) {

        this.token_endpoint_auth_method = token_endpoint_auth_method;

    }

    public String getTokenEndpointAuthSigningAlg() {

        return token_endpoint_auth_signing_alg;

    }

    public void setTokenEndpointAuthSigningAlg(String tokenEndpointAuthSigningAlg) {

        this.token_endpoint_auth_signing_alg = tokenEndpointAuthSigningAlg;

    }

    public String getJwksUri() {

        return jwks_uri;

    }

    public void setJwksUri(String jwksUri) {

        this.jwks_uri = jwksUri;

    }

    public Jwks getJwks() {

        return jwks;

    }

    public void setJwks(Jwks jwks) {

        this.jwks = jwks;

    }

}

class Jwks implements Serializable {

    Key[] keys;

    public Key[] getKeys() {

        return keys;

    }

    public void setKeys(Key[] keys) {

        this.keys = keys;

    }

}

class Key implements Serializable {

    String kty;

    String e;

    String kid;

    String alg;

    String n;

    public String getKty() {

        return kty;

    }

    public void setKty(String kty) {

        this.kty = kty;

    }

    public String getE() {

        return e;

    }

    public void setE(String e) {

        this.e = e;

    }

    public String getKid() {

        return kid;

    }

    public void setKid(String kid) {

        this.kid = kid;

    }

    public String getAlg() {

        return alg;

    }

    public void setAlg(String alg) {

        this.alg = alg;

    }

    public String getN() {

        return n;

    }

    public void setN(String n) {

        this.n = n;

    }

}

package eu.dnetlib.openaire.usermanagement;

import eu.dnetlib.openaire.user.utils.InputValidator;

import eu.dnetlib.openaire.user.utils.LDAPActions;

import eu.dnetlib.openaire.user.utils.VerificationActions;

import eu.dnetlib.openaire.usermanagement.utils.UrlConstructor;

import org.apache.log4j.Logger;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.beans.factory.annotation.Value;

import org.springframework.web.context.support.SpringBeanAutowiringSupport;

import javax.servlet.ServletConfig;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import javax.servlet.http.HttpSession;

import java.io.IOException;

import java.io.PrintWriter;

/**

 * Created by kiatrop on 28/9/2017.

 */

public class ResetPasswordServlet extends HttpServlet {

    public void init(ServletConfig config) throws ServletException {

        super.init(config);

        SpringBeanAutowiringSupport.processInjectionBasedOnServletContext(this,

                config.getServletContext());

    }

    @Autowired

    private VerificationActions verificationActions;

    @Autowired

    private LDAPActions ldapActions;

    @Value("${oidc.home}")

    private String oidcHomeUrl;

    private Logger logger = Logger.getLogger(ResetPasswordServlet.class);

    @Override

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException {

        response.setContentType("text/html");

        PrintWriter printWriter = response.getWriter();

        HttpSession session = request.getSession();

        String username = (String) session.getAttribute("username");

        String password = request.getParameter("password");

        String confirmPassword = request.getParameter("password_conf");

        if (InputValidator.isFilled(password)) {

            if (InputValidator.isValidPassword(password) && password.equals(confirmPassword) && username != null) {

                try {

                    ldapActions.resetPassword(username, password);

                    logger.info("password resetted");

                    session.removeAttribute("username");

                    session.setAttribute("homeUrl", oidcHomeUrl);

                    response.sendRedirect(UrlConstructor.getRedirectUrl(request, "success.jsp"));

                } catch (Exception e) {

                    logger.error("LDAP error in resetting password", e);

                    response.sendRedirect(UrlConstructor.getRedirectUrl(request, "error.jsp"));

                }

            } else {

                if (!InputValidator.isValidPassword(password)) {

                    logger.info("No valid password");

//                    request.getSession().setAttribute("msg_invalid_password", "The password must contain a lowercase letter, a capital (uppercase) letter, a number and must be at least 6 characters long. White space character is not allowed.");

                }

                if (!password.equals(confirmPassword)) {

                    logger.info("No matching passwords");

//                    request.getSession().setAttribute("msg_pass_conf_error", "These passwords don't match.");

                }

                response.sendRedirect("./resetPassword.jsp");

            }

        } else {

            logger.info("Empty password");

            request.getSession().setAttribute("msg_password_error_display", "display:block" );

//            request.getSession().setAttribute("msg_invalid_password", "The password must contain a lowercase letter, a capital (uppercase) letter, a number and must be at least 6 characters long. White space character is not allowed.");

            response.sendRedirect("./resetPassword.jsp");

        }

        printWriter.close();

    }

    public String getOidcHomeUrl() {

        return oidcHomeUrl;

    }

    public void setOidcHomeUrl(String oidcHomeUrl) {

        this.oidcHomeUrl = oidcHomeUrl;

    }

}

package eu.dnetlib.openaire.usermanagement;

import eu.dnetlib.openaire.user.utils.EmailSender;

import eu.dnetlib.openaire.user.utils.LDAPActions;

import eu.dnetlib.openaire.user.utils.VerificationActions;

import eu.dnetlib.openaire.user.utils.VerifyRecaptcha;

import eu.dnetlib.openaire.usermanagement.utils.UrlConstructor;

import org.apache.log4j.Logger;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.beans.factory.annotation.Value;

import org.springframework.web.context.support.SpringBeanAutowiringSupport;

import javax.mail.MessagingException;

import javax.servlet.ServletConfig;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import javax.servlet.http.HttpSession;

import java.io.IOException;

import java.sql.Timestamp;

import java.util.Date;

import java.util.UUID;

/**

 * Created by sofia on 14/5/2018.

 */

public class RequestActivationCodeServlet extends HttpServlet {

    @Autowired

    private VerificationActions verificationActions;

    @Autowired

    private LDAPActions ldapActions;

    @Autowired

    private EmailSender emailSender;

    @Value("${oidc.home}")

    private String oidcHomeUrl;

    @Value("${google.recaptcha.secret}")

    private String secret;

    @Value("${google.recaptcha.key}")

    private String sitekey;

    private static final Logger logger = Logger.getLogger(RequestActivationCodeServlet.class);

    public void init(ServletConfig config) throws ServletException {

        super.init(config);

        SpringBeanAutowiringSupport.processInjectionBasedOnServletContext(this,

                config.getServletContext());

        config.getServletContext().setAttribute("sitekey", sitekey);

    }

    @Override

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException {

        String formUsername = request.getParameter("username").trim();

        String gRecaptchaResponse = request.getParameter("g-recaptcha-response");

        HttpSession session = request.getSession();

        session.setAttribute("homeUrl", oidcHomeUrl);

        if (formUsername == null) {

            request.getSession().setAttribute("message", "Error reading username.");

            response.sendRedirect("./requestActivationCode.jsp");

        } else if (formUsername.isEmpty()) {

            request.getSession().setAttribute("message", "Please enter your username.");

            response.sendRedirect("./requestActivationCode.jsp");

        } else if (!VerifyRecaptcha.verify(gRecaptchaResponse, secret)) {

            request.getSession().setAttribute("reCAPTCHA_message", "You missed the reCAPTCHA validation!");

            response.sendRedirect("./requestActivationCode.jsp");

        } else {

            try {

                if (ldapActions.isZombieUsersUsername(formUsername)) {

                    logger.info("User " + formUsername + " is zombie user!");

                    UUID verificationCode = UUID.randomUUID();

                    Date creationDate = new Date();

                    String vCode = verificationCode.toString();

                    Timestamp timestamp = new Timestamp(creationDate.getTime());

                    if (!verificationActions.verificationEntryExists(formUsername)) {

                        verificationActions.addVerificationEntry(formUsername, vCode, timestamp);

                    } else {

                        verificationActions.updateVerificationEntry(formUsername, vCode, timestamp);

                    }

                    String resultPath = UrlConstructor.getRedirectUrl(request, "activate.jsp");

                    String resultPathWithVCode = UrlConstructor.getVerificationLink(resultPath, vCode);

                    String verificationCodeMsg = "<p>Hello " + formUsername + ",</p>" +

                            "<p> A request has been made to get a new activation code to verify your email and activate your OpenAIRE account. To activate your " +

                            "account, you will need to submit your username and this activation code in order to verify that the " +

                            "request was legitimate.</p>" +

                            "<p>" +

                            "The activation code is " + vCode +

                            "</p>" +

                            "Click the URL below and proceed with activating your password." +

                            "<p><a href=" + resultPathWithVCode + ">" + resultPathWithVCode + "</a></p>" +

                            "<p>The activation code is valid for 24 hours.</p>" +

                            "<p>Thank you,</p>" +

                            "<p>OpenAIRE technical team</p>";

                    String verificationCodeSubject = "Request a new activation code for your OpenAIRE account";

                    String email = ldapActions.getZombieUsersEmail(formUsername);

                    if (email != null && !email.isEmpty()) {

                        emailSender.sendEmail(email, verificationCodeSubject, verificationCodeMsg);

                        logger.info("Sending activation code to user: " + formUsername);

                    }

                    response.sendRedirect("./activate.jsp");

                } else if (ldapActions.usernameExists(formUsername)) {

                    logger.info("User " + formUsername + " has already activated his account.");

                    request.getSession().setAttribute("message", "Your account is already activated.");

                    response.sendRedirect("./requestActivationCode.jsp");

                } else {

                    logger.info("No user with username: "  + formUsername);

                    request.getSession().setAttribute("message", "There is no user registered with that username.");

                    response.sendRedirect("./requestActivationCode.jsp");

                }

            } catch (MessagingException e) {

                logger.error("Error in sending email", e);

                request.getSession().setAttribute("message", "Error sending email");

                response.sendRedirect("./requestActivationCode.jsp");

            } catch (Exception ldape) {

                logger.error("Could not find zombie user with username " + formUsername, ldape);

                response.sendRedirect(UrlConstructor.getRedirectUrl(request, "error.jsp"));

            }

        }

    }

    public String getOidcHomeUrl() {

        return oidcHomeUrl;

    }

    public void setOidcHomeUrl(String oidcHomeUrl) {

        this.oidcHomeUrl = oidcHomeUrl;

    }

}

package eu.dnetlib.openaire.usermanagement;

import com.google.gson.Gson;

import com.google.gson.GsonBuilder;

import com.google.gson.JsonParseException;

import eu.dnetlib.openaire.user.pojos.RegisteredService;

import eu.dnetlib.openaire.usermanagement.utils.RegisteredServicesUtils;

import eu.dnetlib.openaire.usermanagement.utils.TokenUtils;

import org.apache.commons.validator.routines.UrlValidator;

import org.apache.http.HttpResponse;

import org.apache.log4j.Logger;

import org.mitre.openid.connect.model.OIDCAuthenticationToken;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.security.access.method.P;

import org.springframework.security.core.context.SecurityContextHolder;

import org.springframework.web.context.support.SpringBeanAutowiringSupport;

import javax.servlet.ServletConfig;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import java.io.IOException;

import java.sql.SQLException;

public class RegisterServiceServlet extends HttpServlet {

    private Logger logger = Logger.getLogger(RegisterServiceServlet.class);

    public void init(ServletConfig config) throws ServletException {

        super.init(config);

        SpringBeanAutowiringSupport.processInjectionBasedOnServletContext(this,

                config.getServletContext());

    }

    @Autowired

    private RegisteredServicesUtils registeredServicesUtils;

    @Autowired

    private TokenUtils tokenUtils;

    public void doGet(HttpServletRequest request, HttpServletResponse response)

            throws ServletException, IOException {

        OIDCAuthenticationToken authentication = (OIDCAuthenticationToken) SecurityContextHolder.

                getContext().getAuthentication();

        String userid = authentication.getSub();

        StringBuilder name = new StringBuilder().append(authentication.getUserInfo().getGivenName().charAt(0));

        name.append(authentication.getUserInfo().getFamilyName().charAt(0));

        request.getSession().setAttribute("name", name.toString());

        String idParam = request.getParameter("id");

        if (idParam != null && !idParam.isEmpty()) { // EDIT CASE

            System.out.println("In edit");

            try {

                int id = Integer.parseInt(idParam);

                RegisteredService registeredService = registeredServicesUtils.getRegisteredServiceDao().fetchRegisteredServiceById(id);

                if (registeredService != null && registeredServicesUtils.isAuthorized(userid, id)) {

                    ServiceResponse serviceResponse = tokenUtils.getRegisteredService(registeredService.getClientId(), registeredService.getRegistrationAccessToken());

                    updateFormFields(request, registeredService.getName(), registeredService.getKeyType(), serviceResponse);

                } else {

                    if (registeredService == null) {

                        System.out.println("No service found!");

                        request.getSession().setAttribute("message", "Not valid registered service with given id " + id + ".");

                        response.sendRedirect("./registeredServices");

                        logger.warn("Not valid registered service with " + id + "id.");

                    } else {

                        System.out.println("Not authorized");

                        request.getSession().setAttribute("message", "Not authorized to edit the registered service with id " + id + ".");

                        response.sendRedirect("./registeredServices");

                        logger.warn("Not authorized to edit the service with " + id + "id.");

                    }

                }

            } catch (NumberFormatException nfe) {

                System.out.println("WRONG FORMAT");

                request.getSession().setAttribute("message", "Invalid service id.");

                response.sendRedirect("./registeredServices");

                logger.error("Invalid service id.", nfe);

            } catch (SQLException sqle) {

                System.out.println("SQL PROBLEM");

                request.getSession().setAttribute("message", "Could not fetch registered service.");

                response.sendRedirect("./registeredServices");

                logger.error("Could not fetch registered service.", sqle);

            }

        } else {// NEW SERVICE CASE

            //Careful! Redirects in method

            request.getSession().setAttribute("first_name", null);

            request.getSession().setAttribute("key_type", null);

            request.getSession().setAttribute("jwksUri", null);

            request.getSession().setAttribute("value", null);

            checkNumberOfRegisteredServices(request, response, authentication);

        }

        response.setContentType("text/html");

        request.getRequestDispatcher("./registerService.jsp").include(request, response);

    }

    private void updateFormFields(HttpServletRequest request, String serviceName, String keyType, ServiceResponse serviceResponse) {

        System.out.println("UPDATING FORM");

        request.getSession().setAttribute("first_name", serviceName);

        System.out.println("Service response URI " + serviceResponse.getJwksUri());

        request.getSession().setAttribute("key_type", keyType);

        if (keyType != null) {

            if (keyType.equals("uri")) {

                request.getSession().setAttribute("jwksUri", serviceResponse.getJwksUri());

            } else {

                Key key;

                if (serviceResponse.getJwks() != null) {

                    key = serviceResponse.getJwks().keys[0];

                } else {

                    key = new Key();

                }

                System.out.println("Service response keys " + serviceResponse.getJwksUri());

                Gson gson = new GsonBuilder().setPrettyPrinting().create();

                request.getSession().setAttribute("value", gson.toJson(key));

            }

        }

    }

    public void doPost(HttpServletRequest request, HttpServletResponse response)

            throws ServletException, IOException {

        OIDCAuthenticationToken authentication = (OIDCAuthenticationToken) SecurityContextHolder.

                getContext().getAuthentication();

        response.setContentType("text/html");

        boolean canProceed = true;

        String mode = request.getParameter("mode").trim();

        System.out.println("Mode was " + mode);

        checkmode(mode);

        System.out.println("Mode is " + mode);

        String serviceId = request.getParameter("id");

        String name = request.getParameter("first_name").trim();

        if (name.isEmpty()) {

            request.getSession().setAttribute("first_name_error", true);

            canProceed = false;

        }

        String keyType = request.getParameter("key_type");

        String jwksUri = null;

        String jwksString = null;

        Jwks jwks = null;

        if(keyType != null) {

            keyType = keyType.trim();

            if (keyType.equals("uri")) {

                jwksUri = request.getParameter("uri");

                request.getSession().setAttribute("jwksUri", jwksUri);

                String[] schemes = {"https"};

                UrlValidator urlValidator = new UrlValidator(schemes);

                if (!urlValidator.isValid(jwksUri)) {

                    request.getSession().setAttribute("uri_error", true);

                    canProceed = false;

                }

            } else {

                jwksString = request.getParameter("value");

                try {

                    Gson gson = new GsonBuilder().registerTypeAdapter(Jwks.class, new JwksDeserializer()).create();

                    String jwksSet = String.format("{\"keys\":[%s]}", jwksString);

                    jwks = gson.fromJson(jwksSet, Jwks.class);

                    request.getSession().setAttribute("value", jwksString);

                    if (jwks.getKeys() == null || jwks.getKeys().length == 0) {

                        System.out.println("Something wrong with the keys.");

                        request.getSession().setAttribute("value_error", true);

                        canProceed = false;

                    }

                } catch (JsonParseException jpe) {

                    request.getSession().setAttribute("value_error", true);

                    canProceed = false;

                }

            }

        }

        String userid = authentication.getSub();

        String email = authentication.getUserInfo().getEmail();

        ServiceResponse serviceResponse = null;

        if (nameIsValid(name) && userInfoIsValid(userid, email) && keyIsValid(keyType, jwksUri, jwksString) && canProceed) {

            String serverMessage;

            if (mode.equals("create")) {

                //Careful! Redirects in method

                if (!checkNumberOfRegisteredServices(request, response, authentication)) {

                    return;

                }

                String serverRequestJSON = null;

                if(keyType == null) {

                    serverRequestJSON = createServiceJson(null, name, email);

                } else if (keyType.equals("uri")) {

                    serverRequestJSON = createServiceJson(null, name, email, jwksUri);

                } else if (keyType.equals("value")){

                    serverRequestJSON = createServiceJson(null, name, email, jwks);

                }

                if(serverRequestJSON != null) {

                    System.out.println("SERVER JSON " + serverRequestJSON);

                    serverMessage = tokenUtils.registerService(serverRequestJSON);

                    logger.debug(serverMessage);

                    if (serverMessage == null) {

                        request.getSession().setAttribute("message", "There was an error registering your service. Please try again later.");

                        response.sendRedirect("./registeredServices");

                        return;

                    }

                    serviceResponse = new Gson().fromJson(serverMessage, ServiceResponse.class);

                    String client_id = serviceResponse.getClientId();

                    RegisteredService registeredService = new RegisteredService(client_id, userid, name, serviceResponse.getRegistrationAccessToken(), keyType);

                    try {

                        registeredServicesUtils.addRegistedService(registeredService);

                        if(registeredService.getKeyType() != null) {

                            request.getSession().setAttribute("success",

                                    "Your service has been successfully registered!<br>" +

                                            "<b>Client ID</b>: " + serviceResponse.getClientId());

                        } else {

                            request.getSession().setAttribute("success",

                                    "Your service has been successfully registered!<br>" +

                                          "<b>Client ID</b>: " + serviceResponse.getClientId() +

                                          "<br><span style=\"word-wrap: break-word\"><b>Client Secret</b>:" + serviceResponse.getClientSecret() + "</span>");

                        }

                    } catch (SQLException sqle) {

                        logger.error("Fail to save service.", sqle);

                        request.getSession().setAttribute("message", "There was an error registering your service. Please try again later.");

                        response.sendRedirect("./registeredServices");

                        return;

                    }

                } else {

                    logger.error("Service request JSON is null");

                    request.getSession().setAttribute("message", "There was an error registering your service. Please try again later.");

                    response.sendRedirect("./registeredServices");

                    return;

                }

            } else {

                int serviceIdInt = 0;

                if (serviceId == null || serviceId.isEmpty()) { //TODO WRONG MESSAGE

                    request.getSession().setAttribute("message", "Service with id " + serviceId + " does not exist.");

                    response.sendRedirect("./registeredServices");

                } else {

                    System.out.println("In edit...");

                    try {

                        serviceIdInt = Integer.parseInt(serviceId);

                        if (!registeredServicesUtils.isAuthorized(authentication.getSub(), serviceIdInt)) {

                            request.getSession().setAttribute("message", "You have no permission to edit the service.");

                            response.sendRedirect("./registeredServices");

                        } else {

                            RegisteredService registeredService = registeredServicesUtils.getRegisteredServiceDao().fetchRegisteredServiceById(serviceIdInt);

                            if (registeredService != null && registeredService.getClientId() != null) {

                                String serverRequestJSON = null;

                                if (keyType == null) {

                                    serverRequestJSON = createServiceJson(registeredService.getClientId(), name, email);

                                } else if (keyType.equals("uri")) {

                                    serverRequestJSON = createServiceJson(registeredService.getClientId(), name, email, jwksUri);

                                } else if (keyType.equals("value")) {

                                    serverRequestJSON = createServiceJson(registeredService.getClientId(), name, email, jwks);

                                }

                                if (serverRequestJSON != null) {

                                    System.out.println("SERVER JSON " + serverRequestJSON);

                                    HttpResponse resp = tokenUtils.updateService(registeredService.getClientId(), serverRequestJSON, registeredService.getRegistrationAccessToken());

                                    if (resp.getStatusLine().getStatusCode() == 200) {

                                        System.out.println("NAME >>>>" + name);

                                        registeredService.setName(name);

                                        System.out.println("Client Id " + registeredService.getClientId());

                                        try {

                                            registeredServicesUtils.getRegisteredServiceDao().update(registeredService);

                                        } catch (SQLException sqle) {

                                            logger.error("Unable to contact db.", sqle);

                                            request.getSession().setAttribute("message", "Fail to delete the service. Please try again later.");

                                            response.setContentType("text/html");

                                            request.getRequestDispatcher("./registeredServices.jsp").include(request, response);

                                            return;

                                        }

                                        request.getSession().setAttribute("success",

                                                "Your service has been successfully updated!<br>" +

                                                        "<b>Client ID</b>: " + registeredService.getClientId());

                                    }

                                } else {

                                    request.getSession().setAttribute("message", "Service with id " + serviceId + " does not exist.");

                                    response.sendRedirect("./registeredServices");

                                    return;

                                }

                            } else {

                                logger.error("Service request JSON is null");

                                request.getSession().setAttribute("message", "There was an error registering your service. Please try again later.");

                                response.sendRedirect("./registeredServices");

                                return;

                            }

                        }

                    } catch(SQLException sqle){

                        logger.error("Unable to access service with id " + serviceId, sqle);

                        request.getSession().setAttribute("message", "There was an error accessing your service.");

                        response.sendRedirect("./registeredServices");

                    } catch(NumberFormatException nfe){

                        logger.error("Unable to access service with id " + serviceId, nfe);

                        request.getSession().setAttribute("message", "Service with id " + serviceId + " does not exist.");

                        response.sendRedirect("./registeredServices");

                    }

                }

            }

        } else {

            //something is wrong with the form and the error messages will appear

            request.getSession().setAttribute("first_name", name);

            request.getSession().setAttribute("key_type", keyType);

            request.getSession().setAttribute("uri", jwksUri);

            request.getSession().setAttribute("value", jwksString);

            if (serviceId != null && !serviceId.isEmpty()) {

                request.getRequestDispatcher("./registerService.jsp?id=" + serviceId).forward(request, response);

            } else {

                request.getRequestDispatcher("./registerService.jsp").include(request, response);

            }

            return;

        }

        response.sendRedirect("./registeredServices");

    }

    private void checkmode(String mode) {

        if (mode != null && !mode.isEmpty()) {

            if (!mode.equals("edit") || mode.equals("create")) {

                mode = "create";

            }

        } else {

            mode = "create";

        }

    }

    private boolean keyIsValid(String keyType, String jwksUri, String jwksString) {

        return keyType == null || (keyType.equals("uri") && jwksUri != null && !jwksUri.isEmpty()) ||

                keyType.equals("value") && jwksString != null && !jwksString.isEmpty();

    }

    private boolean userInfoIsValid(String userid, String email) {

        return userid != null && !userid.isEmpty() &&

                email != null && !email.isEmpty();

    }

    private boolean nameIsValid(String name) {

        return name != null && !name.isEmpty();

    }

    private boolean checkNumberOfRegisteredServices(HttpServletRequest request, HttpServletResponse response, OIDCAuthenticationToken authentication) throws IOException {

        try {

            long numberOfRegisteredServices =

                    registeredServicesUtils.getRegisteredServiceDao().countRegisteredServices(authentication.getSub());

            if (numberOfRegisteredServices >= 5) {

                response.sendRedirect("./registeredServices"); // The message there already exists.

                return false;

            }

        } catch (SQLException sqle) {

            logger.error("Unable to count registered services.", sqle);

            request.getSession().setAttribute("message", "Unable to contact DB. Please try again later.");

            response.sendRedirect("./registeredServices");

            return false;

        }

        return true;

    }

    private static String createServiceJson(String clientId, String name, String email) {

        ServiceRequest serviceJSON = new ServiceRequest();

        serviceJSON.setClientId(clientId);

        serviceJSON.setClientName(name);

        serviceJSON.setContacts(new String[]{email});

        serviceJSON.setToken_endpoint_auth_method("client_secret_basic");

        serviceJSON.setTokenEndpointAuthSigningAlg(null);

        GsonBuilder builder = new GsonBuilder();

        builder.serializeNulls();

        Gson gson = builder.create();

        System.out.println("Created json " + serviceJSON);

        return gson.toJson(serviceJSON);

    }