Changeset 284:8f09442c1968

Timestamp:

09/04/11 17:59:23 (5 months ago)

Author:

xeraph

Branch:

default

Convert:

svn:7c3792e6-d75b-4784-96a6-b298f655ee64/trunk@2718

Message:

added auto-lock by successive login failures

Location:

kraken-dom/src/main/java/org/krakenapps/dom

Files:

• api/impl/AdminApiImpl.java (modified) (5 diffs)
• exception/AdminLockedException.java (added)
• msgbus/LoginPlugin.java (modified) (1 diff)

kraken-dom/src/main/java/org/krakenapps/dom/api/impl/AdminApiImpl.java

@@ -28 +28 @@
 import org.krakenapps.dom.api.AdminApi;
 import org.krakenapps.dom.api.UserExtensionProvider;
+import org.krakenapps.dom.exception.AdminLockedException;
 import org.krakenapps.dom.exception.CannotRemoveRequestingAdminException;
 import org.krakenapps.dom.exception.InvalidPasswordException;
@@ -38 +39 @@
 import org.krakenapps.jpa.handler.JpaConfig;
 import org.krakenapps.jpa.handler.Transactional;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 @Component(name = "dom-admin-api")
@@ -43 +46 @@
 @JpaConfig(factory = "dom")
 public class AdminApiImpl extends AbstractApi<Admin> implements AdminApi, UserExtensionProvider {
+        private final Logger logger = LoggerFactory.getLogger(AdminApiImpl.class.getName());
+
         @Requires
         private ThreadLocalEntityManagerService entityManagerService;
@@ -51 +56 @@
         }
 
-        @Transactional
         @Override
         public Admin login(String nick, String hash, String nonce) throws AdminNotFoundException, InvalidPasswordException {
-                EntityManager em = entityManagerService.getEntityManager();
+                Admin admin = getAdmin(nick, hash, nonce);
+
+                if (hash.equals(Sha1.hash(admin.getUser().getPassword() + nonce)) == false) {
+                        updateLoginFailures(admin);
+                        throw new InvalidPasswordException();
+                }
+
+                return admin;
+        }
+
+        @Transactional
+        private void updateLoginFailures(Admin admin) {
+                EntityManager em = entityManagerService.getEntityManager();
+                admin = em.find(Admin.class, admin.getId());
+                admin.setLoginFailures(admin.getLoginFailures() + 1);
+                logger.debug("kraken dom: login [{}] login failures [{}]", admin.getUser().getName(), admin.getLoginFailures());
+
+                if (admin.isUseLoginLock() && admin.getLoginFailures() >= admin.getLoginLockCount())
+                        admin.setEnabled(false);
+
+                em.merge(admin);
+        }
+
+        @Transactional
+        private Admin getAdmin(String nick, String hash, String nonce) {
                 try {
+                        EntityManager em = entityManagerService.getEntityManager();
                         Admin admin = (Admin) em.createQuery("SELECT a FROM Admin a LEFT JOIN a.user u WHERE u.loginName = ?")
                                         .setParameter(1, nick).getSingleResult();
-
-                        if (hash.equals(Sha1.hash(admin.getUser().getPassword() + nonce)) == false)
-                                throw new InvalidPasswordException();
+                        if (!admin.isEnabled())
+                                throw new AdminLockedException();
 
                         admin.setLastLoginDateTime(new Date());
@@ -215 +243 @@
                         admin.setIdleTimeout(targetAdmin.getIdleTimeout());
                         admin.setLoginLockCount(targetAdmin.getLoginLockCount());
-                        
-                        if (!admin.isEnabled() && targetAdmin.isEnabled()) 
+
+                        if (!admin.isEnabled() && targetAdmin.isEnabled())
                                 admin.setLoginFailures(0);
-                                
+
                         admin.setEnabled(targetAdmin.isEnabled());
-                        
+
                         em.merge(admin);
 

kraken-dom/src/main/java/org/krakenapps/dom/msgbus/LoginPlugin.java

@@ -53 +53 @@
 
         @AllowGuestAccess
-        @Transactional
         @MsgbusMethod
         public void login(Request req, Response resp) throws AdminNotFoundException, InvalidPasswordException {