From 9b2013ead4b30141321c26f33ab2064582551591 Mon Sep 17 00:00:00 2001 From: Filip Hanik Date: Thu, 29 Oct 2026 11:36:02 -0700 Subject: [PATCH 01/10] fix: confirming a self-service signup leads the user to set a password Confirming the email address of a self-service signup no longer activates the password entered on the signup form. The account is verified after that password is replaced, and the user is sent to the password reset page (force_change=true) to set a password. A signup redirect (an explicit redirect_uri or the client's signup_redirect_url) is applied after the password is set. --- docs/UAA-Configuration-Reference.md | 9 + .../uaa/account/AccountCreationService.java | 10 + .../uaa/account/AccountsController.java | 10 +- .../account/EmailAccountCreationService.java | 29 ++- .../uaa/account/ResetPasswordController.java | 6 +- .../uaa/login/AccountsControllerTest.java | 14 +- .../EmailAccountCreationServiceTests.java | 39 +++ uaa/src/main/resources/messages.properties | 1 + .../integration/feature/CreateAccountIT.java | 50 +++- .../util/IntegrationTestUtils.java | 6 + .../login/AccountsControllerMockMvcTests.java | 223 +++++++++++++++--- ...ccountsControllerMockMvcZonePathTests.java | 99 +++++--- 12 files changed, 408 insertions(+), 88 deletions(-) diff --git a/docs/UAA-Configuration-Reference.md b/docs/UAA-Configuration-Reference.md index 6d0abce0c9c..ad3017b1fd9 100644 --- a/docs/UAA-Configuration-Reference.md +++ b/docs/UAA-Configuration-Reference.md @@ -1892,6 +1892,15 @@ List of usernames to delete on bootstrap. Used to remove specific users during s When `true`, "Create Account" and "Forgot Password" links are displayed on the login page. +> **Note on self-service account confirmation.** Clicking the activation link in the confirmation +> email verifies ownership of the email address but does **not** activate the password typed on the +> registration form. The owner is sent to a password-setup page (stating that a password change is +> required due to changes in the system) and must establish their own password through the link +> before the account can be used to sign in. This ensures a password chosen before the email address +> was verified can never be used to authenticate. Any client or signup redirect configured for the +> registration (an explicit `redirect_uri` or the client's `signup_redirect_url`) is applied after the +> owner has set their password, provided it matches one of the client's registered redirect URIs. + [Back to table](#login--branding) --- diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountCreationService.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountCreationService.java index bd790c6812b..3292a91c11a 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountCreationService.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountCreationService.java @@ -19,6 +19,8 @@ class AccountCreationResponse { private String email; @JsonProperty("redirect_location") private String redirectLocation; + @JsonProperty("password_reset_code") + private String passwordResetCode; public AccountCreationResponse(String userId, String username, String email, String redirectLocation) { this.userId = userId; @@ -50,5 +52,13 @@ public String getRedirectLocation() { public String getEmail() { return email; } + + public String getPasswordResetCode() { + return passwordResetCode; + } + + public void setPasswordResetCode(String passwordResetCode) { + this.passwordResetCode = passwordResetCode; + } } } diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountsController.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountsController.java index 975be8c2494..aab576a47a9 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountsController.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountsController.java @@ -124,12 +124,10 @@ public String verifyUser(Model model, return "accounts/link_prompt"; } - String redirectLocation = accountCreation.getRedirectLocation(); - String res = "redirect:/login?success=verify_success"; - if (!redirectLocation.equals(accountCreationService.getDefaultRedirect())) { - res += "&form_redirect_uri=" + redirectLocation; - } - return res; + // Confirmation establishes email ownership but leaves the account without a usable + // password. Send the owner to the reset-password page to set their own password; any + // client redirect is carried by the reset code and applied once the password is set. + return "redirect:/reset_password?code=" + accountCreation.getPasswordResetCode() + "&force_change=true"; } private String handleUnprocessableEntity(Model model, HttpServletResponse response, String attributeKey, String attributeValue) { diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java index fab9727183c..3b3603ec3bb 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java @@ -14,6 +14,7 @@ import org.cloudfoundry.identity.uaa.scim.exception.ScimResourceAlreadyExistsException; import org.cloudfoundry.identity.uaa.scim.util.ScimUtils; import org.cloudfoundry.identity.uaa.scim.validate.PasswordValidator; +import org.cloudfoundry.identity.uaa.util.AlphanumericRandomValueStringGenerator; import org.cloudfoundry.identity.uaa.util.JsonUtils; import org.cloudfoundry.identity.uaa.zone.IdentityZone; import org.cloudfoundry.identity.uaa.zone.MergedZoneBrandingInformation; @@ -52,6 +53,7 @@ public class EmailAccountCreationService implements AccountCreationService { private final ScimUserProvisioning scimUserProvisioning; private final MultitenantClientServices clientDetailsService; private final PasswordValidator passwordValidator; + private final ResetPasswordService resetPasswordService; private final IdentityZoneManager identityZoneManager; public EmailAccountCreationService( @@ -61,6 +63,7 @@ public EmailAccountCreationService( ScimUserProvisioning scimUserProvisioning, MultitenantClientServices clientDetailsService, PasswordValidator passwordValidator, + ResetPasswordService resetPasswordService, IdentityZoneManager identityZoneManager) { this.templateEngine = templateEngine; @@ -69,6 +72,7 @@ public EmailAccountCreationService( this.scimUserProvisioning = scimUserProvisioning; this.clientDetailsService = clientDetailsService; this.passwordValidator = passwordValidator; + this.resetPasswordService = resetPasswordService; this.identityZoneManager = identityZoneManager; } @@ -121,14 +125,33 @@ public AccountCreationResponse completeActivation(String code) { Map data = JsonUtils.readValue(expiringCode.getData(), new TypeReference>() { }); - ScimUser user = scimUserProvisioning.retrieve(data.get("user_id"), identityZoneManager.getCurrentIdentityZoneId()); - user = scimUserProvisioning.verifyUser(user.getId(), user.getVersion(), identityZoneManager.getCurrentIdentityZoneId()); + String zoneId = identityZoneManager.getCurrentIdentityZoneId(); + ScimUser user = scimUserProvisioning.retrieve(data.get("user_id"), zoneId); + + // Confirming the activation link proves ownership of the email address, but it does not + // prove that the person confirming is the one who chose the password on the registration + // form. Discard the registration password so it can never authenticate, and require the + // confirming owner to establish their own password through the ownership-proving link. + // Replace the password and set the flag while the account is still unverified, then verify + // it last: these are separate updates, so verifying first would briefly leave the account + // verified while still holding the registration password, which a concurrent login could use. + scimUserProvisioning.changePassword(user.getId(), null, new AlphanumericRandomValueStringGenerator(40).generate(), zoneId); + scimUserProvisioning.updatePasswordChangeRequired(user.getId(), true, zoneId); + user = scimUserProvisioning.verifyUser(user.getId(), -1, zoneId); String clientId = data.get("client_id"); String redirectUri = data.get("redirect_uri") != null ? data.get("redirect_uri") : ""; + // Resolve the signup redirect (honouring the client's signup_redirect_url fallback) so it is + // preserved across the reset flow and applied once the owner has set their password. String redirectLocation = getRedirect(clientId, redirectUri); - return new AccountCreationResponse(user.getId(), user.getUserName(), user.getUserName(), redirectLocation); + // Issue an ownership-bound, single-use code so the owner sets their password through the + // same reset flow used for password recovery (no previous password is required). + ForgotPasswordInfo forgotPasswordInfo = resetPasswordService.forgotPassword(user.getUserName(), clientId, redirectLocation); + + AccountCreationResponse response = new AccountCreationResponse(user.getId(), user.getUserName(), user.getUserName(), redirectLocation); + response.setPasswordResetCode(forgotPasswordInfo.getResetPasswordCode().getCode()); + return response; } private String getRedirect(String clientId, String redirectUri) { diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordController.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordController.java index b10f38d66b7..3c98b278aaa 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordController.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordController.java @@ -176,7 +176,8 @@ public void resetPassword() { @GetMapping(value = "/reset_password", params = {"code"}) public String resetPasswordPage(Model model, HttpServletResponse response, - @RequestParam("code") String code) { + @RequestParam("code") String code, + @RequestParam(value = "force_change", required = false) boolean forceChange) { ExpiringCode expiringCode = checkIfUserExists(codeStore.retrieveCode(code, identityZoneManager.getCurrentIdentityZone().getId())); if (expiringCode == null) { @@ -189,6 +190,9 @@ public String resetPasswordPage(Model model, model.addAttribute("code", newCode); model.addAttribute("email", uaaUser.getEmail()); model.addAttribute("username", uaaUser.getUsername()); + if (forceChange) { + model.addAttribute("message_code", "force_change"); + } return "reset_password"; } } diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerTest.java index 732fb7efb76..63199a8e9cf 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerTest.java @@ -203,30 +203,32 @@ void passwordMismatch() throws Exception { @Test void verifyUser() throws Exception { - when(accountCreationService.completeActivation("the_secret_code")) - .thenReturn(new AccountCreationService.AccountCreationResponse("newly-created-user-id", "username", "user@example.com", "//example.com/callback")); + AccountCreationService.AccountCreationResponse response = new AccountCreationService.AccountCreationResponse("newly-created-user-id", "username", "user@example.com", "//example.com/callback"); + response.setPasswordResetCode("the_reset_code"); + when(accountCreationService.completeActivation("the_secret_code")).thenReturn(response); MockHttpServletRequestBuilder get = get("/verify_user") .param("code", "the_secret_code"); mockMvc.perform(get) .andExpect(status().isFound()) - .andExpect(redirectedUrl("/login?success=verify_success&form_redirect_uri=//example.com/callback")); + .andExpect(redirectedUrl("/reset_password?code=the_reset_code&force_change=true")); assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull(); } @Test void verifyUserWithPriorHeadRequest() throws Exception { - when(accountCreationService.completeActivation("the_secret_code")) - .thenReturn(new AccountCreationService.AccountCreationResponse("newly-created-user-id", "username", "user@example.com", "//example.com/callback")); + AccountCreationService.AccountCreationResponse response = new AccountCreationService.AccountCreationResponse("newly-created-user-id", "username", "user@example.com", "//example.com/callback"); + response.setPasswordResetCode("the_reset_code"); + when(accountCreationService.completeActivation("the_secret_code")).thenReturn(response); mockMvc.perform(head("/verify_user").param("code", "the_secret_code")) .andExpect(status().isFound()) .andExpect(redirectedUrl("/login")); mockMvc.perform(get("/verify_user").param("code", "the_secret_code")) .andExpect(status().isFound()) - .andExpect(redirectedUrl("/login?success=verify_success&form_redirect_uri=//example.com/callback")); + .andExpect(redirectedUrl("/reset_password?code=the_reset_code&force_change=true")); assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull(); Mockito.verify(accountCreationService, times(1)).completeActivation("the_secret_code"); diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java index eb1e2bde8bc..edf7870ebe8 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java @@ -3,6 +3,8 @@ import org.assertj.core.api.InstanceOfAssertFactories; import org.cloudfoundry.identity.uaa.account.AccountCreationService; import org.cloudfoundry.identity.uaa.account.EmailAccountCreationService; +import org.cloudfoundry.identity.uaa.account.ForgotPasswordInfo; +import org.cloudfoundry.identity.uaa.account.ResetPasswordService; import org.cloudfoundry.identity.uaa.codestore.ExpiringCode; import org.cloudfoundry.identity.uaa.codestore.ExpiringCodeStore; import org.cloudfoundry.identity.uaa.constants.OriginKeys; @@ -30,6 +32,7 @@ import org.junit.jupiter.api.Test; import org.junit.jupiter.api.extension.ExtendWith; import org.mockito.ArgumentCaptor; +import org.mockito.InOrder; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.http.HttpStatus; @@ -50,7 +53,9 @@ import static org.assertj.core.api.Assertions.assertThat; import static org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType.REGISTRATION; import static org.mockito.ArgumentMatchers.any; +import static org.mockito.ArgumentMatchers.isNull; import static org.mockito.Mockito.anyInt; +import static org.mockito.Mockito.inOrder; import static org.mockito.Mockito.anyString; import static org.mockito.Mockito.doThrow; import static org.mockito.Mockito.eq; @@ -72,6 +77,7 @@ class EmailAccountCreationServiceTests { private MultitenantClientServices mockClientDetailsService; private ClientDetails mockClientDetails; private PasswordValidator mockPasswordValidator; + private ResetPasswordService mockResetPasswordService; private IdentityZoneManager mockIdentityZoneManager; private ScimUser user; private ExpiringCode code; @@ -91,6 +97,7 @@ void setUp() { mockClientDetailsService = mock(MultitenantClientServices.class); mockClientDetails = mock(ClientDetails.class); mockPasswordValidator = mock(PasswordValidator.class); + mockResetPasswordService = mock(ResetPasswordService.class); mockIdentityZoneManager = mock(IdentityZoneManager.class); emailAccountCreationService = initEmailAccountCreationService(); @@ -104,6 +111,10 @@ void setUp() { currentIdentityZoneId = "zoneId" + randomValueStringGenerator.generate(); when(mockIdentityZoneManager.getCurrentIdentityZoneId()).thenReturn(currentIdentityZoneId); + + ExpiringCode resetCode = new ExpiringCode("reset_password_code", new Timestamp(System.currentTimeMillis()), "{}", "forgot_password_for_id:newly-created-user-id"); + when(mockResetPasswordService.forgotPassword(anyString(), any(), any())) + .thenReturn(new ForgotPasswordInfo("newly-created-user-id", "user@example.com", resetCode)); } private EmailAccountCreationService initEmailAccountCreationService() { @@ -114,6 +125,7 @@ private EmailAccountCreationService initEmailAccountCreationService() { mockScimUserProvisioning, mockClientDetailsService, mockPasswordValidator, + mockResetPasswordService, mockIdentityZoneManager ); } @@ -258,6 +270,33 @@ void completeActivation() { assertThat(accountCreation.getUserId()).isNotNull(); } + @Test + void completeActivationDiscardsRegistrationPasswordAndRequiresPasswordReset() { + setUpForSuccess(""); + when(mockCodeStore.retrieveCode("the_secret_code", currentIdentityZoneId)).thenReturn(code); + when(mockScimUserProvisioning.retrieve(anyString(), eq(currentIdentityZoneId))).thenReturn(user); + when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(currentIdentityZoneId))).thenReturn(user); + when(mockClientDetailsService.loadClientByClientId(anyString(), anyString())).thenReturn(mockClientDetails); + + AccountCreationService.AccountCreationResponse accountCreation = emailAccountCreationService.completeActivation("the_secret_code"); + + // The password supplied on the registration form must be discarded (replaced with a value + // that is not it) and the change-required flag set while the account is still unverified, + // and the account must be verified last. Verifying first would briefly leave the account + // verified while still accepting the registration password. + ArgumentCaptor passwordCaptor = ArgumentCaptor.forClass(String.class); + InOrder inOrder = inOrder(mockScimUserProvisioning); + inOrder.verify(mockScimUserProvisioning).changePassword(eq("newly-created-user-id"), isNull(), passwordCaptor.capture(), eq(currentIdentityZoneId)); + inOrder.verify(mockScimUserProvisioning).updatePasswordChangeRequired("newly-created-user-id", true, currentIdentityZoneId); + inOrder.verify(mockScimUserProvisioning).verifyUser(eq("newly-created-user-id"), anyInt(), eq(currentIdentityZoneId)); + assertThat(passwordCaptor.getValue()).isNotEqualTo("password"); + + // An ownership-bound reset code must be issued so the confirming owner can set their own + // password through the link. + verify(mockResetPasswordService).forgotPassword(eq("user@example.com"), anyString(), anyString()); + assertThat(accountCreation.getPasswordResetCode()).isEqualTo("reset_password_code"); + } + @Test void completeActivation_usesAntPathMatching() { setUpForSuccess("http://redirect.uri/"); diff --git a/uaa/src/main/resources/messages.properties b/uaa/src/main/resources/messages.properties index 8cac851020c..80ec61c0705 100644 --- a/uaa/src/main/resources/messages.properties +++ b/uaa/src/main/resources/messages.properties @@ -39,6 +39,7 @@ change_password.unauthorized=Please enter a valid current password. forgot_password.form_error=Please enter a valid email address. forgot_password.bad_code=Sorry, your reset password link is no longer valid. You can request another one below. reset_password.form_error=Passwords must match and not be empty. +reset_password.force_change=A password change is required due to changes in the system. Please set a new password. create_account.form_error=Passwords must match and not be empty. create_account.other_idp=Account sign-up is not required for this email domain. Please login with the identity provider force_password_change.form_error=Passwords must match and not be empty. diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/CreateAccountIT.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/CreateAccountIT.java index e0db98e33e7..bdd63968a5a 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/CreateAccountIT.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/CreateAccountIT.java @@ -95,8 +95,14 @@ void userInitiatedSignup() throws Exception { .doesNotContain("%40"); webDriver.get(link); - assertThat(webDriver.findElement(By.cssSelector("h1")).getText()).doesNotContain("Where to?"); + // Confirming the account lands on the forced password-set page, not a sign-in page. + assertThat(webDriver.findElement(By.cssSelector("h1")).getText()).isEqualTo("Reset Password"); + webDriver.findElement(By.name("password")).sendKeys(SECRET); + webDriver.findElement(By.name("password_confirmation")).sendKeys(SECRET); + webDriver.clickAndWait(By.xpath("//input[@value='Create new password']")); + + // The owner can now sign in with the password they set. webDriver.findElement(By.name("username")).sendKeys(userEmail); webDriver.findElement(By.name("password")).sendKeys(SECRET); webDriver.clickAndWait(By.xpath("//input[@value='Sign in']")); @@ -104,6 +110,40 @@ void userInitiatedSignup() throws Exception { assertThat(webDriver.findElement(By.cssSelector("h1")).getText()).contains("Where to?"); } + @Test + void confirmationDoesNotActivateTheRegistrationFormPassword() throws Exception { + String registrationPassword = SECRET; + String ownerPassword = "0wnerPass"; + + int receivedEmailSize = greenMail.getReceivedMessages().length; + String userEmail = startCreateUserFlow(registrationPassword); + + greenMail.waitForIncomingEmail(5000, receivedEmailSize + 1); + MimeMessage message = greenMail.getReceivedMessages()[receivedEmailSize]; + String link = testClient.extractLink(GreenMailUtil.getBody(message)); + + webDriver.get(link); + // Confirmation requires the owner to establish their own password through the link. + assertThat(webDriver.findElement(By.cssSelector("h1")).getText()).isEqualTo("Reset Password"); + webDriver.findElement(By.name("password")).sendKeys(ownerPassword); + webDriver.findElement(By.name("password_confirmation")).sendKeys(ownerPassword); + webDriver.clickAndWait(By.xpath("//input[@value='Create new password']")); + + // The password typed on the registration form must not grant access. + webDriver.get(baseUrl + "/login"); + webDriver.findElement(By.name("username")).sendKeys(userEmail); + webDriver.findElement(By.name("password")).sendKeys(registrationPassword); + webDriver.clickAndWait(By.xpath("//input[@value='Sign in']")); + assertThat(webDriver.findElement(By.className("alert-error")).getText()).contains("Provided credentials are invalid. Please try again."); + + // Only the password the owner set through the link works. + webDriver.get(baseUrl + "/login"); + webDriver.findElement(By.name("username")).sendKeys(userEmail); + webDriver.findElement(By.name("password")).sendKeys(ownerPassword); + webDriver.clickAndWait(By.xpath("//input[@value='Sign in']")); + assertThat(webDriver.findElement(By.cssSelector("h1")).getText()).contains("Where to?"); + } + @Test void clientInitiatedSignup() throws Exception { String userEmail = "user" + new SecureRandom().nextInt() + "@example.com"; @@ -130,8 +170,14 @@ void clientInitiatedSignup() throws Exception { assertThat(link).isNotEmpty(); webDriver.get(link); - assertThat(webDriver.findElement(By.cssSelector("h1")).getText()).doesNotContain("Where to?"); + // Confirming the account lands on the forced password-set page, not a sign-in page. + assertThat(webDriver.findElement(By.cssSelector("h1")).getText()).isEqualTo("Reset Password"); + + webDriver.findElement(By.name("password")).sendKeys(SECRET); + webDriver.findElement(By.name("password_confirmation")).sendKeys(SECRET); + webDriver.clickAndWait(By.xpath("//input[@value='Create new password']")); + // The owner can now sign in with the password they set. webDriver.findElement(By.name("username")).sendKeys(userEmail); webDriver.findElement(By.name("password")).sendKeys(SECRET); webDriver.clickAndWait(By.xpath("//input[@value='Sign in']")); diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/util/IntegrationTestUtils.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/util/IntegrationTestUtils.java index 922c8083d56..96b8d340409 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/util/IntegrationTestUtils.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/util/IntegrationTestUtils.java @@ -1618,6 +1618,12 @@ public static String createAnotherUser(UaaWebDriver webDriver, String password, throw new RuntimeException(e); } + // Confirming the account now lands on a forced password-set page; the owner must establish + // their password through the link before the account can be used to log in. + webDriver.findElement(By.name("password")).sendKeys(password); + webDriver.findElement(By.name("password_confirmation")).sendKeys(password); + webDriver.clickAndWait(By.xpath("//input[@value='Create new password']")); + return userEmail; } diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java index 288012441b1..92fdf613db7 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java @@ -42,6 +42,7 @@ import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder; import org.springframework.web.context.WebApplicationContext; import org.springframework.web.context.support.StandardServletEnvironment; +import org.springframework.web.util.UriComponentsBuilder; import java.util.Collections; @@ -49,6 +50,7 @@ import static org.cloudfoundry.identity.uaa.mock.util.MockMvcUtils.CookieCsrfPostProcessor.cookieCsrf; import static org.springframework.http.MediaType.APPLICATION_JSON; import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.authenticated; +import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.unauthenticated; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.model; @@ -62,7 +64,6 @@ @DefaultTestContext class AccountsControllerMockMvcTests { - private static final String LOGIN_REDIRECT = "/login?success=verify_success"; private static final String USER_PASSWORD = "secr3T"; private final AlphanumericRandomValueStringGenerator generator = new AlphanumericRandomValueStringGenerator(); private String userEmail; @@ -241,11 +242,7 @@ void creatingAnAccount() throws Exception { ScimUser scimUser = scimUserProvisioning.query("userName eq '" + userEmail + "' and origin eq '" + OriginKeys.UAA + "'", IdentityZoneHolder.get().getId()).getFirst(); assertThat(scimUser.isVerified()).isFalse(); - mockMvc.perform(get("/verify_user") - .param("code", "test" + generator.counter.get())) - .andExpect(status().isFound()) - .andExpect(redirectedUrl(LOGIN_REDIRECT)) - .andReturn(); + confirmAccountAndSetPassword("test" + generator.counter.get(), "", userEmail); MvcResult mvcResult = loginWithAccount("") .andExpect(authenticated()) @@ -260,26 +257,146 @@ void creatingAnAccount() throws Exception { } @Test - void creatingAnAccountWithAnEmptyClientId() throws Exception { + void confirmingAccountDoesNotAuthorizeThePreRegisteredPassword() throws Exception { PredictableGenerator generator = new PredictableGenerator(); JdbcExpiringCodeStore store = webApplicationContext.getBean(JdbcExpiringCodeStore.class); store.setGenerator(generator); + String registrationPassword = "firstPass1"; + mockMvc.perform(post("/create_account.do") .with(cookieCsrf()) .param("email", userEmail) - .param("password", "secr3T") - .param("password_confirmation", "secr3T") - .param("client_id", "")) + .param("password", registrationPassword) + .param("password_confirmation", registrationPassword)) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("accounts/email_sent")); + + mockMvc.perform(get("/verify_user") + .param("code", "test" + generator.counter.get())) + .andExpect(status().isFound()) + .andReturn(); + + // Clicking the confirmation link only proves ownership of the email address. The + // password supplied on the registration form must not become a usable credential once + // the account is confirmed; the owner must establish the password through the link. + mockMvc.perform(post("/login.do") + .with(cookieCsrf()) + .param("username", userEmail) + .param("password", registrationPassword)) + .andExpect(unauthenticated()); + } + + @Test + void confirmingAccountDoesNotAuthorizePasswordFromEarlierRegistration() throws Exception { + PredictableGenerator generator = new PredictableGenerator(); + JdbcExpiringCodeStore store = webApplicationContext.getBean(JdbcExpiringCodeStore.class); + store.setGenerator(generator); + + String firstRegistrationPassword = "firstPass1"; + String laterRegistrationPassword = "laterPass2"; + + // First registration for the address. + mockMvc.perform(post("/create_account.do") + .with(cookieCsrf()) + .param("email", userEmail) + .param("password", firstRegistrationPassword) + .param("password_confirmation", firstRegistrationPassword)) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("accounts/email_sent")); + + // A later registration for the same still-unconfirmed address. + mockMvc.perform(post("/create_account.do") + .with(cookieCsrf()) + .param("email", userEmail) + .param("password", laterRegistrationPassword) + .param("password_confirmation", laterRegistrationPassword)) .andExpect(status().isFound()) .andExpect(redirectedUrl("accounts/email_sent")); + // The owner confirms the account using the most recent link. mockMvc.perform(get("/verify_user") .param("code", "test" + generator.counter.get())) .andExpect(status().isFound()) - .andExpect(redirectedUrl(LOGIN_REDIRECT)) .andReturn(); + // Confirmation must not authorize the password chosen by the earlier registration. + mockMvc.perform(post("/login.do") + .with(cookieCsrf()) + .param("username", userEmail) + .param("password", firstRegistrationPassword)) + .andExpect(unauthenticated()); + } + + @Test + void confirmingAccountSendsOwnerToForcedPasswordSetup() throws Exception { + PredictableGenerator generator = new PredictableGenerator(); + JdbcExpiringCodeStore store = webApplicationContext.getBean(JdbcExpiringCodeStore.class); + store.setGenerator(generator); + + mockMvc.perform(post("/create_account.do") + .with(cookieCsrf()) + .param("email", userEmail) + .param("password", "secr3T") + .param("password_confirmation", "secr3T")) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("accounts/email_sent")); + + // Confirming the account sends the owner to the reset-password page to establish a password. + MvcResult verifyResult = mockMvc.perform(get("/verify_user") + .param("code", "test" + generator.counter.get())) + .andExpect(status().isFound()) + .andReturn(); + + String location = verifyResult.getResponse().getRedirectedUrl(); + assertThat(location) + .startsWith("/reset_password?code=") + .contains("force_change=true"); + String resetCode = UriComponentsBuilder.fromUriString(location).build().getQueryParams().getFirst("code"); + + // The page explains that a password change is required due to changes in the system. + MvcResult pageResult = mockMvc.perform(get("/reset_password") + .param("code", resetCode) + .param("force_change", "true")) + .andExpect(status().isOk()) + .andExpect(view().name("reset_password")) + .andExpect(model().attribute("message_code", "force_change")) + .andReturn(); + String formCode = (String) pageResult.getModelAndView().getModel().get("code"); + + mockMvc.perform(post("/reset_password.do") + .with(cookieCsrf()) + .param("code", formCode) + .param("email", userEmail) + .param("password", USER_PASSWORD) + .param("password_confirmation", USER_PASSWORD)) + .andExpect(status().isFound()); + + // Once the owner has set their own password, the account can be used to log in. + mockMvc.perform(post("/login.do") + .with(cookieCsrf()) + .param("username", userEmail) + .param("password", USER_PASSWORD)) + .andExpect(authenticated()); + } + + @Test + void creatingAnAccountWithAnEmptyClientId() throws Exception { + PredictableGenerator generator = new PredictableGenerator(); + JdbcExpiringCodeStore store = webApplicationContext.getBean(JdbcExpiringCodeStore.class); + store.setGenerator(generator); + + mockMvc.perform(post("/create_account.do") + .with(cookieCsrf()) + .param("email", userEmail) + .param("password", "secr3T") + .param("password_confirmation", "secr3T") + .param("client_id", "")) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("accounts/email_sent")); + + confirmAccountAndSetPassword("test" + generator.counter.get(), "", userEmail); + MvcResult mvcResult = loginWithAccount("") .andExpect(authenticated()) .andReturn(); @@ -320,11 +437,7 @@ void creatingAnAccountWithNoClientRedirect() throws Exception { assertThat(message.getContentString()).contains("Cloud Foundry"); assertThat(message.getMessage().getHeader("From")).contains("Cloud Foundry "); - mockMvc.perform(get("/verify_user") - .param("code", "test" + generator.counter.get())) - .andExpect(status().isFound()) - .andExpect(redirectedUrl(LOGIN_REDIRECT)) - .andReturn(); + confirmAccountAndSetPassword("test" + generator.counter.get(), "", userEmail); MvcResult mvcResult = loginWithAccount("") .andExpect(authenticated()) @@ -375,12 +488,7 @@ void creatingAnAccountInAnotherZoneWithNoClientRedirect() throws Exception { assertThat(hasLength(link)).isTrue(); assertThat(link).contains(subdomain + ".localhost"); - mockMvc.perform(get("/verify_user") - .param("code", "test" + generator.counter.get()) - .with(new SetServerNameRequestPostProcessor(subdomain + ".localhost"))) - .andExpect(status().isFound()) - .andExpect(redirectedUrl(LOGIN_REDIRECT)) - .andReturn(); + confirmAccountAndSetPassword("test" + generator.counter.get(), subdomain, userEmail); MvcResult mvcResult = loginWithAccount(subdomain) .andExpect(redirectedUrl("/")) @@ -425,11 +533,8 @@ void creatingAnAccountInAnotherZoneWithClientRedirect() throws Exception { assertThat(hasLength(link)).isTrue(); assertThat(link).contains(subdomain + ".localhost"); - mockMvc.perform(get("/verify_user") - .param("code", "test" + generator.counter.get()) - .with(new SetServerNameRequestPostProcessor(subdomain + ".localhost"))) - .andExpect(redirectedUrl(LOGIN_REDIRECT + "&form_redirect_uri=http://myzoneclient.example.com")) - .andReturn(); + String afterReset = confirmAccountAndSetPassword("test" + generator.counter.get(), subdomain, userEmail); + assertThat(afterReset).isEqualTo("/login?success=password_reset&form_redirect_uri=http://myzoneclient.example.com"); MvcResult mvcResult = loginWithAccount(subdomain) .andExpect(authenticated()) @@ -468,14 +573,29 @@ void redirectToSavedRequest_ifPresent() throws Exception { .param("password_confirmation", "test-password")) .andExpect(redirectedUrl("accounts/email_sent")); - mockMvc.perform(get("/verify_user") + MvcResult verifyResult = mockMvc.perform(get("/verify_user") .session(session) .param("code", "test" + generator.counter.get())) .andExpect(status().isFound()) - .andExpect(redirectedUrl(LOGIN_REDIRECT)) .andReturn(); + String location = verifyResult.getResponse().getRedirectedUrl(); + assertThat(location) + .startsWith("/reset_password?code=") + .contains("force_change=true"); + assertThat(SessionUtils.getSavedRequestSession(MockMvcUtils.getZoneSession(session)).getRedirectUrl()).isNotNull(); + + // Consume the reset code so the predictable code sequence does not collide with later tests. + String resetCode = UriComponentsBuilder.fromUriString(location).build().getQueryParams().getFirst("code"); + mockMvc.perform(post("/reset_password.do") + .with(cookieCsrf()) + .session(session) + .param("code", resetCode) + .param("email", "testuser@test.org") + .param("password", USER_PASSWORD) + .param("password_confirmation", USER_PASSWORD)) + .andExpect(status().isFound()); } @Test @@ -600,11 +720,8 @@ private void createAccount(String expectedRedirectUri, String redirectUri) throw assertThat(message.getContentString()).contains("Cloud Foundry"); assertThat(message.getMessage().getHeader("From")).contains("Cloud Foundry "); - mockMvc.perform(get("/verify_user") - .param("code", "test" + generator.counter.get())) - .andExpect(status().isFound()) - .andExpect(redirectedUrl(LOGIN_REDIRECT + "&form_redirect_uri=" + expectedRedirectUri)) - .andReturn(); + String afterReset = confirmAccountAndSetPassword("test" + generator.counter.get(), "", userEmail); + assertThat(afterReset).isEqualTo("/login?success=password_reset&form_redirect_uri=" + expectedRedirectUri); MvcResult mvcResult = loginWithAccount("") .andExpect(authenticated()) @@ -618,6 +735,44 @@ private void createAccount(String expectedRedirectUri, String redirectUri) throw assertThat(principal.getOrigin()).isEqualTo(OriginKeys.UAA); } + /** + * Account confirmation no longer leaves a usable password: clicking the activation link sends + * the owner to the reset-password page to establish their own password. This helper completes + * that flow, confirming the account via {@code /verify_user} and setting the password to + * {@link #USER_PASSWORD} so the account can then be used to log in. + */ + private String confirmAccountAndSetPassword(String activationCode, String subdomain, String email) throws Exception { + MockHttpServletRequestBuilder verify = get("/verify_user").param("code", activationCode); + if (hasText(subdomain)) { + verify.with(new SetServerNameRequestPostProcessor(subdomain + ".localhost")); + } + MvcResult verifyResult = mockMvc.perform(verify) + .andExpect(status().isFound()) + .andReturn(); + + String location = verifyResult.getResponse().getRedirectedUrl(); + assertThat(location) + .startsWith("/reset_password?code=") + .contains("force_change=true"); + String resetCode = UriComponentsBuilder.fromUriString(location).build().getQueryParams().getFirst("code"); + + MockHttpServletRequestBuilder reset = post("/reset_password.do") + .with(cookieCsrf()) + .param("code", resetCode) + .param("email", email) + .param("password", USER_PASSWORD) + .param("password_confirmation", USER_PASSWORD); + if (hasText(subdomain)) { + reset.with(new SetServerNameRequestPostProcessor(subdomain + ".localhost")); + } + // Returns the post-reset redirect so callers can assert the carried signup redirect. + return mockMvc.perform(reset) + .andExpect(status().isFound()) + .andReturn() + .getResponse() + .getRedirectedUrl(); + } + private ResultActions loginWithAccount(String subdomain) throws Exception { MockHttpServletRequestBuilder req = post("/login.do") diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcZonePathTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcZonePathTests.java index e510aedcc09..9ab1efa2069 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcZonePathTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcZonePathTests.java @@ -45,6 +45,7 @@ import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder; import org.springframework.web.context.WebApplicationContext; import org.springframework.web.context.support.StandardServletEnvironment; +import org.springframework.web.util.UriComponentsBuilder; import org.cloudfoundry.identity.uaa.extensions.EnabledIfZonePathsEnabled; import java.util.Collections; @@ -61,12 +62,12 @@ import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.view; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.xpath; import static org.springframework.util.StringUtils.hasLength; +import static org.springframework.util.StringUtils.hasText; @DefaultTestContext @EnabledIfZonePathsEnabled class AccountsControllerMockMvcZonePathTests { - private static final String LOGIN_REDIRECT = "/login?success=verify_success"; private static final String USER_PASSWORD = "secr3T"; private final AlphanumericRandomValueStringGenerator generator = new AlphanumericRandomValueStringGenerator(); private String userEmail; @@ -303,11 +304,7 @@ void creatingAnAccount() throws Exception { ScimUser scimUser = scimUserProvisioning.query("userName eq '" + userEmail + "' and origin eq '" + OriginKeys.UAA + "'", IdentityZoneHolder.get().getId()).getFirst(); assertThat(scimUser.isVerified()).isFalse(); - mockMvc.perform(get("/verify_user") - .param("code", "test" + generator.counter.get())) - .andExpect(status().isFound()) - .andExpect(redirectedUrl(LOGIN_REDIRECT)) - .andReturn(); + confirmAccountAndSetPassword(ZoneResolutionMode.SUBDOMAIN, "", "test" + generator.counter.get(), userEmail); MvcResult mvcResult = loginWithAccount("") .andExpect(authenticated()) @@ -336,11 +333,7 @@ void creatingAnAccountWithAnEmptyClientId() throws Exception { .andExpect(status().isFound()) .andExpect(redirectedUrl("accounts/email_sent")); - mockMvc.perform(get("/verify_user") - .param("code", "test" + generator.counter.get())) - .andExpect(status().isFound()) - .andExpect(redirectedUrl(LOGIN_REDIRECT)) - .andReturn(); + confirmAccountAndSetPassword(ZoneResolutionMode.SUBDOMAIN, "", "test" + generator.counter.get(), userEmail); MvcResult mvcResult = loginWithAccount("") .andExpect(authenticated()) @@ -382,11 +375,7 @@ void creatingAnAccountWithNoClientRedirect() throws Exception { assertThat(message.getContentString()).contains("Cloud Foundry"); assertThat(message.getMessage().getHeader("From")).contains("Cloud Foundry "); - mockMvc.perform(get("/verify_user") - .param("code", "test" + generator.counter.get())) - .andExpect(status().isFound()) - .andExpect(redirectedUrl(LOGIN_REDIRECT)) - .andReturn(); + confirmAccountAndSetPassword(ZoneResolutionMode.SUBDOMAIN, "", "test" + generator.counter.get(), userEmail); MvcResult mvcResult = loginWithAccount("") .andExpect(authenticated()) @@ -441,12 +430,7 @@ void creatingAnAccountInAnotherZoneWithNoClientRedirect(ZoneResolutionMode mode) assertThat(link).contains(subdomain + ".localhost"); } - String expectedVerifyRedirect = mode == ZoneResolutionMode.ZONE_PATH ? "/z/" + subdomain + "/login?success=verify_success" : LOGIN_REDIRECT; - mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.GET, "/verify_user") - .param("code", "test" + generator.counter.get())) - .andExpect(status().isFound()) - .andExpect(redirectedUrl(expectedVerifyRedirect)) - .andReturn(); + confirmAccountAndSetPassword(mode, subdomain, "test" + generator.counter.get(), userEmail); MvcResult mvcResult = loginWithAccount(subdomain) .andExpect(redirectedUrl("/")) @@ -495,13 +479,11 @@ void creatingAnAccountInAnotherZoneWithClientRedirect(ZoneResolutionMode mode) t assertThat(link).contains(subdomain + ".localhost"); } - String expectedVerifyRedirect = mode == ZoneResolutionMode.ZONE_PATH - ? "/z/" + subdomain + "/login?success=verify_success&form_redirect_uri=http://myzoneclient.example.com" - : LOGIN_REDIRECT + "&form_redirect_uri=http://myzoneclient.example.com"; - mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.GET, "/verify_user") - .param("code", "test" + generator.counter.get())) - .andExpect(redirectedUrl(expectedVerifyRedirect)) - .andReturn(); + String afterReset = confirmAccountAndSetPassword(mode, subdomain, "test" + generator.counter.get(), userEmail); + String expectedAfterReset = mode == ZoneResolutionMode.ZONE_PATH + ? "/z/" + subdomain + "/login?success=password_reset&form_redirect_uri=http://myzoneclient.example.com" + : "/login?success=password_reset&form_redirect_uri=http://myzoneclient.example.com"; + assertThat(afterReset).isEqualTo(expectedAfterReset); MvcResult mvcResult = loginWithAccount(subdomain) .andExpect(authenticated()) @@ -540,14 +522,29 @@ void redirectToSavedRequest_ifPresent() throws Exception { .param("password_confirmation", "test-password")) .andExpect(redirectedUrl("accounts/email_sent")); - mockMvc.perform(get("/verify_user") + MvcResult verifyResult = mockMvc.perform(get("/verify_user") .session(session) .param("code", "test" + generator.counter.get())) .andExpect(status().isFound()) - .andExpect(redirectedUrl(LOGIN_REDIRECT)) .andReturn(); + String location = verifyResult.getResponse().getRedirectedUrl(); + assertThat(location) + .startsWith("/reset_password?code=") + .contains("force_change=true"); + assertThat(SessionUtils.getSavedRequestSession(MockMvcUtils.getZoneSession(session)).getRedirectUrl()).isNotNull(); + + // Consume the reset code so the predictable code sequence does not collide with later tests. + String resetCode = UriComponentsBuilder.fromUriString(location).build().getQueryParams().getFirst("code"); + mockMvc.perform(post("/reset_password.do") + .with(cookieCsrf()) + .session(session) + .param("code", resetCode) + .param("email", "testuser@test.org") + .param("password", USER_PASSWORD) + .param("password_confirmation", USER_PASSWORD)) + .andExpect(status().isFound()); } @Test @@ -669,11 +666,8 @@ private void createAccount(String expectedRedirectUri, String redirectUri) throw assertThat(message.getContentString()).contains("Cloud Foundry"); assertThat(message.getMessage().getHeader("From")).contains("Cloud Foundry "); - mockMvc.perform(get("/verify_user") - .param("code", "test" + generator.counter.get())) - .andExpect(status().isFound()) - .andExpect(redirectedUrl(LOGIN_REDIRECT + "&form_redirect_uri=" + expectedRedirectUri)) - .andReturn(); + String afterReset = confirmAccountAndSetPassword(ZoneResolutionMode.SUBDOMAIN, "", "test" + generator.counter.get(), userEmail); + assertThat(afterReset).isEqualTo("/login?success=password_reset&form_redirect_uri=" + expectedRedirectUri); MvcResult mvcResult = loginWithAccount("") .andExpect(authenticated()) @@ -687,6 +681,39 @@ private void createAccount(String expectedRedirectUri, String redirectUri) throw assertThat(principal.getOrigin()).isEqualTo(OriginKeys.UAA); } + /** + * Account confirmation no longer leaves a usable password: clicking the activation link sends + * the owner to the reset-password page to establish their own password. This helper completes + * that flow (zone-resolution aware), confirming the account via {@code /verify_user} and setting + * the password to {@link #USER_PASSWORD} so the account can then be used to log in. + */ + private String confirmAccountAndSetPassword(ZoneResolutionMode mode, String subdomain, String activationCode, String email) throws Exception { + MvcResult verifyResult = mockMvc.perform(mode.createRequestBuilder(subdomain != null ? subdomain : "", HttpMethod.GET, "/verify_user") + .param("code", activationCode)) + .andExpect(status().isFound()) + .andReturn(); + + String location = verifyResult.getResponse().getRedirectedUrl(); + String expectedPrefix = (mode == ZoneResolutionMode.ZONE_PATH && hasText(subdomain)) + ? "/z/" + subdomain + "/reset_password?code=" : "/reset_password?code="; + assertThat(location) + .startsWith(expectedPrefix) + .contains("force_change=true"); + String resetCode = UriComponentsBuilder.fromUriString(location).build().getQueryParams().getFirst("code"); + + // Returns the post-reset redirect so callers can assert the carried signup redirect. + return mockMvc.perform(mode.createRequestBuilder(subdomain != null ? subdomain : "", HttpMethod.POST, "/reset_password.do") + .with(cookieCsrf()) + .param("code", resetCode) + .param("email", email) + .param("password", USER_PASSWORD) + .param("password_confirmation", USER_PASSWORD)) + .andExpect(status().isFound()) + .andReturn() + .getResponse() + .getRedirectedUrl(); + } + private ResultActions loginWithAccount(String subdomain) throws Exception { return loginWithAccount(ZoneResolutionMode.SUBDOMAIN, subdomain); } From 03313203e9a3ec03011ebf2330121097892b8dd1 Mon Sep 17 00:00:00 2001 From: Filip Hanik Date: Thu, 29 Oct 2026 11:36:03 -0700 Subject: [PATCH 02/10] fix: redirects after email change, invitation acceptance and password reset - Email change verification only redirects to a requested redirect_uri that matches a registered redirect URI of the client, or to the client's change_email_redirect_url; otherwise the user goes to the profile page (or the login page when signed out). - The URL carried to /login as form_redirect_uri is URL-encoded after email change, invitation acceptance and password reset, so it arrives as one parameter. --- .../uaa/account/ChangeEmailController.java | 4 +- .../uaa/account/EmailChangeEmailService.java | 4 +- .../ResetPasswordAuthenticationFilter.java | 4 +- .../invitations/InvitationsController.java | 2 +- .../account/EmailChangeEmailServiceTest.java | 47 +++++++- ...ResetPasswordAuthenticationFilterTest.java | 24 +++- .../InvitationsControllerTest.java | 41 +++++++ .../InvitationsControllerZonePathTest.java | 43 ++++++++ .../uaa/login/ChangeEmailControllerTest.java | 43 +++++++- .../integration/feature/ResetPasswordIT.java | 80 ++++++++++---- .../login/AccountsControllerMockMvcTests.java | 21 +++- ...ccountsControllerMockMvcZonePathTests.java | 24 +++- .../login/InvitationsServiceMockMvcTests.java | 51 ++++++++- ...nvitationsServiceMockMvcZonePathTests.java | 15 ++- .../identity/uaa/login/LoginMockMvcTests.java | 100 +++++++++++++++++ .../uaa/login/LoginMockMvcZonePathTests.java | 104 ++++++++++++++++++ .../PasswordResetEndpointMockMvcTests.java | 18 ++- 17 files changed, 582 insertions(+), 43 deletions(-) diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ChangeEmailController.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ChangeEmailController.java index e00a7abe32f..780d0933f52 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ChangeEmailController.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ChangeEmailController.java @@ -25,6 +25,8 @@ import jakarta.servlet.http.HttpServletResponse; import jakarta.validation.Valid; import jakarta.validation.constraints.Email; +import java.net.URLEncoder; +import java.nio.charset.StandardCharsets; import java.util.Map; @Controller @@ -125,7 +127,7 @@ public String verifyEmail(Model model, @RequestParam String code, RedirectAttrib if (redirectLocation == null) { return "redirect:login?success=change_email_success"; } else { - return "redirect:login?success=change_email_success&form_redirect_uri=" + redirectLocation; + return "redirect:login?success=change_email_success&form_redirect_uri=" + URLEncoder.encode(redirectLocation, StandardCharsets.UTF_8); } } } diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailService.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailService.java index d6967aa20e7..9d355761209 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailService.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailService.java @@ -127,7 +127,9 @@ public Map completeVerification(String code) { Set redirectUris = clientDetails.getRegisteredRedirectUri() == null ? Collections.emptySet() : clientDetails.getRegisteredRedirectUri(); String changeEmailRedirectUrl = (String) clientDetails.getAdditionalInformation().get(CHANGE_EMAIL_REDIRECT_URL); - redirectLocation = findMatchingRedirectUri(redirectUris, redirectUri, changeEmailRedirectUrl); + // without a configured fallback, only a requested URI that matches a registered one is used + String matchingRedirectUri = findMatchingRedirectUri(redirectUris, redirectUri, changeEmailRedirectUrl != null ? changeEmailRedirectUrl : ""); + redirectLocation = StringUtils.hasText(matchingRedirectUri) ? matchingRedirectUri : null; } catch (NoSuchClientException _) { // ignore } diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilter.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilter.java index 47084790f4d..13d03c61062 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilter.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilter.java @@ -34,6 +34,8 @@ import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; import java.io.IOException; +import java.net.URLEncoder; +import java.nio.charset.StandardCharsets; import java.sql.Timestamp; public class ResetPasswordAuthenticationFilter extends OncePerRequestFilter { @@ -82,7 +84,7 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse if (!StringUtils.hasText(redirectUri) || "home".equals(redirectUri)) { response.sendRedirect(request.getContextPath() + "/login?success=password_reset"); } else { - response.sendRedirect(request.getContextPath() + "/login?success=password_reset&form_redirect_uri=" + redirectUri); + response.sendRedirect(request.getContextPath() + "/login?success=password_reset&form_redirect_uri=" + URLEncoder.encode(redirectUri, StandardCharsets.UTF_8)); } } catch (InvalidPasswordException e) { if (expiringCode != null) { diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsController.java b/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsController.java index e17d5bbb956..8615d1373c6 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsController.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsController.java @@ -287,7 +287,7 @@ public String acceptInvitation(@RequestParam("password") String password, } String res = "redirect:/login?success=invite_accepted"; if (!invitation.getRedirectUri().equals("/home")) { - res += "&" + FORM_REDIRECT_PARAMETER + "=" + invitation.getRedirectUri(); + res += "&" + FORM_REDIRECT_PARAMETER + "=" + URLEncoder.encode(invitation.getRedirectUri(), StandardCharsets.UTF_8); } return res; } diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailServiceTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailServiceTest.java index 86c48fb6a9c..fd280f23a05 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailServiceTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailServiceTest.java @@ -27,6 +27,8 @@ import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; import org.junit.jupiter.api.extension.ExtendWith; +import org.junit.jupiter.params.ParameterizedTest; +import org.junit.jupiter.params.provider.NullSource; import org.mockito.ArgumentCaptor; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Qualifier; @@ -303,14 +305,55 @@ void completeActivationWithNoRedirectUri() { assertThat(response).containsEntry("redirect_url", "http://fallback.url/redirect"); } + @Test + void completeVerificationWithoutFallbackGivesNoRedirectWhenClientHasNoRegisteredUris() { + UaaClientDetails clientDetails = new UaaClientDetails("client-id", null, null, "authorization_grant", null, null); + + Map response = setUpCompleteActivation("user@example.com", "app", "http://other.example.com/page", clientDetails); + + assertThat(response).containsEntry("redirect_url", null); + } + + @Test + void completeVerificationWithoutFallbackGivesNoRedirectWhenRequestedUriMatchesNoRegisteredUri() { + UaaClientDetails clientDetails = new UaaClientDetails("client-id", null, null, "authorization_grant", null, "http://app.com/*"); + + Map response = setUpCompleteActivation("user@example.com", "app", "http://other.example.com/page", clientDetails); + + assertThat(response).containsEntry("redirect_url", null); + } + + @ParameterizedTest + @NullSource + void completeVerificationWithoutFallbackGivesNoRedirectWhenNoUriIsRequested(String requestedRedirectUri) { + UaaClientDetails clientDetails = new UaaClientDetails("client-id", null, null, "authorization_grant", null, "http://app.com/*"); + + Map response = setUpCompleteActivation("user@example.com", "app", requestedRedirectUri, clientDetails); + + assertThat(response).containsEntry("redirect_url", null); + } + + @Test + void completeVerificationWithoutFallbackKeepsRequestedUriThatMatchesRegisteredUri() { + UaaClientDetails clientDetails = new UaaClientDetails("client-id", null, null, "authorization_grant", null, "http://app.com/*"); + + Map response = setUpCompleteActivation("user@example.com", "app", "http://app.com/redirect", clientDetails); + + assertThat(response).containsEntry("redirect_url", "http://app.com/redirect"); + } + private Map setUpCompleteActivation(String username, String clientId, String redirectUri) { + UaaClientDetails clientDetails = new UaaClientDetails("client-id", null, null, "authorization_grant", null, "http://app.com/*"); + clientDetails.addAdditionalInformation(CHANGE_EMAIL_REDIRECT_URL, "http://fallback.url/redirect"); + return setUpCompleteActivation(username, clientId, redirectUri, clientDetails); + } + + private Map setUpCompleteActivation(String username, String clientId, String redirectUri, UaaClientDetails clientDetails) { Map codeData = new HashMap<>(); codeData.put("user_id", "user-001"); codeData.put("client_id", clientId); codeData.put("redirect_uri", redirectUri); codeData.put("email", "new@example.com"); - UaaClientDetails clientDetails = new UaaClientDetails("client-id", null, null, "authorization_grant", null, "http://app.com/*"); - clientDetails.addAdditionalInformation(CHANGE_EMAIL_REDIRECT_URL, "http://fallback.url/redirect"); when(mockExpiringCodeStore.retrieveCode("the_secret_code", zoneId)).thenReturn(new ExpiringCode("the_secret_code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), null)); ScimUser user = new ScimUser("user-001", username, "", ""); diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilterTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilterTest.java index c3c52c2d227..e663bb846ed 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilterTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilterTest.java @@ -15,6 +15,7 @@ import jakarta.servlet.FilterChain; import jakarta.servlet.http.HttpServletResponse; +import java.nio.charset.StandardCharsets; import java.sql.Timestamp; import static org.assertj.core.api.Assertions.assertThat; @@ -50,6 +51,9 @@ import org.springframework.test.util.ReflectionTestUtils; import org.springframework.test.web.servlet.request.MockMvcRequestBuilders; import org.springframework.util.StringUtils; +import org.springframework.web.util.UriComponents; +import org.springframework.web.util.UriComponentsBuilder; +import org.springframework.web.util.UriUtils; class ResetPasswordAuthenticationFilterTest { @@ -111,6 +115,13 @@ void happy_day_password_reset_with_null_redirect() throws Exception { happy_day_password_reset(resetPasswordResponse.getRedirectUri()); } + @Test + void happy_day_password_reset_with_query_in_redirect() throws Exception { + resetPasswordResponse = new ResetPasswordService.ResetPasswordResponse(user, "http://app.example.com/page?first=1&second=2#fragment", null); + when(service.resetPassword(any(ExpiringCode.class), eq(password))).thenReturn(resetPasswordResponse); + happy_day_password_reset(resetPasswordResponse.getRedirectUri()); + } + @Test void happy_day_password_reset_with_home_redirect() throws Exception { resetPasswordResponse = new ResetPasswordService.ResetPasswordResponse(user, "home", null); @@ -118,6 +129,15 @@ void happy_day_password_reset_with_home_redirect() throws Exception { happy_day_password_reset(""); } + private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) { + UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build(); + assertThat(redirect.getPath()).endsWith("/login"); + assertThat(redirect.getFragment()).isNull(); + assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri"); + assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("password_reset"); + assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri); + } + public void happy_day_password_reset(String redirectUri) throws Exception { filter.doFilterInternal(request, response, chain); //do our assertion @@ -126,7 +146,9 @@ public void happy_day_password_reset(String redirectUri) throws Exception { if (!StringUtils.hasText(redirectUri) || "home".equals(redirectUri)) { verify(response, times(1)).sendRedirect(request.getContextPath() + "/login?success=password_reset"); } else { - verify(response, times(1)).sendRedirect(request.getContextPath() + "/login?success=password_reset&form_redirect_uri=" + redirectUri); + ArgumentCaptor redirectCaptor = ArgumentCaptor.forClass(String.class); + verify(response, times(1)).sendRedirect(redirectCaptor.capture()); + assertRedirectsToLoginWithSingleFormRedirectUri(redirectCaptor.getValue(), redirectUri); } verify(chain, times(0)).doFilter(any(), any()); } diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java index 8cbc501daae..85e56dfaefa 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java @@ -1,5 +1,6 @@ package org.cloudfoundry.identity.uaa.invitations; +import java.nio.charset.StandardCharsets; import org.cloudfoundry.identity.uaa.authentication.UaaPrincipal; import org.cloudfoundry.identity.uaa.authentication.manager.DynamicLdapAuthenticationManager; import org.cloudfoundry.identity.uaa.authentication.manager.DynamicZoneAwareAuthenticationManager; @@ -63,6 +64,9 @@ import java.util.Arrays; import java.util.HashMap; import java.util.Map; +import org.springframework.web.util.UriComponents; +import org.springframework.web.util.UriComponentsBuilder; +import org.springframework.web.util.UriUtils; import static org.assertj.core.api.Assertions.assertThat; import static org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType.INVITATION; @@ -534,6 +538,15 @@ void acceptInvite() throws Exception { verify(invitationsService).acceptInvitation(anyString(), eq("passw0rd")); } + private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) { + UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build(); + assertThat(redirect.getPath()).endsWith("/login"); + assertThat(redirect.getFragment()).isNull(); + assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri"); + assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("invite_accepted"); + assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri); + } + private MockHttpServletRequestBuilder startAcceptInviteFlow(String password, String passwordConfirmation) { String zoneId = IdentityZoneHolder.get().getId(); UaaPrincipal uaaPrincipal = new UaaPrincipal("user-id-001", "user@example.com", "user@example.com", OriginKeys.UAA, null, zoneId); @@ -572,6 +585,34 @@ void acceptInviteWithValidClientRedirect() throws Exception { .andExpect(redirectedUrl("/login?success=invite_accepted&form_redirect_uri=valid.redirect.com")); } + @Test + void acceptInviteKeepsRedirectUrlWithQueryAsOneFormRedirectParameter() throws Exception { + String zoneId = IdentityZoneHolder.get().getId(); + UaaPrincipal uaaPrincipal = new UaaPrincipal("user-id-001", "user@example.com", "user@example.com", OriginKeys.UAA, null, zoneId); + ScimUser user = new ScimUser(uaaPrincipal.getId(), uaaPrincipal.getName(), "fname", "lname"); + user.setPrimaryEmail(user.getUserName()); + + UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(uaaPrincipal, null, UaaAuthority.USER_AUTHORITIES); + SecurityContextHolder.getContext().setAuthentication(token); + + Map codeData = getInvitationsCode(OriginKeys.UAA); + String codeDataString = JsonUtils.writeValueAsString(codeData); + when(expiringCodeStore.retrieveCode("thecode", zoneId)).thenReturn(new ExpiringCode("thecode", new Timestamp(1), codeDataString, INVITATION.name()), null); + when(expiringCodeStore.generateCode(eq(codeDataString), any(), eq(INVITATION.name()), eq(zoneId))).thenReturn(new ExpiringCode("thenewcode", new Timestamp(1), codeDataString, INVITATION.name())); + when(invitationsService.acceptInvitation(anyString(), eq("password"))).thenReturn(new AcceptedInvitation("http://app.example.com/page?first=1&second=2#fragment", user)); + + MockHttpServletRequestBuilder post = post("/invitations/accept.do") + .param("password", "password") + .param("password_confirmation", "password") + .param("code", "thecode"); + + MvcResult result = mockMvc.perform(post) + .andExpect(status().isFound()) + .andReturn(); + + assertRedirectsToLoginWithSingleFormRedirectUri(result.getResponse().getRedirectedUrl(), "http://app.example.com/page?first=1&second=2#fragment"); + } + @Test void acceptInviteWithInvalidClientRedirect() throws Exception { String zoneId = IdentityZoneHolder.get().getId(); diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerZonePathTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerZonePathTest.java index 1db57d5c24b..f94c835a57b 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerZonePathTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerZonePathTest.java @@ -1,5 +1,6 @@ package org.cloudfoundry.identity.uaa.invitations; +import java.nio.charset.StandardCharsets; import org.cloudfoundry.identity.uaa.authentication.UaaPrincipal; import org.cloudfoundry.identity.uaa.authentication.manager.DynamicLdapAuthenticationManager; import org.cloudfoundry.identity.uaa.authentication.manager.DynamicZoneAwareAuthenticationManager; @@ -67,6 +68,9 @@ import java.util.Arrays; import java.util.HashMap; import java.util.Map; +import org.springframework.web.util.UriComponents; +import org.springframework.web.util.UriComponentsBuilder; +import org.springframework.web.util.UriUtils; import static org.assertj.core.api.Assertions.assertThat; import static org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType.INVITATION; @@ -139,6 +143,15 @@ void tearDown() { } /** Uses context path for ZONE_PATH so request matches ZonePathContextRewritingFilter output. */ + private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) { + UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build(); + assertThat(redirect.getPath()).endsWith("/login"); + assertThat(redirect.getFragment()).isNull(); + assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri"); + assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("invite_accepted"); + assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri); + } + private static MockHttpServletRequestBuilder requestGet(ZoneRequestPathMode mode, String pathSuffix) { if (mode.redirectPrefix().isEmpty()) { return get(pathSuffix); @@ -630,6 +643,36 @@ void acceptInviteWithValidClientRedirect(ZoneRequestPathMode mode) throws Except .andExpect(redirectedUrl(expectedRedirect)); } + @ParameterizedTest + @EnumSource(ZoneRequestPathMode.class) + void acceptInviteKeepsRedirectUrlWithQueryAsOneFormRedirectParameter(ZoneRequestPathMode mode) throws Exception { + mode.setZone(); + String zoneId = IdentityZoneHolder.get().getId(); + UaaPrincipal uaaPrincipal = new UaaPrincipal("user-id-001", "user@example.com", "user@example.com", OriginKeys.UAA, null, zoneId); + ScimUser user = new ScimUser(uaaPrincipal.getId(), uaaPrincipal.getName(), "fname", "lname"); + user.setPrimaryEmail(user.getUserName()); + + UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(uaaPrincipal, null, UaaAuthority.USER_AUTHORITIES); + SecurityContextHolder.getContext().setAuthentication(token); + + Map codeData = getInvitationsCode(OriginKeys.UAA); + String codeDataString = JsonUtils.writeValueAsString(codeData); + when(expiringCodeStore.retrieveCode("thecode", zoneId)).thenReturn(new ExpiringCode("thecode", new Timestamp(1), codeDataString, INVITATION.name()), null); + when(expiringCodeStore.generateCode(eq(codeDataString), any(), eq(INVITATION.name()), eq(zoneId))).thenReturn(new ExpiringCode("thenewcode", new Timestamp(1), codeDataString, INVITATION.name())); + when(invitationsService.acceptInvitation(anyString(), eq("password"))).thenReturn(new AcceptedInvitation("http://app.example.com/page?first=1&second=2#fragment", user)); + + MockHttpServletRequestBuilder post = requestPost(mode, "/invitations/accept.do") + .param("password", "password") + .param("password_confirmation", "password") + .param("code", "thecode"); + + MvcResult result = mockMvc.perform(post) + .andExpect(status().isFound()) + .andReturn(); + + assertRedirectsToLoginWithSingleFormRedirectUri(result.getResponse().getRedirectedUrl(), "http://app.example.com/page?first=1&second=2#fragment"); + } + @ParameterizedTest @EnumSource(ZoneRequestPathMode.class) void acceptInviteWithInvalidClientRedirect(ZoneRequestPathMode mode) throws Exception { diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/login/ChangeEmailControllerTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/login/ChangeEmailControllerTest.java index e0189dff362..3006a34f8a1 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/login/ChangeEmailControllerTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/login/ChangeEmailControllerTest.java @@ -30,13 +30,18 @@ import org.springframework.test.context.junit.jupiter.SpringJUnitConfig; import org.springframework.test.context.web.WebAppConfiguration; import org.springframework.test.web.servlet.MockMvc; +import org.springframework.test.web.servlet.MvcResult; import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder; import org.springframework.test.web.servlet.setup.MockMvcBuilders; import org.springframework.web.context.WebApplicationContext; import org.springframework.web.servlet.config.annotation.DefaultServletHandlerConfigurer; import org.springframework.web.servlet.config.annotation.EnableWebMvc; import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; +import org.springframework.web.util.UriComponents; +import org.springframework.web.util.UriComponentsBuilder; +import org.springframework.web.util.UriUtils; +import java.nio.charset.StandardCharsets; import java.util.Collections; import java.util.HashMap; import java.util.Map; @@ -241,9 +246,43 @@ void verifyEmailWithRedirectUrl() throws Exception { .contentType(APPLICATION_FORM_URLENCODED) .param("code", "the_secret_code"); - mockMvc.perform(get) + MvcResult result = mockMvc.perform(get) + .andExpect(status().isFound()) + .andReturn(); + + assertRedirectsToLoginWithSingleFormRedirectUri(result, "//example.com/callback"); + } + + @Test + void verifyEmailKeepsRedirectUrlWithQueryAsOneFormRedirectParameter() throws Exception { + UaaUser user = new UaaUser("user-id-001", "new@example.com", "password", "new@example.com", Collections.emptyList(), "name", "name", null, null, OriginKeys.UAA, null, true, IdentityZoneHolder.get().getId(), "user-id-001", null); + when(uaaUserDatabase.retrieveUserById(anyString())).thenReturn(user); + + Map response = new HashMap<>(); + response.put("userId", "user-id-001"); + response.put("username", "new@example.com"); + response.put("email", "new@example.com"); + response.put("redirect_url", "http://app.example.com/page?first=1&second=2#fragment"); + when(changeEmailService.completeVerification("the_secret_code")).thenReturn(response); + + MockHttpServletRequestBuilder get = get("/verify_email") + .contentType(APPLICATION_FORM_URLENCODED) + .param("code", "the_secret_code"); + + MvcResult result = mockMvc.perform(get) .andExpect(status().isFound()) - .andExpect(redirectedUrl("login?success=change_email_success&form_redirect_uri=//example.com/callback")); + .andReturn(); + + assertRedirectsToLoginWithSingleFormRedirectUri(result, "http://app.example.com/page?first=1&second=2#fragment"); + } + + private static void assertRedirectsToLoginWithSingleFormRedirectUri(MvcResult result, String expectedFormRedirectUri) { + UriComponents redirect = UriComponentsBuilder.fromUriString(result.getResponse().getRedirectedUrl()).build(); + assertThat(redirect.getPath()).isEqualTo("login"); + assertThat(redirect.getFragment()).isNull(); + assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri"); + assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("change_email_success"); + assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri); } @Test diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/ResetPasswordIT.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/ResetPasswordIT.java index a59671fefb5..822fcf22eb6 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/ResetPasswordIT.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/ResetPasswordIT.java @@ -16,6 +16,8 @@ import com.icegreen.greenmail.util.GreenMail; import com.icegreen.greenmail.util.GreenMailUtil; import jakarta.mail.internet.MimeMessage; +import java.net.URLEncoder; +import java.nio.charset.StandardCharsets; import org.cloudfoundry.identity.uaa.client.UaaClientDetails; import org.cloudfoundry.identity.uaa.integration.util.IntegrationTestUtils; import org.cloudfoundry.identity.uaa.login.test.UnlessProfileActive; @@ -33,6 +35,9 @@ import java.security.SecureRandom; import java.util.Collections; +import org.springframework.web.util.UriComponents; +import org.springframework.web.util.UriComponentsBuilder; +import org.springframework.web.util.UriUtils; import static org.apache.commons.lang3.StringUtils.contains; import static org.assertj.core.api.Assertions.assertThat; @@ -116,33 +121,23 @@ void resettingAPasswordWithPrimaryEmail() { @Test void resetPassword_with_clientRedirect() throws Exception { - webDriver.get(baseUrl + "/forgot_password?client_id=" + scimClientId + "&redirect_uri=http://testzonedoesnotexist.localhost"); - assertThat(webDriver.findElement(By.tagName("h1")).getText()).isEqualTo("Reset Password"); - - int receivedEmailSize = greenMail.getReceivedMessages().length; - - webDriver.findElement(By.name("username")).sendKeys(username); - webDriver.clickAndWait(By.xpath("//input[@value='Send reset password link']")); - assertThat(webDriver.findElement(By.tagName("h1")).getText()).isEqualTo("Instructions Sent"); + String finalUrl = resetPasswordWithClientRedirect(scimClientId, "http://testzonedoesnotexist.localhost"); - greenMail.waitForIncomingEmail(5000, receivedEmailSize + 1); - assertThat(greenMail.getReceivedMessages()).hasSize(receivedEmailSize + 1); - MimeMessage message = greenMail.getReceivedMessages()[receivedEmailSize]; - assertThat(message.getHeader("To")[0]).isEqualTo(email); - assertThat(GreenMailUtil.getBody(message)).contains("Reset your password"); - - assertThat(webDriver.findElement(By.cssSelector(".instructions-sent")).getText()).isEqualTo("Please check your email for a reset password link."); + assertRedirectsToLoginWithSingleFormRedirectUri(finalUrl, "http://testzonedoesnotexist.localhost"); + } - String link = testClient.extractLink(GreenMailUtil.getBody(message)); - assertThat(contains(link, "@")).isFalse(); - assertThat(contains(link, "%40")).isFalse(); - webDriver.get(link); + @Test + void resetPassword_keepsClientRedirectWithQueryAsOneFormRedirectParameter() throws Exception { + String redirectUri = "http://testzonedoesnotexist.localhost/page?first=1&second=2#fragment"; + String adminAccessToken = testClient.getOAuthAccessToken("admin", "adminsecret", "client_credentials", "clients.read clients.write clients.secret clients.admin"); + String patternClientId = "pattern_" + new SecureRandom().nextInt(); + UaaClientDetails patternClient = new UaaClientDetails(patternClientId, "oauth", "uaa.user", "authorization_code,refresh_token", null, "http://testzonedoesnotexist.localhost/**"); + patternClient.setClientSecret("scimsecret"); + IntegrationTestUtils.createClient(adminAccessToken, baseUrl, patternClient); - webDriver.findElement(By.name("password")).sendKeys("new_password"); - webDriver.findElement(By.name("password_confirmation")).sendKeys("new_password"); - webDriver.clickAndWait(By.xpath("//input[@value='Create new password']")); + String finalUrl = resetPasswordWithClientRedirect(patternClientId, redirectUri); - assertThat(webDriver.getCurrentUrl()).isEqualTo(baseUrl + "/login?success=password_reset&form_redirect_uri=http://testzonedoesnotexist.localhost"); + assertRedirectsToLoginWithSingleFormRedirectUri(finalUrl, redirectUri); } @Test @@ -237,6 +232,45 @@ void resetPassword_displaysErrorMessage_NewPasswordSameAsOld() { assertThat(webDriver.findElement(By.cssSelector(".error-message")).getText()).contains("Your new password cannot be the same as the old password."); } + private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) { + UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build(); + assertThat(redirect.getPath()).endsWith("/login"); + assertThat(redirect.getFragment()).isNull(); + assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri"); + assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("password_reset"); + assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri); + } + + private String resetPasswordWithClientRedirect(String clientId, String redirectUri) throws Exception { + webDriver.get(baseUrl + "/forgot_password?client_id=" + clientId + "&redirect_uri=" + URLEncoder.encode(redirectUri, StandardCharsets.UTF_8)); + assertThat(webDriver.findElement(By.tagName("h1")).getText()).isEqualTo("Reset Password"); + + int receivedEmailSize = greenMail.getReceivedMessages().length; + + webDriver.findElement(By.name("username")).sendKeys(username); + webDriver.clickAndWait(By.xpath("//input[@value='Send reset password link']")); + assertThat(webDriver.findElement(By.tagName("h1")).getText()).isEqualTo("Instructions Sent"); + + greenMail.waitForIncomingEmail(5000, receivedEmailSize + 1); + assertThat(greenMail.getReceivedMessages()).hasSize(receivedEmailSize + 1); + MimeMessage message = greenMail.getReceivedMessages()[receivedEmailSize]; + assertThat(message.getHeader("To")[0]).isEqualTo(email); + assertThat(GreenMailUtil.getBody(message)).contains("Reset your password"); + + assertThat(webDriver.findElement(By.cssSelector(".instructions-sent")).getText()).isEqualTo("Please check your email for a reset password link."); + + String link = testClient.extractLink(GreenMailUtil.getBody(message)); + assertThat(contains(link, "@")).isFalse(); + assertThat(contains(link, "%40")).isFalse(); + webDriver.get(link); + + webDriver.findElement(By.name("password")).sendKeys("new_password"); + webDriver.findElement(By.name("password_confirmation")).sendKeys("new_password"); + webDriver.clickAndWait(By.xpath("//input[@value='Create new password']")); + + return webDriver.getCurrentUrl(); + } + private void beginPasswordReset(String username) { webDriver.get(baseUrl + "/login"); assertThat(webDriver.getTitle()).isEqualTo("Cloud Foundry"); diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java index 92fdf613db7..865c55bbcc9 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java @@ -1,5 +1,6 @@ package org.cloudfoundry.identity.uaa.login; +import java.nio.charset.StandardCharsets; import org.apache.commons.lang3.RandomStringUtils; import org.cloudfoundry.identity.uaa.DefaultTestContext; import org.cloudfoundry.identity.uaa.account.EmailAccountCreationService; @@ -42,9 +43,11 @@ import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder; import org.springframework.web.context.WebApplicationContext; import org.springframework.web.context.support.StandardServletEnvironment; +import org.springframework.web.util.UriComponents; import org.springframework.web.util.UriComponentsBuilder; import java.util.Collections; +import org.springframework.web.util.UriUtils; import static org.assertj.core.api.Assertions.assertThat; import static org.cloudfoundry.identity.uaa.mock.util.MockMvcUtils.CookieCsrfPostProcessor.cookieCsrf; @@ -414,6 +417,11 @@ void creatingAnAccountWithClientRedirect() throws Exception { createAccount("http://redirect.uri/client", "http://redirect.uri/client"); } + @Test + void creatingAnAccountKeepsClientRedirectWithQueryAsOneFormRedirectParameter() throws Exception { + createAccount("http://redirect.uri/page?first=1&second=2#fragment", "http://redirect.uri/page?first=1&second=2#fragment"); + } + @Test void creatingAnAccountWithFallbackClientRedirect() throws Exception { createAccount("http://redirect.uri/fallback", null); @@ -534,7 +542,7 @@ void creatingAnAccountInAnotherZoneWithClientRedirect() throws Exception { assertThat(link).contains(subdomain + ".localhost"); String afterReset = confirmAccountAndSetPassword("test" + generator.counter.get(), subdomain, userEmail); - assertThat(afterReset).isEqualTo("/login?success=password_reset&form_redirect_uri=http://myzoneclient.example.com"); + assertRedirectsToLoginWithSingleFormRedirectUri(afterReset, "http://myzoneclient.example.com"); MvcResult mvcResult = loginWithAccount(subdomain) .andExpect(authenticated()) @@ -686,6 +694,15 @@ void consentIfConfiguredDisplaysMeaningfulErrorWhenConsentNotProvided() throws E assertThat(result.getResponse().getContentAsString()).contains("Please agree before continuing."); } + private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) { + UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build(); + assertThat(redirect.getPath()).endsWith("/login"); + assertThat(redirect.getFragment()).isNull(); + assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri"); + assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("password_reset"); + assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri); + } + private UaaClientDetails createTestClient() throws Exception { UaaClientDetails clientDetails = new UaaClientDetails(); clientDetails.setClientId("test-client-" + RandomStringUtils.randomAlphanumeric(200)); @@ -721,7 +738,7 @@ private void createAccount(String expectedRedirectUri, String redirectUri) throw assertThat(message.getMessage().getHeader("From")).contains("Cloud Foundry "); String afterReset = confirmAccountAndSetPassword("test" + generator.counter.get(), "", userEmail); - assertThat(afterReset).isEqualTo("/login?success=password_reset&form_redirect_uri=" + expectedRedirectUri); + assertRedirectsToLoginWithSingleFormRedirectUri(afterReset, expectedRedirectUri); MvcResult mvcResult = loginWithAccount("") .andExpect(authenticated()) diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcZonePathTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcZonePathTests.java index 9ab1efa2069..0bedb800a66 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcZonePathTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcZonePathTests.java @@ -1,5 +1,6 @@ package org.cloudfoundry.identity.uaa.login; +import java.nio.charset.StandardCharsets; import org.apache.commons.lang3.RandomStringUtils; import org.cloudfoundry.identity.uaa.DefaultTestContext; import org.cloudfoundry.identity.uaa.account.EmailAccountCreationService; @@ -45,10 +46,12 @@ import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder; import org.springframework.web.context.WebApplicationContext; import org.springframework.web.context.support.StandardServletEnvironment; +import org.springframework.web.util.UriComponents; import org.springframework.web.util.UriComponentsBuilder; import org.cloudfoundry.identity.uaa.extensions.EnabledIfZonePathsEnabled; import java.util.Collections; +import org.springframework.web.util.UriUtils; import static org.assertj.core.api.Assertions.assertThat; import static org.cloudfoundry.identity.uaa.mock.util.MockMvcUtils.CookieCsrfPostProcessor.cookieCsrf; @@ -352,6 +355,11 @@ void creatingAnAccountWithClientRedirect() throws Exception { createAccount("http://redirect.uri/client", "http://redirect.uri/client"); } + @Test + void creatingAnAccountKeepsClientRedirectWithQueryAsOneFormRedirectParameter() throws Exception { + createAccount("http://redirect.uri/page?first=1&second=2#fragment", "http://redirect.uri/page?first=1&second=2#fragment"); + } + @Test void creatingAnAccountWithFallbackClientRedirect() throws Exception { createAccount("http://redirect.uri/fallback", null); @@ -480,10 +488,7 @@ void creatingAnAccountInAnotherZoneWithClientRedirect(ZoneResolutionMode mode) t } String afterReset = confirmAccountAndSetPassword(mode, subdomain, "test" + generator.counter.get(), userEmail); - String expectedAfterReset = mode == ZoneResolutionMode.ZONE_PATH - ? "/z/" + subdomain + "/login?success=password_reset&form_redirect_uri=http://myzoneclient.example.com" - : "/login?success=password_reset&form_redirect_uri=http://myzoneclient.example.com"; - assertThat(afterReset).isEqualTo(expectedAfterReset); + assertRedirectsToLoginWithSingleFormRedirectUri(afterReset, "http://myzoneclient.example.com"); MvcResult mvcResult = loginWithAccount(subdomain) .andExpect(authenticated()) @@ -632,6 +637,15 @@ void consentIfConfiguredDisplaysMeaningfulErrorWhenConsentNotProvided(ZoneResolu assertThat(result.getResponse().getContentAsString()).contains("Please agree before continuing."); } + private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) { + UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build(); + assertThat(redirect.getPath()).endsWith("/login"); + assertThat(redirect.getFragment()).isNull(); + assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri"); + assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("password_reset"); + assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri); + } + private UaaClientDetails createTestClient() throws Exception { UaaClientDetails clientDetails = new UaaClientDetails(); clientDetails.setClientId("test-client-" + RandomStringUtils.randomAlphanumeric(200)); @@ -667,7 +681,7 @@ private void createAccount(String expectedRedirectUri, String redirectUri) throw assertThat(message.getMessage().getHeader("From")).contains("Cloud Foundry "); String afterReset = confirmAccountAndSetPassword(ZoneResolutionMode.SUBDOMAIN, "", "test" + generator.counter.get(), userEmail); - assertThat(afterReset).isEqualTo("/login?success=password_reset&form_redirect_uri=" + expectedRedirectUri); + assertRedirectsToLoginWithSingleFormRedirectUri(afterReset, expectedRedirectUri); MvcResult mvcResult = loginWithAccount("") .andExpect(authenticated()) diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/InvitationsServiceMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/InvitationsServiceMockMvcTests.java index b79a8b1782c..9794c77da1c 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/InvitationsServiceMockMvcTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/InvitationsServiceMockMvcTests.java @@ -14,6 +14,7 @@ package org.cloudfoundry.identity.uaa.login; +import java.nio.charset.StandardCharsets; import org.cloudfoundry.identity.uaa.DefaultTestContext; import org.cloudfoundry.identity.uaa.client.UaaClientDetails; import org.cloudfoundry.identity.uaa.constants.OriginKeys; @@ -48,6 +49,9 @@ import java.net.URL; import java.util.Arrays; import java.util.Collections; +import org.springframework.web.util.UriComponents; +import org.springframework.web.util.UriComponentsBuilder; +import org.springframework.web.util.UriUtils; import static org.assertj.core.api.Assertions.assertThat; import static org.cloudfoundry.identity.uaa.mock.util.MockMvcUtils.CookieCsrfPostProcessor.cookieCsrf; @@ -350,8 +354,8 @@ void acceptInvitationSetsYourPassword() throws Exception { post ) .andExpect(status().isFound()) - .andExpect(redirectedUrl("/login?success=invite_accepted&form_redirect_uri=" + REDIRECT_URI)) .andReturn(); + assertRedirectsToLoginWithSingleFormRedirectUri(result.getResponse().getRedirectedUrl(), REDIRECT_URI); assertThat(queryUserForField(jdbcTemplate, email, "verified", Boolean.class)).as("User should be verified after password reset").isTrue(); @@ -365,6 +369,42 @@ void acceptInvitationSetsYourPassword() throws Exception { .andExpect(redirectedUrl("/login")); } + @Test + void acceptInvitationKeepsRedirectUrlWithQueryAsOneFormRedirectParameter() throws Exception { + String adminToken = MockMvcUtils.getClientCredentialsOAuthAccessToken(mockMvc, "admin", "adminsecret", "clients.admin clients.read clients.write clients.secret scim.read scim.write", null); + String patternClientId = generator.generate().toLowerCase(); + String patternClientSecret = generator.generate().toLowerCase(); + MockMvcUtils.createClient(this.mockMvc, adminToken, patternClientId, patternClientSecret, Collections.singleton("oauth"), Arrays.asList("scim.read", "scim.invite"), Arrays.asList("client_credentials", "password"), "scim.read,scim.invite", Collections.singleton(REDIRECT_URI + "/**"), IdentityZone.getUaa()); + String patternInviteToken = MockMvcUtils.getScimInviteUserToken(mockMvc, patternClientId, patternClientSecret, null, "admin", "adminsecret"); + String redirectUri = REDIRECT_URI + "/page?first=1&second=2#fragment"; + + String email = generator.generate().toLowerCase() + "@test.org"; + URL inviteLink = MockMvcUtils.inviteUser(webApplicationContext, mockMvc, email, patternInviteToken, null, patternClientId, OriginKeys.UAA, redirectUri); + + String code = extractInvitationCode(inviteLink.toString()); + MvcResult result = mockMvc.perform(get("/invitations/accept") + .param("code", code) + .accept(MediaType.TEXT_HTML)) + .andExpect(status().isOk()) + .andReturn(); + + code = jdbcTemplate.queryForObject("SELECT code FROM expiring_code_store", String.class); + MockHttpSession session = (MockHttpSession) result.getRequest().getSession(false); + MockHttpServletRequestBuilder post = post("/invitations/accept.do") + .param("password", "s3cret") + .param("password_confirmation", "s3cret") + .param("code", code) + .with(cookieCsrf()); + if (session != null) { + post = post.session(session); + } + result = mockMvc.perform(post) + .andExpect(status().isFound()) + .andReturn(); + + assertRedirectsToLoginWithSingleFormRedirectUri(result.getResponse().getRedirectedUrl(), redirectUri); + } + @Test void inviteLdapUsersVerifiesAndRedirects() throws Exception { ZoneScimInviteData zone = createZoneForInvites(mockMvc, webApplicationContext, clientId); @@ -425,6 +465,15 @@ void inviteSamlUserWillRedirectUponAccept() throws Exception { assertThat(queryUserForField(jdbcTemplate, email, "verified", Boolean.class)).as("Saml user should not yet be verified after clicking on the accept link").isFalse(); } + private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) { + UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build(); + assertThat(redirect.getPath()).endsWith("/login"); + assertThat(redirect.getFragment()).isNull(); + assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri"); + assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("invite_accepted"); + assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri); + } + private static T queryUserForField(JdbcTemplate jdbcTemplate, String email, String field, Class type) { return jdbcTemplate.queryForObject("SELECT " + field + " FROM users WHERE email=?", type, email); } diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/InvitationsServiceMockMvcZonePathTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/InvitationsServiceMockMvcZonePathTests.java index 2ecbf9f86d9..c5ccc72ffba 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/InvitationsServiceMockMvcZonePathTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/InvitationsServiceMockMvcZonePathTests.java @@ -14,6 +14,7 @@ package org.cloudfoundry.identity.uaa.login; +import java.nio.charset.StandardCharsets; import org.cloudfoundry.identity.uaa.DefaultTestContext; import org.cloudfoundry.identity.uaa.client.UaaClientDetails; import org.cloudfoundry.identity.uaa.constants.OriginKeys; @@ -60,6 +61,9 @@ import org.cloudfoundry.identity.uaa.util.JsonUtils; import java.net.URL; +import org.springframework.web.util.UriComponents; +import org.springframework.web.util.UriComponentsBuilder; +import org.springframework.web.util.UriUtils; import static org.cloudfoundry.identity.uaa.oauth.common.util.OAuth2Utils.CLIENT_ID; import static org.springframework.http.MediaType.APPLICATION_JSON; @@ -628,8 +632,8 @@ void acceptInvitationSetsYourPassword() throws Exception { post ) .andExpect(status().isFound()) - .andExpect(redirectedUrl("/login?success=invite_accepted&form_redirect_uri=" + REDIRECT_URI)) .andReturn(); + assertRedirectsToLoginWithSingleFormRedirectUri(result.getResponse().getRedirectedUrl(), REDIRECT_URI); assertThat(queryUserForField(jdbcTemplate, email, "verified", Boolean.class)).as("User should be verified after password reset").isTrue(); @@ -762,6 +766,15 @@ void inviteSamlUserWillRedirectUponAccept() throws Exception { assertThat(queryUserForField(jdbcTemplate, email, "verified", Boolean.class)).as("Saml user should not yet be verified after clicking on the accept link").isFalse(); } + private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) { + UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build(); + assertThat(redirect.getPath()).endsWith("/login"); + assertThat(redirect.getFragment()).isNull(); + assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri"); + assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("invite_accepted"); + assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri); + } + private static T queryUserForField(JdbcTemplate jdbcTemplate, String email, String field, Class type) { return jdbcTemplate.queryForObject("SELECT " + field + " FROM users WHERE email=?", type, email); } diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcTests.java index 2f39d6ceca8..fb44627b094 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcTests.java @@ -10,6 +10,7 @@ import org.cloudfoundry.identity.uaa.codestore.ExpiringCodeStore; import org.cloudfoundry.identity.uaa.codestore.JdbcExpiringCodeStore; import org.cloudfoundry.identity.uaa.impl.config.IdentityZoneConfigurationBootstrap; +import org.cloudfoundry.identity.uaa.message.util.FakeJavaMailSender; import org.cloudfoundry.identity.uaa.mock.util.MockMvcUtils; import org.cloudfoundry.identity.uaa.oauth.client.ClientConstants; import org.cloudfoundry.identity.uaa.oauth.common.util.RandomValueStringGenerator; @@ -73,7 +74,9 @@ import org.springframework.test.web.servlet.request.MockMvcRequestBuilders; import org.springframework.util.StringUtils; import org.springframework.web.context.WebApplicationContext; +import org.springframework.web.util.UriComponents; import org.springframework.web.util.UriComponentsBuilder; +import org.springframework.web.util.UriUtils; import java.io.File; import java.net.URI; @@ -2032,6 +2035,94 @@ void changeEmailSubmitWithCorrectCsrf() throws Exception { } + @Test + void changeEmailVerificationGoesToProfileWhenClientHasNoRedirectUrisAndRequestedUriIsNotRegistered() throws Exception { + assumeFalse(isLimitedMode(limitedModeUaaFilter.getFilter()), "Test only runs in non limited mode."); + String username = generator.generate() + "@testdomain.com"; + createUser(scimUserProvisioning, username, IdentityZone.getUaaZoneId()); + SecurityContext userContext = getUaaSecurityContext(username, webApplicationContext, IdentityZoneHolder.getCurrentZoneId()); + + String clientId = generator.generate(); + UaaClientDetails client = new UaaClientDetails(clientId, "", "", "client_credentials", "uaa.none"); + client.setClientSecret(clientId); + MockMvcUtils.createClient(webApplicationContext, client, getUaa()); + + FakeJavaMailSender sender = webApplicationContext.getBean(FakeJavaMailSender.class); + sender.clearMessage(); + + MockHttpSession session = (MockHttpSession) mockMvc.perform(get("/change_email") + .accept(TEXT_HTML) + .with(securityContext(userContext))) + .andExpect(status().isOk()) + .andReturn().getRequest().getSession(); + + mockMvc.perform(post("/change_email.do") + .accept(TEXT_HTML) + .session(session) + .with(securityContext(userContext)) + .with(cookieCsrf()) + .param("newEmail", generator.generate() + "@testdomain.com") + .param("client_id", clientId) + .param("redirect_uri", "http://other.example.com/page")) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("email_sent?code=email_change")); + + Matcher matcher = Pattern.compile("verify_email\\?code=([A-Za-z0-9_-]+)").matcher(sender.getSentMessages().getFirst().getContentString()); + assertThat(matcher.find()).isTrue(); + + mockMvc.perform(get("/verify_email") + .accept(TEXT_HTML) + .session(session) + .with(securityContext(userContext)) + .param("code", matcher.group(1))) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("profile?success_message_code=email_change.success")); + } + + @Test + void changeEmailVerificationKeepsRedirectUrlAsOneFormRedirectParameterWhenNotSignedIn() throws Exception { + assumeFalse(isLimitedMode(limitedModeUaaFilter.getFilter()), "Test only runs in non limited mode."); + String username = generator.generate() + "@testdomain.com"; + createUser(scimUserProvisioning, username, IdentityZone.getUaaZoneId()); + SecurityContext userContext = getUaaSecurityContext(username, webApplicationContext, IdentityZoneHolder.getCurrentZoneId()); + + String clientId = generator.generate(); + UaaClientDetails client = new UaaClientDetails(clientId, "", "", "client_credentials", "uaa.none", "http://app.example.com/**"); + client.setClientSecret(clientId); + MockMvcUtils.createClient(webApplicationContext, client, getUaa()); + + FakeJavaMailSender sender = webApplicationContext.getBean(FakeJavaMailSender.class); + sender.clearMessage(); + + MockHttpSession session = (MockHttpSession) mockMvc.perform(get("/change_email") + .accept(TEXT_HTML) + .with(securityContext(userContext))) + .andExpect(status().isOk()) + .andReturn().getRequest().getSession(); + + mockMvc.perform(post("/change_email.do") + .accept(TEXT_HTML) + .session(session) + .with(securityContext(userContext)) + .with(cookieCsrf()) + .param("newEmail", generator.generate() + "@testdomain.com") + .param("client_id", clientId) + .param("redirect_uri", "http://app.example.com/page?first=1&second=2#fragment")) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("email_sent?code=email_change")); + + Matcher matcher = Pattern.compile("verify_email\\?code=([A-Za-z0-9_-]+)").matcher(sender.getSentMessages().getFirst().getContentString()); + assertThat(matcher.find()).isTrue(); + + MvcResult result = mockMvc.perform(get("/verify_email") + .accept(TEXT_HTML) + .param("code", matcher.group(1))) + .andExpect(status().isFound()) + .andReturn(); + + assertRedirectsToLoginWithSingleFormRedirectUri(result.getResponse().getRedirectedUrl(), "http://app.example.com/page?first=1&second=2#fragment"); + } + @Test void changeEmailDoNotLoggedIn() throws Exception { assumeFalse(isLimitedMode(limitedModeUaaFilter.getFilter()), "Test only runs in non limited mode."); @@ -3061,6 +3152,15 @@ public Map getParameterMap() { }; } + private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) { + UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build(); + assertThat(redirect.getPath()).endsWith("login"); + assertThat(redirect.getFragment()).isNull(); + assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri"); + assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("change_email_success"); + assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri); + } + private static ScimUser createUser(ScimUserProvisioning scimUserProvisioning, AlphanumericRandomValueStringGenerator generator, String zoneId) { String username = generator.generate() + "@testdomain.com"; return createUser(scimUserProvisioning, username, zoneId); diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcZonePathTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcZonePathTests.java index a84fe9c23dc..0d7249d64e6 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcZonePathTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcZonePathTests.java @@ -10,6 +10,7 @@ import org.cloudfoundry.identity.uaa.codestore.ExpiringCodeStore; import org.cloudfoundry.identity.uaa.codestore.JdbcExpiringCodeStore; import org.cloudfoundry.identity.uaa.impl.config.IdentityZoneConfigurationBootstrap; +import org.cloudfoundry.identity.uaa.message.util.FakeJavaMailSender; import org.cloudfoundry.identity.uaa.mock.util.MockMvcUtils; import org.cloudfoundry.identity.uaa.oauth.client.ClientConstants; import org.cloudfoundry.identity.uaa.oauth.common.util.RandomValueStringGenerator; @@ -77,7 +78,9 @@ import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder; import org.springframework.util.StringUtils; import org.springframework.web.context.WebApplicationContext; +import org.springframework.web.util.UriComponents; import org.springframework.web.util.UriComponentsBuilder; +import org.springframework.web.util.UriUtils; import org.cloudfoundry.identity.uaa.extensions.EnabledIfZonePathsEnabled; import java.io.File; @@ -359,6 +362,98 @@ void access_login_page_while_logged_in(ZoneResolutionMode mode) throws Exception .andExpect(redirectedUrl(expectedRedirect)); } + @ParameterizedTest + @EnumSource(ZoneResolutionMode.class) + void changeEmailVerificationGoesToProfileWhenClientHasNoRedirectUrisAndRequestedUriIsNotRegistered(ZoneResolutionMode mode) throws Exception { + assumeFalse(isLimitedMode(limitedModeUaaFilter.getFilter()), "Zone creation returns 503 in limited mode."); + String subdomain = new AlphanumericRandomValueStringGenerator(24).generate().toLowerCase(); + IdentityZone zone = MockMvcUtils.createOtherIdentityZone(subdomain, mockMvc, webApplicationContext, false, IdentityZoneHolder.getCurrentZoneId()); + ScimUser zoneUser = createUser(scimUserProvisioning, generator, zone.getId()); + SecurityContext userContext = getUaaSecurityContext(zoneUser.getUserName(), webApplicationContext, zone.getId()); + + String clientId = generator.generate(); + UaaClientDetails client = new UaaClientDetails(clientId, "", "", "client_credentials", "uaa.none"); + client.setClientSecret(clientId); + MockMvcUtils.createClient(webApplicationContext, client, zone); + + FakeJavaMailSender sender = webApplicationContext.getBean(FakeJavaMailSender.class); + sender.clearMessage(); + + MockHttpSession session = (MockHttpSession) mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.GET, "/change_email") + .accept(TEXT_HTML) + .with(securityContext(userContext))) + .andExpect(status().isOk()) + .andReturn().getRequest().getSession(); + + mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, "/change_email.do") + .accept(TEXT_HTML) + .session(session) + .with(securityContext(userContext)) + .with(cookieCsrf()) + .param("newEmail", generator.generate() + "@testdomain.com") + .param("client_id", clientId) + .param("redirect_uri", "http://other.example.com/page")) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("email_sent?code=email_change")); + + Matcher matcher = Pattern.compile("verify_email\\?code=([A-Za-z0-9_-]+)").matcher(sender.getSentMessages().getFirst().getContentString()); + assertThat(matcher.find()).isTrue(); + + mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.GET, "/verify_email") + .accept(TEXT_HTML) + .session(session) + .with(securityContext(userContext)) + .param("code", matcher.group(1))) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("profile?success_message_code=email_change.success")); + } + + @ParameterizedTest + @EnumSource(ZoneResolutionMode.class) + void changeEmailVerificationKeepsRedirectUrlAsOneFormRedirectParameterWhenNotSignedIn(ZoneResolutionMode mode) throws Exception { + assumeFalse(isLimitedMode(limitedModeUaaFilter.getFilter()), "Zone creation returns 503 in limited mode."); + String subdomain = new AlphanumericRandomValueStringGenerator(24).generate().toLowerCase(); + IdentityZone zone = MockMvcUtils.createOtherIdentityZone(subdomain, mockMvc, webApplicationContext, false, IdentityZoneHolder.getCurrentZoneId()); + ScimUser zoneUser = createUser(scimUserProvisioning, generator, zone.getId()); + SecurityContext userContext = getUaaSecurityContext(zoneUser.getUserName(), webApplicationContext, zone.getId()); + + String clientId = generator.generate(); + UaaClientDetails client = new UaaClientDetails(clientId, "", "", "client_credentials", "uaa.none", "http://app.example.com/**"); + client.setClientSecret(clientId); + MockMvcUtils.createClient(webApplicationContext, client, zone); + + FakeJavaMailSender sender = webApplicationContext.getBean(FakeJavaMailSender.class); + sender.clearMessage(); + + MockHttpSession session = (MockHttpSession) mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.GET, "/change_email") + .accept(TEXT_HTML) + .with(securityContext(userContext))) + .andExpect(status().isOk()) + .andReturn().getRequest().getSession(); + + mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, "/change_email.do") + .accept(TEXT_HTML) + .session(session) + .with(securityContext(userContext)) + .with(cookieCsrf()) + .param("newEmail", generator.generate() + "@testdomain.com") + .param("client_id", clientId) + .param("redirect_uri", "http://app.example.com/page?first=1&second=2#fragment")) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("email_sent?code=email_change")); + + Matcher matcher = Pattern.compile("verify_email\\?code=([A-Za-z0-9_-]+)").matcher(sender.getSentMessages().getFirst().getContentString()); + assertThat(matcher.find()).isTrue(); + + MvcResult result = mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.GET, "/verify_email") + .accept(TEXT_HTML) + .param("code", matcher.group(1))) + .andExpect(status().isFound()) + .andReturn(); + + assertRedirectsToLoginWithSingleFormRedirectUri(result.getResponse().getRedirectedUrl(), "http://app.example.com/page?first=1&second=2#fragment"); + } + @ParameterizedTest @EnumSource(ZoneResolutionMode.class) void invalid_accept_media_type(ZoneResolutionMode mode) throws Exception { @@ -3670,6 +3765,15 @@ public Map getParameterMap() { }; } + private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) { + UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build(); + assertThat(redirect.getPath()).endsWith("login"); + assertThat(redirect.getFragment()).isNull(); + assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri"); + assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("change_email_success"); + assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri); + } + private static ScimUser createUser(ScimUserProvisioning scimUserProvisioning, AlphanumericRandomValueStringGenerator generator, String zoneId) { String username = generator.generate() + "@testdomain.com"; return createUser(scimUserProvisioning, username, zoneId); diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/PasswordResetEndpointMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/PasswordResetEndpointMockMvcTests.java index 8faba60ee7e..1ff7ba8ea95 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/PasswordResetEndpointMockMvcTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/PasswordResetEndpointMockMvcTests.java @@ -1,5 +1,9 @@ package org.cloudfoundry.identity.uaa.scim.endpoints; +import java.nio.charset.StandardCharsets; +import org.springframework.web.util.UriComponents; +import org.springframework.web.util.UriComponentsBuilder; +import org.springframework.web.util.UriUtils; import tools.jackson.core.type.TypeReference; import org.cloudfoundry.identity.uaa.DefaultTestContext; import org.cloudfoundry.identity.uaa.codestore.ExpiringCode; @@ -186,9 +190,10 @@ void changePasswordDoWithClientidAndRedirecturi() throws Exception { .param("password_confirmation", "newpass") .with(cookieCsrf()); - mockMvc.perform(post) + MvcResult resetResult = mockMvc.perform(post) .andExpect(status().is3xxRedirection()) - .andExpect(redirectedUrl(webApplicationContext.getServletContext().getContextPath() + "/login?success=password_reset&form_redirect_uri=http://localhost:8080/app/")); + .andReturn(); + assertRedirectsToLoginWithSingleFormRedirectUri(resetResult.getResponse().getRedirectedUrl(), "http://localhost:8080/app/"); post = post("/login.do") .param("username", scimUser.getUserName()) @@ -285,6 +290,15 @@ void zoneAdminCanResetsAndChangePassword() throws Exception { .andExpect(jsonPath("$.code").isNotEmpty()); } + private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) { + UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build(); + assertThat(redirect.getPath()).endsWith("/login"); + assertThat(redirect.getFragment()).isNull(); + assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri"); + assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("password_reset"); + assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri); + } + private static String getExpiringCode(MockMvc mockMvc, String clientId, String redirectUri, String loginToken, ScimUser scimUser) throws Exception { MockHttpServletRequestBuilder post = post("/password_resets") .header("Authorization", "Bearer " + loginToken) From d5ace057ff9fd256cf40b2982f0c4aed5d0bf17c Mon Sep 17 00:00:00 2001 From: Filip Hanik Date: Thu, 29 Oct 2026 11:36:03 -0700 Subject: [PATCH 03/10] fix: expiring code intents and reset code lifetime - POST /Codes requires a non-blank intent and stores it as given; a missing or blank intent is answered with 400. Documented in UAA-APIs.rst and the API docs. - Passcode login requires the intent the passcode endpoint stores ("PASSCODE "). - Opening a password reset link, or submitting a rejected password, no longer extends the lifetime of the reset code; opening the link again shows the form. --- docs/UAA-APIs.rst | 49 ++++++++++++ .../ResetPasswordAuthenticationFilter.java | 3 +- .../uaa/account/ResetPasswordController.java | 6 +- .../PasscodeAuthenticationFilter.java | 3 +- .../uaa/codestore/CodeStoreEndpoints.java | 13 +++- .../uaa/codestore/JdbcExpiringCodeStore.java | 4 + ...ResetPasswordAuthenticationFilterTest.java | 30 ++++++++ .../PasscodeAuthenticationFilterTest.java | 76 ++++++++++++++++++- .../codestore/CodeStoreEndpointsTests.java | 62 +++++++++++---- .../login/ResetPasswordControllerTest.java | 19 ++++- .../source/index.html.md.erb | 29 +++++++ .../integration/feature/InvitationsIT.java | 2 +- .../integration/feature/ResetPasswordIT.java | 6 ++ .../ResetPasswordControllerMockMvcTests.java | 38 ++++++++++ ...asswordControllerMockMvcZonePathTests.java | 36 +++++++++ .../mock/codestore/CodeStoreEndpointDocs.java | 60 +++++++++++++++ .../CodeStoreEndpointsMockMvcTests.java | 59 +++++++++++--- ...odeStoreEndpointsMockMvcZonePathTests.java | 61 +++++++++++---- 18 files changed, 504 insertions(+), 52 deletions(-) create mode 100644 uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointDocs.java diff --git a/docs/UAA-APIs.rst b/docs/UAA-APIs.rst index 4835dfd30e8..3ea3d54608e 100644 --- a/docs/UAA-APIs.rst +++ b/docs/UAA-APIs.rst @@ -2136,6 +2136,55 @@ Change Email Flow: $ curl 'http://localhost:8080/email_changes' -i -X POST -H 'Content-Type: application/json' -d 6FfI4o +Create a Code: ``POST /Codes`` +------------------------------ + +Stores a one time code and returns it. Codes are stored per identity zone and can be read back once with ``GET /Codes/{code}``. + +* Request: ``POST /Codes`` + +* Authorization: a token with the scope ``oauth.login`` or a UAA admin token. + +* Request Body:: + + { + "data": "{\"user_id\":\"a-user-id\"}", + "expiresAt": 1792688400000, + "intent": "MY_APPLICATION_CODE" + } + + ``data`` (required) is stored with the code, as a string. ``expiresAt`` (required) is milliseconds since the epoch and must be in the future. + ``intent`` (required, not blank) says what the code may be used for. + +* Intents: + + The UAA flows accept a code only when its intent matches the flow, and the match is case sensitive: + + * ``EMAIL``: email change verification (``POST /email_changes`` and ``/verify_email``) + * ``INVITATION``: invitation acceptance (``/invitations/accept``) + * ``REGISTRATION``: account activation (``/verify_user``) + + Any other value is stored as given; use it for codes that your own application creates and redeems. + Intents that the UAA creates for its own flows (for example the ones for password reset, autologin and passcodes) are also stored as given. + Codes stored without an intent before this requirement was added remain redeemable until they expire. + +* Response Codes:: + + 201 - Created + 400 - Bad Request (the intent is missing or blank, data or expiresAt are missing, or expiresAt is in the past) + 401 - Unauthorized + 403 - Forbidden + +* Error message for a missing intent:: + + intent is required. Known intents: EMAIL, INVITATION, REGISTRATION; custom values are accepted. + +* Example CURL :: + + $ curl 'http://localhost:8080/Codes' -i -X POST -H 'Content-Type: application/json' -H 'Authorization: Bearer ' \ + -d '{"data":"{}","expiresAt":1792688400000,"intent":"MY_APPLICATION_CODE"}' + + Verify User Links: ``GET /Users/{id}/verify-link`` -------------------------------------------------- diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilter.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilter.java index 13d03c61062..7c5e0073771 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilter.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilter.java @@ -36,7 +36,6 @@ import java.io.IOException; import java.net.URLEncoder; import java.nio.charset.StandardCharsets; -import java.sql.Timestamp; public class ResetPasswordAuthenticationFilter extends OncePerRequestFilter { private final ResetPasswordService service; @@ -102,7 +101,7 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse } private void refreshCode(HttpServletRequest request, ExpiringCode expiringCode) { - ExpiringCode newCode = expiringCodeStore.generateCode(expiringCode.getData(), new Timestamp(System.currentTimeMillis() + 1000 * 60 * 10), expiringCode.getIntent(), IdentityZoneHolder.get().getId()); + ExpiringCode newCode = expiringCodeStore.generateCode(expiringCode.getData(), expiringCode.getExpiresAt(), expiringCode.getIntent(), IdentityZoneHolder.get().getId()); request.setAttribute("code", newCode.getCode()); } diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordController.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordController.java index 3c98b278aaa..6a6ed112844 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordController.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordController.java @@ -35,7 +35,6 @@ import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; import jakarta.servlet.http.HttpSession; -import java.sql.Timestamp; import java.util.Map; import static org.cloudfoundry.identity.uaa.account.UaaResetPasswordService.FORGOT_PASSWORD_INTENT_PREFIX; @@ -179,15 +178,14 @@ public String resetPasswordPage(Model model, @RequestParam("code") String code, @RequestParam(value = "force_change", required = false) boolean forceChange) { - ExpiringCode expiringCode = checkIfUserExists(codeStore.retrieveCode(code, identityZoneManager.getCurrentIdentityZone().getId())); + ExpiringCode expiringCode = checkIfUserExists(codeStore.peekCode(code, identityZoneManager.getCurrentIdentityZone().getId())); if (expiringCode == null) { return handleUnprocessableEntity(model, response, "message_code", "bad_code"); } else { PasswordChange passwordChange = JsonUtils.readValue(expiringCode.getData(), PasswordChange.class); String userId = passwordChange.getUserId(); UaaUser uaaUser = userDatabase.retrieveUserById(userId); - String newCode = codeStore.generateCode(expiringCode.getData(), new Timestamp(System.currentTimeMillis() + (10 * 60 * 1000)), expiringCode.getIntent(), identityZoneManager.getCurrentIdentityZoneId()).getCode(); - model.addAttribute("code", newCode); + model.addAttribute("code", expiringCode.getCode()); model.addAttribute("email", uaaUser.getEmail()); model.addAttribute("username", uaaUser.getUsername()); if (forceChange) { diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/authentication/PasscodeAuthenticationFilter.java b/server/src/main/java/org/cloudfoundry/identity/uaa/authentication/PasscodeAuthenticationFilter.java index f727afd43d4..52177fb46d6 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/authentication/PasscodeAuthenticationFilter.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/authentication/PasscodeAuthenticationFilter.java @@ -16,6 +16,7 @@ import org.cloudfoundry.identity.uaa.codestore.ExpiringCode; import org.cloudfoundry.identity.uaa.codestore.ExpiringCodeStore; +import org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType; import org.cloudfoundry.identity.uaa.constants.OriginKeys; import org.cloudfoundry.identity.uaa.oauth.provider.OAuth2RequestFactory; import org.cloudfoundry.identity.uaa.passcode.PasscodeInformation; @@ -194,7 +195,7 @@ public Authentication authenticate(Authentication authentication) throws Authent } } - if (pi == null) { + if (pi == null || !(ExpiringCodeType.PASSCODE + " " + pi.getUserId()).equals(eCode.getIntent())) { throw new InsufficientAuthenticationException("Invalid passcode"); } logger.debug("Successful passcode authentication request for {}", pi.getUsername()); diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpoints.java b/server/src/main/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpoints.java index f9b47ac1524..eb3da1b349c 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpoints.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpoints.java @@ -13,9 +13,16 @@ import jakarta.servlet.http.HttpServletRequest; +import static org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType.EMAIL; +import static org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType.INVITATION; +import static org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType.REGISTRATION; + @Controller public class CodeStoreEndpoints { + private static final String INTENT_REQUIRED_MESSAGE = "intent is required. Known intents: " + + String.join(", ", EMAIL.name(), INVITATION.name(), REGISTRATION.name()) + "; custom values are accepted."; + private final ExpiringCodeStore expiringCodeStore; private final HttpMessageConverter[] messageConverters; private final IdentityZoneManager identityZoneManager; @@ -33,8 +40,12 @@ public class CodeStoreEndpoints { @ResponseStatus(HttpStatus.CREATED) @ResponseBody public ExpiringCode generateCode(@RequestBody ExpiringCode expiringCode) { + String intent = expiringCode.getIntent(); + if (intent == null || intent.isBlank()) { + throw new CodeStoreException(INTENT_REQUIRED_MESSAGE, HttpStatus.BAD_REQUEST); + } try { - return expiringCodeStore.generateCode(expiringCode.getData(), expiringCode.getExpiresAt(), null, identityZoneManager.getCurrentIdentityZoneId()); + return expiringCodeStore.generateCode(expiringCode.getData(), expiringCode.getExpiresAt(), intent, identityZoneManager.getCurrentIdentityZoneId()); } catch (NullPointerException _) { throw new CodeStoreException("data and expiresAt are required.", HttpStatus.BAD_REQUEST); } catch (IllegalArgumentException _) { diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/codestore/JdbcExpiringCodeStore.java b/server/src/main/java/org/cloudfoundry/identity/uaa/codestore/JdbcExpiringCodeStore.java index 040fc8a1b9b..7975538f345 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/codestore/JdbcExpiringCodeStore.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/codestore/JdbcExpiringCodeStore.java @@ -154,6 +154,10 @@ public ExpiringCode retrieveCode(String code, String zoneId) { if (expiringCode != null && expiringCode.getExpiresAt().getTime() < timeService.getCurrentTimeMillis()) { expiringCode = null; } + if (expiringCode != null && expiringCode.getIntent() == null) { + // codes stored without an intent predate required intents; each is redeemed once, so this logs at most once per code + logger.debug("Redeemed an expiring code stored without an intent, zoneId={}", zoneId); + } return expiringCode; } catch (EmptyResultDataAccessException _) { return null; diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilterTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilterTest.java index e663bb846ed..95059dbdb84 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilterTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilterTest.java @@ -181,6 +181,36 @@ void error_during_password_reset_invalid_password_exception() throws Exception { verify(service, times(1)).resetPassword(any(ExpiringCode.class), eq(password)); } + @Test + void rejected_password_does_not_extend_the_code_lifetime() throws Exception { + when(service.resetPassword(any(ExpiringCode.class), anyString())).thenThrow(new InvalidPasswordException("failed", HttpStatus.BAD_REQUEST)); + + assertThat(codeLifetimeAfterFailedSubmit(false)).isNotNull(); + } + + @Test + void mismatched_confirmation_does_not_extend_the_code_lifetime() throws Exception { + assertThat(codeLifetimeAfterFailedSubmit(true)).isNotNull(); + } + + private ExpiringCode codeLifetimeAfterFailedSubmit(boolean mismatchedConfirmation) throws Exception { + var store = new InMemoryExpiringCodeStore(new TimeServiceImpl()); + Timestamp expiresAt = new Timestamp(System.currentTimeMillis() + 60_000); + var code = store.generateCode("{}", expiresAt, "forgot_password_for_id:id", IdentityZoneHolder.get().getId()).getCode(); + var submit = MockMvcRequestBuilders.post("/reset_password.do") + .param("code", code) + .param("password", password) + .param("password_confirmation", mismatchedConfirmation ? "different" : password) + .param("email", email) + .buildRequest(new MockServletContext()); + + new ResetPasswordAuthenticationFilter(service, entryPoint, store).doFilterInternal(submit, response, chain); + + ExpiringCode renewed = store.peekCode((String) submit.getAttribute("code"), IdentityZoneHolder.get().getId()); + assertThat(renewed.getExpiresAt()).isBeforeOrEqualTo(expiresAt); + return renewed; + } + @Test void invalid_code_password_reset() throws Exception { request.setParameter("code", "invalid"); diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/authentication/PasscodeAuthenticationFilterTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/authentication/PasscodeAuthenticationFilterTest.java index b92b7471adf..c79a2ecd1a2 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/authentication/PasscodeAuthenticationFilterTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/authentication/PasscodeAuthenticationFilterTest.java @@ -4,14 +4,32 @@ import org.cloudfoundry.identity.uaa.authentication.PasscodeAuthenticationFilter.ExpiringCodeAuthenticationManager; import org.cloudfoundry.identity.uaa.codestore.ExpiringCodeStore; import org.cloudfoundry.identity.uaa.codestore.InMemoryExpiringCodeStore; +import org.cloudfoundry.identity.uaa.passcode.PasscodeInformation; +import org.cloudfoundry.identity.uaa.user.UaaUser; +import org.cloudfoundry.identity.uaa.user.UaaUserDatabase; +import org.cloudfoundry.identity.uaa.util.JsonUtils; +import org.cloudfoundry.identity.uaa.zone.IdentityZoneHolder; import org.cloudfoundry.identity.uaa.util.MockTimeService; import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Nested; import org.junit.jupiter.api.Test; +import org.junit.jupiter.params.ParameterizedTest; +import org.junit.jupiter.params.provider.NullSource; +import org.junit.jupiter.params.provider.ValueSource; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import org.springframework.mock.web.MockHttpServletRequest; import org.springframework.security.authentication.InsufficientAuthenticationException; +import org.springframework.security.core.Authentication; + +import java.sql.Timestamp; +import java.util.List; import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatThrownBy; +import static org.mockito.Mockito.doReturn; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; class PasscodeAuthenticationFilterTest { @@ -44,4 +62,60 @@ void setup() { ExpiringCodeStore expiringCodeStore = new InMemoryExpiringCodeStore(new MockTimeService()); manager = new ExpiringCodeAuthenticationManager(null, null, logger, expiringCodeStore, null); } -} \ No newline at end of file + + @Nested + class PasscodeIntent { + + private static final String USER_ID = "user-id-1"; + + private ExpiringCodeStore expiringCodeStore; + private UaaUserDatabase userDatabase; + private ExpiringCodeAuthenticationManager passcodeManager; + + @BeforeEach + void setUp() { + expiringCodeStore = new InMemoryExpiringCodeStore(new MockTimeService()); + userDatabase = mock(UaaUserDatabase.class); + UaaUser user = mock(UaaUser.class); + doReturn(List.of()).when(user).getAuthorities(); + when(userDatabase.retrieveUserById(USER_ID)).thenReturn(user); + passcodeManager = new ExpiringCodeAuthenticationManager( + userDatabase, null, LoggerFactory.getLogger(PasscodeAuthenticationFilterTest.class), expiringCodeStore, null); + } + + private String storePasscode(String intent) { + PasscodeInformation information = new PasscodeInformation(USER_ID, "marissa", "unused", "uaa", List.of()); + return expiringCodeStore.generateCode( + JsonUtils.writeValueAsString(information), + new Timestamp(System.currentTimeMillis() + 60_000), + intent, + IdentityZoneHolder.get().getId()).getCode(); + } + + private ExpiringCodeAuthentication authenticationFor(String passcode) { + return new ExpiringCodeAuthentication( + new PasscodeAuthenticationFilter.PasscodeHttpServletRequest(new MockHttpServletRequest("POST", "/oauth/token")), + passcode); + } + + @Test + void passcodeWithItsOwnIntentSignsIn() { + String passcode = storePasscode("PASSCODE " + USER_ID); + + Authentication result = passcodeManager.authenticate(authenticationFor(passcode)); + + assertThat(result.getPrincipal()).hasFieldOrPropertyWithValue("id", USER_ID); + } + + @ParameterizedTest + @NullSource + @ValueSource(strings = {"", "EMAIL", "AUTOLOGIN", "PASSCODE", "PASSCODE other-user-id", "passcode user-id-1", "my-application-code"}) + void codeWithAnyOtherIntentIsRejected(String intent) { + String passcode = storePasscode(intent); + + assertThatThrownBy(() -> passcodeManager.authenticate(authenticationFor(passcode))) + .isInstanceOf(InsufficientAuthenticationException.class) + .hasMessage("Invalid passcode"); + } + } +} diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpointsTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpointsTests.java index cf80667eb0c..7d046592d49 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpointsTests.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpointsTests.java @@ -8,6 +8,9 @@ import org.cloudfoundry.identity.uaa.zone.beans.IdentityZoneManager; import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; +import org.junit.jupiter.params.ParameterizedTest; +import org.junit.jupiter.params.provider.NullSource; +import org.junit.jupiter.params.provider.ValueSource; import org.mockito.InOrder; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.http.HttpStatus; @@ -20,8 +23,10 @@ import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThatNoException; import static org.assertj.core.api.Assertions.assertThatThrownBy; +import static org.mockito.ArgumentMatchers.any; import static org.mockito.Mockito.inOrder; import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.never; import static org.mockito.Mockito.spy; import static org.mockito.Mockito.times; import static org.mockito.Mockito.verify; @@ -72,7 +77,7 @@ private String createDummyIdentityZone(@Autowired JdbcTemplate jdbcTemplate) { @Test void generateCode() { Timestamp expiresAt = new Timestamp(currentTime.get() + 60000); - ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, null); + ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, "EMAIL"); ExpiringCode result = codeStoreEndpoints.generateCode(expiringCode); @@ -85,45 +90,72 @@ void generateCode() { assertThat(result.getData()).isEqualTo(EMPTY_JSON); - verify(spiedExpiringCodeStore).generateCode(EMPTY_JSON, expiresAt, null, currentIdentityZoneId); + verify(spiedExpiringCodeStore).generateCode(EMPTY_JSON, expiresAt, "EMAIL", currentIdentityZoneId); + } + + @ParameterizedTest + @ValueSource(strings = {"EMAIL", "INVITATION", "REGISTRATION", "email", "my-application-code"}) + void generateCodeStoresGivenIntent(String intent) { + Timestamp expiresAt = new Timestamp(currentTime.get() + 60000); + ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, intent); + + ExpiringCode result = codeStoreEndpoints.generateCode(expiringCode); + + assertThat(result.getIntent()).isEqualTo(intent); + verify(spiedExpiringCodeStore).generateCode(EMPTY_JSON, expiresAt, intent, currentIdentityZoneId); + } + + @ParameterizedTest + @NullSource + @ValueSource(strings = {"", " "}) + void generateCodeWithoutIntent(String intent) { + Timestamp expiresAt = new Timestamp(currentTime.get() + 60000); + ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, intent); + + assertThatThrownBy(() -> codeStoreEndpoints.generateCode(expiringCode)) + .isInstanceOf(CodeStoreException.class) + .hasMessage("intent is required. Known intents: EMAIL, INVITATION, REGISTRATION; custom values are accepted.") + .extracting("status") + .isEqualTo(HttpStatus.BAD_REQUEST); + verify(spiedExpiringCodeStore, never()).generateCode(any(), any(), any(), any()); } @Test void generateCodeWithNullData() { Timestamp expiresAt = new Timestamp(currentTime.get() + 60000); - ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, null, null); + ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, null, "EMAIL"); assertThatThrownBy(() -> codeStoreEndpoints.generateCode(expiringCode)) .isInstanceOf(CodeStoreException.class) .hasMessage("data and expiresAt are required.") .extracting("status") .isEqualTo(HttpStatus.BAD_REQUEST); - verify(spiedExpiringCodeStore).generateCode(null, expiresAt, null, currentIdentityZoneId); + verify(spiedExpiringCodeStore).generateCode(null, expiresAt, "EMAIL", currentIdentityZoneId); } @Test void generateCodeWithNullExpiresAt() { - ExpiringCode expiringCode = new ExpiringCode(null, null, EMPTY_JSON, null); + ExpiringCode expiringCode = new ExpiringCode(null, null, EMPTY_JSON, "EMAIL"); assertThatThrownBy(() -> codeStoreEndpoints.generateCode(expiringCode)) .isInstanceOf(CodeStoreException.class) .hasMessage("data and expiresAt are required.") .extracting("status") .isEqualTo(HttpStatus.BAD_REQUEST); - verify(spiedExpiringCodeStore).generateCode(EMPTY_JSON, null, null, currentIdentityZoneId); + verify(spiedExpiringCodeStore).generateCode(EMPTY_JSON, null, "EMAIL", currentIdentityZoneId); } @Test void generateCodeWithExpiresAtInThePast() { Timestamp expiresAt = new Timestamp(currentTime.get() - 60000); - ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, null); + ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, "EMAIL"); assertThatThrownBy(() -> codeStoreEndpoints.generateCode(expiringCode)) .isInstanceOf(CodeStoreException.class) .hasMessage("expiresAt must be in the future.") .extracting("status") .isEqualTo(HttpStatus.BAD_REQUEST); - verify(spiedExpiringCodeStore).generateCode(EMPTY_JSON, expiresAt, null, currentIdentityZoneId); + verify(spiedExpiringCodeStore).generateCode(EMPTY_JSON, expiresAt, "EMAIL", currentIdentityZoneId); } @Test @@ -133,7 +165,7 @@ void generateCodeWithDuplicateCode() { spiedExpiringCodeStore.setGenerator(generator); Timestamp expiresAt = new Timestamp(currentTime.get() + 60000); - ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, null); + ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, "EMAIL"); assertThatNoException().isThrownBy(() -> codeStoreEndpoints.generateCode(expiringCode)); @@ -143,13 +175,13 @@ void generateCodeWithDuplicateCode() { .extracting("status") .isEqualTo(HttpStatus.INTERNAL_SERVER_ERROR); verify(spiedExpiringCodeStore, times(2)) - .generateCode(EMPTY_JSON, expiresAt, null, currentIdentityZoneId); + .generateCode(EMPTY_JSON, expiresAt, "EMAIL", currentIdentityZoneId); } @Test void retrieveCode() { Timestamp expiresAt = new Timestamp(currentTime.get() + 60000); - ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, null); + ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, "EMAIL"); ExpiringCode generatedCode = codeStoreEndpoints.generateCode(expiringCode); String code = generatedCode.getCode(); @@ -163,7 +195,7 @@ void retrieveCode() { .isEqualTo(HttpStatus.NOT_FOUND); InOrder inOrder = inOrder(spiedExpiringCodeStore); - inOrder.verify(spiedExpiringCodeStore).generateCode(EMPTY_JSON, expiresAt, null, currentIdentityZoneId); + inOrder.verify(spiedExpiringCodeStore).generateCode(EMPTY_JSON, expiresAt, "EMAIL", currentIdentityZoneId); inOrder.verify(spiedExpiringCodeStore).retrieveCode(code, currentIdentityZoneId); } @@ -193,7 +225,7 @@ void storeLargeData() { Arrays.fill(oneMb, 'a'); String data = new String(oneMb); Timestamp expiresAt = new Timestamp(currentTime.get() + 60000); - ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, data, null); + ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, data, "EMAIL"); ExpiringCode generatedCode = codeStoreEndpoints.generateCode(expiringCode); @@ -202,7 +234,7 @@ void storeLargeData() { assertThat(actualCode).isEqualTo(generatedCode); InOrder inOrder = inOrder(spiedExpiringCodeStore); - inOrder.verify(spiedExpiringCodeStore).generateCode(data, expiresAt, null, currentIdentityZoneId); + inOrder.verify(spiedExpiringCodeStore).generateCode(data, expiresAt, "EMAIL", currentIdentityZoneId); inOrder.verify(spiedExpiringCodeStore).retrieveCode(code, currentIdentityZoneId); } @@ -210,7 +242,7 @@ void storeLargeData() { void retrieveCodeWithExpiredCode() { int expiresIn = 1000; Timestamp expiresAt = new Timestamp(currentTime.get() + expiresIn); - ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, null); + ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, "EMAIL"); ExpiringCode generatedCode = codeStoreEndpoints.generateCode(expiringCode); currentTime.addAndGet(expiresIn + 1); diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerTest.java index 72e63ad0263..3b6dec44ec6 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerTest.java @@ -329,8 +329,23 @@ void resetPasswordPageDuplicate() throws Exception { .andExpect(status().isOk()) .andExpect(view().name("reset_password")); mockMvc.perform(get("/reset_password").param("email", "user@example.com").param("code", code.getCode())) - .andExpect(status().isUnprocessableEntity()) - .andExpect(view().name("forgot_password")); + .andExpect(status().isOk()) + .andExpect(view().name("reset_password")); + } + + @Test + void resetPasswordPageDoesNotExtendTheCodeLifetime() throws Exception { + Timestamp expiresAt = new Timestamp(System.currentTimeMillis() + 60_000); + ExpiringCode code = codeStore.generateCode("{\"user_id\" : \"some-user-id\"}", expiresAt, FORGOT_PASSWORD_INTENT_PREFIX + "some-user-id", IdentityZoneHolder.get().getId()); + + MvcResult result = mockMvc.perform(get("/reset_password").param("code", code.getCode())) + .andExpect(status().isOk()) + .andReturn(); + + String formCode = (String) result.getModelAndView().getModel().get("code"); + ExpiringCode codeInTheForm = codeStore.peekCode(formCode, IdentityZoneHolder.get().getId()); + assertThat(codeInTheForm).isNotNull(); + assertThat(codeInTheForm.getExpiresAt()).isBeforeOrEqualTo(expiresAt); } @Test diff --git a/uaa/slateCustomizations/source/index.html.md.erb b/uaa/slateCustomizations/source/index.html.md.erb index 9332b0d65e4..226792cd8ce 100644 --- a/uaa/slateCustomizations/source/index.html.md.erb +++ b/uaa/slateCustomizations/source/index.html.md.erb @@ -2986,6 +2986,35 @@ _Request Parameters_ <%= render('LoginInfoEndpointDocs/perform_auto_login/query-parameters.md') %> +# Expiring Codes + +## Create a Code + +`POST /Codes` stores a one time code with an expiry and an intent, and returns the generated code. A code can be read back +once with `GET /Codes/{code}`; reading it removes it. Codes are stored per identity zone. + +The `intent` is required and must not be blank; a request without one is rejected with `400 Bad Request` and the message +`intent is required. Known intents: EMAIL, INVITATION, REGISTRATION; custom values are accepted.` +The UAA flows only accept a code whose intent matches the flow: `EMAIL` for email change verification, `INVITATION` for +invitation acceptance and `REGISTRATION` for account activation. Any other value is stored as given and is meant for codes +that your own application creates and redeems. + +<%= render('CodeStoreEndpointDocs/document_create_code/curl-request.md') %> +<%= render('CodeStoreEndpointDocs/document_create_code/http-request.md') %> +<%= render('CodeStoreEndpointDocs/document_create_code/http-response.md') %> + +_Request Headers_ + +<%= render('CodeStoreEndpointDocs/document_create_code/request-headers.md') %> + +_Request Body_ + +<%= render('CodeStoreEndpointDocs/document_create_code/request-fields.md') %> + +_Response Body_ + +<%= render('CodeStoreEndpointDocs/document_create_code/response-fields.md') %> + # External Login Server The UAA provides endpoints that facilitate the use of an external login server. A server that handles the UI diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/InvitationsIT.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/InvitationsIT.java index a497084e162..7bfd956791c 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/InvitationsIT.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/InvitationsIT.java @@ -117,7 +117,7 @@ public static String createInvitation(String baseUrl, String username, String us invitationHeaders.add("Authorization", "Bearer " + loginToken); Timestamp expiry = new Timestamp(System.currentTimeMillis() + TimeUnit.MILLISECONDS.convert(System.currentTimeMillis() + 24 * 3600, TimeUnit.MILLISECONDS)); - ExpiringCode expiringCode = new ExpiringCode(null, expiry, "{\"origin\":\"" + origin + "\", \"client_id\":\"app\", \"redirect_uri\":\"" + redirectUri + "\", \"user_id\":\"" + userId + "\", \"email\":\"" + userEmail + "\"}", null); + ExpiringCode expiringCode = new ExpiringCode(null, expiry, "{\"origin\":\"" + origin + "\", \"client_id\":\"app\", \"redirect_uri\":\"" + redirectUri + "\", \"user_id\":\"" + userId + "\", \"email\":\"" + userEmail + "\"}", "INVITATION"); HttpEntity expiringCodeRequest = new HttpEntity<>(expiringCode, invitationHeaders); ResponseEntity expiringCodeResponse = uaaTemplate.exchange(baseUrl + "/Codes", POST, expiringCodeRequest, ExpiringCode.class); expiringCode = expiringCodeResponse.getBody(); diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/ResetPasswordIT.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/ResetPasswordIT.java index 822fcf22eb6..f422778e27f 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/ResetPasswordIT.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/ResetPasswordIT.java @@ -202,6 +202,12 @@ void codesCanOnlyBeUsedOnce() { beginPasswordReset(username); String link = getPasswordResetLink(email); webDriver.get(link); + + webDriver.findElement(By.name("password")).sendKeys("new_password"); + webDriver.findElement(By.name("password_confirmation")).sendKeys("new_password"); + webDriver.clickAndWait(By.xpath("//input[@value='Create new password']")); + assertThat(webDriver.findElement(By.cssSelector(".alert-success")).getText()).contains("Password reset successful"); + webDriver.get(link); assertThat(webDriver.findElement(By.cssSelector(".error-message")).getText()).contains("Sorry, your reset password link is no longer valid. You can request another one below."); } diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerMockMvcTests.java index 9aac6697162..94ef74e642a 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerMockMvcTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerMockMvcTests.java @@ -32,6 +32,7 @@ import org.springframework.security.web.savedrequest.DefaultSavedRequest; import org.springframework.security.web.savedrequest.SavedRequest; import org.springframework.test.web.servlet.MockMvc; +import org.springframework.test.web.servlet.MvcResult; import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder; import org.springframework.web.context.WebApplicationContext; @@ -54,6 +55,7 @@ import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.request; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.view; @DefaultTestContext public class ResetPasswordControllerMockMvcTests { @@ -404,6 +406,42 @@ void resetPassword_ReturnsUnprocessableEntity_NewPasswordNotAccordingToPolicy() webApplicationContext.getBean(JdbcIdentityProviderProvisioning.class).update(uaaProvider, uaaProvider.getIdentityZoneId()); } + @Test + void openingTheResetLinkTwiceStillWorksAndDoesNotExtendTheCodeLifetime() throws Exception { + ScimUser user = getScimUser(); + PasswordChange change = new PasswordChange(user.getId(), user.getUserName(), user.getPasswordLastModified(), "", ""); + Timestamp expiresAt = new Timestamp(System.currentTimeMillis() + 60_000); + ExpiringCode code = codeStore.generateCode(JsonUtils.writeValueAsString(change), expiresAt, FORGOT_PASSWORD_INTENT_PREFIX + user.getId(), IdentityZoneHolder.get().getId()); + + mockMvc.perform(get("/reset_password").param("code", code.getCode())) + .andExpect(status().isOk()); + MvcResult second = mockMvc.perform(get("/reset_password").param("code", code.getCode())) + .andExpect(status().isOk()) + .andExpect(view().name("reset_password")) + .andReturn(); + + String formCode = (String) second.getModelAndView().getModel().get("code"); + assertThat(codeStore.peekCode(formCode, IdentityZoneHolder.get().getId()).getExpiresAt()).isBeforeOrEqualTo(expiresAt); + mockMvc.perform(createChangePasswordRequest(user, formCode, true, "secret1", "secret1")) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("/login?success=password_reset")); + } + + @Test + void aRejectedPasswordDoesNotExtendTheCodeLifetime() throws Exception { + ScimUser user = getScimUser(); + PasswordChange change = new PasswordChange(user.getId(), user.getUserName(), user.getPasswordLastModified(), "", ""); + Timestamp expiresAt = new Timestamp(System.currentTimeMillis() + 60_000); + ExpiringCode code = codeStore.generateCode(JsonUtils.writeValueAsString(change), expiresAt, FORGOT_PASSWORD_INTENT_PREFIX + user.getId(), IdentityZoneHolder.get().getId()); + + MvcResult result = mockMvc.perform(createChangePasswordRequest(user, code, true, "secret1", "different")) + .andExpect(status().isUnprocessableEntity()) + .andReturn(); + + String renewedCode = (String) result.getRequest().getAttribute("code"); + assertThat(codeStore.peekCode(renewedCode, IdentityZoneHolder.get().getId()).getExpiresAt()).isBeforeOrEqualTo(expiresAt); + } + private MockHttpServletRequestBuilder createChangePasswordRequest(ScimUser user, ExpiringCode code, boolean useCSRF) throws Exception { return createChangePasswordRequest(user, code, useCSRF, "newpassw0rDl", "newpassw0rDl"); } diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerMockMvcZonePathTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerMockMvcZonePathTests.java index 3a7c42c245f..de91eff3739 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerMockMvcZonePathTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerMockMvcZonePathTests.java @@ -418,6 +418,42 @@ void resetPassword_ReturnsUnprocessableEntity_NewPasswordNotAccordingToPolicy() webApplicationContext.getBean(JdbcIdentityProviderProvisioning.class).update(uaaProvider, uaaProvider.getIdentityZoneId()); } + @Test + void openingTheResetLinkTwiceStillWorksAndDoesNotExtendTheCodeLifetime() throws Exception { + ScimUser user = getScimUser(); + PasswordChange change = new PasswordChange(user.getId(), user.getUserName(), user.getPasswordLastModified(), "", ""); + Timestamp expiresAt = new Timestamp(System.currentTimeMillis() + 60_000); + ExpiringCode code = codeStore.generateCode(JsonUtils.writeValueAsString(change), expiresAt, FORGOT_PASSWORD_INTENT_PREFIX + user.getId(), IdentityZoneHolder.get().getId()); + + mockMvc.perform(get("/reset_password").param("code", code.getCode())) + .andExpect(status().isOk()); + MvcResult second = mockMvc.perform(get("/reset_password").param("code", code.getCode())) + .andExpect(status().isOk()) + .andExpect(view().name("reset_password")) + .andReturn(); + + String formCode = (String) second.getModelAndView().getModel().get("code"); + assertThat(codeStore.peekCode(formCode, IdentityZoneHolder.get().getId()).getExpiresAt()).isBeforeOrEqualTo(expiresAt); + mockMvc.perform(createChangePasswordRequest(user, formCode, true, "secret1", "secret1")) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("/login?success=password_reset")); + } + + @Test + void aRejectedPasswordDoesNotExtendTheCodeLifetime() throws Exception { + ScimUser user = getScimUser(); + PasswordChange change = new PasswordChange(user.getId(), user.getUserName(), user.getPasswordLastModified(), "", ""); + Timestamp expiresAt = new Timestamp(System.currentTimeMillis() + 60_000); + ExpiringCode code = codeStore.generateCode(JsonUtils.writeValueAsString(change), expiresAt, FORGOT_PASSWORD_INTENT_PREFIX + user.getId(), IdentityZoneHolder.get().getId()); + + MvcResult result = mockMvc.perform(createChangePasswordRequest(user, code, true, "secret1", "different")) + .andExpect(status().isUnprocessableEntity()) + .andReturn(); + + String renewedCode = (String) result.getRequest().getAttribute("code"); + assertThat(codeStore.peekCode(renewedCode, IdentityZoneHolder.get().getId()).getExpiresAt()).isBeforeOrEqualTo(expiresAt); + } + private MockHttpServletRequestBuilder createChangePasswordRequest(ScimUser user, ExpiringCode code, boolean useCSRF) throws Exception { return createChangePasswordRequest(user, code, useCSRF, "newpassw0rDl", "newpassw0rDl"); } diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointDocs.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointDocs.java new file mode 100644 index 00000000000..56cb1fecee6 --- /dev/null +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointDocs.java @@ -0,0 +1,60 @@ +package org.cloudfoundry.identity.uaa.mock.codestore; + +import org.cloudfoundry.identity.uaa.mock.EndpointDocs; +import org.cloudfoundry.identity.uaa.mock.util.MockMvcUtils; +import org.cloudfoundry.identity.uaa.zone.IdentityZoneSwitchingFilter; +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Test; +import org.springframework.restdocs.snippet.Snippet; + +import static org.cloudfoundry.identity.uaa.test.SnippetUtils.fieldWithPath; +import static org.cloudfoundry.identity.uaa.test.SnippetUtils.headerWithName; +import static org.springframework.http.MediaType.APPLICATION_JSON; +import static org.springframework.restdocs.headers.HeaderDocumentation.requestHeaders; +import static org.springframework.restdocs.mockmvc.MockMvcRestDocumentation.document; +import static org.springframework.restdocs.operation.preprocess.Preprocessors.preprocessResponse; +import static org.springframework.restdocs.operation.preprocess.Preprocessors.prettyPrint; +import static org.springframework.restdocs.payload.JsonFieldType.NUMBER; +import static org.springframework.restdocs.payload.JsonFieldType.STRING; +import static org.springframework.restdocs.payload.PayloadDocumentation.requestFields; +import static org.springframework.restdocs.payload.PayloadDocumentation.responseFields; +import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post; + +class CodeStoreEndpointDocs extends EndpointDocs { + + private String loginToken; + + @BeforeEach + void setUpToken() throws Exception { + loginToken = MockMvcUtils.getClientOAuthAccessToken(mockMvc, "login", "loginsecret", "oauth.login"); + } + + @Test + void document_create_code() throws Exception { + Snippet requestHeaders = requestHeaders( + headerWithName("Authorization").required().description("Bearer token with the scope `oauth.login` present, or a UAA admin token."), + headerWithName(IdentityZoneSwitchingFilter.HEADER).optional(null).description("If using a `zones..admin` scope/token, indicates what zone this request goes to by supplying a zone_id."), + headerWithName(IdentityZoneSwitchingFilter.SUBDOMAIN_HEADER).optional(null).description("If using a `zones..admin` scope/token, indicates what zone this request goes to by supplying a subdomain.") + ); + + Snippet requestFields = requestFields( + fieldWithPath("data").required().type(STRING).description("The data stored with the code, returned when the code is redeemed. For the flows below this is a JSON document written as a string."), + fieldWithPath("expiresAt").required().type(NUMBER).description("Expiry time of the code in milliseconds since the epoch. It must be in the future."), + fieldWithPath("intent").required().type(STRING).description("What the code may be used for. It is required and must not be blank. The values `EMAIL` (email change verification), `INVITATION` (invitation acceptance) and `REGISTRATION` (account activation) are used by the UAA flows of the same name; the match is case sensitive. Any other value is stored as given, for codes that your own application creates and redeems.") + ); + + Snippet responseFields = responseFields( + fieldWithPath("code").type(STRING).description("The generated one time code."), + fieldWithPath("expiresAt").type(NUMBER).description("Expiry time of the code in milliseconds since the epoch."), + fieldWithPath("data").type(STRING).description("The data stored with the code."), + fieldWithPath("intent").type(STRING).description("The intent stored with the code.") + ); + + mockMvc.perform(post("/Codes") + .header("Authorization", "Bearer " + loginToken) + .contentType(APPLICATION_JSON) + .accept(APPLICATION_JSON) + .content("{\"data\":\"{\\\"user_id\\\":\\\"a-user-id\\\"}\",\"expiresAt\":" + (System.currentTimeMillis() + 600_000) + ",\"intent\":\"MY_APPLICATION_CODE\"}")) + .andDo(document("{ClassName}/{methodName}", preprocessResponse(prettyPrint()), requestHeaders, requestFields, responseFields)); + } +} diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcTests.java index 4a5dfc124d9..53fc87628d6 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcTests.java @@ -10,6 +10,7 @@ import org.junit.jupiter.api.Nested; import org.junit.jupiter.api.Test; import org.junit.jupiter.params.ParameterizedTest; +import org.junit.jupiter.params.provider.NullSource; import org.junit.jupiter.params.provider.ValueSource; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Value; @@ -64,7 +65,7 @@ void tearDown() { @ValueSource(strings = {"/Codes", "/Codes/"}) void generateCode(String url) throws Exception { Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000); - ExpiringCode code = new ExpiringCode(null, ts, "{}", null); + ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL"); String requestBody = JsonUtils.writeValueAsString(code); MockHttpServletRequestBuilder post = post(url) @@ -81,11 +82,45 @@ void generateCode(String url) throws Exception { } + @ParameterizedTest + @ValueSource(strings = {"EMAIL", "INVITATION", "REGISTRATION", "email", "my-application-code"}) + void generateCodeStoresGivenIntent(String intent) throws Exception { + Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000); + ExpiringCode code = new ExpiringCode(null, ts, "{}", intent); + + mockMvc.perform(post("/Codes") + .header("Authorization", "Bearer " + loginToken) + .contentType(APPLICATION_JSON) + .accept(MediaType.APPLICATION_JSON) + .content(JsonUtils.writeValueAsString(code))) + .andExpect(status().isCreated()) + .andExpect(jsonPath("$.intent").value(intent)); + + assertThat(jdbcTemplate.queryForObject("select intent from expiring_code_store", String.class)).isEqualTo(intent); + } + + @ParameterizedTest + @NullSource + @ValueSource(strings = {"", " "}) + void generateCodeWithoutIntent(String intent) throws Exception { + Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000); + ExpiringCode code = new ExpiringCode(null, ts, "{}", intent); + + mockMvc.perform(post("/Codes") + .header("Authorization", "Bearer " + loginToken) + .contentType(APPLICATION_JSON) + .accept(MediaType.APPLICATION_JSON) + .content(JsonUtils.writeValueAsString(code))) + .andExpect(status().isBadRequest()); + + assertThat(jdbcTemplate.queryForObject("select count(*) from expiring_code_store", Integer.class)).isZero(); + } + @ParameterizedTest @ValueSource(strings = {"/Codes", "/Codes/"}) void generateCodeWithInvalidScope(String url) throws Exception { Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000); - ExpiringCode code = new ExpiringCode(null, ts, "{}", null); + ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL"); String loginToken = testClient.getClientCredentialsOAuthAccessToken("admin", "adminsecret", "scim.read"); String requestBody = JsonUtils.writeValueAsString(code); @@ -103,7 +138,7 @@ void generateCodeWithInvalidScope(String url) throws Exception { @ValueSource(strings = {"/Codes", "/Codes/"}) void generateCodeAnonymous(String url) throws Exception { Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000); - ExpiringCode code = new ExpiringCode(null, ts, "{}", null); + ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL"); String requestBody = JsonUtils.writeValueAsString(code); MockHttpServletRequestBuilder post = post(url) @@ -119,7 +154,7 @@ void generateCodeAnonymous(String url) throws Exception { @ValueSource(strings = {"/Codes", "/Codes/"}) void generateCodeWithNullData(String url) throws Exception { Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000); - ExpiringCode code = new ExpiringCode(null, ts, null, null); + ExpiringCode code = new ExpiringCode(null, ts, null, "EMAIL"); String requestBody = JsonUtils.writeValueAsString(code); MockHttpServletRequestBuilder post = post(url) .header("Authorization", "Bearer " + loginToken) @@ -135,7 +170,7 @@ void generateCodeWithNullData(String url) throws Exception { @ParameterizedTest @ValueSource(strings = {"/Codes", "/Codes/"}) void generateCodeWithNullExpiresAt(String url) throws Exception { - ExpiringCode code = new ExpiringCode(null, null, "{}", null); + ExpiringCode code = new ExpiringCode(null, null, "{}", "EMAIL"); String requestBody = JsonUtils.writeValueAsString(code); MockHttpServletRequestBuilder post = post(url) .header("Authorization", "Bearer " + loginToken) @@ -152,7 +187,7 @@ void generateCodeWithNullExpiresAt(String url) throws Exception { @ValueSource(strings = {"/Codes", "/Codes/"}) void generateCodeWithExpiresAtInThePast(String url) throws Exception { Timestamp ts = new Timestamp(System.currentTimeMillis() - 60000); - ExpiringCode code = new ExpiringCode(null, ts, null, null); + ExpiringCode code = new ExpiringCode(null, ts, null, "EMAIL"); String requestBody = JsonUtils.writeValueAsString(code); MockHttpServletRequestBuilder post = post(url) .header("Authorization", "Bearer " + loginToken) @@ -169,7 +204,7 @@ void generateCodeWithExpiresAtInThePast(String url) throws Exception { @ValueSource(strings = {"/Codes", "/Codes/"}) void retrieveCode(String url) throws Exception { Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000); - ExpiringCode code = new ExpiringCode(null, ts, "{}", null); + ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL"); String requestBody = JsonUtils.writeValueAsString(code); MockHttpServletRequestBuilder post = post(url) .header("Authorization", "Bearer " + loginToken) @@ -200,7 +235,7 @@ void retrieveCode(String url) throws Exception { @ValueSource(strings = {"/Codes", "/Codes/"}) void retrieveCodeThatIsExpired(String url) throws Exception { Timestamp ts = new Timestamp(Long.MAX_VALUE); - ExpiringCode code = new ExpiringCode(null, ts, "{}", null); + ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL"); String requestBody = JsonUtils.writeValueAsString(code); MockHttpServletRequestBuilder post = post(url) .header("Authorization", "Bearer " + loginToken) @@ -227,7 +262,7 @@ void retrieveCodeThatIsExpired(String url) throws Exception { @ValueSource(strings = {"/Codes", "/Codes/"}) void codeThatIsExpiredIsDeletedOnCreateOfNewCode(String url) throws Exception { Timestamp ts = new Timestamp(Long.MAX_VALUE); - ExpiringCode code = new ExpiringCode(null, ts, "{}", null); + ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL"); String requestBody = JsonUtils.writeValueAsString(code); MockHttpServletRequestBuilder post = post(url) .header("Authorization", "Bearer " + loginToken) @@ -244,7 +279,7 @@ void codeThatIsExpiredIsDeletedOnCreateOfNewCode(String url) throws Exception { expireAllCodes(); ts = new Timestamp(Long.MAX_VALUE); - code = new ExpiringCode(null, ts, "{}", null); + code = new ExpiringCode(null, ts, "{}", "EMAIL"); requestBody = JsonUtils.writeValueAsString(code); post = post(url) .header("Authorization", "Bearer " + loginToken) @@ -268,7 +303,7 @@ class WithCustomExpirationInterval { void setUp() throws Exception { // TODO: Why is this here? Timestamp ts = new Timestamp(Long.MAX_VALUE); - ExpiringCode code = new ExpiringCode(null, ts, "{}", null); + ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL"); String requestBody = JsonUtils.writeValueAsString(code); MockHttpServletRequestBuilder post = post("/Codes") .header("Authorization", "Bearer " + loginToken) @@ -296,7 +331,7 @@ void tearDown() { void verifyExpirationIntervalWorks(String url) throws Exception { jdbcExpiringCodeStore.setExpirationInterval(10000000); Timestamp ts = new Timestamp(System.currentTimeMillis() + 1000); - ExpiringCode code = new ExpiringCode(null, ts, "{}", null); + ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL"); String requestBody = JsonUtils.writeValueAsString(code); MockHttpServletRequestBuilder post = post(url) .header("Authorization", "Bearer " + loginToken) diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcZonePathTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcZonePathTests.java index fa5197bc5f8..45f54f99def 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcZonePathTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcZonePathTests.java @@ -15,6 +15,7 @@ import org.junit.jupiter.api.Test; import org.junit.jupiter.params.ParameterizedTest; import org.junit.jupiter.params.provider.EnumSource; +import org.junit.jupiter.params.provider.NullSource; import org.junit.jupiter.params.provider.ValueSource; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Value; @@ -77,7 +78,7 @@ void tearDown() { @ValueSource(strings = {"/Codes", "/Codes/"}) void generateCode(String url) throws Exception { Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000); - ExpiringCode code = new ExpiringCode(null, ts, "{}", null); + ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL"); String requestBody = JsonUtils.writeValueAsString(code); MockHttpServletRequestBuilder post = post(url) @@ -94,11 +95,45 @@ void generateCode(String url) throws Exception { } + @ParameterizedTest + @ValueSource(strings = {"EMAIL", "INVITATION", "REGISTRATION", "email", "my-application-code"}) + void generateCodeStoresGivenIntent(String intent) throws Exception { + Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000); + ExpiringCode code = new ExpiringCode(null, ts, "{}", intent); + + mockMvc.perform(post("/Codes") + .header("Authorization", "Bearer " + loginToken) + .contentType(APPLICATION_JSON) + .accept(MediaType.APPLICATION_JSON) + .content(JsonUtils.writeValueAsString(code))) + .andExpect(status().isCreated()) + .andExpect(jsonPath("$.intent").value(intent)); + + assertThat(jdbcTemplate.queryForObject("select intent from expiring_code_store", String.class)).isEqualTo(intent); + } + + @ParameterizedTest + @NullSource + @ValueSource(strings = {"", " "}) + void generateCodeWithoutIntent(String intent) throws Exception { + Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000); + ExpiringCode code = new ExpiringCode(null, ts, "{}", intent); + + mockMvc.perform(post("/Codes") + .header("Authorization", "Bearer " + loginToken) + .contentType(APPLICATION_JSON) + .accept(MediaType.APPLICATION_JSON) + .content(JsonUtils.writeValueAsString(code))) + .andExpect(status().isBadRequest()); + + assertThat(jdbcTemplate.queryForObject("select count(*) from expiring_code_store", Integer.class)).isZero(); + } + @ParameterizedTest @ValueSource(strings = {"/Codes", "/Codes/"}) void generateCodeWithInvalidScope(String url) throws Exception { Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000); - ExpiringCode code = new ExpiringCode(null, ts, "{}", null); + ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL"); String loginToken = testClient.getClientCredentialsOAuthAccessToken("admin", "adminsecret", "scim.read"); String requestBody = JsonUtils.writeValueAsString(code); @@ -116,7 +151,7 @@ void generateCodeWithInvalidScope(String url) throws Exception { @ValueSource(strings = {"/Codes", "/Codes/"}) void generateCodeAnonymous(String url) throws Exception { Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000); - ExpiringCode code = new ExpiringCode(null, ts, "{}", null); + ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL"); String requestBody = JsonUtils.writeValueAsString(code); MockHttpServletRequestBuilder post = post(url) @@ -132,7 +167,7 @@ void generateCodeAnonymous(String url) throws Exception { @ValueSource(strings = {"/Codes", "/Codes/"}) void generateCodeWithNullData(String url) throws Exception { Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000); - ExpiringCode code = new ExpiringCode(null, ts, null, null); + ExpiringCode code = new ExpiringCode(null, ts, null, "EMAIL"); String requestBody = JsonUtils.writeValueAsString(code); MockHttpServletRequestBuilder post = post(url) .header("Authorization", "Bearer " + loginToken) @@ -148,7 +183,7 @@ void generateCodeWithNullData(String url) throws Exception { @ParameterizedTest @ValueSource(strings = {"/Codes", "/Codes/"}) void generateCodeWithNullExpiresAt(String url) throws Exception { - ExpiringCode code = new ExpiringCode(null, null, "{}", null); + ExpiringCode code = new ExpiringCode(null, null, "{}", "EMAIL"); String requestBody = JsonUtils.writeValueAsString(code); MockHttpServletRequestBuilder post = post(url) .header("Authorization", "Bearer " + loginToken) @@ -165,7 +200,7 @@ void generateCodeWithNullExpiresAt(String url) throws Exception { @ValueSource(strings = {"/Codes", "/Codes/"}) void generateCodeWithExpiresAtInThePast(String url) throws Exception { Timestamp ts = new Timestamp(System.currentTimeMillis() - 60000); - ExpiringCode code = new ExpiringCode(null, ts, null, null); + ExpiringCode code = new ExpiringCode(null, ts, null, "EMAIL"); String requestBody = JsonUtils.writeValueAsString(code); MockHttpServletRequestBuilder post = post(url) .header("Authorization", "Bearer " + loginToken) @@ -182,7 +217,7 @@ void generateCodeWithExpiresAtInThePast(String url) throws Exception { @ValueSource(strings = {"/Codes", "/Codes/"}) void retrieveCode(String url) throws Exception { Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000); - ExpiringCode code = new ExpiringCode(null, ts, "{}", null); + ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL"); String requestBody = JsonUtils.writeValueAsString(code); MockHttpServletRequestBuilder post = post(url) .header("Authorization", "Bearer " + loginToken) @@ -213,7 +248,7 @@ void retrieveCode(String url) throws Exception { @ValueSource(strings = {"/Codes", "/Codes/"}) void retrieveCodeThatIsExpired(String url) throws Exception { Timestamp ts = new Timestamp(Long.MAX_VALUE); - ExpiringCode code = new ExpiringCode(null, ts, "{}", null); + ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL"); String requestBody = JsonUtils.writeValueAsString(code); MockHttpServletRequestBuilder post = post(url) .header("Authorization", "Bearer " + loginToken) @@ -240,7 +275,7 @@ void retrieveCodeThatIsExpired(String url) throws Exception { @ValueSource(strings = {"/Codes", "/Codes/"}) void codeThatIsExpiredIsDeletedOnCreateOfNewCode(String url) throws Exception { Timestamp ts = new Timestamp(Long.MAX_VALUE); - ExpiringCode code = new ExpiringCode(null, ts, "{}", null); + ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL"); String requestBody = JsonUtils.writeValueAsString(code); MockHttpServletRequestBuilder post = post(url) .header("Authorization", "Bearer " + loginToken) @@ -257,7 +292,7 @@ void codeThatIsExpiredIsDeletedOnCreateOfNewCode(String url) throws Exception { expireAllCodes(); ts = new Timestamp(Long.MAX_VALUE); - code = new ExpiringCode(null, ts, "{}", null); + code = new ExpiringCode(null, ts, "{}", "EMAIL"); requestBody = JsonUtils.writeValueAsString(code); post = post(url) .header("Authorization", "Bearer " + loginToken) @@ -294,7 +329,7 @@ class WithCustomExpirationInterval { void setUp() throws Exception { // TODO: Why is this here? Timestamp ts = new Timestamp(Long.MAX_VALUE); - ExpiringCode code = new ExpiringCode(null, ts, "{}", null); + ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL"); String requestBody = JsonUtils.writeValueAsString(code); MockHttpServletRequestBuilder post = post("/Codes") .header("Authorization", "Bearer " + loginToken) @@ -322,7 +357,7 @@ void tearDown() { void verifyExpirationIntervalWorks(String url) throws Exception { jdbcExpiringCodeStore.setExpirationInterval(10000000); Timestamp ts = new Timestamp(System.currentTimeMillis() + 1000); - ExpiringCode code = new ExpiringCode(null, ts, "{}", null); + ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL"); String requestBody = JsonUtils.writeValueAsString(code); MockHttpServletRequestBuilder post = post(url) .header("Authorization", "Bearer " + loginToken) @@ -351,7 +386,7 @@ void codes_endpoint_responds_for_zone_path(ZoneResolutionMode mode) throws Excep MockMvcUtils.createOtherIdentityZoneAndReturnResult(subdomain, mockMvc, webApplicationContext, loginClient, IdentityZoneHolder.getCurrentZoneId()); Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000); - ExpiringCode code = new ExpiringCode(null, ts, "{}", null); + ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL"); String requestBody = JsonUtils.writeValueAsString(code); mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, "/Codes") From 9fb964055eaab4f69c5f188fe477c9dcb8068e0f Mon Sep 17 00:00:00 2001 From: Filip Hanik Date: Thu, 29 Oct 2026 11:36:03 -0700 Subject: [PATCH 04/10] fix: signup and email change for an existing address, and verification links from the user API - POST /create_account.do and POST /change_email.do answer the same way for an address that already has an account as for a new address. The owner of the address receives an email (account_exists.html) instead of an activation or verification link. The signup confirmation page names the address the email was sent to. - The duplicate-email handling in ChangeEmailController that can no longer be reached and the email_change.username_exists message are removed. - A link from GET /Users/{id}/verify-link only verifies the user: the password set by the caller keeps working, and the user is redirected to /login?success=verify_success. - The password reset code on AccountCreationResponse is not serialized. - Docs: login.selfServiceLinksEnabled in UAA-Configuration-Reference.md. --- docs/UAA-Configuration-Reference.md | 9 +++ .../uaa/account/AccountCreationService.java | 3 +- .../uaa/account/AccountsController.java | 17 ++++- .../uaa/account/ChangeEmailController.java | 11 +-- .../account/EmailAccountCreationService.java | 32 +++++++- .../uaa/account/EmailChangeEmailService.java | 15 +++- .../uaa/scim/endpoints/ScimUserEndpoints.java | 2 +- .../identity/uaa/scim/util/ScimUtils.java | 22 ++++++ .../templates/mail/account_exists.html | 22 ++++++ .../templates/web/accounts/email_sent.html | 5 +- .../account/AccountCreationResponseTest.java | 21 +++++ .../AccountsControllerViewZonePathTests.java | 20 +++++ .../account/EmailChangeEmailServiceTest.java | 7 +- .../uaa/login/AccountsControllerTest.java | 50 ++++++++++-- .../uaa/login/ChangeEmailControllerTest.java | 13 ++-- .../EmailAccountCreationServiceTests.java | 42 +++++++++- server/src/test/resources/messages.properties | 1 + uaa/src/main/resources/messages.properties | 2 +- .../integration/feature/CreateAccountIT.java | 4 +- .../login/AccountsControllerMockMvcTests.java | 73 ++++++++++++++++++ ...ccountsControllerMockMvcZonePathTests.java | 76 +++++++++++++++++++ .../ScimUserEndpointsMockMvcTests.java | 27 ++++++- ...ScimUserEndpointsMockMvcZonePathTests.java | 27 ++++++- 23 files changed, 459 insertions(+), 42 deletions(-) create mode 100644 server/src/main/resources/templates/mail/account_exists.html create mode 100644 server/src/test/java/org/cloudfoundry/identity/uaa/account/AccountCreationResponseTest.java diff --git a/docs/UAA-Configuration-Reference.md b/docs/UAA-Configuration-Reference.md index ad3017b1fd9..ed645247842 100644 --- a/docs/UAA-Configuration-Reference.md +++ b/docs/UAA-Configuration-Reference.md @@ -1900,6 +1900,15 @@ When `true`, "Create Account" and "Forgot Password" links are displayed on the l > was verified can never be used to authenticate. Any client or signup redirect configured for the > registration (an explicit `redirect_uri` or the client's `signup_redirect_url`) is applied after the > owner has set their password, provided it matches one of the client's registered redirect URIs. +> +> **Note on addresses that already have an account.** The registration form (`/create_account.do`) and +> the change email form (`/change_email.do`) answer the same way whether or not the address already +> has a verified account in the zone's `uaa` origin: the user is sent to the "email sent" page, and no +> `422` response or "There is already a user with that username" message is shown. After a +> registration the page names the address the email was sent to. When the address already has an +> account, no activation or verification link is created. The owner of the address instead receives an +> email stating that the address already has an account and that nothing has changed. Clients that +> parsed the previous `422` page of these two forms must be updated. [Back to table](#login--branding) diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountCreationService.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountCreationService.java index 3292a91c11a..6dd06130100 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountCreationService.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountCreationService.java @@ -1,5 +1,6 @@ package org.cloudfoundry.identity.uaa.account; +import com.fasterxml.jackson.annotation.JsonIgnore; import com.fasterxml.jackson.annotation.JsonProperty; import org.cloudfoundry.identity.uaa.scim.ScimUser; @@ -19,7 +20,7 @@ class AccountCreationResponse { private String email; @JsonProperty("redirect_location") private String redirectLocation; - @JsonProperty("password_reset_code") + @JsonIgnore private String passwordResetCode; public AccountCreationResponse(String userId, String username, String email, String redirectLocation) { diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountsController.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountsController.java index aab576a47a9..262e7f92a11 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountsController.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountsController.java @@ -20,11 +20,14 @@ import org.springframework.web.bind.annotation.RequestMethod; import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.client.HttpClientErrorException; +import org.springframework.web.servlet.mvc.support.RedirectAttributes; import jakarta.servlet.http.HttpServletResponse; import jakarta.servlet.http.HttpSession; import jakarta.validation.Valid; import jakarta.validation.constraints.Email; +import java.net.URLEncoder; +import java.nio.charset.StandardCharsets; import java.util.List; @Controller @@ -65,7 +68,8 @@ public String sendActivationEmail(Model model, HttpServletResponse response, @Valid @ModelAttribute ValidEmail email, BindingResult result, @RequestParam String password, @RequestParam("password_confirmation") String passwordConfirmation, - @RequestParam(value = "does_user_consent", required = false) boolean doesUserConsent) { + @RequestParam(value = "does_user_consent", required = false) boolean doesUserConsent, + RedirectAttributes redirectAttributes) { BrandingInformation zoneBranding = IdentityZoneHolder.get().getConfig().getBranding(); if (zoneBranding != null && zoneBranding.getConsent() != null && !doesUserConsent) { @@ -95,6 +99,7 @@ public String sendActivationEmail(Model model, HttpServletResponse response, } catch (InvalidPasswordException e) { return handleUnprocessableEntity(model, response, "error_message", e.getMessagesAsOneString()); } + redirectAttributes.addFlashAttribute("email", email.getEmail()); return "redirect:accounts/email_sent"; } @@ -124,6 +129,16 @@ public String verifyUser(Model model, return "accounts/link_prompt"; } + if (accountCreation.getPasswordResetCode() == null) { + // the password was set by whoever created the account, so there is nothing left to set + String redirectLocation = accountCreation.getRedirectLocation(); + String res = "redirect:/login?success=verify_success"; + if (!redirectLocation.equals(accountCreationService.getDefaultRedirect())) { + res += "&form_redirect_uri=" + URLEncoder.encode(redirectLocation, StandardCharsets.UTF_8); + } + return res; + } + // Confirmation establishes email ownership but leaves the account without a usable // password. Send the owner to the reset-password page to set their own password; any // client redirect is carried by the reset code and applied once the password is set. diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ChangeEmailController.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ChangeEmailController.java index 780d0933f52..cbb967152da 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ChangeEmailController.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ChangeEmailController.java @@ -74,16 +74,7 @@ public String changeEmail(Model model, @Valid @ModelAttribute ValidEmail newEmai String userId = ((UaaPrincipal) securityContext.getAuthentication().getPrincipal()).getId(); String userEmail = ((UaaPrincipal) securityContext.getAuthentication().getPrincipal()).getName(); - try { - changeEmailService.beginEmailChange(userId, userEmail, newEmail.getNewEmail(), clientId, redirectUri); - } catch (UaaException e) { - if (e.getHttpStatus() == 409) { - model.addAttribute("error_message_code", "username_exists"); - model.addAttribute("email", ((UaaPrincipal) securityContext.getAuthentication().getPrincipal()).getEmail()); - response.setStatus(HttpStatus.UNPROCESSABLE_ENTITY.value()); - return "change_email"; - } - } + changeEmailService.beginEmailChange(userId, userEmail, newEmail.getNewEmail(), clientId, redirectUri); return "redirect:email_sent?code=email_change"; } diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java index 3b3603ec3bb..657870fdac3 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java @@ -23,7 +23,6 @@ import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Qualifier; -import org.springframework.http.HttpStatus; import org.springframework.stereotype.Service; import org.springframework.util.StringUtils; import org.springframework.web.client.HttpClientErrorException; @@ -88,7 +87,7 @@ public void beginActivation(String email, String password, String clientId, Stri List users = scimUserProvisioning.retrieveByUsernameAndOriginAndZone(email, OriginKeys.UAA, identityZoneManager.getCurrentIdentityZoneId()); if (!users.isEmpty()) { if (users.getFirst().isVerified()) { - throw new UaaException("User already active.", HttpStatus.CONFLICT.value()); + messageService.sendMessage(email, MessageType.CREATE_ACCOUNT_CONFIRMATION, buildAccountExistsSubjectText(), getAccountExistsEmailHtml(email)); } else { generateAndSendCode(email, clientId, subject, users.getFirst().getId(), redirectUri, identityZoneManager.getCurrentIdentityZone()); } @@ -128,6 +127,16 @@ public AccountCreationResponse completeActivation(String code) { String zoneId = identityZoneManager.getCurrentIdentityZoneId(); ScimUser user = scimUserProvisioning.retrieve(data.get("user_id"), zoneId); + String clientId = data.get("client_id"); + String redirectUri = data.get("redirect_uri") != null ? data.get("redirect_uri") : ""; + + if (Boolean.parseBoolean(data.get(ScimUtils.USER_PROVISIONED))) { + // The code was requested through the user API, so a caller that may create users set the password. + // Opening the link only has to verify the email address. + user = scimUserProvisioning.verifyUser(user.getId(), user.getVersion(), zoneId); + return new AccountCreationResponse(user.getId(), user.getUserName(), user.getUserName(), getRedirect(clientId, redirectUri)); + } + // Confirming the activation link proves ownership of the email address, but it does not // prove that the person confirming is the one who chose the password on the registration // form. Discard the registration password so it can never authenticate, and require the @@ -139,8 +148,6 @@ public AccountCreationResponse completeActivation(String code) { scimUserProvisioning.updatePasswordChangeRequired(user.getId(), true, zoneId); user = scimUserProvisioning.verifyUser(user.getId(), -1, zoneId); - String clientId = data.get("client_id"); - String redirectUri = data.get("redirect_uri") != null ? data.get("redirect_uri") : ""; // Resolve the signup redirect (honouring the client's signup_redirect_url fallback) so it is // preserved across the reset flow and applied once the owner has set their password. String redirectLocation = getRedirect(clientId, redirectUri); @@ -211,6 +218,23 @@ private String buildSubjectText() { } } + private String buildAccountExistsSubjectText() { + return "You already have an account"; + } + + private String getAccountExistsEmailHtml(String email) { + IdentityZone currentIdentityZone = identityZoneManager.getCurrentIdentityZone(); + final Context ctx = new Context(); + String companyName = MergedZoneBrandingInformation.resolveBranding().getCompanyName(); + if (currentIdentityZone.isUaa()) { + ctx.setVariable("serviceName", StringUtils.hasText(companyName) ? companyName : "Cloud Foundry"); + } else { + ctx.setVariable("serviceName", currentIdentityZone.getName()); + } + ctx.setVariable("email", email); + return templateEngine.process("account_exists", ctx); + } + private String getEmailHtml(String code, String email, IdentityZone currentIdentityZone) { String accountsUrl = ScimUtils.getVerificationURL(null, currentIdentityZone).toString(); diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailService.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailService.java index 9d355761209..11e6afd99b4 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailService.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailService.java @@ -69,7 +69,8 @@ public void beginEmailChange(String userId, String email, String newEmail, Strin if (user.getUserName().equals(user.getPrimaryEmail())) { if (!results.isEmpty()) { - throw new UaaException("Conflict", 409); + messageService.sendMessage(newEmail, MessageType.CHANGE_EMAIL, "You already have an account", getAccountExistsEmailHtml(newEmail)); + return; } } @@ -152,6 +153,18 @@ private String getSubjectText() { } } + private String getAccountExistsEmailHtml(String newEmail) { + final Context ctx = new Context(); + if (identityZoneManager.isCurrentZoneUaa()) { + String companyName = MergedZoneBrandingInformation.resolveBranding().getCompanyName(); + ctx.setVariable("serviceName", StringUtils.hasText(companyName) ? companyName : "Cloud Foundry"); + } else { + ctx.setVariable("serviceName", identityZoneManager.getCurrentIdentityZone().getName()); + } + ctx.setVariable("email", newEmail); + return templateEngine.process("account_exists", ctx); + } + private String getEmailChangeEmailHtml(String email, String newEmail, String code) { String verifyUrl = UaaUrlUtils.getUaaUrl("/verify_email", identityZoneManager.getCurrentIdentityZone()); diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpoints.java b/server/src/main/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpoints.java index 3bfef100c4a..2b332c3e02d 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpoints.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpoints.java @@ -455,7 +455,7 @@ public ResponseEntity getUserVerificationLink(@PathVariabl throw new UserAlreadyVerifiedException(); } - ExpiringCode expiringCode = ScimUtils.getExpiringCode(codeStore, userId, user.getPrimaryEmail(), clientId, redirectUri, REGISTRATION, identityZoneManager.getCurrentIdentityZoneId()); + ExpiringCode expiringCode = ScimUtils.getExpiringCode(codeStore, userId, user.getPrimaryEmail(), clientId, redirectUri, REGISTRATION, identityZoneManager.getCurrentIdentityZoneId(), Map.of(ScimUtils.USER_PROVISIONED, "true")); responseBody.setVerifyLink(ScimUtils.getVerificationURL(expiringCode, identityZoneManager.getCurrentIdentityZone())); return new ResponseEntity<>(responseBody, HttpStatus.OK); diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/scim/util/ScimUtils.java b/server/src/main/java/org/cloudfoundry/identity/uaa/scim/util/ScimUtils.java index 729c16d2dd6..5c4ab1ff50e 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/scim/util/ScimUtils.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/scim/util/ScimUtils.java @@ -24,6 +24,12 @@ public final class ScimUtils { + /** + * Data entry of a verification code that was requested through the user API: the password of the + * account was set by the caller, so opening the link only has to verify the email address. + */ + public static final String USER_PROVISIONED = "user_provisioned"; + private static final Logger logger = LoggerFactory.getLogger(ScimUtils.class); private ScimUtils() { @@ -49,6 +55,21 @@ public static ExpiringCode getExpiringCode( String redirectUri, ExpiringCodeType intent, String currentZoneId) { + return getExpiringCode(codeStore, userId, email, clientId, redirectUri, intent, currentZoneId, Map.of()); + } + + /** + * Same as above, with extra entries for the data stored in the code. + */ + public static ExpiringCode getExpiringCode( + ExpiringCodeStore codeStore, + String userId, + String email, + String clientId, + String redirectUri, + ExpiringCodeType intent, + String currentZoneId, + Map additionalData) { Assert.notNull(codeStore, "codeStore must not be null"); Assert.notNull(userId, "userId must not be null"); Assert.notNull(email, "email must not be null"); @@ -61,6 +82,7 @@ public static ExpiringCode getExpiringCode( if (redirectUri != null) { codeData.put("redirect_uri", redirectUri); } + codeData.putAll(additionalData); String codeDataString = JsonUtils.writeValueAsString(codeData); Timestamp expiresAt = new Timestamp(System.currentTimeMillis() + (60 * 60 * 1000)); // 1 hour diff --git a/server/src/main/resources/templates/mail/account_exists.html b/server/src/main/resources/templates/mail/account_exists.html new file mode 100644 index 00000000000..5012abe1126 --- /dev/null +++ b/server/src/main/resources/templates/mail/account_exists.html @@ -0,0 +1,22 @@ + + + + + + +

+ A request has been made to use user@example.com for a ExampleService account. +

+

+ This email address already has an account, so no new account was created and your account has not changed. + You can sign in with your existing password, or use the forgot password link on the sign in page if you do not remember it. +

+

+ If you did not make this request, simply ignore this message. +

+

+ Thank you,
+ The Administration +

+ + diff --git a/server/src/main/resources/templates/web/accounts/email_sent.html b/server/src/main/resources/templates/web/accounts/email_sent.html index 389d37b61b0..82ff6d04880 100644 --- a/server/src/main/resources/templates/web/accounts/email_sent.html +++ b/server/src/main/resources/templates/web/accounts/email_sent.html @@ -11,9 +11,12 @@

Create your -

+

Check email for an activation link

+

+ Check user@example.com for an activation link +

diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/account/AccountCreationResponseTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/account/AccountCreationResponseTest.java new file mode 100644 index 00000000000..4962b75d261 --- /dev/null +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/account/AccountCreationResponseTest.java @@ -0,0 +1,21 @@ +package org.cloudfoundry.identity.uaa.account; + +import org.cloudfoundry.identity.uaa.util.JsonUtils; +import org.junit.jupiter.api.Test; + +import static org.assertj.core.api.Assertions.assertThat; + +class AccountCreationResponseTest { + + @Test + void serializedResponseDoesNotContainThePasswordResetCode() { + AccountCreationService.AccountCreationResponse response = new AccountCreationService.AccountCreationResponse("user-id", "username", "user@example.com", "home"); + response.setPasswordResetCode("the_reset_code"); + + String json = JsonUtils.writeValueAsString(response); + + assertThat(json) + .contains("user_id", "user-id") + .doesNotContain("password_reset_code", "the_reset_code"); + } +} diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/account/AccountsControllerViewZonePathTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/account/AccountsControllerViewZonePathTests.java index da1ed4214bf..94fb8acdfe0 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/account/AccountsControllerViewZonePathTests.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/account/AccountsControllerViewZonePathTests.java @@ -113,6 +113,26 @@ void accountsEmailSentPageContainsZoneAwareCreateAccountLink(ZoneRequestPathMode assertThat(result.getResponse().getContentAsString()).contains(expectedHref(mode, "/create_account")); } + @ParameterizedTest + @EnumSource(ZoneRequestPathMode.class) + void accountsEmailSentPageShowsTheAddressTheEmailWasSentTo(ZoneRequestPathMode mode) throws Exception { + setZoneWithSelfServiceEnabled(mode); + MvcResult result = mockMvc.perform(request(mode, "/accounts/email_sent").flashAttr("email", "user@example.com")) + .andExpect(status().isOk()) + .andReturn(); + assertThat(result.getResponse().getContentAsString()).contains("user@example.com"); + } + + @ParameterizedTest + @EnumSource(ZoneRequestPathMode.class) + void accountsEmailSentPageEscapesTheAddress(ZoneRequestPathMode mode) throws Exception { + setZoneWithSelfServiceEnabled(mode); + MvcResult result = mockMvc.perform(request(mode, "/accounts/email_sent").flashAttr("email", "bold@example.com")) + .andExpect(status().isOk()) + .andReturn(); + assertThat(result.getResponse().getContentAsString()).doesNotContain("bold"); + } + @ParameterizedTest @EnumSource(ZoneRequestPathMode.class) void createAccountPageContainsZoneAwareFormActionAndLoginLink(ZoneRequestPathMode mode) throws Exception { diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailServiceTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailServiceTest.java index fd280f23a05..d37ac7dd8b9 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailServiceTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailServiceTest.java @@ -45,6 +45,7 @@ import java.util.Map; import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatCode; import static org.assertj.core.api.Assertions.assertThatThrownBy; import static org.cloudfoundry.identity.uaa.account.EmailChangeEmailService.CHANGE_EMAIL_REDIRECT_URL; import static org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType.EMAIL; @@ -54,6 +55,7 @@ import static org.mockito.Mockito.doThrow; import static org.mockito.Mockito.eq; import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.never; import static org.mockito.Mockito.verify; import static org.mockito.Mockito.when; @@ -153,7 +155,10 @@ void beginEmailChangeWithUsernameConflict() { eq(zoneId)) ).thenReturn(Collections.singletonList(new ScimUser())); - assertThatThrownBy(() -> emailChangeEmailService.beginEmailChange("user-001", "user@example.com", "new@example.com", null, null)).asInstanceOf(InstanceOfAssertFactories.throwable(UaaException.class)); + assertThatCode(() -> emailChangeEmailService.beginEmailChange("user-001", "user@example.com", "new@example.com", null, null)).doesNotThrowAnyException(); + + verify(mockEmailService).sendMessage(eq("new@example.com"), any(MessageType.class), anyString(), anyString()); + verify(mockExpiringCodeStore, never()).generateCode(anyString(), any(Timestamp.class), anyString(), anyString()); } @Test diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerTest.java index 63199a8e9cf..664228d673d 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerTest.java @@ -3,7 +3,6 @@ import org.cloudfoundry.identity.uaa.account.AccountCreationService; import org.cloudfoundry.identity.uaa.account.AccountsController; import org.cloudfoundry.identity.uaa.constants.OriginKeys; -import org.cloudfoundry.identity.uaa.error.UaaException; import org.cloudfoundry.identity.uaa.extensions.PollutionPreventionExtension; import org.cloudfoundry.identity.uaa.home.BuildInfo; import org.cloudfoundry.identity.uaa.provider.IdentityProvider; @@ -37,6 +36,8 @@ import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; import java.net.URI; +import java.net.URLEncoder; +import java.nio.charset.StandardCharsets; import java.util.Arrays; import java.util.Collections; @@ -48,6 +49,7 @@ import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.head; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.flash; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.model; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; @@ -115,6 +117,20 @@ void sendActivationEmail() throws Exception { Mockito.verify(accountCreationService).beginActivation("user1@example.com", "password", "app", "http://example.com/redirect"); } + @Test + void sendActivationEmailKeepsTheEmailForTheConfirmationPage() throws Exception { + MockHttpServletRequestBuilder post = post("/create_account.do") + .param("email", "user1@example.com") + .param("password", "password") + .param("password_confirmation", "password") + .param("client_id", "app"); + + mockMvc.perform(post) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("accounts/email_sent")) + .andExpect(flash().attribute("email", "user1@example.com")); + } + @Test void attemptCreateAccountWithEmailDomainRestriction() throws Exception { MockHttpSession session = new MockHttpSession(); @@ -138,9 +154,7 @@ void attemptCreateAccountWithEmailDomainRestriction() throws Exception { } @Test - void sendActivationEmailWithUserNameConflict() throws Exception { - doThrow(new UaaException("username already exists", 409)).when(accountCreationService).beginActivation("user1@example.com", "password", "app", null); - + void sendActivationEmailForAnExistingAccountRedirectsLikeANewAddress() throws Exception { MockHttpServletRequestBuilder post = post("/create_account.do") .param("email", "user1@example.com") .param("password", "password") @@ -148,9 +162,9 @@ void sendActivationEmailWithUserNameConflict() throws Exception { .param("client_id", "app"); mockMvc.perform(post) - .andExpect(status().isUnprocessableEntity()) - .andExpect(view().name("accounts/new_activation_email")) - .andExpect(model().attribute("error_message_code", "username_exists")); + .andExpect(status().isFound()) + .andExpect(redirectedUrl("accounts/email_sent")) + .andExpect(model().attributeDoesNotExist("error_message_code")); Mockito.verify(accountCreationService).beginActivation("user1@example.com", "password", "app", null); } @@ -217,6 +231,28 @@ void verifyUser() throws Exception { assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull(); } + @Test + void verifyUserWithoutResetCodeGoesToLoginAndKeepsTheClientRedirect() throws Exception { + AccountCreationService.AccountCreationResponse response = new AccountCreationService.AccountCreationResponse("newly-created-user-id", "username", "user@example.com", "http://example.com/callback?a=1&b=2"); + when(accountCreationService.completeActivation("the_secret_code")).thenReturn(response); + when(accountCreationService.getDefaultRedirect()).thenReturn("home"); + + mockMvc.perform(get("/verify_user").param("code", "the_secret_code")) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("/login?success=verify_success&form_redirect_uri=" + URLEncoder.encode("http://example.com/callback?a=1&b=2", StandardCharsets.UTF_8))); + } + + @Test + void verifyUserWithoutResetCodeAndWithTheDefaultRedirectGoesToLogin() throws Exception { + AccountCreationService.AccountCreationResponse response = new AccountCreationService.AccountCreationResponse("newly-created-user-id", "username", "user@example.com", "home"); + when(accountCreationService.completeActivation("the_secret_code")).thenReturn(response); + when(accountCreationService.getDefaultRedirect()).thenReturn("home"); + + mockMvc.perform(get("/verify_user").param("code", "the_secret_code")) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("/login?success=verify_success")); + } + @Test void verifyUserWithPriorHeadRequest() throws Exception { AccountCreationService.AccountCreationResponse response = new AccountCreationService.AccountCreationResponse("newly-created-user-id", "username", "user@example.com", "//example.com/callback"); diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/login/ChangeEmailControllerTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/login/ChangeEmailControllerTest.java index 3006a34f8a1..074d942b493 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/login/ChangeEmailControllerTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/login/ChangeEmailControllerTest.java @@ -48,7 +48,6 @@ import static org.assertj.core.api.Assertions.assertThat; import static org.mockito.Mockito.anyString; -import static org.mockito.Mockito.doThrow; import static org.mockito.Mockito.mock; import static org.mockito.Mockito.verify; import static org.mockito.Mockito.when; @@ -129,21 +128,19 @@ void changeEmailWithClientIdAndRedirectUri() throws Exception { } @Test - void changeEmailWithUsernameConflict() throws Exception { + void changeEmailToAnAddressThatHasAnAccountRedirectsLikeAFreeAddress() throws Exception { setupSecurityContext(); - doThrow(new UaaException("username already exists", 409)).when(changeEmailService).beginEmailChange("user-id-001", "bob", "new@example.com", "", null); - MockHttpServletRequestBuilder post = post("/change_email.do") .contentType(APPLICATION_FORM_URLENCODED) .param("newEmail", "new@example.com") .param("client_id", ""); mockMvc.perform(post) - .andExpect(status().isUnprocessableEntity()) - .andExpect(view().name("change_email")) - .andExpect(model().attribute("error_message_code", "username_exists")) - .andExpect(model().attribute("email", "user@example.com")); + .andExpect(status().isFound()) + .andExpect(redirectedUrl("email_sent?code=email_change")); + + verify(changeEmailService).beginEmailChange("user-id-001", "bob", "new@example.com", "", null); } @Test diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java index edf7870ebe8..ac0d21610c3 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java @@ -8,7 +8,6 @@ import org.cloudfoundry.identity.uaa.codestore.ExpiringCode; import org.cloudfoundry.identity.uaa.codestore.ExpiringCodeStore; import org.cloudfoundry.identity.uaa.constants.OriginKeys; -import org.cloudfoundry.identity.uaa.error.UaaException; import org.cloudfoundry.identity.uaa.extensions.PollutionPreventionExtension; import org.cloudfoundry.identity.uaa.message.MessageService; import org.cloudfoundry.identity.uaa.message.MessageType; @@ -49,6 +48,7 @@ import java.util.HashMap; import java.util.Map; +import static org.assertj.core.api.Assertions.assertThatCode; import static org.assertj.core.api.Assertions.assertThatThrownBy; import static org.assertj.core.api.Assertions.assertThat; import static org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType.REGISTRATION; @@ -60,6 +60,9 @@ import static org.mockito.Mockito.doThrow; import static org.mockito.Mockito.eq; import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.never; +import static org.mockito.Mockito.verifyNoInteractions; +import static org.mockito.ArgumentMatchers.anyBoolean; import static org.mockito.Mockito.verify; import static org.mockito.Mockito.when; @@ -211,8 +214,19 @@ void beginActivationWithExistingUser() { eq(currentIdentityZoneId)) ).thenReturn(Collections.singletonList(user)); when(mockScimUserProvisioning.createUser(any(ScimUser.class), anyString(), eq(currentIdentityZoneId))).thenThrow(new ScimResourceAlreadyExistsException("duplicate")); + IdentityZone mockIdentityZone = mock(IdentityZone.class); + when(mockIdentityZone.getName()).thenReturn("something"); + when(mockIdentityZoneManager.getCurrentIdentityZone()).thenReturn(mockIdentityZone); - assertThatThrownBy(() -> emailAccountCreationService.beginActivation("user@example.com", "password", "login", null)).asInstanceOf(InstanceOfAssertFactories.throwable(UaaException.class)); + assertThatCode(() -> emailAccountCreationService.beginActivation("user@example.com", "password", "login", null)).doesNotThrowAnyException(); + + verify(mockMessageService).sendMessage( + eq("user@example.com"), + any(MessageType.class), + anyString(), + anyString() + ); + verify(mockCodeStore, never()).generateCode(anyString(), any(Timestamp.class), anyString(), anyString()); } @Test @@ -297,6 +311,30 @@ void completeActivationDiscardsRegistrationPasswordAndRequiresPasswordReset() { assertThat(accountCreation.getPasswordResetCode()).isEqualTo("reset_password_code"); } + @Test + void completeActivationForACodeFromTheUserApiOnlyVerifiesTheUser() { + setUpForSuccess(""); + Map data = new HashMap<>(); + data.put("user_id", "newly-created-user-id"); + data.put("email", "user@example.com"); + data.put("client_id", "login"); + data.put("user_provisioned", "true"); + code = new ExpiringCode("the_secret_code", code.getExpiresAt(), JsonUtils.writeValueAsString(data), REGISTRATION.name()); + when(mockCodeStore.retrieveCode("the_secret_code", currentIdentityZoneId)).thenReturn(code); + when(mockScimUserProvisioning.retrieve(anyString(), eq(currentIdentityZoneId))).thenReturn(user); + when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(currentIdentityZoneId))).thenReturn(user); + when(mockClientDetailsService.loadClientByClientId(anyString(), anyString())).thenReturn(mockClientDetails); + + AccountCreationService.AccountCreationResponse accountCreation = emailAccountCreationService.completeActivation("the_secret_code"); + + verify(mockScimUserProvisioning).verifyUser(eq("newly-created-user-id"), anyInt(), eq(currentIdentityZoneId)); + verify(mockScimUserProvisioning, never()).changePassword(anyString(), any(), anyString(), anyString()); + verify(mockScimUserProvisioning, never()).updatePasswordChangeRequired(anyString(), anyBoolean(), anyString()); + verifyNoInteractions(mockResetPasswordService); + assertThat(accountCreation.getPasswordResetCode()).isNull(); + assertThat(accountCreation.getRedirectLocation()).isEqualTo("home"); + } + @Test void completeActivation_usesAntPathMatching() { setUpForSuccess("http://redirect.uri/"); diff --git a/server/src/test/resources/messages.properties b/server/src/test/resources/messages.properties index 4ab272636fb..2d90f1a257b 100644 --- a/server/src/test/resources/messages.properties +++ b/server/src/test/resources/messages.properties @@ -32,3 +32,4 @@ INSUFFICIENT_CHARACTERISTICS=Password matches %1$s of %3$s character rules, but SOURCE_VIOLATION=Password cannot be the same as your %1$s password. TOO_LONG=Password must be no more than %2$s characters in length. TOO_SHORT=Password must be at least %1$s characters in length. +email_sent.activation_address=Please check {0} for an activation link. diff --git a/uaa/src/main/resources/messages.properties b/uaa/src/main/resources/messages.properties index 80ec61c0705..1a1749c7828 100644 --- a/uaa/src/main/resources/messages.properties +++ b/uaa/src/main/resources/messages.properties @@ -24,9 +24,9 @@ email_change.success=Email address successfully verified. email_change.non-uaa-origin=Sorry, your email cannot be changed from here. email_change.invalid_email=Please enter a valid email address. email_change.invalid_code=Your verification link has expired. Please request another. -email_change.username_exists=There is already a user with that email address. email_sent.email_change=Please check your email for a verification link. email_sent.activation=Please check email for an activation link. +email_sent.activation_address=Please check {0} for an activation link. email_sent.reset_password=Please check your email for a reset password link. account_activation.form_error=Passwords must match and not be empty. account_activation.code_expired=Your invitation code has expired. Please request another. diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/CreateAccountIT.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/CreateAccountIT.java index bdd63968a5a..3f785a02a57 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/CreateAccountIT.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/CreateAccountIT.java @@ -87,7 +87,7 @@ void userInitiatedSignup() throws Exception { assertThat(body).contains("Activate your account"); assertThat(webDriver.findElement(By.tagName("h1")).getText()).isEqualTo("Create your account"); - assertThat(webDriver.findElement(By.cssSelector(".instructions-sent")).getText()).isEqualTo("Please check email for an activation link."); + assertThat(webDriver.findElement(By.cssSelector(".instructions-sent")).getText()).isEqualTo("Please check " + userEmail + " for an activation link."); String link = testClient.extractLink(body); assertThat(link).isNotEmpty() @@ -164,7 +164,7 @@ void clientInitiatedSignup() throws Exception { assertThat(message.getHeader("To")[0]).isEqualTo(userEmail); assertThat(GreenMailUtil.getBody(message)).contains("Activate your account"); - assertThat(webDriver.findElement(By.cssSelector(".instructions-sent")).getText()).isEqualTo("Please check email for an activation link."); + assertThat(webDriver.findElement(By.cssSelector(".instructions-sent")).getText()).isEqualTo("Please check " + userEmail + " for an activation link."); String link = testClient.extractLink(GreenMailUtil.getBody(message)); assertThat(link).isNotEmpty(); diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java index 865c55bbcc9..2bfafa157aa 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java @@ -1,5 +1,6 @@ package org.cloudfoundry.identity.uaa.login; +import jakarta.mail.Message; import java.nio.charset.StandardCharsets; import org.apache.commons.lang3.RandomStringUtils; import org.cloudfoundry.identity.uaa.DefaultTestContext; @@ -139,6 +140,78 @@ void activationEmailSentPage() throws Exception { assertThat(result.getResponse().getContentAsString()).contains("Create your account"); } + @Test + void activationEmailSentPageWithoutAnAddressStillRenders() throws Exception { + mockMvc.perform(get("/accounts/email_sent")) + .andExpect(status().isOk()) + .andExpect(xpath("//input[@disabled='disabled']/@value").string("Email successfully sent")); + } + + @Test + void creatingAnAccountShowsTheEmailOnTheConfirmationPage() throws Exception { + useRandomActivationCodes(); + MockHttpSession session = new MockHttpSession(); + mockMvc.perform(post("/create_account.do") + .with(cookieCsrf()) + .session(session) + .param("email", userEmail) + .param("password", "secr3T") + .param("password_confirmation", "secr3T")) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("accounts/email_sent")); + + MvcResult page = mockMvc.perform(get("/accounts/email_sent").session(session)) + .andExpect(status().isOk()) + .andReturn(); + + assertThat(page.getResponse().getContentAsString()).contains(userEmail); + } + + @Test + void creatingAnAccountForAnExistingVerifiedUserRedirectsLikeANewAddress() throws Exception { + useRandomActivationCodes(); + createVerifiedUaaUser(userEmail); + + mockMvc.perform(post("/create_account.do") + .with(cookieCsrf()) + .param("email", userEmail) + .param("password", "secr3T") + .param("password_confirmation", "secr3T")) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("accounts/email_sent")); + } + + @Test + void creatingAnAccountForAnExistingVerifiedUserMailsTheOwnerWithoutAnActivationLink() throws Exception { + useRandomActivationCodes(); + createVerifiedUaaUser(userEmail); + + mockMvc.perform(post("/create_account.do") + .with(cookieCsrf()) + .param("email", userEmail) + .param("password", "secr3T") + .param("password_confirmation", "secr3T")); + + assertThat(fakeJavaMailSender.getSentMessages()).hasSize(1); + FakeJavaMailSender.MimeMessageWrapper message = fakeJavaMailSender.getSentMessages().getFirst(); + assertThat(message.getRecipients(Message.RecipientType.TO)).hasSize(1); + assertThat(message.getRecipients(Message.RecipientType.TO).getFirst()).hasToString(userEmail); + assertThat(message.getContentString()).doesNotContain("verify_user"); + } + + private void useRandomActivationCodes() { + webApplicationContext.getBean(JdbcExpiringCodeStore.class).setGenerator(new AlphanumericRandomValueStringGenerator(24)); + } + + private void createVerifiedUaaUser(String email) { + ScimUser existing = new ScimUser(null, email, "Given", "Family"); + existing.setPrimaryEmail(email); + existing.setOrigin(OriginKeys.UAA); + existing.setVerified(true); + webApplicationContext.getBean(JdbcScimUserProvisioning.class) + .createUser(existing, USER_PASSWORD, IdentityZoneHolder.get().getId()); + } + @Test void activationEmailSentPageWithinZone() throws Exception { String subdomain = generator.generate(); diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcZonePathTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcZonePathTests.java index 0bedb800a66..ccad157c708 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcZonePathTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcZonePathTests.java @@ -1,5 +1,6 @@ package org.cloudfoundry.identity.uaa.login; +import jakarta.mail.Message; import java.nio.charset.StandardCharsets; import org.apache.commons.lang3.RandomStringUtils; import org.cloudfoundry.identity.uaa.DefaultTestContext; @@ -153,6 +154,81 @@ void activationEmailSentPageWithinZone(ZoneResolutionMode mode) throws Exception assertThat(result.getResponse().getContentAsString()).contains("Create your account", "Cloud Foundry"); } + @ParameterizedTest + @EnumSource(ZoneResolutionMode.class) + void creatingAnAccountInAnotherZoneShowsTheEmailOnTheConfirmationPage(ZoneResolutionMode mode) throws Exception { + useRandomActivationCodes(); + String subdomain = generator.generate(); + MockMvcUtils.createOtherIdentityZone(subdomain, mockMvc, webApplicationContext, IdentityZoneHolder.getCurrentZoneId()); + + MockHttpSession session = new MockHttpSession(); + mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, "/create_account.do") + .with(cookieCsrf()) + .session(session) + .param("email", userEmail) + .param("password", USER_PASSWORD) + .param("password_confirmation", USER_PASSWORD)) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("accounts/email_sent")); + + MvcResult page = mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.GET, "/accounts/email_sent") + .session(session)) + .andExpect(status().isOk()) + .andReturn(); + + assertThat(page.getResponse().getContentAsString()).contains(userEmail); + } + + @ParameterizedTest + @EnumSource(ZoneResolutionMode.class) + void creatingAnAccountInAnotherZoneForAnExistingVerifiedUserRedirectsLikeANewAddress(ZoneResolutionMode mode) throws Exception { + useRandomActivationCodes(); + String subdomain = generator.generate(); + IdentityZone zone = MockMvcUtils.createOtherIdentityZone(subdomain, mockMvc, webApplicationContext, IdentityZoneHolder.getCurrentZoneId()); + createVerifiedUaaUser(userEmail, zone.getId()); + + mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, "/create_account.do") + .with(cookieCsrf()) + .param("email", userEmail) + .param("password", USER_PASSWORD) + .param("password_confirmation", USER_PASSWORD)) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("accounts/email_sent")); + } + + @ParameterizedTest + @EnumSource(ZoneResolutionMode.class) + void creatingAnAccountInAnotherZoneForAnExistingVerifiedUserMailsTheOwnerWithoutAnActivationLink(ZoneResolutionMode mode) throws Exception { + useRandomActivationCodes(); + String subdomain = generator.generate(); + IdentityZone zone = MockMvcUtils.createOtherIdentityZone(subdomain, mockMvc, webApplicationContext, IdentityZoneHolder.getCurrentZoneId()); + createVerifiedUaaUser(userEmail, zone.getId()); + + mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, "/create_account.do") + .with(cookieCsrf()) + .param("email", userEmail) + .param("password", USER_PASSWORD) + .param("password_confirmation", USER_PASSWORD)); + + assertThat(fakeJavaMailSender.getSentMessages()).hasSize(1); + FakeJavaMailSender.MimeMessageWrapper message = fakeJavaMailSender.getSentMessages().getFirst(); + assertThat(message.getRecipients(Message.RecipientType.TO)).hasSize(1); + assertThat(message.getRecipients(Message.RecipientType.TO).getFirst()).hasToString(userEmail); + assertThat(message.getContentString()).doesNotContain("verify_user"); + } + + private void useRandomActivationCodes() { + webApplicationContext.getBean(JdbcExpiringCodeStore.class).setGenerator(new AlphanumericRandomValueStringGenerator(24)); + } + + private void createVerifiedUaaUser(String email, String zoneId) { + ScimUser existing = new ScimUser(null, email, "Given", "Family"); + existing.setPrimaryEmail(email); + existing.setOrigin(OriginKeys.UAA); + existing.setVerified(true); + webApplicationContext.getBean(JdbcScimUserProvisioning.class).createUser(existing, USER_PASSWORD, zoneId); + } + /** * accounts/email_sent page must render "Resend activation email" link zone-aware. * Passes for SUBDOMAIN; will pass for ZONE_PATH once template/controller are zone path aware. diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpointsMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpointsMockMvcTests.java index 360f54abcf6..2c4fa83f3b9 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpointsMockMvcTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpointsMockMvcTests.java @@ -537,7 +537,32 @@ void verification_link() throws Exception { assertThat(data.get(USER_ID)).isNotNull(); assertThat(data) .containsEntry(CLIENT_ID, clientDetails.getClientId()) - .containsEntry(REDIRECT_URI, HTTP_REDIRECT_EXAMPLE_COM); + .containsEntry(REDIRECT_URI, HTTP_REDIRECT_EXAMPLE_COM) + .containsEntry("user_provisioned", "true"); + } + + @Test + void verification_link_opened_by_the_user_keeps_the_password_set_by_the_caller() throws Exception { + ScimUser joel = setUpScimUser(); + MvcResult linkResult = mockMvc.perform(setUpVerificationLinkRequest(joel, scimCreateToken)) + .andExpect(status().isOk()) + .andReturn(); + VerificationResponse verificationResponse = JsonUtils.readValue(linkResult.getResponse().getContentAsString(), VerificationResponse.class); + String code = getQueryStringParam(verificationResponse.getVerifyLink().getQuery(), "code"); + + MvcResult verifyResult = mockMvc.perform(get("/verify_user").param("code", code)) + .andExpect(status().isFound()) + .andReturn(); + + assertThat(verifyResult.getResponse().getRedirectedUrl()).startsWith("/login?success=verify_success"); + ScimUser verified = usersRepository.retrieve(joel.getId(), IdentityZoneHolder.get().getId()); + assertThat(verified.isVerified()).isTrue(); + mockMvc.perform(post("/login.do") + .with(cookieCsrf()) + .param("username", joel.getUserName()) + .param("password", USER_PASSWORD)) + .andExpect(redirectedUrl("/")) + .andExpect(authenticated()); } @Test diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpointsMockMvcZonePathTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpointsMockMvcZonePathTests.java index e558e2406b6..80746a648fb 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpointsMockMvcZonePathTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpointsMockMvcZonePathTests.java @@ -281,7 +281,32 @@ void verification_link() throws Exception { assertThat(data.get(USER_ID)).isNotNull(); assertThat(data) .containsEntry(CLIENT_ID, clientDetails.getClientId()) - .containsEntry(REDIRECT_URI, HTTP_REDIRECT_EXAMPLE_COM); + .containsEntry(REDIRECT_URI, HTTP_REDIRECT_EXAMPLE_COM) + .containsEntry("user_provisioned", "true"); + } + + @Test + void verification_link_opened_by_the_user_keeps_the_password_set_by_the_caller() throws Exception { + ScimUser joel = setUpScimUser(); + MvcResult linkResult = mockMvc.perform(setUpVerificationLinkRequest(joel, scimCreateToken)) + .andExpect(status().isOk()) + .andReturn(); + VerificationResponse verificationResponse = JsonUtils.readValue(linkResult.getResponse().getContentAsString(), VerificationResponse.class); + String code = getQueryStringParam(verificationResponse.getVerifyLink().getQuery(), "code"); + + MvcResult verifyResult = mockMvc.perform(get("/verify_user").param("code", code)) + .andExpect(status().isFound()) + .andReturn(); + + assertThat(verifyResult.getResponse().getRedirectedUrl()).startsWith("/login?success=verify_success"); + ScimUser verified = usersRepository.retrieve(joel.getId(), IdentityZoneHolder.get().getId()); + assertThat(verified.isVerified()).isTrue(); + mockMvc.perform(post("/login.do") + .with(cookieCsrf()) + .param("username", joel.getUserName()) + .param("password", USER_PASSWORD)) + .andExpect(redirectedUrl("/")) + .andExpect(authenticated()); } @Test From b42f54825bb68a0bb05280b730f48b98446c4107 Mon Sep 17 00:00:00 2001 From: Filip Hanik Date: Thu, 29 Oct 2026 11:36:03 -0700 Subject: [PATCH 05/10] fix: password change page guard and zone path request hosts - The password change page guard treats /force_password_change/ like /force_password_change, and a password change submit is refused when no change is pending. - A zone path request (/z/{subdomain}/...) must come from a recognized host, like any other request; otherwise it is answered with 404, and the message names the hostname. - Docs: zones.paths.enabled and zones.internal.hostnames in UAA-Configuration-Reference.md. --- docs/UAA-Configuration-Reference.md | 10 +++- .../PasswordChangeUiRequiredFilter.java | 5 +- .../login/ForcePasswordChangeController.java | 3 + .../uaa/zone/IdentityZoneResolvingFilter.java | 17 ++++-- .../PasswordChangeUiRequiredFilterTest.java | 28 +++++++++ .../ForcePasswordChangeControllerTest.java | 30 +++++++++- ...ntityZoneResolvingFilterZonePathTests.java | 53 +++++++++++++++++ ...cePasswordChangeControllerMockMvcTest.java | 36 +++++++++++- ...rdChangeControllerZonePathMockMvcTest.java | 41 +++++++++++++ ...asswordControllerMockMvcZonePathTests.java | 58 +++++++++++++++++++ 10 files changed, 272 insertions(+), 9 deletions(-) diff --git a/docs/UAA-Configuration-Reference.md b/docs/UAA-Configuration-Reference.md index ed645247842..04afa62f63b 100644 --- a/docs/UAA-Configuration-Reference.md +++ b/docs/UAA-Configuration-Reference.md @@ -3314,6 +3314,13 @@ URL paths instead of different subdomains. metadata generation in non-default zones, as the zone information is already encoded in the URL path. See the `login.entityBaseURL` documentation for details on how this affects SAML endpoint URLs. +**Required since 2026-10-26:** A zone path request must come from a recognized host, like any other request. The +hostname must be the host of [`uaa.url`](#uaaurl), the host of [`login.url`](#loginurl), `localhost`, or one of the +[`zones.internal.hostnames`](#zonesinternalhostnames); otherwise the request is answered with a `404` before it reaches +the zone. Earlier versions accepted any hostname for a zone path request. Deployments that reach zone paths through a +hostname that is not yet listed must add it to `zones.internal.hostnames`. When only `localhost` is configured, any +hostname is accepted. + [Back to table](#zone-paths) --- @@ -3326,7 +3333,8 @@ metadata generation in non-default zones, as the zone information is already enc A comprehensive list of hostnames that route to the UAA default zone. The UAA uses these to distinguish zone subdomains. If a request's hostname is not in this list and has extra -subdomain levels, it is treated as a zone subdomain. +subdomain levels, it is treated as a zone subdomain. A hostname that matches none of the +configured root domains is not served, including for zone path requests (`/z/{subdomain}/`) since 2026-10-26. ```yaml zones: diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/authentication/PasswordChangeUiRequiredFilter.java b/server/src/main/java/org/cloudfoundry/identity/uaa/authentication/PasswordChangeUiRequiredFilter.java index e177ac49f35..02bbe40ead4 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/authentication/PasswordChangeUiRequiredFilter.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/authentication/PasswordChangeUiRequiredFilter.java @@ -9,6 +9,7 @@ import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher; import org.springframework.security.web.util.matcher.RequestMatcher; +import org.springframework.security.web.util.matcher.RequestMatchers; import org.springframework.web.filter.OncePerRequestFilter; import jakarta.servlet.FilterChain; @@ -33,7 +34,9 @@ public PasswordChangeUiRequiredFilter() { public PasswordChangeUiRequiredFilter(UaaSavedRequestCache cache) { this.cache = cache; - this.matchPath = PathPatternRequestMatcher.withDefaults().matcher(MATCH_PATH); + this.matchPath = RequestMatchers.anyOf( + PathPatternRequestMatcher.withDefaults().matcher(MATCH_PATH), + PathPatternRequestMatcher.withDefaults().matcher(MATCH_PATH + "/")); this.completedPath = PathPatternRequestMatcher.withDefaults().matcher(COMPLETED_PATH); } diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeController.java b/server/src/main/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeController.java index 975ba488652..568ed763492 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeController.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeController.java @@ -45,6 +45,9 @@ public String handleForcePasswordChange(Model model, @RequestParam("password_confirmation") String passwordConfirmation, HttpServletRequest request, HttpServletResponse response, HttpSession httpSession) { + if (!SessionUtils.isPasswordChangeRequired(httpSession)) { + return "redirect:/"; + } SecurityContext securityContext = SecurityContextHolder.getContext(); UaaAuthentication authentication = (UaaAuthentication) securityContext.getAuthentication(); UaaPrincipal principal = authentication.getPrincipal(); diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneResolvingFilter.java b/server/src/main/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneResolvingFilter.java index adf19d1c93f..7b2c07afc8b 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneResolvingFilter.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneResolvingFilter.java @@ -52,12 +52,17 @@ public IdentityZoneResolvingFilter(final IdentityZoneProvisioning dao, private static final String INTERNAL_ERROR_MESSAGE = "Internal server error while fetching identity zone for subdomain "; private static final String NOT_FOUND_MESSAGE = "Cannot find identity zone for subdomain "; + private static final String UNRECOGNIZED_HOSTNAME_MESSAGE = "Cannot find identity zone, unrecognized hostname: "; @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { String effectiveSubdomain = resolveEffectiveSubdomain(request, response); - if (effectiveSubdomain == null && response.isCommitted()) { + if (effectiveSubdomain == null) { + // no zone to look up: either the response is already sent (400), or the host is not a recognized one + if (!response.isCommitted()) { + handleZoneNotFound(null, request, response, filterChain); + } return; } @@ -85,6 +90,10 @@ private String resolveEffectiveSubdomain(HttpServletRequest request, HttpServlet response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Cannot use both subdomain and zone path"); return null; } + if (subdomainFromHost == null && !defaultZoneHostnames.isEmpty()) { + // the zone comes from the path, but the host is still none of the configured root domains + return null; + } return subdomainFromPath; } return subdomainFromHost; @@ -94,9 +103,6 @@ private String resolveEffectiveSubdomain(HttpServletRequest request, HttpServlet * Looks up identity zone by subdomain. On generic exception sends 500 and returns null; caller should check response.isCommitted(). */ private IdentityZone resolveZoneBySubdomain(String subdomain, HttpServletResponse response) throws IOException { - if (subdomain == null) { - return null; - } try { return dao.retrieveBySubdomain(subdomain); } catch (EmptyResultDataAccessException _) { @@ -119,7 +125,8 @@ private void handleZoneNotFound(String subdomain, HttpServletRequest request, Ht return; } request.setAttribute("error_message_code", "zone.not.found"); - response.sendError(HttpServletResponse.SC_NOT_FOUND, NOT_FOUND_MESSAGE + subdomain); + String message = subdomain == null ? UNRECOGNIZED_HOSTNAME_MESSAGE + request.getServerName() : NOT_FOUND_MESSAGE + subdomain; + response.sendError(HttpServletResponse.SC_NOT_FOUND, message); } private void doFilterWithZone(IdentityZone identityZone, HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/authentication/PasswordChangeUiRequiredFilterTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/authentication/PasswordChangeUiRequiredFilterTest.java index 684cade59ba..94bb6b3034b 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/authentication/PasswordChangeUiRequiredFilterTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/authentication/PasswordChangeUiRequiredFilterTest.java @@ -7,6 +7,8 @@ import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; import org.junit.jupiter.api.extension.ExtendWith; +import org.junit.jupiter.params.ParameterizedTest; +import org.junit.jupiter.params.provider.ValueSource; import org.mockito.InjectMocks; import org.mockito.Mock; import org.mockito.junit.jupiter.MockitoExtension; @@ -153,6 +155,32 @@ void tryingAccessForcePasswordPage() throws Exception { verify(mockHttpServletResponse, times(1)).sendRedirect("/"); } + @ParameterizedTest + @ValueSource(strings = {"GET", "POST"}) + void tryingAccessForcePasswordPageWithTrailingSlash(String method) throws Exception { + mockHttpServletRequest.setRequestURI("/force_password_change/"); + mockHttpServletRequest.setMethod(method); + SecurityContextHolder.getContext().setAuthentication(mockUaaAuthentication); + when(mockUaaAuthentication.isAuthenticated()).thenReturn(true); + setRequiresPasswordChange(mockHttpServletRequest, false); + passwordChangeUiRequiredFilter.doFilterInternal(mockHttpServletRequest, mockHttpServletResponse, mockFilterChain); + verify(mockFilterChain, never()).doFilter(any(), any()); + verify(mockHttpServletResponse, times(1)).sendRedirect("/"); + } + + @ParameterizedTest + @ValueSource(strings = {"GET", "POST"}) + void changePasswordPageWithTrailingSlashWhenChangeIsRequired(String method) throws Exception { + mockHttpServletRequest.setRequestURI("/force_password_change/"); + mockHttpServletRequest.setMethod(method); + SecurityContextHolder.getContext().setAuthentication(mockUaaAuthentication); + when(mockUaaAuthentication.isAuthenticated()).thenReturn(true); + setRequiresPasswordChange(mockHttpServletRequest, true); + passwordChangeUiRequiredFilter.doFilterInternal(mockHttpServletRequest, mockHttpServletResponse, mockFilterChain); + verify(mockFilterChain, times(1)).doFilter(same(mockHttpServletRequest), same(mockHttpServletResponse)); + verify(mockHttpServletResponse, never()).sendRedirect(anyString()); + } + @Test void tryingAccessForcePasswordPageNotAuthenticated() throws Exception { mockHttpServletRequest.setPathInfo("/force_password_change"); diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerTest.java index 81c16984c5f..2a2ef3aaa6b 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerTest.java @@ -5,6 +5,7 @@ import org.cloudfoundry.identity.uaa.authentication.UaaAuthentication; import org.cloudfoundry.identity.uaa.authentication.UaaPrincipal; import org.cloudfoundry.identity.uaa.extensions.PollutionPreventionExtension; +import org.cloudfoundry.identity.uaa.util.SessionUtils; import org.cloudfoundry.identity.uaa.zone.beans.IdentityZoneManagerImpl; import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; @@ -12,13 +13,16 @@ import org.junit.jupiter.params.ParameterizedTest; import org.junit.jupiter.params.provider.ValueSource; import org.springframework.core.io.support.ResourcePropertySource; +import org.springframework.mock.web.MockHttpSession; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.test.context.junit.jupiter.SpringJUnitConfig; import org.springframework.test.web.servlet.MockMvc; import org.springframework.test.web.servlet.setup.MockMvcBuilders; +import static org.mockito.ArgumentMatchers.any; import static org.mockito.ArgumentMatchers.anyLong; import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.never; import static org.mockito.Mockito.times; import static org.mockito.Mockito.verify; import static org.mockito.Mockito.when; @@ -35,14 +39,16 @@ class ForcePasswordChangeControllerTest extends TestClassNullifier { private MockMvc mockMvc; private ResourcePropertySource mockResourcePropertySource; + private ResetPasswordService mockResetPasswordService; private UaaAuthentication mockUaaAuthentication; @BeforeEach void beforeEach() { mockResourcePropertySource = mock(ResourcePropertySource.class); + mockResetPasswordService = mock(ResetPasswordService.class); ForcePasswordChangeController controller = new ForcePasswordChangeController( mockResourcePropertySource, - mock(ResetPasswordService.class), + mockResetPasswordService, new IdentityZoneManagerImpl() ); mockMvc = MockMvcBuilders @@ -79,6 +85,7 @@ void redirectToLogInIfPasswordIsNotExpired(String url) throws Exception { void handleForcePasswordChange(String url) throws Exception { mockMvc.perform( post(url) + .session(sessionWithPasswordChangePending()) .param("password", "pwd") .param("password_confirmation", "pwd") .contextPath("/uaa")) @@ -92,20 +99,41 @@ void handleForcePasswordChange(String url) throws Exception { void handleForcePasswordChangeWithRedirect(String url) throws Exception { mockMvc.perform( post(url) + .session(sessionWithPasswordChangePending()) .param("password", "pwd") .param("password_confirmation", "pwd")) .andExpect(status().isFound()) .andExpect(redirectedUrl("/force_password_change_completed")); } + @ParameterizedTest + @ValueSource(strings = {"/force_password_change", "/force_password_change/"}) + void submitWhenNoPasswordChangeIsPending(String url) throws Exception { + mockMvc.perform( + post(url) + .param("password", "pwd") + .param("password_confirmation", "pwd")) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("/")); + verify(mockResetPasswordService, never()).resetUserPassword(any(), any()); + verify(mockUaaAuthentication, never()).setAuthenticatedTime(anyLong()); + } + @ParameterizedTest @ValueSource(strings = {"/force_password_change", "/force_password_change/"}) void passwordAndConfirmAreDifferent(String url) throws Exception { when(mockResourcePropertySource.getProperty("force_password_change.form_error")).thenReturn("Passwords must match and not be empty."); mockMvc.perform( post(url) + .session(sessionWithPasswordChangePending()) .param("password", "pwd") .param("password_confirmation", "nopwd")) .andExpect(status().isUnprocessableEntity()); } + + private static MockHttpSession sessionWithPasswordChangePending() { + MockHttpSession session = new MockHttpSession(); + SessionUtils.setPasswordChangeRequired(session, true); + return session; + } } diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneResolvingFilterZonePathTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneResolvingFilterZonePathTests.java index 2c91697f8f9..154a88f20bf 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneResolvingFilterZonePathTests.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneResolvingFilterZonePathTests.java @@ -173,6 +173,58 @@ void pathSubdomainAndDefaultZoneHost_continuesWithPathSubdomain() throws Excepti } } + // ---------- Path-based: the host must still be recognized when root domains are configured ---------- + + @Nested + class PathBasedWithUnrecognizedHost { + + @Test + void hostDoesNotMatchAnyRoot_returns404() throws Exception { + filter.setDefaultInternalHostnames(Collections.singleton(ROOT_HOST)); + request.setAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH, "myzone"); + request.setServerName("some.other.domain.com"); + when(dao.retrieveBySubdomain(eq("myzone"))).thenReturn(MultitenancyFixture.identityZone("zone-id", "myzone")); + + filter.doFilter(request, response, chainThatCapturesHolder()); + + assertThat(response.getStatus()).isEqualTo(MockHttpServletResponse.SC_NOT_FOUND); + assertThat(response.getErrorMessage()).contains("some.other.domain.com"); + assertThat(request.getAttribute("error_message_code")).isEqualTo("zone.not.found"); + assertThat(chainInvoked.get()).isFalse(); + verifyNoInteractions(dao); + } + + @Test + void staticResource_hostDoesNotMatchAnyRoot_continuesChain() throws Exception { + filter.setDefaultInternalHostnames(Collections.singleton(ROOT_HOST)); + request.setAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH, "myzone"); + request.setServerName("some.other.domain.com"); + request.setContextPath(""); + request.setRequestURI("/resources/css/app.css"); + request.setServletPath("/resources/css/app.css"); + + filter.doFilter(request, response, chainThatCapturesHolder()); + + assertThat(response.getStatus()).isEqualTo(MockHttpServletResponse.SC_OK); + assertThat(chainInvoked.get()).isTrue(); + } + + @Test + void onlyLocalhostConfigured_acceptsAnyHost() throws Exception { + filter.setDefaultInternalHostnames(Collections.singleton("localhost")); + request.setAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH, "myzone"); + request.setServerName("some.other.domain.com"); + IdentityZone zone = MultitenancyFixture.identityZone("zone-id", "myzone"); + when(dao.retrieveBySubdomain(eq("myzone"))).thenReturn(zone); + + filter.doFilter(request, response, chainThatCapturesHolder()); + + assertThat(response.getStatus()).isEqualTo(MockHttpServletResponse.SC_OK); + assertThat(chainInvoked.get()).isTrue(); + assertThat(zoneInHolderWhenChainInvoked.get().getSubdomain()).isEqualTo("myzone"); + } + } + // ---------- Hostname-based: zone resolution ---------- @Nested @@ -242,6 +294,7 @@ void hostDoesNotMatchAnyRoot_returns404() throws Exception { filter.doFilter(request, response, chainThatCapturesHolder()); assertThat(response.getStatus()).isEqualTo(MockHttpServletResponse.SC_NOT_FOUND); + assertThat(response.getErrorMessage()).contains("some.other.domain.com"); assertThat(request.getAttribute("error_message_code")).isEqualTo("zone.not.found"); assertThat(chainInvoked.get()).isFalse(); verifyNoInteractions(dao); diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerMockMvcTest.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerMockMvcTest.java index 4863bd7707b..55c5d28a93e 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerMockMvcTest.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerMockMvcTest.java @@ -22,16 +22,17 @@ import org.junit.jupiter.api.Test; import org.junit.jupiter.params.ParameterizedTest; import org.junit.jupiter.params.provider.MethodSource; +import org.junit.jupiter.params.provider.ValueSource; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.mock.web.MockHttpSession; import org.springframework.security.core.context.SecurityContext; import org.springframework.security.web.context.HttpSessionSecurityContextRepository; import org.springframework.test.web.servlet.MockMvc; +import org.springframework.test.web.servlet.MvcResult; import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder; import org.springframework.web.context.WebApplicationContext; import jakarta.servlet.http.Cookie; -import jakarta.servlet.http.HttpSession; import java.util.Date; import java.util.stream.Stream; @@ -264,6 +265,39 @@ void submit_password_change_when_not_authenticated() throws Exception { .andExpect(redirectedUrl("/login")); } + @ParameterizedTest + @ValueSource(strings = {"/force_password_change", "/force_password_change/"}) + void submit_password_change_when_no_change_is_pending(String path) throws Exception { + MockHttpSession session = new MockHttpSession(); + mockMvc.perform(post("/login.do") + .param("username", user.getUserName()) + .param("password", "secret") + .session(session) + .with(cookieCsrf()) + .param(CookieBasedCsrfTokenRepository.DEFAULT_CSRF_COOKIE_NAME, "csrf1")) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("/")); + assertThat(SessionUtils.isPasswordChangeRequired(MockMvcUtils.getZoneSession(session))).isFalse(); + + MvcResult submitResult = mockMvc.perform(post(path) + .param("password", "test") + .param("password_confirmation", "test") + .session(session) + .with(cookieCsrf())) + .andExpect(status().isFound()) + .andReturn(); + + mockMvc.perform(post("/login.do") + .param("username", user.getUserName()) + .param("password", "secret") + .session(new MockHttpSession()) + .with(cookieCsrf()) + .param(CookieBasedCsrfTokenRepository.DEFAULT_CSRF_COOKIE_NAME, "csrf1")) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("/")); + assertThat(submitResult.getResponse().getRedirectedUrl()).isEqualTo("/"); + } + static class PasswordPolicyWithInvalidPassword { PasswordPolicy passwordPolicy; String password; diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerZonePathMockMvcTest.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerZonePathMockMvcTest.java index 0b8ed5893d9..b3ce39adc17 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerZonePathMockMvcTest.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerZonePathMockMvcTest.java @@ -331,6 +331,47 @@ void submit_password_change_when_not_authenticated(ZoneResolutionMode mode) thro .andExpect(redirectedUrl(expectedRedirect)); } + @ParameterizedTest + @MethodSource("zoneModesWithForcePasswordChangePaths") + void submit_password_change_when_no_change_is_pending(ZoneResolutionMode mode, String path) throws Exception { + setupZoneAndUser(mode); + String expectedRedirect = mode == ZoneResolutionMode.ZONE_PATH ? "/z/" + subdomain + "/" : "/"; + + MockHttpSession session = new MockHttpSession(); + mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, "/login.do") + .param("username", user.getUserName()) + .param("password", "secret") + .session(session) + .with(cookieCsrf()) + .param(CookieBasedCsrfTokenRepository.DEFAULT_CSRF_COOKIE_NAME, "csrf1")) + .andExpect(status().isFound()) + .andExpect(redirectedUrl(expectedRedirect)); + assertThat(SessionUtils.isPasswordChangeRequired(MockMvcUtils.getZoneSession(session, mode, subdomain))).isFalse(); + + MvcResult submitResult = mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, path) + .param("password", "test") + .param("password_confirmation", "test") + .session(session) + .with(cookieCsrf())) + .andExpect(status().isFound()) + .andReturn(); + + mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, "/login.do") + .param("username", user.getUserName()) + .param("password", "secret") + .session(new MockHttpSession()) + .with(cookieCsrf()) + .param(CookieBasedCsrfTokenRepository.DEFAULT_CSRF_COOKIE_NAME, "csrf1")) + .andExpect(status().isFound()) + .andExpect(redirectedUrl(expectedRedirect)); + assertThat(submitResult.getResponse().getRedirectedUrl()).isEqualTo(expectedRedirect); + } + + static Stream zoneModesWithForcePasswordChangePaths() { + return Stream.of(ZoneResolutionMode.values()) + .flatMap(mode -> Stream.of("/force_password_change", "/force_password_change/").map(path -> Arguments.of(mode, path))); + } + static Stream authenticationTestParamsWithZoneModes() { return ForcePasswordChangeControllerMockMvcTest.authenticationTestParams() .flatMap(pp -> Stream.of(ZoneResolutionMode.values()).map(mode -> Arguments.of(pp, mode))); diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerMockMvcZonePathTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerMockMvcZonePathTests.java index de91eff3739..873270541e4 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerMockMvcZonePathTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerMockMvcZonePathTests.java @@ -1,6 +1,11 @@ package org.cloudfoundry.identity.uaa.login; import org.cloudfoundry.identity.uaa.DefaultTestContext; +import org.springframework.test.util.ReflectionTestUtils; +import org.springframework.test.util.AopTestUtils; +import org.springframework.boot.web.servlet.FilterRegistrationBean; +import org.cloudfoundry.identity.uaa.zone.IdentityZoneResolvingFilter; +import org.cloudfoundry.identity.uaa.account.ResetPasswordController; import org.cloudfoundry.identity.uaa.account.UaaResetPasswordService; import org.cloudfoundry.identity.uaa.codestore.ExpiringCode; import org.cloudfoundry.identity.uaa.codestore.ExpiringCodeStore; @@ -47,6 +52,8 @@ import jakarta.servlet.http.Cookie; import java.sql.Timestamp; import java.util.Collection; +import java.util.ArrayList; +import java.util.Set; import java.util.List; import java.util.Locale; import java.util.Map; @@ -76,6 +83,8 @@ public class ResetPasswordControllerMockMvcZonePathTests { private ExpiringCodeStore codeStore; @Autowired private MockMvc mockMvc; + @Autowired + private FilterRegistrationBean identityZoneResolvingFilter; @BeforeEach void initResetPasswordTest() { @@ -483,6 +492,55 @@ private MockHttpServletRequestBuilder createChangePasswordRequest(ScimUser user, return post; } + @Test + void forgotPasswordForAnUnknownHostIsNotServedWhenRootDomainsAreConfigured() throws Exception { + Set originalHostnames = identityZoneResolvingFilter.getFilter().getDefaultZoneHostnames(); + identityZoneResolvingFilter.getFilter().restoreDefaultHostnames(Set.of("uaa.example.com")); + try { + mockMvc.perform(post("/forgot_password.do") + .header("Host", "request-host.example.org") + .param("username", "marissa")) + .andExpect(status().isNotFound()); + } finally { + identityZoneResolvingFilter.getFilter().restoreDefaultHostnames(originalHostnames); + } + } + + @Test + void forgotPasswordLinkInZonePathRequestDoesNotUseTheRequestHostWhenLoginUrlIsBlank() throws Exception { + String subdomain = subdomainGenerator.generate(); + ScimUser user = createUserInOtherZone(subdomain); + FakeJavaMailSender sender = webApplicationContext.getBean(FakeJavaMailSender.class); + sender.clearMessage(); + Set originalHostnames = identityZoneResolvingFilter.getFilter().getDefaultZoneHostnames(); + identityZoneResolvingFilter.getFilter().restoreDefaultHostnames(Set.of("uaa.example.com")); + String originalLoginUrl = setLoginUrl(""); + try { + mockMvc.perform(ZoneResolutionMode.ZONE_PATH.createRequestBuilder(subdomain, HttpMethod.POST, "/forgot_password.do") + .header("Host", "request-host.example.org") + .param("username", user.getUserName())); + } finally { + setLoginUrl(originalLoginUrl); + identityZoneResolvingFilter.getFilter().restoreDefaultHostnames(originalHostnames); + } + assertThat(contents(sender)).noneMatch(content -> content.contains("request-host.example.org")); + } + + private String setLoginUrl(String loginUrl) { + ResetPasswordController controller = AopTestUtils.getUltimateTargetObject(webApplicationContext.getBean(ResetPasswordController.class)); + String original = (String) ReflectionTestUtils.getField(controller, "externalLoginUrl"); + ReflectionTestUtils.setField(controller, "externalLoginUrl", loginUrl); + return original; + } + + private static List contents(FakeJavaMailSender sender) throws Exception { + List contents = new ArrayList<>(); + for (FakeJavaMailSender.MimeMessageWrapper message : sender.getSentMessages()) { + contents.add(message.getContentString()); + } + return contents; + } + /** * Creates another identity zone (with admin client) and a user in that zone for zone-path tests. * Returns the created user; the zone is in the DB and request-based resolution will use it. From d755d0457fd80b3bb2300b1c9c3aacc723c1e787 Mon Sep 17 00:00:00 2001 From: Filip Hanik Date: Thu, 29 Oct 2026 11:36:03 -0700 Subject: [PATCH 06/10] feat: invitations: email for external acceptance, LDAP code intent, scim.invite.allow_reinvite - An invited user who accepts through SAML must supply an email that matches the invited address, unless the user is a fresh invitee (unverified, username equal to the email). - The invitation code re-issued during LDAP acceptance keeps its intent. - New property scim.invite.allow_reinvite (default true, unchanged behavior). With false, POST /invite_users reports a verified user under failed_invites (user.already-verified) when the caller holds scim.invite but cannot read users (scim.read or zone admin). - Docs: invitations accepted through an external identity provider, the client attributes signup_redirect_url and change_email_redirect_url, and the new property. --- docs/UAA-APIs.rst | 40 +++++ docs/UAA-Configuration-Reference.md | 42 +++++ .../invitations/InvitationsController.java | 4 +- .../uaa/invitations/InvitationsEndpoint.java | 16 +- .../SamlUaaAuthenticationUserManager.java | 4 + .../InvitationsControllerTest.java | 77 ++++++++ .../InvitationsControllerZonePathTest.java | 82 +++++++++ .../ExternalOAuthAuthenticationManagerIT.java | 29 +++ ...enSaml5AuthenticationProviderUaaTests.java | 73 +++++++- .../source/index.html.md.erb | 6 + .../InvitationsEndpointMockMvcTests.java | 170 ++++++++++++++++++ ...vitationsEndpointMockMvcZonePathTests.java | 110 ++++++++++++ 12 files changed, 648 insertions(+), 5 deletions(-) diff --git a/docs/UAA-APIs.rst b/docs/UAA-APIs.rst index 3ea3d54608e..cd556c15c6b 100644 --- a/docs/UAA-APIs.rst +++ b/docs/UAA-APIs.rst @@ -2124,6 +2124,9 @@ Change Email Flow: "email": "example@newemail.com" } +* ``redirect_url`` is the value of the ``change_email_redirect_url`` attribute of the client that started the email + change, and ``null`` when the client has no such attribute or no client was given. + * Response Codes:: 200 - OK @@ -2402,6 +2405,28 @@ The redirect_uri will be validated against allowed redirect_uri for the client. "failed_invites":[] } +.. note:: + + **Verified users and** ``scim.invite.allow_reinvite`` + + By default an email address that belongs to a verified user is invited like any other address: the response + contains the user's ``userId`` and a new ``inviteLink``. When the server sets ``scim.invite.allow_reinvite: false`` + and the token has ``scim.invite`` but may not read users (``GET /Users`` would refuse it, for example because it has + neither ``scim.read`` nor the zone administrator scope), the address is reported in ``failed_invites`` instead. No + user id or link is returned and no invitation is created:: + + { + "new_invites":[], + "failed_invites":[ + {"email":"user1@cqv4f7.com","userId":null,"origin":null,"success":false,"errorCode":"user.already-verified","errorMessage":"The user is already verified.","inviteLink":null} + ] + } + + The other addresses of the request are processed as usual, and users who are not verified yet, as well as new + users, are always invited. A client that re-invites existing users and needs the user id or the link should hold + ``scim.read`` before the property is set to ``false``. See ``scim.invite.allow_reinvite`` in + ``docs/UAA-Configuration-Reference.md``. + .. note:: **Existing unverified UAA-origin users and password handling** @@ -2421,6 +2446,21 @@ The redirect_uri will be validated against allowed redirect_uri for the client. Newly created users (first-time invitations where the account did not exist before) are unaffected: the supplied password is set normally. +.. note:: + + **Accepting an invitation through an external identity provider** + + When the invited user accepts the invitation by signing in at a SAML or OIDC provider, the response of the provider + must carry an email address, and it must match the invited email address (the comparison ignores case). A sign-in that + carries a different address is rejected. + + * SAML: if the assertion has no email attribute, the invitation is accepted only for a first-time invitee, that is a + user created by the invitation who is still unverified and whose username equals the invited email address. For any + other invited user (already verified, or a username that differs from the email address) the sign-in is rejected. + * OIDC: if the token has no email claim, UAA derives an address from the username claim. That address has to match + the invited email address as well, so a token without an email claim only works when the username claim equals the + invited email address. + Group Management APIs diff --git a/docs/UAA-Configuration-Reference.md b/docs/UAA-Configuration-Reference.md index 04afa62f63b..dd74fd76624 100644 --- a/docs/UAA-Configuration-Reference.md +++ b/docs/UAA-Configuration-Reference.md @@ -185,6 +185,7 @@ or `$CLOUDFOUNDRY_CONFIG_PATH/uaa.yml`. | [↪](#scimuserids_enabled) `scim.userids_enabled` | `true`| Enable /ids/Users endpoint| | [↪](#scimuseroverride) `scim.user.override` | `false`| Override existing bootstrap users| | [↪](#scimdeletedeactivate) `scim.delete.deactivate` | `false`| Deactivate instead of delete| +| [↪](#sciminviteallow_reinvite) `scim.invite.allow_reinvite` | `true`| Invite verified users for any `scim.invite` caller| | [↪](#usermaxcount) `userMaxCount` | `500`| Max users returned by list endpoint| | [↪](#groupmaxcount) `groupMaxCount` | `500`| Max groups returned by list endpoint| | [↪](#deleteusers) `delete.users` | — (null)| Users to delete on bootstrap| @@ -1184,6 +1185,16 @@ Bootstrap client definitions loaded at startup. Each entry is keyed by client ID - `jwks` — Inline JWKS for private_key_jwt auth - `jwks_uri` — URI to fetch JWKS - `name` — Display name +- `signup_redirect_url` — Where a user is sent after confirming a self-service signup and setting a password, when the + signup request carries no `redirect_uri` that matches one of the client's registered redirect URIs. Without it the + default is the UAA home page. +- `change_email_redirect_url` — Where a user is sent after verifying an email change, when the verification link + carries no `redirect_uri` that matches one of the client's registered redirect URIs. Without it the user is sent to + the profile page (or the login page when signed out). `POST /email_changes` returns this value as `redirect_url`. + +`signup_redirect_url` and `change_email_redirect_url` are stored as additional information of the client. They are +keys of the client definition (see `scripts/boot/uaa.yml`) and top-level attributes of the client in the client +registration API. [Back to table](#oauth-clients--users) @@ -1848,6 +1859,37 @@ of permanently deleting the record. --- +### `scim.invite.allow_reinvite` + +**Default:** `true` +**Source:** `@Value("${scim.invite.allow_reinvite:true}")` in [`InvitationsEndpoint`](../server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpoint.java) +**Type:** `boolean` + +Controls what `POST /invite_users` returns for an email address that belongs to a user who is already verified. + +- `true` (default): the user is invited like any other user. The response lists the address under `new_invites` with + the user's `userId` and a new `inviteLink`. +- `false`: when the token has `scim.invite` but may not read users, that is when `GET /Users` would refuse it (for + example it has neither `scim.read` nor the zone administrator scope), the address is listed under `failed_invites` + with the error code `user.already-verified` and the message `The user is already verified.`. No user id and no link + are returned, and no invitation code is created. A token that may read users still gets the user id and the link. + +With either value, users who are not verified yet and new users are invited as before, so an expired invitation can +always be sent again, and the other addresses of a batch are processed as usual. + +Before setting `false`, check the clients that call `/invite_users`. A client that holds `scim.invite` without +`scim.read`, re-invites existing users and relies on the user id or the link in the response (for example to assign +permissions or to send the link itself) receives `failed_invites` for verified users. Give such a client `scim.read`, +or leave the property at `true`. + +Which users are verified: users created with `POST /Users` are verified unless the request says otherwise, users of +the `uaa` origin become verified when they accept an invitation, and users of an external origin are verified only +when their identity provider says so (for example the `email_verified` claim of an OpenID Connect provider). + +[Back to table](#scim-user-provisioning) + +--- + ### `userMaxCount` **Default:** `500` diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsController.java b/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsController.java index 8615d1373c6..0186a2c66d5 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsController.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsController.java @@ -321,7 +321,7 @@ public String acceptLdapInvitation(@RequestParam("enterprise_username") String u return handleUnprocessableEntity(model, response, "error_message_code", "code_expired", "invitations/accept_enterprise.do"); } - String newCode = expiringCodeStore.generateCode(expiringCode.getData(), new Timestamp(System.currentTimeMillis() + (1000 * 60 * 10)), null, identityZoneManager.getCurrentIdentityZoneId()).getCode(); + String newCode = expiringCodeStore.generateCode(expiringCode.getData(), new Timestamp(System.currentTimeMillis() + (1000 * 60 * 10)), expiringCode.getIntent(), identityZoneManager.getCurrentIdentityZoneId()).getCode(); UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(username, password); AuthenticationManager authenticationManager; @@ -346,7 +346,7 @@ public String acceptLdapInvitation(@RequestParam("enterprise_username") String u if (!user.getPrimaryEmail().equalsIgnoreCase(((ExtendedLdapUserDetails) authentication.getPrincipal()).getEmailAddress())) { model.addAttribute(EMAIL, data.get(EMAIL)); model.addAttribute("provider", OriginKeys.LDAP); - model.addAttribute("code", expiringCodeStore.generateCode(expiringCode.getData(), new Timestamp(System.currentTimeMillis() + (10 * 60 * 1000)), null, identityZoneManager.getCurrentIdentityZoneId()).getCode()); + model.addAttribute("code", expiringCodeStore.generateCode(expiringCode.getData(), new Timestamp(System.currentTimeMillis() + (10 * 60 * 1000)), expiringCode.getIntent(), identityZoneManager.getCurrentIdentityZoneId()).getCode()); return handleUnprocessableEntity(model, response, "error_message", "invite.email_mismatch", "invitations/accept_invite"); } diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpoint.java b/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpoint.java index b87a446d6c0..e1cfc11931a 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpoint.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpoint.java @@ -21,6 +21,7 @@ import org.cloudfoundry.identity.uaa.oauth.provider.ClientDetails; import org.springframework.stereotype.Controller; import org.springframework.beans.factory.annotation.Qualifier; +import org.springframework.beans.factory.annotation.Value; import org.springframework.web.bind.annotation.PostMapping; import org.springframework.web.bind.annotation.RequestBody; import org.springframework.web.bind.annotation.RequestParam; @@ -40,6 +41,7 @@ import static org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType.INVITATION; import static org.cloudfoundry.identity.uaa.constants.OriginKeys.ORIGIN; import static org.cloudfoundry.identity.uaa.util.DomainFilter.filter; +import static org.cloudfoundry.identity.uaa.web.AuthorizationManagersUtils.anyOf; import static org.cloudfoundry.identity.uaa.zone.IdentityZoneSwitchingFilter.HEADER; import static org.cloudfoundry.identity.uaa.zone.IdentityZoneSwitchingFilter.SUBDOMAIN_HEADER; import static org.cloudfoundry.identity.uaa.oauth.common.util.OAuth2Utils.CLIENT_ID; @@ -58,15 +60,18 @@ public class InvitationsEndpoint { private final IdentityProviderProvisioning identityProviderProvisioning; private final MultitenantClientServices multitenantClientServices; private final ExpiringCodeStore expiringCodeStore; + private final boolean allowReinvite; public InvitationsEndpoint(final ScimUserProvisioning scimUserProvisioning, final @Qualifier("identityProviderProvisioning") IdentityProviderProvisioning identityProviderProvisioning, final MultitenantClientServices multitenantClientServices, - final ExpiringCodeStore expiringCodeStore) { + final ExpiringCodeStore expiringCodeStore, + final @Value("${scim.invite.allow_reinvite:true}") boolean allowReinvite) { this.scimUserProvisioning = scimUserProvisioning; this.identityProviderProvisioning = identityProviderProvisioning; this.multitenantClientServices = multitenantClientServices; this.expiringCodeStore = expiringCodeStore; + this.allowReinvite = allowReinvite; } @PostMapping(value = {"/invite_users", "/invite_users/"}, consumes = "application/json") @@ -103,6 +108,10 @@ public ResponseEntity inviteUsers(@RequestBody InvitationsR if (providers.size() == 1) { FindResult findResult = findOrCreateUser(email, providers.getFirst().getOriginKey()); ScimUser user = findResult.user(); + if (!allowReinvite && user.isVerified() && !canReadUsers(authentication)) { + invitationsResponse.getFailedInvites().add(InvitationsResponse.failure(email, "user.already-verified", "The user is already verified.")); + continue; + } String accountsUrl = UaaUrlUtils.getUaaUrl("/invitations/accept", !IdentityZoneHolder.isUaa(), IdentityZoneHolder.get()); Map data = new HashMap<>(); @@ -159,6 +168,11 @@ private FindResult findOrCreateUser(String email, String origin) { record FindResult(ScimUser user, boolean newUser) {} + // same rule that grants GET /Users + private static boolean canReadUsers(Authentication authentication) { + return anyOf().hasScope("scim.read").isZoneAdmin().authorize(() -> authentication, null).isGranted(); + } + private boolean validateEmail(String email) { boolean valid = true; try { diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/SamlUaaAuthenticationUserManager.java b/server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/SamlUaaAuthenticationUserManager.java index e4a491667e6..cb140ee7f6b 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/SamlUaaAuthenticationUserManager.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/SamlUaaAuthenticationUserManager.java @@ -143,6 +143,10 @@ private UaaUser getAcceptedInvitationUser(UaaPrincipal samlPrincipal, CreateIfMi if (!context.getEmailAttribute().equalsIgnoreCase(user.getEmail())) { throw new BadCredentialsException("SAML User email mismatch. Authenticated email doesn't match invited email."); } + } else if (user.isVerified()) { + throw new BadCredentialsException("SAML User email missing. Authenticated email is required because the invited user is already verified."); + } else if (!user.getUsername().equals(user.getEmail())) { + throw new BadCredentialsException("SAML User email missing. Authenticated email is required because the invited user's username differs from the invited email."); } else { context.addEmailAttribute(user.getEmail()); } diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java index 85e56dfaefa..2ca5c744352 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java @@ -314,6 +314,47 @@ void unverifiedLdapUser_acceptsInvite_byLoggingIn() throws Exception { verify(ldapAuthenticationManager).authenticate(any()); } + @Test + void ldapInviteAcceptanceReissuesCodeWithItsIntent() throws Exception { + Map codeData = getInvitationsCode(LDAP); + String zoneId = IdentityZoneHolder.get().getId(); + when(expiringCodeStore.retrieveCode("the_secret_code", zoneId)).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name())); + when(expiringCodeStore.generateCode(anyString(), any(), any(), eq(zoneId))).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name())); + DynamicLdapAuthenticationManager ldapAuthenticationManager = mock(DynamicLdapAuthenticationManager.class); + when(zoneAwareAuthenticationManager.getLdapAuthenticationManager(any(), any())).thenReturn(ldapAuthenticationManager); + + AuthenticationManager ldapActual = mock(AuthenticationManager.class); + when(ldapAuthenticationManager.getLdapManagerActual()).thenReturn(ldapActual); + + Authentication auth = mock(Authentication.class); + when(auth.isAuthenticated()).thenReturn(true); + when(ldapActual.authenticate(any())).thenReturn(auth); + + ExtendedLdapUserDetails extendedLdapUserDetails = mock(ExtendedLdapUserDetails.class); + + when(auth.getPrincipal()).thenReturn(extendedLdapUserDetails); + when(extendedLdapUserDetails.getEmailAddress()).thenReturn("user@example.com"); + when(extendedLdapUserDetails.getUsername()).thenReturn("test-ldap-user"); + + ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f"); + invitedUser.setPrimaryEmail("user@example.com"); + + when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser); + when(invitationsService.acceptInvitation(anyString(), anyString())).thenReturn(new AcceptedInvitation("blah.test.com", new ScimUser())); + when(expiringCodeStore.generateCode(anyString(), any(), any(), eq(zoneId))).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name())); + + mockMvc.perform(post("/invitations/accept_enterprise.do") + .param("enterprise_username", "test-ldap-user") + .param("enterprise_password", "password") + .param("enterprise_email", "email") + .param("code", "the_secret_code")) + .andExpect(redirectedUrl("/login?success=invite_accepted&form_redirect_uri=blah.test.com")) + .andReturn(); + + + verify(expiringCodeStore, times(1)).generateCode(anyString(), any(), eq(INVITATION.name()), eq(zoneId)); + } + @Test void unverifiedLdapUser_acceptsInvite_byLoggingIn_bad_credentials() throws Exception { Map codeData = getInvitationsCode("ldap"); @@ -379,6 +420,42 @@ void unverifiedLdapUser_acceptsInvite_byLoggingIn_whereEmailDoesNotMatchAuthenti verify(ldapActual).authenticate(any()); } + @Test + void ldapInviteEmailMismatchReissuesCodesWithTheirIntent() throws Exception { + Map codeData = getInvitationsCode(LDAP); + String zoneId = IdentityZoneHolder.get().getId(); + when(expiringCodeStore.retrieveCode("the_secret_code", zoneId)).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name())); + DynamicLdapAuthenticationManager ldapAuthenticationManager = mock(DynamicLdapAuthenticationManager.class); + when(zoneAwareAuthenticationManager.getLdapAuthenticationManager(any(), any())).thenReturn(ldapAuthenticationManager); + + AuthenticationManager ldapActual = mock(AuthenticationManager.class); + when(ldapAuthenticationManager.getLdapManagerActual()).thenReturn(ldapActual); + Authentication auth = mock(Authentication.class); + when(ldapActual.authenticate(any())).thenReturn(auth); + + ExtendedLdapUserDetails extendedLdapUserDetails = mock(ExtendedLdapUserDetails.class); + when(auth.getPrincipal()).thenReturn(extendedLdapUserDetails); + when(extendedLdapUserDetails.getEmailAddress()).thenReturn("different-email@example.com"); + + ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f"); + invitedUser.setPrimaryEmail("user@example.com"); + when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser); + when(expiringCodeStore.generateCode(anyString(), any(), any(), eq(zoneId))).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name())); + + mockMvc.perform(post("/invitations/accept_enterprise.do") + .param("enterprise_username", "test-ldap-user") + .param("enterprise_password", "password") + .param("enterprise_email", "email") + .param("code", "the_secret_code")) + .andExpect(status().isUnprocessableEntity()) + .andExpect(view().name("invitations/accept_invite")) + .andExpect(model().attribute("code", "code")) + .andExpect(model().attribute("error_message", "invite.email_mismatch")) + .andReturn(); + + verify(expiringCodeStore, times(2)).generateCode(anyString(), any(), eq(INVITATION.name()), eq(zoneId)); + } + @Test void acceptInvitePage_for_verifiedUser() throws Exception { String zoneId = IdentityZoneHolder.get().getId(); diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerZonePathTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerZonePathTest.java index f94c835a57b..f2fb31c7abb 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerZonePathTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerZonePathTest.java @@ -355,6 +355,50 @@ void unverifiedLdapUser_acceptsInvite_byLoggingIn(ZoneRequestPathMode mode) thro verify(ldapAuthenticationManager).authenticate(any()); } + @ParameterizedTest + @EnumSource(ZoneRequestPathMode.class) + void ldapInviteAcceptanceReissuesCodeWithItsIntent(ZoneRequestPathMode mode) throws Exception { + mode.setZone(); + Map codeData = getInvitationsCode(LDAP); + String zoneId = IdentityZoneHolder.get().getId(); + when(expiringCodeStore.retrieveCode("the_secret_code", zoneId)).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name())); + when(expiringCodeStore.generateCode(anyString(), any(), any(), eq(zoneId))).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name())); + DynamicLdapAuthenticationManager ldapAuthenticationManager = mock(DynamicLdapAuthenticationManager.class); + when(zoneAwareAuthenticationManager.getLdapAuthenticationManager(any(), any())).thenReturn(ldapAuthenticationManager); + + AuthenticationManager ldapActual = mock(AuthenticationManager.class); + when(ldapAuthenticationManager.getLdapManagerActual()).thenReturn(ldapActual); + + Authentication auth = mock(Authentication.class); + when(auth.isAuthenticated()).thenReturn(true); + when(ldapActual.authenticate(any())).thenReturn(auth); + + ExtendedLdapUserDetails extendedLdapUserDetails = mock(ExtendedLdapUserDetails.class); + + when(auth.getPrincipal()).thenReturn(extendedLdapUserDetails); + when(extendedLdapUserDetails.getEmailAddress()).thenReturn("user@example.com"); + when(extendedLdapUserDetails.getUsername()).thenReturn("test-ldap-user"); + + ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f"); + invitedUser.setPrimaryEmail("user@example.com"); + + when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser); + when(invitationsService.acceptInvitation(anyString(), anyString())).thenReturn(new AcceptedInvitation("blah.test.com", new ScimUser())); + when(expiringCodeStore.generateCode(anyString(), any(), any(), eq(zoneId))).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name())); + + String expectedRedirect = mode.redirectPrefix() + "/login?success=invite_accepted&form_redirect_uri=blah.test.com"; + mockMvc.perform(requestPost(mode, "/invitations/accept_enterprise.do") + .param("enterprise_username", "test-ldap-user") + .param("enterprise_password", "password") + .param("enterprise_email", "email") + .param("code", "the_secret_code")) + .andExpect(redirectedUrl(expectedRedirect)) + .andReturn(); + + + verify(expiringCodeStore, times(1)).generateCode(anyString(), any(), eq(INVITATION.name()), eq(zoneId)); + } + @ParameterizedTest @EnumSource(ZoneRequestPathMode.class) void unverifiedLdapUser_acceptsInvite_byLoggingIn_bad_credentials(ZoneRequestPathMode mode) throws Exception { @@ -424,6 +468,44 @@ void unverifiedLdapUser_acceptsInvite_byLoggingIn_whereEmailDoesNotMatchAuthenti verify(ldapActual).authenticate(any()); } + @ParameterizedTest + @EnumSource(ZoneRequestPathMode.class) + void ldapInviteEmailMismatchReissuesCodesWithTheirIntent(ZoneRequestPathMode mode) throws Exception { + mode.setZone(); + Map codeData = getInvitationsCode(LDAP); + String zoneId = IdentityZoneHolder.get().getId(); + when(expiringCodeStore.retrieveCode("the_secret_code", zoneId)).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name())); + DynamicLdapAuthenticationManager ldapAuthenticationManager = mock(DynamicLdapAuthenticationManager.class); + when(zoneAwareAuthenticationManager.getLdapAuthenticationManager(any(), any())).thenReturn(ldapAuthenticationManager); + + AuthenticationManager ldapActual = mock(AuthenticationManager.class); + when(ldapAuthenticationManager.getLdapManagerActual()).thenReturn(ldapActual); + Authentication auth = mock(Authentication.class); + when(ldapActual.authenticate(any())).thenReturn(auth); + + ExtendedLdapUserDetails extendedLdapUserDetails = mock(ExtendedLdapUserDetails.class); + when(auth.getPrincipal()).thenReturn(extendedLdapUserDetails); + when(extendedLdapUserDetails.getEmailAddress()).thenReturn("different-email@example.com"); + + ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f"); + invitedUser.setPrimaryEmail("user@example.com"); + when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser); + when(expiringCodeStore.generateCode(anyString(), any(), any(), eq(zoneId))).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name())); + + mockMvc.perform(requestPost(mode, "/invitations/accept_enterprise.do") + .param("enterprise_username", "test-ldap-user") + .param("enterprise_password", "password") + .param("enterprise_email", "email") + .param("code", "the_secret_code")) + .andExpect(status().isUnprocessableEntity()) + .andExpect(view().name("invitations/accept_invite")) + .andExpect(model().attribute("code", "code")) + .andExpect(model().attribute("error_message", "invite.email_mismatch")) + .andReturn(); + + verify(expiringCodeStore, times(2)).generateCode(anyString(), any(), eq(INVITATION.name()), eq(zoneId)); + } + @ParameterizedTest @EnumSource(ZoneRequestPathMode.class) void acceptInvitePage_for_verifiedUser(ZoneRequestPathMode mode) throws Exception { diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManagerIT.java b/server/src/test/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManagerIT.java index 08cdbc34752..e18d0e8cde6 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManagerIT.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManagerIT.java @@ -61,6 +61,7 @@ import org.springframework.context.ApplicationEventPublisher; import org.springframework.mock.http.client.MockClientHttpRequest; import org.springframework.mock.web.MockHttpServletRequest; +import org.springframework.security.authentication.BadCredentialsException; import org.springframework.security.authentication.InsufficientAuthenticationException; import org.springframework.security.core.Authentication; import org.springframework.security.core.GrantedAuthority; @@ -1059,6 +1060,29 @@ void invitedUser_becomesVerifiedOnAccept() { RequestContextHolder.resetRequestAttributes(); } + @Test + void invitedVerifiedUser_isRejectedWhenTokenHasNoEmail() { + try { + setUpInvitedUser(true); + assertThat(userDatabase.retrieveUserById("user-id").isVerified()).isTrue(); + addTheUserOnAuth(); + + claims.remove("email"); + claims.put("preferred_username", "someone-else"); + mockToken(); + + assertThatThrownBy(() -> externalOAuthAuthenticationManager.authenticate(xCodeToken)) + .isInstanceOf(BadCredentialsException.class) + .hasMessageContaining("Authenticated email doesn't match invited email"); + + ArgumentCaptor eventCaptor = ArgumentCaptor.forClass(ApplicationEvent.class); + verify(publisher, atLeast(0)).publishEvent(eventCaptor.capture()); + assertThat(eventCaptor.getAllValues()).noneMatch(InvitedUserAuthenticatedEvent.class::isInstance); + } finally { + RequestContextHolder.resetRequestAttributes(); + } + } + @Test void loginAndValidateSignatureUsingTokenKeyEndpoint() throws Exception { config.setTokenKeyUrl(URI.create("http://localhost/token_key").toURL()); @@ -1418,10 +1442,15 @@ private void addTheUserOnAuth() { } private void setUpInvitedUser() { + setUpInvitedUser(false); + } + + private void setUpInvitedUser(boolean verified) { UaaUser existingShadowUser = new UaaUser(new UaaUserPrototype() .withUsername("marissa@bloggs.com") .withPassword("") .withEmail("marissa@bloggs.com") + .withVerified(verified) .withGivenName("Marissa_Old") .withFamilyName("Bloggs_Old") .withId("user-id") diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUaaTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUaaTests.java index 721e99b4ed7..07e2607d12f 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUaaTests.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUaaTests.java @@ -508,9 +508,78 @@ void invitedUserAuthenticationWhenAuthenticatedEmailDoesNotMatchInvitedEmail() { assertThat(user.isVerified()).isFalse(); } + @Test + void invitedVerifiedUserAuthenticationWhenAssertionHasNoEmail() { + Map attributeMappings = new HashMap<>(); + attributeMappings.put("email", "emailAddress"); + providerDefinition.setAttributeMappings(attributeMappings); + provider.setConfig(providerDefinition); + providerProvisioning.update(provider, identityZoneManager.getCurrentIdentityZone().getId()); + + ScimUser scimUser = getInvitedUser(true); + assertThat(userDatabase.retrieveUserById(scimUser.getId()).isVerified()).isTrue(); + Map userAttributes = getUserAttributes("Marissa-invited", null, null, null, null); + Saml2AuthenticationToken authenticationToken = authenticationToken("marissa-invited", attributeStatements(userAttributes)); + + assertThatThrownBy(() -> authenticate(authenticationToken)) + .isInstanceOf(Saml2AuthenticationException.class) + .hasMessageContaining("invited user is already verified"); + + UaaUser user = userDatabase.retrieveUserById(scimUser.getId()); + assertThat(user.getUsername()).isEqualTo("marissa.invited@test.org"); + assertThat(user.getEmail()).isEqualTo("marissa.invited@test.org"); + } + + @Test + void invitedUnverifiedUserWithDifferentUsernameAuthenticationWhenAssertionHasNoEmail() { + Map attributeMappings = new HashMap<>(); + attributeMappings.put("email", "emailAddress"); + providerDefinition.setAttributeMappings(attributeMappings); + provider.setConfig(providerDefinition); + providerProvisioning.update(provider, identityZoneManager.getCurrentIdentityZone().getId()); + + ScimUser scimUser = getInvitedUser(false, "marissa-existing"); + assertThat(userDatabase.retrieveUserById(scimUser.getId()).isVerified()).isFalse(); + Map userAttributes = getUserAttributes("Marissa-invited", null, null, null, null); + Saml2AuthenticationToken authenticationToken = authenticationToken("marissa-invited", attributeStatements(userAttributes)); + + assertThatThrownBy(() -> authenticate(authenticationToken)) + .isInstanceOf(Saml2AuthenticationException.class) + .hasMessageContaining("username differs from the invited email"); + + UaaUser user = userDatabase.retrieveUserById(scimUser.getId()); + assertThat(user.getUsername()).isEqualTo("marissa-existing"); + assertThat(user.getEmail()).isEqualTo("marissa.invited@test.org"); + } + + @Test + void invitedUnverifiedUserAuthenticationWhenAssertionHasNoEmail() { + Map attributeMappings = new HashMap<>(); + attributeMappings.put("email", "emailAddress"); + providerDefinition.setAttributeMappings(attributeMappings); + provider.setConfig(providerDefinition); + providerProvisioning.update(provider, identityZoneManager.getCurrentIdentityZone().getId()); + + ScimUser scimUser = getInvitedUser(false); + Map userAttributes = getUserAttributes("Marissa-invited", null, null, null, null); + authenticate(authenticationToken("marissa-invited", attributeStatements(userAttributes))); + + UaaUser user = userDatabase.retrieveUserById(scimUser.getId()); + assertThat(user.getUsername()).isEqualTo("marissa-invited"); + assertThat(user.getEmail()).isEqualTo("marissa.invited@test.org"); + } + private ScimUser getInvitedUser() { - ScimUser invitedUser = new ScimUser(null, "marissa.invited@test.org", "Marissa", "Bloggs"); - invitedUser.setVerified(false); + return getInvitedUser(false); + } + + private ScimUser getInvitedUser(boolean verified) { + return getInvitedUser(verified, "marissa.invited@test.org"); + } + + private ScimUser getInvitedUser(boolean verified, String username) { + ScimUser invitedUser = new ScimUser(null, username, "Marissa", "Bloggs"); + invitedUser.setVerified(verified); invitedUser.setPrimaryEmail("marissa.invited@test.org"); invitedUser.setOrigin(OriginKeys.UAA); ScimUser scimUser = userProvisioning.createUser(invitedUser, "getInvitedUser-password", diff --git a/uaa/slateCustomizations/source/index.html.md.erb b/uaa/slateCustomizations/source/index.html.md.erb index 226792cd8ce..684df7ec37f 100644 --- a/uaa/slateCustomizations/source/index.html.md.erb +++ b/uaa/slateCustomizations/source/index.html.md.erb @@ -2182,6 +2182,12 @@ _Response Fields_ <%= render('InvitationsEndpointDocs/inviteUsers/response-fields.md') %> +An email address that belongs to a user who is already verified is invited like any other address by default. When the +server sets `scim.invite.allow_reinvite: false` and the token has `scim.invite` but may not read users (`GET /Users` +would refuse it, for example because it has neither `scim.read` nor the zone administrator scope), the address is listed +under `failed_invites` with the error code `user.already-verified`, without a `userId` or an `inviteLink`, and no +invitation is created. Users who are not verified yet and new users are always invited. + | Error Code | Description | |------------|-----------------------------------------------------------------------| | 403 | Forbidden - Insufficient scope | diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpointMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpointMockMvcTests.java index edcd6e45fad..a0381e1d0ee 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpointMockMvcTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpointMockMvcTests.java @@ -432,6 +432,135 @@ void inviteExistingUnverifiedUaaUser_codeContainsCreatedNewUserFalse(@Autowired jdbcTemplate.update("DELETE FROM users WHERE username = ?", email); } + @Test + void inviteVerifiedUserWithScimInviteOnly_returnsUserIdAndLinkByDefault() throws Exception { + String inviteOnlyToken = createScimInviteOnlyClient(mockMvc); + ScimUser verifiedUser = createVerifiedUser(mockMvc, "verified-" + generator.generate().toLowerCase() + "@" + emailDomain); + + InvitationsResponse response = sendRequestWithTokenAndReturnResponse( + webApplicationContext, mockMvc, inviteOnlyToken, null, clientId, "example.com", verifiedUser.getPrimaryEmail()); + + assertInvitedWithUserIdAndLink(response, verifiedUser); + } + + @Nested + @DefaultTestContext + @TestPropertySource(properties = "scim.invite.allow_reinvite=true") + class WhenReinviteIsAllowed { + + @Autowired // New mockMvc tied to the new web app context created by @TestPropertySource + protected MockMvc mockMvc; + + @Test + void inviteVerifiedUserWithScimInviteOnly_returnsUserIdAndLink() throws Exception { + String inviteOnlyToken = createScimInviteOnlyClient(mockMvc); + ScimUser verifiedUser = createVerifiedUser(mockMvc, "verified-" + generator.generate().toLowerCase() + "@" + emailDomain); + + InvitationsResponse response = sendRequestWithTokenAndReturnResponse( + webApplicationContext, mockMvc, inviteOnlyToken, null, clientId, "example.com", verifiedUser.getPrimaryEmail()); + + assertInvitedWithUserIdAndLink(response, verifiedUser); + } + } + + @Nested + @DefaultTestContext + @TestPropertySource(properties = "scim.invite.allow_reinvite=false") + class WhenReinviteIsNotAllowed { + + @Autowired // New mockMvc tied to the new web app context created by @TestPropertySource + protected MockMvc mockMvc; + + @Test + void inviteVerifiedUserWithScimInviteOnlyClient_isReportedAsAlreadyVerified(@Autowired JdbcTemplate jdbcTemplate) throws Exception { + String inviteOnlyToken = createScimInviteOnlyClient(mockMvc); + ScimUser verifiedUser = createVerifiedUser(mockMvc, "verified-" + generator.generate().toLowerCase() + "@" + emailDomain); + int codesBefore = jdbcTemplate.queryForObject("SELECT count(*) FROM expiring_code_store", Integer.class); + + InvitationsResponse response = sendRequestWithTokenAndReturnResponse( + webApplicationContext, mockMvc, inviteOnlyToken, null, clientId, "example.com", verifiedUser.getPrimaryEmail()); + + assertReportedAsAlreadyVerified(response, verifiedUser.getPrimaryEmail()); + assertThat(jdbcTemplate.queryForObject("SELECT count(*) FROM expiring_code_store", Integer.class)).isEqualTo(codesBefore); + } + + @Test + void inviteVerifiedUserWithScimInviteOnlyUserToken_isReportedAsAlreadyVerified() throws Exception { + String userToken = MockMvcUtils.getScimInviteUserToken(mockMvc, clientId, clientSecret, null, "admin", "adminsecret"); + ScimUser verifiedUser = createVerifiedUser(mockMvc, "verified-" + generator.generate().toLowerCase() + "@" + emailDomain); + + InvitationsResponse response = sendRequestWithTokenAndReturnResponse( + webApplicationContext, mockMvc, userToken, null, clientId, "example.com", verifiedUser.getPrimaryEmail()); + + assertReportedAsAlreadyVerified(response, verifiedUser.getPrimaryEmail()); + } + + @Test + void inviteBatchWithScimInviteOnly_onlyTheVerifiedUserIsReported() throws Exception { + String inviteOnlyToken = createScimInviteOnlyClient(mockMvc); + ScimUser verifiedUser = createVerifiedUser(mockMvc, "verified-" + generator.generate().toLowerCase() + "@" + emailDomain); + String unverifiedEmail = "unverified-" + generator.generate().toLowerCase() + "@" + emailDomain; + String newEmail = "new-" + generator.generate().toLowerCase() + "@" + emailDomain; + sendRequestWithTokenAndReturnResponse(webApplicationContext, mockMvc, inviteOnlyToken, null, clientId, "example.com", unverifiedEmail); + + InvitationsResponse response = sendRequestWithTokenAndReturnResponse( + webApplicationContext, mockMvc, inviteOnlyToken, null, clientId, "example.com", verifiedUser.getPrimaryEmail(), unverifiedEmail, newEmail); + + assertThat(response.getNewInvites()) + .extracting(InvitationsResponse.Invitee::getEmail) + .containsExactlyInAnyOrder(unverifiedEmail, newEmail); + assertThat(response.getNewInvites()).allSatisfy(invitee -> { + assertThat(invitee.getUserId()).isNotNull(); + assertThat(invitee.getInviteLink()).isNotNull(); + }); + assertThat(response.getFailedInvites()) + .singleElement() + .satisfies(invitee -> assertThat(invitee.getErrorCode()).isEqualTo("user.already-verified")) + .extracting(InvitationsResponse.Invitee::getEmail) + .isEqualTo(verifiedUser.getPrimaryEmail()); + } + + @Test + void inviteUnverifiedUserWithScimInviteOnly_returnsUserIdAndLink() throws Exception { + String inviteOnlyToken = createScimInviteOnlyClient(mockMvc); + String unverifiedEmail = "unverified-" + generator.generate().toLowerCase() + "@" + emailDomain; + String firstUserId = sendRequestWithTokenAndReturnResponse( + webApplicationContext, mockMvc, inviteOnlyToken, null, clientId, "example.com", unverifiedEmail) + .getNewInvites().getFirst().getUserId(); + + InvitationsResponse response = sendRequestWithTokenAndReturnResponse( + webApplicationContext, mockMvc, inviteOnlyToken, null, clientId, "example.com", unverifiedEmail); + + assertThat(response.getFailedInvites()).isEmpty(); + assertThat(response.getNewInvites()).singleElement().satisfies(invitee -> { + assertThat(invitee.getUserId()).isEqualTo(firstUserId); + assertThat(invitee.getInviteLink()).isNotNull(); + }); + } + + @Test + void inviteVerifiedUserWithScimRead_returnsUserIdAndLink() throws Exception { + String scimReadAndInviteToken = MockMvcUtils.getClientCredentialsOAuthAccessToken(mockMvc, clientId, clientSecret, "scim.read scim.invite", null); + ScimUser verifiedUser = createVerifiedUser(mockMvc, "verified-" + generator.generate().toLowerCase() + "@" + emailDomain); + + InvitationsResponse response = sendRequestWithTokenAndReturnResponse( + webApplicationContext, mockMvc, scimReadAndInviteToken, null, clientId, "example.com", verifiedUser.getPrimaryEmail()); + + assertInvitedWithUserIdAndLink(response, verifiedUser); + } + + @Test + void inviteVerifiedUserAsUaaAdmin_returnsUserIdAndLink() throws Exception { + String uaaAdminToken = MockMvcUtils.getClientCredentialsOAuthAccessToken(mockMvc, "admin", "adminsecret", "uaa.admin", null); + ScimUser verifiedUser = createVerifiedUser(mockMvc, "verified-" + generator.generate().toLowerCase() + "@" + emailDomain); + + InvitationsResponse response = sendRequestWithTokenAndReturnResponse( + webApplicationContext, mockMvc, uaaAdminToken, null, clientId, "example.com", verifiedUser.getPrimaryEmail()); + + assertInvitedWithUserIdAndLink(response, verifiedUser); + } + } + @Test void acceptInvitationEmailWithDefaultCompanyName() throws Exception { MvcResult mvcResult = mockMvc.perform(get(getAcceptInvitationLink(webApplicationContext, mockMvc, clientId, clientSecret, generator, emailDomain, null, "admin", "adminsecret"))) @@ -486,6 +615,47 @@ void invitationsAcceptGetSecurity(@Autowired JdbcTemplate jdbcTemplate) throws E .contains("
"); } + private String createScimInviteOnlyClient(MockMvc mockMvc) throws Exception { + String inviteOnlyClientId = generator.generate().toLowerCase(); + String inviteOnlyClientSecret = generator.generate().toLowerCase(); + String clientAdminToken = MockMvcUtils.getClientCredentialsOAuthAccessToken(mockMvc, "admin", "adminsecret", "clients.write", null); + MockMvcUtils.createClient(mockMvc, clientAdminToken, inviteOnlyClientId, inviteOnlyClientSecret, Collections.singleton("oauth"), + Collections.singletonList("scim.invite"), Collections.singletonList("client_credentials"), "scim.invite"); + return MockMvcUtils.getClientCredentialsOAuthAccessToken(mockMvc, inviteOnlyClientId, inviteOnlyClientSecret, "scim.invite", null); + } + + private static ScimUser createVerifiedUser(MockMvc mockMvc, String email) throws Exception { + String scimWriteToken = MockMvcUtils.getClientCredentialsOAuthAccessToken(mockMvc, "admin", "adminsecret", "scim.write", null); + ScimUser user = new ScimUser(null, email, "givenName", "familyName"); + user.setPrimaryEmail(email); + user.setPassword("password"); + ScimUser created = MockMvcUtils.createUser(mockMvc, scimWriteToken, user); + assertThat(created.isVerified()).isTrue(); + return created; + } + + private static void assertInvitedWithUserIdAndLink(InvitationsResponse response, ScimUser user) { + assertThat(response.getFailedInvites()).isEmpty(); + assertThat(response.getNewInvites()).singleElement().satisfies(invitee -> { + assertThat(invitee.getEmail()).isEqualTo(user.getPrimaryEmail()); + assertThat(invitee.getUserId()).isEqualTo(user.getId()); + assertThat(invitee.isSuccess()).isTrue(); + assertThat(invitee.getInviteLink()).isNotNull(); + }); + } + + private static void assertReportedAsAlreadyVerified(InvitationsResponse response, String email) { + assertThat(response.getNewInvites()).isEmpty(); + assertThat(response.getFailedInvites()).singleElement().satisfies(invitee -> { + assertThat(invitee.getEmail()).isEqualTo(email); + assertThat(invitee.isSuccess()).isFalse(); + assertThat(invitee.getErrorCode()).isEqualTo("user.already-verified"); + assertThat(invitee.getErrorMessage()).isEqualTo("The user is already verified."); + assertThat(invitee.getUserId()).isNull(); + assertThat(invitee.getInviteLink()).isNull(); + }); + } + private static InvitationsResponse sendRequestWithTokenAndReturnResponse(WebApplicationContext webApplicationContext, MockMvc mockMvc, String token, diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpointMockMvcZonePathTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpointMockMvcZonePathTests.java index 9cbcc0a8da2..f2e827ea9a5 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpointMockMvcZonePathTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpointMockMvcZonePathTests.java @@ -249,6 +249,52 @@ void inviteUserWithUserCredentialsWithinZone(ZoneResolutionMode mode) throws Exc assertResponseAndCodeCorrect(expiringCodeStore, new String[]{email}, redirectUrl, mode, zoneResult.getIdentityZone(), response, zonedClientDetails); } + @ParameterizedTest + @EnumSource(ZoneResolutionMode.class) + void inviteVerifiedUserWithinZoneWithScimInviteOnly_returnsUserIdAndLinkByDefault(ZoneResolutionMode mode) throws Exception { + InviteZone zone = createInviteZone(mockMvc, webApplicationContext); + ScimUser verifiedUser = createVerifiedUserInZone(mockMvc, zone, "verified-" + generator.generate().toLowerCase() + "@example.com"); + + InvitationsResponse response = inviteWithinZone(mockMvc, mode, zone, zone.scimInviteUserToken(), verifiedUser.getPrimaryEmail()); + + assertInvitedWithUserIdAndLink(response, verifiedUser); + } + + @Nested + @DefaultTestContext + @TestPropertySource(properties = "scim.invite.allow_reinvite=false") + class WhenReinviteIsNotAllowed { + + @Autowired // New mockMvc tied to the new web app context created by @TestPropertySource + protected MockMvc mockMvc; + + @Autowired + protected WebApplicationContext webApplicationContext; + + @ParameterizedTest + @EnumSource(ZoneResolutionMode.class) + void inviteVerifiedUserWithinZoneWithScimInviteOnly_isReportedAsAlreadyVerified(ZoneResolutionMode mode) throws Exception { + InviteZone zone = createInviteZone(mockMvc, webApplicationContext); + ScimUser verifiedUser = createVerifiedUserInZone(mockMvc, zone, "verified-" + generator.generate().toLowerCase() + "@example.com"); + + InvitationsResponse response = inviteWithinZone(mockMvc, mode, zone, zone.scimInviteUserToken(), verifiedUser.getPrimaryEmail()); + + assertReportedAsAlreadyVerified(response, verifiedUser.getPrimaryEmail()); + } + + @ParameterizedTest + @EnumSource(ZoneResolutionMode.class) + void inviteVerifiedUserWithinZoneWithScimRead_returnsUserIdAndLink(ZoneResolutionMode mode) throws Exception { + InviteZone zone = createInviteZone(mockMvc, webApplicationContext); + ScimUser verifiedUser = createVerifiedUserInZone(mockMvc, zone, "verified-" + generator.generate().toLowerCase() + "@example.com"); + String scimReadAndInviteToken = MockMvcUtils.getClientCredentialsOAuthAccessToken(mockMvc, zone.clientId(), zone.clientSecret(), "scim.read scim.invite", zone.subdomain()); + + InvitationsResponse response = inviteWithinZone(mockMvc, mode, zone, scimReadAndInviteToken, verifiedUser.getPrimaryEmail()); + + assertInvitedWithUserIdAndLink(response, verifiedUser); + } + } + @Nested @DefaultTestContext @TestPropertySource( @@ -770,6 +816,70 @@ private static InvitationsResponse sendRequestWithTokenAndReturnResponse(WebAppl mockMvc, token, subdomain, clientId, redirectUri, emails); } + private record InviteZone(String subdomain, IdentityZone identityZone, String clientId, String clientSecret, String scimInviteUserToken) { + } + + private InviteZone createInviteZone(MockMvc mockMvc, WebApplicationContext webApplicationContext) throws Exception { + String subdomain = generator.generate().toLowerCase(); + UaaClientDetails adminClient = new UaaClientDetails("admin", null, null, "client_credentials", + "clients.admin,scim.read,scim.write,idps.write,uaa.admin", "http://redirect.url"); + adminClient.setClientSecret("admin-secret"); + IdentityZoneCreationResult zoneResult = MockMvcUtils.createOtherIdentityZoneAndReturnResult(subdomain, mockMvc, webApplicationContext, adminClient, IdentityZoneHolder.getCurrentZoneId()); + + String zonedClientId = generator.generate().toLowerCase(); + String zonedClientSecret = generator.generate().toLowerCase(); + MockMvcUtils.createClient(mockMvc, zoneResult.getZoneAdminToken(), zonedClientId, zonedClientSecret, + Collections.singleton("oauth"), Arrays.asList("scim.read", "scim.invite"), Arrays.asList("client_credentials", "password"), + "scim.read,scim.invite", Collections.singleton("http://redirect.url"), zoneResult.getIdentityZone()); + String userToken = MockMvcUtils.getScimInviteUserToken(mockMvc, zonedClientId, zonedClientSecret, zoneResult.getIdentityZone(), "admin", "admin-secret"); + return new InviteZone(subdomain, zoneResult.getIdentityZone(), zonedClientId, zonedClientSecret, userToken); + } + + private static ScimUser createVerifiedUserInZone(MockMvc mockMvc, InviteZone zone, String email) throws Exception { + String zoneAdminToken = MockMvcUtils.getClientCredentialsOAuthAccessToken(mockMvc, "admin", "admin-secret", "", zone.subdomain()); + ScimUser user = new ScimUser(null, email, "givenName", "familyName"); + user.setPrimaryEmail(email); + user.setPassword("password"); + ScimUser created = MockMvcUtils.createUserInZone(mockMvc, zoneAdminToken, user, zone.subdomain()); + assertThat(created.isVerified()).isTrue(); + return created; + } + + private static InvitationsResponse inviteWithinZone(MockMvc mockMvc, ZoneResolutionMode mode, InviteZone zone, String token, String... emails) throws Exception { + MockHttpServletRequestBuilder post = mode.createRequestBuilder(zone.subdomain(), HttpMethod.POST, "/invite_users") + .param(OAuth2Utils.CLIENT_ID, zone.clientId()) + .param(OAuth2Utils.REDIRECT_URI, "example.com") + .header("Authorization", "Bearer " + token) + .contentType(APPLICATION_JSON) + .content(writeValueAsString(new InvitationsRequest(emails))); + MvcResult mvcResult = mockMvc.perform(post) + .andExpect(status().isOk()) + .andReturn(); + return readValue(mvcResult.getResponse().getContentAsString(), InvitationsResponse.class); + } + + private static void assertInvitedWithUserIdAndLink(InvitationsResponse response, ScimUser user) { + assertThat(response.getFailedInvites()).isEmpty(); + assertThat(response.getNewInvites()).singleElement().satisfies(invitee -> { + assertThat(invitee.getEmail()).isEqualTo(user.getPrimaryEmail()); + assertThat(invitee.getUserId()).isEqualTo(user.getId()); + assertThat(invitee.isSuccess()).isTrue(); + assertThat(invitee.getInviteLink()).isNotNull(); + }); + } + + private static void assertReportedAsAlreadyVerified(InvitationsResponse response, String email) { + assertThat(response.getNewInvites()).isEmpty(); + assertThat(response.getFailedInvites()).singleElement().satisfies(invitee -> { + assertThat(invitee.getEmail()).isEqualTo(email); + assertThat(invitee.isSuccess()).isFalse(); + assertThat(invitee.getErrorCode()).isEqualTo("user.already-verified"); + assertThat(invitee.getErrorMessage()).isEqualTo("The user is already verified."); + assertThat(invitee.getUserId()).isNull(); + assertThat(invitee.getInviteLink()).isNull(); + }); + } + private static void assertResponseAndCodeCorrect(ExpiringCodeStore expiringCodeStore, String[] emails, String redirectUrl, IdentityZone zone, InvitationsResponse response, ClientDetails clientDetails) { String expectedLinkPrefix = (zone != null && StringUtils.hasText(zone.getSubdomain())) ? "http://" + zone.getSubdomain() + ".localhost/invitations/accept" From 73f2c1d7e427ecdac51b320e430fd5581a91c3e7 Mon Sep 17 00:00:00 2001 From: Filip Hanik Date: Tue, 3 Nov 2026 11:57:38 -0800 Subject: [PATCH 07/10] test: another activation link, an unregistered signup redirect and a reset code expiring during a submit Opening another activation link for an account that is already confirmed keeps the password the owner has set and asks for no further change. A client's signup_redirect_url applies after the owner sets a password, also when it is not one of the client's registered redirect URIs. Any other unregistered redirect still falls back to home. A reset password submit that fails validation after the code has expired is reported as an invalid code, instead of failing while the code is issued again. https://github.com/cloudfoundry/uaa/pull/4100#pullrequestreview-5755715986 --- ...ResetPasswordAuthenticationFilterTest.java | 40 +++++++++++ .../InvitationsControllerTest.java | 30 +++++++++ .../EmailAccountCreationServiceTests.java | 19 ++++++ .../login/UaaResetPasswordServiceTests.java | 36 ++++++++++ ...enSaml5AuthenticationProviderUaaTests.java | 23 +++++++ .../login/AccountsControllerMockMvcTests.java | 67 ++++++++++++++++++- 6 files changed, 214 insertions(+), 1 deletion(-) diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilterTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilterTest.java index 95059dbdb84..c25a1bd3015 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilterTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilterTest.java @@ -17,6 +17,7 @@ import jakarta.servlet.http.HttpServletResponse; import java.nio.charset.StandardCharsets; import java.sql.Timestamp; +import java.util.concurrent.atomic.AtomicLong; import static org.assertj.core.api.Assertions.assertThat; import static org.mockito.ArgumentMatchers.any; @@ -36,11 +37,14 @@ import org.cloudfoundry.identity.uaa.error.UaaException; import org.cloudfoundry.identity.uaa.scim.ScimUser; import org.cloudfoundry.identity.uaa.scim.exception.InvalidPasswordException; +import org.cloudfoundry.identity.uaa.util.TimeService; import org.cloudfoundry.identity.uaa.util.TimeServiceImpl; import org.cloudfoundry.identity.uaa.zone.IdentityZoneHolder; import org.junit.jupiter.api.AfterEach; import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; +import org.junit.jupiter.params.ParameterizedTest; +import org.junit.jupiter.params.provider.ValueSource; import org.mockito.ArgumentCaptor; import org.springframework.http.HttpStatus; import org.springframework.mock.web.MockHttpServletRequest; @@ -211,6 +215,42 @@ private ExpiringCode codeLifetimeAfterFailedSubmit(boolean mismatchedConfirmatio return renewed; } + @ParameterizedTest + @ValueSource(booleans = {false, true}) + void failed_submit_with_a_code_that_expires_meanwhile_reports_an_invalid_code(boolean mismatchedConfirmation) throws Exception { + AtomicLong now = new AtomicLong(System.currentTimeMillis()); + TimeService clock = new TimeService() { + @Override + public long getCurrentTimeMillis() { + return now.get(); + } + }; + // The code is valid when it is redeemed and expires while the submitted password is checked. + var store = new InMemoryExpiringCodeStore(clock) { + @Override + public ExpiringCode retrieveCode(String code, String zoneId) { + ExpiringCode retrieved = super.retrieveCode(code, zoneId); + now.addAndGet(60_000); + return retrieved; + } + }; + var code = store.generateCode("{}", new Timestamp(now.get() + 30_000), "forgot_password_for_id:id", IdentityZoneHolder.get().getId()).getCode(); + when(service.resetPassword(any(ExpiringCode.class), anyString())).thenThrow(new InvalidPasswordException("failed", HttpStatus.BAD_REQUEST)); + var submit = MockMvcRequestBuilders.post("/reset_password.do") + .param("code", code) + .param("password", password) + .param("password_confirmation", mismatchedConfirmation ? "different" : password) + .param("email", email) + .buildRequest(new MockServletContext()); + + new ResetPasswordAuthenticationFilter(service, entryPoint, store).doFilterInternal(submit, response, chain); + + ArgumentCaptor failure = ArgumentCaptor.forClass(AuthenticationException.class); + verify(entryPoint).commence(same(submit), same(response), failure.capture()); + assertThat(failure.getValue()).hasCauseInstanceOf(InvalidCodeException.class); + assertThat(submit.getAttribute("code")).isNull(); + } + @Test void invalid_code_password_reset() throws Exception { request.setParameter("code", "invalid"); diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java index 2ca5c744352..018e0509f99 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java @@ -34,6 +34,8 @@ import org.junit.jupiter.api.AfterEach; import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; +import org.junit.jupiter.params.ParameterizedTest; +import org.junit.jupiter.params.provider.ValueSource; import org.mockito.ArgumentCaptor; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Qualifier; @@ -210,6 +212,34 @@ void acceptInvitePage_for_unverifiedSamlUser() throws Exception { assertThat(result.getRequest().getSession().getAttribute("user_id")).isEqualTo("user-id-001"); } + @ParameterizedTest + @ValueSource(booleans = {true, false}) + void acceptInvitePage_for_unverifiedSamlUser_recordsWhetherTheInvitationCreatedTheUser(boolean createdNewUser) throws Exception { + Map codeData = getInvitationsCode("test-saml"); + codeData.put("created_new_user", String.valueOf(createdNewUser)); + String zoneId = IdentityZoneHolder.get().getId(); + when(expiringCodeStore.peekCode("the_secret_code", zoneId)).thenReturn(createCode(codeData)); + IdentityProvider provider = new IdentityProvider<>(); + SamlIdentityProviderDefinition definition = new SamlIdentityProviderDefinition() + .setMetaDataLocation("http://test.saml.com") + .setIdpEntityAlias("test-saml") + .setNameID("test") + .setLinkText("testsaml") + .setIconUrl("test.com") + .setZoneId(zoneId); + provider.setConfig(definition); + provider.setType(OriginKeys.SAML); + when(providerProvisioning.retrieveByOrigin(eq("test-saml"), anyString())).thenReturn(provider); + MockHttpServletRequestBuilder get = get("/invitations/accept") + .param("code", "the_secret_code"); + + MvcResult result = mockMvc.perform(get) + .andExpect(redirectedUrl("/saml2/authenticate/test-saml")) + .andReturn(); + + assertThat(result.getRequest().getSession().getAttribute("created_new_user")).isEqualTo(createdNewUser); + } + @Test void acceptInvitePage_for_unverifiedOIDCUser() throws Exception { Map codeData = getInvitationsCode("test-oidc"); diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java index ac0d21610c3..c2d0ae03bcd 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java @@ -335,6 +335,25 @@ void completeActivationForACodeFromTheUserApiOnlyVerifiesTheUser() { assertThat(accountCreation.getRedirectLocation()).isEqualTo("home"); } + @Test + void completeActivationForAnAlreadyVerifiedAccountKeepsItsPassword() { + setUpForSuccess(""); + user.setVerified(true); + when(mockCodeStore.retrieveCode("the_secret_code", currentIdentityZoneId)).thenReturn(code); + when(mockScimUserProvisioning.retrieve(anyString(), eq(currentIdentityZoneId))).thenReturn(user); + when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(currentIdentityZoneId))).thenReturn(user); + when(mockClientDetailsService.loadClientByClientId(anyString(), anyString())).thenReturn(mockClientDetails); + + AccountCreationService.AccountCreationResponse accountCreation = emailAccountCreationService.completeActivation("the_secret_code"); + + // Another activation link for the same account stays valid after the account was confirmed. + // Opening it must keep the password the owner has set and must not ask for another change. + verify(mockScimUserProvisioning, never()).changePassword(anyString(), any(), anyString(), anyString()); + verify(mockScimUserProvisioning, never()).updatePasswordChangeRequired(anyString(), anyBoolean(), anyString()); + verifyNoInteractions(mockResetPasswordService); + assertThat(accountCreation.getPasswordResetCode()).isNull(); + } + @Test void completeActivation_usesAntPathMatching() { setUpForSuccess("http://redirect.uri/"); diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/login/UaaResetPasswordServiceTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/login/UaaResetPasswordServiceTests.java index 82f94df1aaf..5a9f5fac629 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/login/UaaResetPasswordServiceTests.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/login/UaaResetPasswordServiceTests.java @@ -2,6 +2,7 @@ import org.assertj.core.api.InstanceOfAssertFactories; import org.cloudfoundry.identity.uaa.account.ConflictException; +import org.cloudfoundry.identity.uaa.account.EmailAccountCreationService; import org.cloudfoundry.identity.uaa.account.ForgotPasswordInfo; import org.cloudfoundry.identity.uaa.account.NotFoundException; import org.cloudfoundry.identity.uaa.account.ResetPasswordService.ResetPasswordResponse; @@ -25,6 +26,8 @@ import org.junit.jupiter.api.AfterEach; import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; +import org.junit.jupiter.params.ParameterizedTest; +import org.junit.jupiter.params.provider.MethodSource; import org.mockito.ArgumentCaptor; import org.springframework.context.ApplicationEventPublisher; import org.springframework.core.io.support.ResourcePropertySource; @@ -35,6 +38,8 @@ import java.sql.Timestamp; import java.util.Collections; import java.util.Date; +import java.util.Set; +import java.util.stream.Stream; import static org.assertj.core.api.Assertions.*; import static org.mockito.ArgumentMatchers.any; @@ -276,6 +281,37 @@ void resetPassword_WhereWildcardsDoNotMatch() { assertThat(response.getRedirectUri()).isEqualTo("home"); } + @ParameterizedTest + @MethodSource("registeredRedirectUrisWithoutTheSignupRedirect") + void resetPassword_keepsTheClientSignupRedirect(Set registeredRedirectUris) { + ExpiringCode code = setupResetPassword("example", "http://login.example.com/after-signup"); + UaaClientDetails client = new UaaClientDetails(); + client.setRegisteredRedirectUri(registeredRedirectUris); + client.addAdditionalInformation(EmailAccountCreationService.SIGNUP_REDIRECT_URL, "http://login.example.com/after-signup"); + when(clientDetailsService.loadClientByClientId("example", currentZoneId)).thenReturn(client); + + ResetPasswordResponse response = uaaResetPasswordService.resetPassword(code, "new_secret"); + + assertThat(response.getRedirectUri()).isEqualTo("http://login.example.com/after-signup"); + } + + static Stream> registeredRedirectUrisWithoutTheSignupRedirect() { + return Stream.of(Set.of(), Set.of("http://app.example.com/*")); + } + + @Test + void resetPassword_doesNotFollowAnUnregisteredRedirectThatIsNotTheSignupRedirect() { + ExpiringCode code = setupResetPassword("example", "http://elsewhere.example.com/"); + UaaClientDetails client = new UaaClientDetails(); + client.setRegisteredRedirectUri(Collections.singleton("http://app.example.com/*")); + client.addAdditionalInformation(EmailAccountCreationService.SIGNUP_REDIRECT_URL, "http://login.example.com/after-signup"); + when(clientDetailsService.loadClientByClientId("example", currentZoneId)).thenReturn(client); + + ResetPasswordResponse response = uaaResetPasswordService.resetPassword(code, "new_secret"); + + assertThat(response.getRedirectUri()).isEqualTo("home"); + } + @Test void resetPassword_WithNoRedirectUri() { ExpiringCode code = setupResetPassword("example", ""); diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUaaTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUaaTests.java index 07e2607d12f..a309349921a 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUaaTests.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUaaTests.java @@ -569,6 +569,29 @@ void invitedUnverifiedUserAuthenticationWhenAssertionHasNoEmail() { assertThat(user.getEmail()).isEqualTo("marissa.invited@test.org"); } + @Test + void reinvitedUnverifiedUserAuthenticationWhenAssertionHasNoEmail() { + Map attributeMappings = new HashMap<>(); + attributeMappings.put("email", "emailAddress"); + providerDefinition.setAttributeMappings(attributeMappings); + provider.setConfig(providerDefinition); + providerProvisioning.update(provider, identityZoneManager.getCurrentIdentityZone().getId()); + + ScimUser scimUser = getInvitedUser(false); + // the invitation found this account instead of creating it + RequestContextHolder.currentRequestAttributes().setAttribute("created_new_user", false, RequestAttributes.SCOPE_SESSION); + Map userAttributes = getUserAttributes("Marissa-invited", null, null, null, null); + Saml2AuthenticationToken authenticationToken = authenticationToken("marissa-invited", attributeStatements(userAttributes)); + + assertThatThrownBy(() -> authenticate(authenticationToken)) + .isInstanceOf(Saml2AuthenticationException.class) + .hasMessageContaining("SAML User email missing"); + + UaaUser user = userDatabase.retrieveUserById(scimUser.getId()); + assertThat(user.getUsername()).isEqualTo("marissa.invited@test.org"); + assertThat(user.getEmail()).isEqualTo("marissa.invited@test.org"); + } + private ScimUser getInvitedUser() { return getInvitedUser(false); } diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java index 2bfafa157aa..2bbf546ceb3 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java @@ -456,6 +456,43 @@ void confirmingAccountSendsOwnerToForcedPasswordSetup() throws Exception { .andExpect(authenticated()); } + @Test + void openingAnotherActivationLinkAfterPasswordSetupKeepsThePassword() throws Exception { + PredictableGenerator generator = new PredictableGenerator(); + JdbcExpiringCodeStore store = webApplicationContext.getBean(JdbcExpiringCodeStore.class); + store.setGenerator(generator); + + // Two registrations for the same unconfirmed address send two activation links. + mockMvc.perform(post("/create_account.do") + .with(cookieCsrf()) + .param("email", userEmail) + .param("password", "firstPass1") + .param("password_confirmation", "firstPass1")) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("accounts/email_sent")); + String firstActivationCode = "test" + generator.counter.get(); + + mockMvc.perform(post("/create_account.do") + .with(cookieCsrf()) + .param("email", userEmail) + .param("password", "laterPass2") + .param("password_confirmation", "laterPass2")) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("accounts/email_sent")); + String secondActivationCode = "test" + generator.counter.get(); + + // The owner confirms with the second link and sets a password. + confirmAccountAndSetPassword(secondActivationCode, "", userEmail); + + // Opening the first link afterwards must not replace that password. + mockMvc.perform(get("/verify_user") + .param("code", firstActivationCode)) + .andExpect(status().isFound()); + + loginWithAccount("") + .andExpect(authenticated()); + } + @Test void creatingAnAccountWithAnEmptyClientId() throws Exception { PredictableGenerator generator = new PredictableGenerator(); @@ -500,6 +537,30 @@ void creatingAnAccountWithFallbackClientRedirect() throws Exception { createAccount("http://redirect.uri/fallback", null); } + @Test + void creatingAnAccountWithFallbackClientRedirectThatIsNotARegisteredRedirectUri() throws Exception { + PredictableGenerator generator = new PredictableGenerator(); + JdbcExpiringCodeStore store = webApplicationContext.getBean(JdbcExpiringCodeStore.class); + store.setGenerator(generator); + // the client's redirect URIs are http://redirect.uri/*, so this fallback matches none of them + UaaClientDetails clientDetails = createTestClient("http://other.uri/after-signup"); + + mockMvc.perform(post("/create_account.do") + .with(cookieCsrf()) + .param("email", userEmail) + .param("password", USER_PASSWORD) + .param("password_confirmation", USER_PASSWORD) + .param("client_id", clientDetails.getClientId())) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("accounts/email_sent")); + + String afterReset = confirmAccountAndSetPassword("test" + generator.counter.get(), "", userEmail); + + // signup_redirect_url is set on the client by an administrator, so it applies after the + // password is set even when it is not one of the client's registered redirect URIs. + assertRedirectsToLoginWithSingleFormRedirectUri(afterReset, "http://other.uri/after-signup"); + } + @Test void creatingAnAccountWithNoClientRedirect() throws Exception { PredictableGenerator generator = new PredictableGenerator(); @@ -777,12 +838,16 @@ private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redir } private UaaClientDetails createTestClient() throws Exception { + return createTestClient("http://redirect.uri/fallback"); + } + + private UaaClientDetails createTestClient(String signupRedirectUrl) throws Exception { UaaClientDetails clientDetails = new UaaClientDetails(); clientDetails.setClientId("test-client-" + RandomStringUtils.randomAlphanumeric(200)); clientDetails.setClientSecret("test-client-secret"); clientDetails.setAuthorizedGrantTypes(Collections.singletonList("client_credentials")); clientDetails.setRegisteredRedirectUri(Collections.singleton("http://redirect.uri/*")); - clientDetails.addAdditionalInformation(EmailAccountCreationService.SIGNUP_REDIRECT_URL, "http://redirect.uri/fallback"); + clientDetails.addAdditionalInformation(EmailAccountCreationService.SIGNUP_REDIRECT_URL, signupRedirectUrl); UaaTestAccounts testAccounts = UaaTestAccounts.standard(null); String adminToken = testClient.getClientCredentialsOAuthAccessToken(testAccounts.getAdminClientId(), From df2c742b709a3fa4cfd0f00b7d8014416e50eecd Mon Sep 17 00:00:00 2001 From: Filip Hanik Date: Tue, 3 Nov 2026 13:07:22 -0800 Subject: [PATCH 08/10] fix: another activation link, an unregistered signup redirect and a reset code expiring during a submit Completing activation for an account that is already verified changes nothing: no new password, no password change flag and no reset code. The user is sent to the login page with the verify_success message. Resetting a password follows the stored redirect when it is the client's signup_redirect_url, which an administrator sets on the client, also when it is not a registered redirect URI. Any other redirect still has to match a registered redirect URI. When a reset password submit fails validation and the code has expired meanwhile, the user is sent to the forgot password page with the invalid code message, instead of an error while the code is issued again. Docs: the SAML part of the invitation acceptance note says what UAA checks when the assertion has no email attribute, and that mapping the email attribute compares every acceptance with the invited address. The self-service confirmation note describes the signup redirect fallback and opening another activation link. The two tests for SAML acceptance without an email are dropped, as that behavior stays unchanged. The account MockMvc tests also run in another zone (subdomain and zone path). createTestClient takes the signup redirect as a parameter. --- docs/UAA-APIs.rst | 11 ++- docs/UAA-Configuration-Reference.md | 8 ++- .../account/EmailAccountCreationService.java | 6 ++ .../ResetPasswordAuthenticationFilter.java | 30 ++++---- .../uaa/account/UaaResetPasswordService.java | 11 ++- .../InvitationsControllerTest.java | 30 -------- ...enSaml5AuthenticationProviderUaaTests.java | 23 ------- ...ccountsControllerMockMvcZonePathTests.java | 69 ++++++++++++++++++- 8 files changed, 113 insertions(+), 75 deletions(-) diff --git a/docs/UAA-APIs.rst b/docs/UAA-APIs.rst index cd556c15c6b..c04720c8175 100644 --- a/docs/UAA-APIs.rst +++ b/docs/UAA-APIs.rst @@ -2454,9 +2454,14 @@ The redirect_uri will be validated against allowed redirect_uri for the client. must carry an email address, and it must match the invited email address (the comparison ignores case). A sign-in that carries a different address is rejected. - * SAML: if the assertion has no email attribute, the invitation is accepted only for a first-time invitee, that is a - user created by the invitation who is still unverified and whose username equals the invited email address. For any - other invited user (already verified, or a username that differs from the email address) the sign-in is rejected. + * SAML: if the assertion has no email attribute, there is no address to compare. UAA then accepts the sign-in only + when the invited account is still unverified and its username equals the invited email address. That is the state + of an account created by an invitation that has not been accepted yet. Any other account is rejected: one that is + verified, or one whose username differs from its email address. + + UAA does not record whether the invitation created the account, so an existing account in the same state is + accepted too. UAA marks a SAML user verified only when the provider's ``email_verified`` attribute says so. To have + every acceptance compared with the invited address, map the ``email`` attribute for the provider. * OIDC: if the token has no email claim, UAA derives an address from the username claim. That address has to match the invited email address as well, so a token without an email claim only works when the username claim equals the invited email address. diff --git a/docs/UAA-Configuration-Reference.md b/docs/UAA-Configuration-Reference.md index dd74fd76624..482ee05ad08 100644 --- a/docs/UAA-Configuration-Reference.md +++ b/docs/UAA-Configuration-Reference.md @@ -1939,9 +1939,11 @@ When `true`, "Create Account" and "Forgot Password" links are displayed on the l > registration form. The owner is sent to a password-setup page (stating that a password change is > required due to changes in the system) and must establish their own password through the link > before the account can be used to sign in. This ensures a password chosen before the email address -> was verified can never be used to authenticate. Any client or signup redirect configured for the -> registration (an explicit `redirect_uri` or the client's `signup_redirect_url`) is applied after the -> owner has set their password, provided it matches one of the client's registered redirect URIs. +> was verified can never be used to authenticate. The redirect configured for the registration is +> applied after the owner has set their password: an explicit `redirect_uri` when it matches one of the +> client's registered redirect URIs, otherwise the client's `signup_redirect_url`, which does not have +> to be a registered redirect URI. Opening another activation link for an account that is already +> confirmed changes nothing: the password stays as it is and the user is sent to the login page. > > **Note on addresses that already have an account.** The registration form (`/create_account.do`) and > the change email form (`/change_email.do`) answer the same way whether or not the address already diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java index 657870fdac3..2dac84fc15b 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java @@ -130,6 +130,12 @@ public AccountCreationResponse completeActivation(String code) { String clientId = data.get("client_id"); String redirectUri = data.get("redirect_uri") != null ? data.get("redirect_uri") : ""; + if (user.isVerified()) { + // The account is already verified, for example through another activation link. Leave its password + // alone: the owner has set it, or can set it through forgot password. + return new AccountCreationResponse(user.getId(), user.getUserName(), user.getUserName(), getRedirect(clientId, redirectUri)); + } + if (Boolean.parseBoolean(data.get(ScimUtils.USER_PROVISIONED))) { // The code was requested through the user API, so a caller that may create users set the password. // Opening the link only has to verify the email address. diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilter.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilter.java index 7c5e0073771..5c01b557e25 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilter.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilter.java @@ -23,6 +23,7 @@ import org.springframework.http.HttpMethod; import org.springframework.security.authentication.BadCredentialsException; import org.springframework.security.authentication.InternalAuthenticationServiceException; +import org.springframework.security.core.AuthenticationException; import org.springframework.security.web.AuthenticationEntryPoint; import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher; import org.springframework.security.web.util.matcher.RequestMatcher; @@ -42,6 +43,7 @@ public class ResetPasswordAuthenticationFilter extends OncePerRequestFilter { private final AuthenticationEntryPoint entryPoint; private final ExpiringCodeStore expiringCodeStore; public static final String RESET_PASSWORD_URL = "/reset_password.do"; + private static final String INVALID_CODE_MESSAGE = "Sorry, your reset password link is no longer valid. Please request a new one"; private static final RequestMatcher matcher = PathPatternRequestMatcher.withDefaults().matcher(HttpMethod.POST, RESET_PASSWORD_URL); public ResetPasswordAuthenticationFilter( @@ -76,7 +78,7 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse expiringCode = expiringCodeStore.retrieveCode(code, IdentityZoneHolder.get().getId()); validation.throwIfNotValid(); if (expiringCode == null) { - throw new InvalidCodeException("invalid_code", "Sorry, your reset password link is no longer valid. Please request a new one", 422); + throw new InvalidCodeException("invalid_code", INVALID_CODE_MESSAGE, 422); } ResetPasswordService.ResetPasswordResponse resetPasswordResponse = service.resetPassword(expiringCode, password); String redirectUri = resetPasswordResponse.getRedirectUri(); @@ -86,23 +88,27 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response.sendRedirect(request.getContextPath() + "/login?success=password_reset&form_redirect_uri=" + URLEncoder.encode(redirectUri, StandardCharsets.UTF_8)); } } catch (InvalidPasswordException e) { - if (expiringCode != null) { - refreshCode(request, expiringCode); - } - entryPoint.commence(request, response, new BadCredentialsException(e.getMessagesAsOneString(), e)); + commenceWithRefreshedCode(request, response, expiringCode, new BadCredentialsException(e.getMessagesAsOneString(), e)); } catch (UaaException e) { entryPoint.commence(request, response, new InternalAuthenticationServiceException(e.getMessage(), e)); } catch (PasswordConfirmationException pe) { - if (expiringCode != null) { - refreshCode(request, expiringCode); - } - entryPoint.commence(request, response, new BadCredentialsException("Password did not pass validation.", pe)); + commenceWithRefreshedCode(request, response, expiringCode, new BadCredentialsException("Password did not pass validation.", pe)); } } - private void refreshCode(HttpServletRequest request, ExpiringCode expiringCode) { - ExpiringCode newCode = expiringCodeStore.generateCode(expiringCode.getData(), expiringCode.getExpiresAt(), expiringCode.getIntent(), IdentityZoneHolder.get().getId()); - request.setAttribute("code", newCode.getCode()); + private void commenceWithRefreshedCode(HttpServletRequest request, HttpServletResponse response, ExpiringCode expiringCode, AuthenticationException failure) throws IOException, ServletException { + if (expiringCode != null) { + try { + ExpiringCode newCode = expiringCodeStore.generateCode(expiringCode.getData(), expiringCode.getExpiresAt(), expiringCode.getIntent(), IdentityZoneHolder.get().getId()); + request.setAttribute("code", newCode.getCode()); + } catch (IllegalArgumentException _) { + // the code expired while the password was checked, so there is no code left to submit again + InvalidCodeException expired = new InvalidCodeException("invalid_code", INVALID_CODE_MESSAGE, 422); + entryPoint.commence(request, response, new InternalAuthenticationServiceException(expired.getMessage(), expired)); + return; + } + } + entryPoint.commence(request, response, failure); } } diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/UaaResetPasswordService.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/UaaResetPasswordService.java index a7c51da5b32..42ae880822e 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/UaaResetPasswordService.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/UaaResetPasswordService.java @@ -135,9 +135,14 @@ private ResetPasswordResponse changePasswordCodeAuthenticated(ExpiringCode expir ClientDetails clientDetails = clientDetailsService.loadClientByClientId(clientId, identityZoneManager.getCurrentIdentityZoneId()); Set redirectUris = clientDetails.getRegisteredRedirectUri() == null ? Collections.emptySet() : clientDetails.getRegisteredRedirectUri(); - String matchingRedirectUri = UaaUrlUtils.findMatchingRedirectUri(redirectUris, redirectUri, redirectLocation); - if (matchingRedirectUri != null) { - redirectLocation = matchingRedirectUri; + if (redirectUri.equals(clientDetails.getAdditionalInformation().get(EmailAccountCreationService.SIGNUP_REDIRECT_URL))) { + // an administrator set it on the client, so it does not have to be a registered redirect URI + redirectLocation = redirectUri; + } else { + String matchingRedirectUri = UaaUrlUtils.findMatchingRedirectUri(redirectUris, redirectUri, redirectLocation); + if (matchingRedirectUri != null) { + redirectLocation = matchingRedirectUri; + } } } catch (NoSuchClientException _) { // ignore diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java index 018e0509f99..2ca5c744352 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java @@ -34,8 +34,6 @@ import org.junit.jupiter.api.AfterEach; import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; -import org.junit.jupiter.params.ParameterizedTest; -import org.junit.jupiter.params.provider.ValueSource; import org.mockito.ArgumentCaptor; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Qualifier; @@ -212,34 +210,6 @@ void acceptInvitePage_for_unverifiedSamlUser() throws Exception { assertThat(result.getRequest().getSession().getAttribute("user_id")).isEqualTo("user-id-001"); } - @ParameterizedTest - @ValueSource(booleans = {true, false}) - void acceptInvitePage_for_unverifiedSamlUser_recordsWhetherTheInvitationCreatedTheUser(boolean createdNewUser) throws Exception { - Map codeData = getInvitationsCode("test-saml"); - codeData.put("created_new_user", String.valueOf(createdNewUser)); - String zoneId = IdentityZoneHolder.get().getId(); - when(expiringCodeStore.peekCode("the_secret_code", zoneId)).thenReturn(createCode(codeData)); - IdentityProvider provider = new IdentityProvider<>(); - SamlIdentityProviderDefinition definition = new SamlIdentityProviderDefinition() - .setMetaDataLocation("http://test.saml.com") - .setIdpEntityAlias("test-saml") - .setNameID("test") - .setLinkText("testsaml") - .setIconUrl("test.com") - .setZoneId(zoneId); - provider.setConfig(definition); - provider.setType(OriginKeys.SAML); - when(providerProvisioning.retrieveByOrigin(eq("test-saml"), anyString())).thenReturn(provider); - MockHttpServletRequestBuilder get = get("/invitations/accept") - .param("code", "the_secret_code"); - - MvcResult result = mockMvc.perform(get) - .andExpect(redirectedUrl("/saml2/authenticate/test-saml")) - .andReturn(); - - assertThat(result.getRequest().getSession().getAttribute("created_new_user")).isEqualTo(createdNewUser); - } - @Test void acceptInvitePage_for_unverifiedOIDCUser() throws Exception { Map codeData = getInvitationsCode("test-oidc"); diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUaaTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUaaTests.java index a309349921a..07e2607d12f 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUaaTests.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUaaTests.java @@ -569,29 +569,6 @@ void invitedUnverifiedUserAuthenticationWhenAssertionHasNoEmail() { assertThat(user.getEmail()).isEqualTo("marissa.invited@test.org"); } - @Test - void reinvitedUnverifiedUserAuthenticationWhenAssertionHasNoEmail() { - Map attributeMappings = new HashMap<>(); - attributeMappings.put("email", "emailAddress"); - providerDefinition.setAttributeMappings(attributeMappings); - provider.setConfig(providerDefinition); - providerProvisioning.update(provider, identityZoneManager.getCurrentIdentityZone().getId()); - - ScimUser scimUser = getInvitedUser(false); - // the invitation found this account instead of creating it - RequestContextHolder.currentRequestAttributes().setAttribute("created_new_user", false, RequestAttributes.SCOPE_SESSION); - Map userAttributes = getUserAttributes("Marissa-invited", null, null, null, null); - Saml2AuthenticationToken authenticationToken = authenticationToken("marissa-invited", attributeStatements(userAttributes)); - - assertThatThrownBy(() -> authenticate(authenticationToken)) - .isInstanceOf(Saml2AuthenticationException.class) - .hasMessageContaining("SAML User email missing"); - - UaaUser user = userDatabase.retrieveUserById(scimUser.getId()); - assertThat(user.getUsername()).isEqualTo("marissa.invited@test.org"); - assertThat(user.getEmail()).isEqualTo("marissa.invited@test.org"); - } - private ScimUser getInvitedUser() { return getInvitedUser(false); } diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcZonePathTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcZonePathTests.java index ccad157c708..7177ffcb315 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcZonePathTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcZonePathTests.java @@ -397,6 +397,45 @@ void creatingAnAccount() throws Exception { assertThat(principal.getOrigin()).isEqualTo(OriginKeys.UAA); } + @ParameterizedTest + @EnumSource(ZoneResolutionMode.class) + void openingAnotherActivationLinkInAnotherZoneAfterPasswordSetupKeepsThePassword(ZoneResolutionMode mode) throws Exception { + String subdomain = generator.generate(); + MockMvcUtils.createOtherIdentityZone(subdomain, mockMvc, webApplicationContext, IdentityZoneHolder.getCurrentZoneId()); + PredictableGenerator codes = new PredictableGenerator(); + webApplicationContext.getBean(JdbcExpiringCodeStore.class).setGenerator(codes); + + // Two registrations for the same unconfirmed address send two activation links. + mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, "/create_account.do") + .with(cookieCsrf()) + .param("email", userEmail) + .param("password", "firstPass1") + .param("password_confirmation", "firstPass1")) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("accounts/email_sent")); + String firstActivationCode = "test" + codes.counter.get(); + + mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, "/create_account.do") + .with(cookieCsrf()) + .param("email", userEmail) + .param("password", "laterPass2") + .param("password_confirmation", "laterPass2")) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("accounts/email_sent")); + String secondActivationCode = "test" + codes.counter.get(); + + // The owner confirms with the second link and sets a password. + confirmAccountAndSetPassword(mode, subdomain, secondActivationCode, userEmail); + + // Opening the first link afterwards must not replace that password. + mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.GET, "/verify_user") + .param("code", firstActivationCode)) + .andExpect(status().isFound()); + + loginWithAccount(mode, subdomain) + .andExpect(authenticated()); + } + @Test void creatingAnAccountWithAnEmptyClientId() throws Exception { PredictableGenerator generator = new PredictableGenerator(); @@ -441,6 +480,30 @@ void creatingAnAccountWithFallbackClientRedirect() throws Exception { createAccount("http://redirect.uri/fallback", null); } + @Test + void creatingAnAccountWithFallbackClientRedirectThatIsNotARegisteredRedirectUri() throws Exception { + PredictableGenerator generator = new PredictableGenerator(); + JdbcExpiringCodeStore store = webApplicationContext.getBean(JdbcExpiringCodeStore.class); + store.setGenerator(generator); + // the client's redirect URIs are http://redirect.uri/*, so this fallback matches none of them + UaaClientDetails clientDetails = createTestClient("http://other.uri/after-signup"); + + mockMvc.perform(post("/create_account.do") + .with(cookieCsrf()) + .param("email", userEmail) + .param("password", USER_PASSWORD) + .param("password_confirmation", USER_PASSWORD) + .param("client_id", clientDetails.getClientId())) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("accounts/email_sent")); + + String afterReset = confirmAccountAndSetPassword(ZoneResolutionMode.SUBDOMAIN, "", "test" + generator.counter.get(), userEmail); + + // signup_redirect_url is set on the client by an administrator, so it applies after the + // password is set even when it is not one of the client's registered redirect URIs. + assertRedirectsToLoginWithSingleFormRedirectUri(afterReset, "http://other.uri/after-signup"); + } + @Test void creatingAnAccountWithNoClientRedirect() throws Exception { PredictableGenerator generator = new PredictableGenerator(); @@ -723,12 +786,16 @@ private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redir } private UaaClientDetails createTestClient() throws Exception { + return createTestClient("http://redirect.uri/fallback"); + } + + private UaaClientDetails createTestClient(String signupRedirectUrl) throws Exception { UaaClientDetails clientDetails = new UaaClientDetails(); clientDetails.setClientId("test-client-" + RandomStringUtils.randomAlphanumeric(200)); clientDetails.setClientSecret("test-client-secret"); clientDetails.setAuthorizedGrantTypes(Collections.singletonList("client_credentials")); clientDetails.setRegisteredRedirectUri(Collections.singleton("http://redirect.uri/*")); - clientDetails.addAdditionalInformation(EmailAccountCreationService.SIGNUP_REDIRECT_URL, "http://redirect.uri/fallback"); + clientDetails.addAdditionalInformation(EmailAccountCreationService.SIGNUP_REDIRECT_URL, signupRedirectUrl); UaaTestAccounts testAccounts = UaaTestAccounts.standard(null); String adminToken = testClient.getClientCredentialsOAuthAccessToken(testAccounts.getAdminClientId(), From e5f9bf2b3c3e2da5ba46bc7c3f5acc7caa637a16 Mon Sep 17 00:00:00 2001 From: strehle Date: Fri, 6 Nov 2026 08:31:10 +0100 Subject: [PATCH 09/10] Markus - Copilot review --- docs/UAA-APIs.rst | 13 +-- docs/zone-path-feature.md | 14 ++- .../uaa/account/AccountsController.java | 4 + .../uaa/account/ChangeEmailController.java | 6 ++ .../account/EmailAccountCreationService.java | 25 +++-- .../ResetPasswordAuthenticationFilter.java | 4 + .../uaa/codestore/CodeStoreEndpoints.java | 4 +- .../invitations/EmailInvitationsService.java | 21 +++- .../invitations/InvitationsController.java | 59 +++++++++--- .../ExternalOAuthAuthenticationManager.java | 8 +- .../SamlUaaAuthenticationUserManager.java | 7 +- .../uaa/scim/ScimUserProvisioning.java | 7 ++ .../uaa/scim/beans/ScimAopConfig.java | 6 ++ .../scim/jdbc/JdbcScimUserProvisioning.java | 28 ++++++ .../uaa/util/UaaHttpRequestUtils.java | 45 +++++++-- ...uestAwareAuthenticationSuccessHandler.java | 27 ++++++ .../zone/ZonePathContextRewritingFilter.java | 3 +- .../codestore/CodeStoreEndpointsTests.java | 10 ++ .../EmailInvitationsServiceTests.java | 62 ++++++++---- .../InvitationsControllerTest.java | 96 +++++++++++++++++++ .../InvitationsControllerZonePathTest.java | 59 ++++++++++++ .../uaa/login/AccountsControllerTest.java | 7 +- .../uaa/login/ChangeEmailControllerTest.java | 7 +- .../EmailAccountCreationServiceTests.java | 50 ++++++---- .../ExternalOAuthAuthenticationManagerIT.java | 25 ++++- ...enSaml5AuthenticationProviderUaaTests.java | 22 ++++- .../jdbc/JdbcScimUserProvisioningTests.java | 35 +++++++ ...wareAuthenticationSuccessHandlerTests.java | 13 +++ ...ntityZoneResolvingFilterZonePathTests.java | 28 ++++++ .../ZonePathContextRewritingFilterTests.java | 12 +-- .../CodeStoreEndpointsMockMvcTests.java | 14 ++- ...odeStoreEndpointsMockMvcZonePathTests.java | 14 ++- .../PasswordResetEndpointMockMvcTests.java | 94 +++++++++++------- 33 files changed, 692 insertions(+), 137 deletions(-) diff --git a/docs/UAA-APIs.rst b/docs/UAA-APIs.rst index c04720c8175..bfb8adaa1f2 100644 --- a/docs/UAA-APIs.rst +++ b/docs/UAA-APIs.rst @@ -2124,8 +2124,9 @@ Change Email Flow: "email": "example@newemail.com" } -* ``redirect_url`` is the value of the ``change_email_redirect_url`` attribute of the client that started the email - change, and ``null`` when the client has no such attribute or no client was given. +* ``redirect_url`` is the requested ``redirect_uri`` when it matches one of the client's registered redirect URIs. + Otherwise, it is the value of the client's ``change_email_redirect_url`` attribute, or ``null`` when the client has + no such attribute or no client was given. * Response Codes:: @@ -2152,7 +2153,7 @@ Stores a one time code and returns it. Codes are stored per identity zone and ca { "data": "{\"user_id\":\"a-user-id\"}", - "expiresAt": 1792688400000, + "expiresAt": 4102444800000, "intent": "MY_APPLICATION_CODE" } @@ -2185,7 +2186,7 @@ Stores a one time code and returns it. Codes are stored per identity zone and ca * Example CURL :: $ curl 'http://localhost:8080/Codes' -i -X POST -H 'Content-Type: application/json' -H 'Authorization: Bearer ' \ - -d '{"data":"{}","expiresAt":1792688400000,"intent":"MY_APPLICATION_CODE"}' + -d '{"data":"{}","expiresAt":4102444800000,"intent":"MY_APPLICATION_CODE"}' Verify User Links: ``GET /Users/{id}/verify-link`` @@ -2196,8 +2197,8 @@ Verify User Links: ``GET /Users/{id}/verify-link`` * Request Parameters:: - client_id; the id of the client requesting the verification link (optional) - redirect_uri; the eventual URI that will be redirected after the user finishes resetting their password (optional) + client_id; the id of the client requesting the verification link (optional; defaults to the client id from the OAuth2 bearer token when available) + redirect_uri; the eventual URI that will be redirected after the user finishes resetting their password (required) the redirect_uri whitelist that can be set per client accepts wildcards, and matches against this redirect_uri using Ant-style path pattern matching (as per ) * Request Headers: Authorization header containing an `OAuth2`_ bearer token with:: diff --git a/docs/zone-path-feature.md b/docs/zone-path-feature.md index d15331a40c9..845e79da45d 100644 --- a/docs/zone-path-feature.md +++ b/docs/zone-path-feature.md @@ -72,7 +72,11 @@ This is useful in deployments where wildcard DNS or wildcard TLS certificates ar The refactoring into `resolveZoneBySubdomain()`, `handleZoneNotFound()`, and `doFilterWithZone()` is a readability improvement that also makes each responsibility independently testable. -**Default zone path (`/z/default/`):** `ZonePathContextRewritingFilter` does **not** set `ZONE_SUBDOMAIN_FROM_PATH` for `/z/default/` requests. This means `resolveEffectiveSubdomain()` sees `null` for the path attribute and falls through to hostname-based resolution, which naturally resolves to the default zone. No special-case "default" handling is needed in this filter. +**Default zone path (`/z/default/`):** `ZonePathContextRewritingFilter` sets +`ZONE_SUBDOMAIN_FROM_PATH` to the empty string for `/z/default/` requests. This +explicitly selects the default zone. A tenant hostname combined with +`/z/default/` is rejected as ambiguous instead of allowing the hostname to +override the path. ### 2.2 `OpenIdConnectEndpoints.java` @@ -131,7 +135,13 @@ The outermost filter in the chain (`Ordered.HIGHEST_PRECEDENCE + 1`). For reques - **Rewrites the request** by wrapping it in `ZonePathRewrittenRequest` (a private `HttpServletRequestWrapper`) that moves `/z/{subdomain}` from the servlet path into the context path. Downstream code sees `getContextPath()` = `/uaa/z/myzone` and `getServletPath()` = `/login`. - **Sets request attributes** `ZONE_SUBDOMAIN_FROM_PATH` (the subdomain string) and `ZONE_ORIGINAL_CONTEXT_PATH` (the pre-rewrite context path like `/uaa`), consumed by `IdentityZoneResolvingFilter` and `ZoneAwareStaticResourceLinkBuilder`. - **Wraps the response** in `CookiePathRewritingResponse` which intercepts `addCookie()`, `addHeader("Set-Cookie", ...)`, and `setHeader("Set-Cookie", ...)` to rewrite cookie paths from `/` back to the original context path (e.g., `/uaa`). -- **Default zone path:** For the subdomain `"default"`, rewrites so the context path **includes** `/z/default` (e.g. `/uaa/z/default`), like any other zone path. Does **not** set `ZONE_SUBDOMAIN_FROM_PATH` so the default zone is resolved. `ZoneContextPathSessionRequestWrapper` maps this context path to the same session key as the root, so `/profile` and `/z/default/profile` share the same cookie/session. See "Default zone path" below. +- **Default zone path:** For the subdomain `"default"`, rewrites so the context + path **includes** `/z/default` (e.g. `/uaa/z/default`), like any other zone + path. Sets `ZONE_SUBDOMAIN_FROM_PATH` to the empty string to explicitly select + the default zone. `ZoneContextPathSessionRequestWrapper` maps this context + path to the same session key as the root, so `/profile` and + `/z/default/profile` share the same cookie/session. See "Default zone path" + below. - **Passes through** non-zone requests unchanged (but still wraps the response for cookie path normalization when a context path is present). #### Default zone path diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountsController.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountsController.java index 262e7f92a11..8b64a654923 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountsController.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountsController.java @@ -6,6 +6,7 @@ import org.cloudfoundry.identity.uaa.provider.IdentityProviderProvisioning; import org.cloudfoundry.identity.uaa.scim.exception.InvalidPasswordException; import org.cloudfoundry.identity.uaa.util.DomainFilter; +import org.cloudfoundry.identity.uaa.web.UaaSavedRequestAwareAuthenticationSuccessHandler; import org.cloudfoundry.identity.uaa.zone.BrandingInformation; import org.cloudfoundry.identity.uaa.zone.IdentityZoneHolder; import org.springframework.core.env.Environment; @@ -71,6 +72,8 @@ public String sendActivationEmail(Model model, HttpServletResponse response, @RequestParam(value = "does_user_consent", required = false) boolean doesUserConsent, RedirectAttributes redirectAttributes) { + model.addAttribute("client_id", clientId); + model.addAttribute("redirect_uri", redirectUri); BrandingInformation zoneBranding = IdentityZoneHolder.get().getConfig().getBranding(); if (zoneBranding != null && zoneBranding.getConsent() != null && !doesUserConsent) { return handleUnprocessableEntity(model, response, "error_message_code", "missing_consent"); @@ -134,6 +137,7 @@ public String verifyUser(Model model, String redirectLocation = accountCreation.getRedirectLocation(); String res = "redirect:/login?success=verify_success"; if (!redirectLocation.equals(accountCreationService.getDefaultRedirect())) { + UaaSavedRequestAwareAuthenticationSuccessHandler.saveTrustedRedirect(session, redirectLocation); res += "&form_redirect_uri=" + URLEncoder.encode(redirectLocation, StandardCharsets.UTF_8); } return res; diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ChangeEmailController.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ChangeEmailController.java index cbb967152da..601c6a8ad27 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ChangeEmailController.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ChangeEmailController.java @@ -7,6 +7,7 @@ import org.cloudfoundry.identity.uaa.error.UaaException; import org.cloudfoundry.identity.uaa.user.UaaUser; import org.cloudfoundry.identity.uaa.user.UaaUserDatabase; +import org.cloudfoundry.identity.uaa.web.UaaSavedRequestAwareAuthenticationSuccessHandler; import org.springframework.http.HttpStatus; import org.springframework.security.authentication.AnonymousAuthenticationToken; import org.springframework.security.core.context.SecurityContext; @@ -58,6 +59,8 @@ public String changeEmail(Model model, @Valid @ModelAttribute ValidEmail newEmai @RequestParam(required = false, value = "redirect_uri") String redirectUri, RedirectAttributes redirectAttributes, HttpServletResponse response) { SecurityContext securityContext = SecurityContextHolder.getContext(); + model.addAttribute("client_id", clientId); + model.addAttribute("redirect_uri", redirectUri); if (result.hasErrors()) { model.addAttribute("error_message_code", "invalid_email"); @@ -118,6 +121,9 @@ public String verifyEmail(Model model, @RequestParam String code, RedirectAttrib if (redirectLocation == null) { return "redirect:login?success=change_email_success"; } else { + UaaSavedRequestAwareAuthenticationSuccessHandler.saveTrustedRedirect( + request.getSession(), + redirectLocation); return "redirect:login?success=change_email_success&form_redirect_uri=" + URLEncoder.encode(redirectLocation, StandardCharsets.UTF_8); } } diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java index 2dac84fc15b..56c2b4c8ea2 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java @@ -23,6 +23,7 @@ import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Qualifier; +import org.springframework.dao.OptimisticLockingFailureException; import org.springframework.stereotype.Service; import org.springframework.util.StringUtils; import org.springframework.web.client.HttpClientErrorException; @@ -145,14 +146,22 @@ public AccountCreationResponse completeActivation(String code) { // Confirming the activation link proves ownership of the email address, but it does not // prove that the person confirming is the one who chose the password on the registration - // form. Discard the registration password so it can never authenticate, and require the - // confirming owner to establish their own password through the ownership-proving link. - // Replace the password and set the flag while the account is still unverified, then verify - // it last: these are separate updates, so verifying first would briefly leave the account - // verified while still holding the registration password, which a concurrent login could use. - scimUserProvisioning.changePassword(user.getId(), null, new AlphanumericRandomValueStringGenerator(40).generate(), zoneId); - scimUserProvisioning.updatePasswordChangeRequired(user.getId(), true, zoneId); - user = scimUserProvisioning.verifyUser(user.getId(), -1, zoneId); + // form. Atomically discard that password, require a change, and verify the account. The + // conditional update also ensures that only one of several concurrent activation links can + // claim the account; a losing request must not overwrite a password the owner has since set. + try { + user = scimUserProvisioning.verifyUserAndSetPassword( + user.getId(), + new AlphanumericRandomValueStringGenerator(40).generate(), + true, + zoneId); + } catch (OptimisticLockingFailureException e) { + user = scimUserProvisioning.retrieve(data.get("user_id"), zoneId); + if (!user.isVerified()) { + throw e; + } + return new AccountCreationResponse(user.getId(), user.getUserName(), user.getUserName(), getRedirect(clientId, redirectUri)); + } // Resolve the signup redirect (honouring the client's signup_redirect_url fallback) so it is // preserved across the reset flow and applied once the owner has set their password. diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilter.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilter.java index 5c01b557e25..93d7772fdf4 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilter.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilter.java @@ -19,6 +19,7 @@ import org.cloudfoundry.identity.uaa.codestore.ExpiringCodeStore; import org.cloudfoundry.identity.uaa.error.UaaException; import org.cloudfoundry.identity.uaa.scim.exception.InvalidPasswordException; +import org.cloudfoundry.identity.uaa.web.UaaSavedRequestAwareAuthenticationSuccessHandler; import org.cloudfoundry.identity.uaa.zone.IdentityZoneHolder; import org.springframework.http.HttpMethod; import org.springframework.security.authentication.BadCredentialsException; @@ -85,6 +86,9 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse if (!StringUtils.hasText(redirectUri) || "home".equals(redirectUri)) { response.sendRedirect(request.getContextPath() + "/login?success=password_reset"); } else { + UaaSavedRequestAwareAuthenticationSuccessHandler.saveTrustedRedirect( + request.getSession(), + redirectUri); response.sendRedirect(request.getContextPath() + "/login?success=password_reset&form_redirect_uri=" + URLEncoder.encode(redirectUri, StandardCharsets.UTF_8)); } } catch (InvalidPasswordException e) { diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpoints.java b/server/src/main/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpoints.java index eb3da1b349c..a7b1962b50a 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpoints.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpoints.java @@ -39,8 +39,8 @@ public class CodeStoreEndpoints { @PostMapping({"/Codes", "/Codes/"}) @ResponseStatus(HttpStatus.CREATED) @ResponseBody - public ExpiringCode generateCode(@RequestBody ExpiringCode expiringCode) { - String intent = expiringCode.getIntent(); + public ExpiringCode generateCode(@RequestBody(required = false) ExpiringCode expiringCode) { + String intent = expiringCode == null ? null : expiringCode.getIntent(); if (intent == null || intent.isBlank()) { throw new CodeStoreException(INTENT_REQUIRED_MESSAGE, HttpStatus.BAD_REQUEST); } diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/EmailInvitationsService.java b/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/EmailInvitationsService.java index 8b8c594d1e0..7eb5b874454 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/EmailInvitationsService.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/EmailInvitationsService.java @@ -14,6 +14,7 @@ import org.slf4j.LoggerFactory; import org.springframework.http.HttpStatus; import org.cloudfoundry.identity.uaa.oauth.provider.ClientDetails; +import org.springframework.dao.OptimisticLockingFailureException; import org.springframework.stereotype.Service; import org.springframework.util.StringUtils; import org.springframework.web.client.HttpClientErrorException; @@ -65,14 +66,24 @@ public AcceptedInvitation acceptInvitation(String code, String password) { ScimUser user = scimUserProvisioning.retrieve(userId, identityZoneManager.getCurrentIdentityZoneId()); - if (UAA.equals(user.getOrigin())) { - user = scimUserProvisioning.verifyUser(userId, user.getVersion(), identityZoneManager.getCurrentIdentityZoneId()); - - // Only reset the password for newly created users + if (UAA.equals(user.getOrigin()) && !user.isVerified()) { boolean createdNewUser = Boolean.parseBoolean( userData.getOrDefault(CREATED_NEW_USER, "true")); // default true for in-flight codes if (StringUtils.hasText(password) && createdNewUser) { - scimUserProvisioning.changePassword(userId, null, password, identityZoneManager.getCurrentIdentityZoneId()); + try { + user = scimUserProvisioning.verifyUserAndSetPassword( + userId, + password, + false, + identityZoneManager.getCurrentIdentityZoneId()); + } catch (OptimisticLockingFailureException e) { + user = scimUserProvisioning.retrieve(userId, identityZoneManager.getCurrentIdentityZoneId()); + if (!user.isVerified()) { + throw e; + } + } + } else { + user = scimUserProvisioning.verifyUser(userId, user.getVersion(), identityZoneManager.getCurrentIdentityZoneId()); } } diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsController.java b/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsController.java index 0186a2c66d5..8a04044ba07 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsController.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsController.java @@ -22,6 +22,7 @@ import org.cloudfoundry.identity.uaa.scim.ScimUser; import org.cloudfoundry.identity.uaa.scim.ScimUserProvisioning; import org.cloudfoundry.identity.uaa.scim.exception.InvalidPasswordException; +import org.cloudfoundry.identity.uaa.scim.exception.ScimResourceNotFoundException; import org.cloudfoundry.identity.uaa.scim.validate.PasswordValidator; import org.cloudfoundry.identity.uaa.user.UaaAuthority; import org.cloudfoundry.identity.uaa.user.UaaUser; @@ -29,6 +30,7 @@ import org.cloudfoundry.identity.uaa.util.JsonUtils; import org.cloudfoundry.identity.uaa.util.ObjectUtils; import org.cloudfoundry.identity.uaa.util.UaaHttpRequestUtils; +import org.cloudfoundry.identity.uaa.web.UaaSavedRequestAwareAuthenticationSuccessHandler; import org.cloudfoundry.identity.uaa.zone.BrandingInformation; import org.cloudfoundry.identity.uaa.zone.beans.IdentityZoneManager; import org.springframework.beans.factory.annotation.Qualifier; @@ -61,6 +63,7 @@ import java.util.Enumeration; import java.util.HashMap; import java.util.Map; +import java.util.Objects; import static org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType.INVITATION; import static org.cloudfoundry.identity.uaa.constants.OriginKeys.OAUTH20; @@ -134,14 +137,18 @@ public String acceptInvitePage(@RequestParam String code, Model model, HttpServl boolean isUaaUserAndVerified = UAA.equals(provider.getType()) && user.isVerified(); boolean isExternalUserAndAcceptedInvite = - !UAA.equals(provider.getType()) && UaaHttpRequestUtils.isAcceptedInvitationAuthentication(); + !UAA.equals(provider.getType()) + && UaaHttpRequestUtils.isAcceptedInvitationAuthentication() + && Objects.equals(codeData.get("user_id"), UaaHttpRequestUtils.getInvitedUserId()) + && Objects.equals(origin, UaaHttpRequestUtils.getInvitationOrigin()); if (isUaaUserAndVerified || isExternalUserAndAcceptedInvite) { AcceptedInvitation accepted = invitationsService.acceptInvitation(code, ""); + UaaHttpRequestUtils.clearInvitationSessionAttributes(); String redirect = "redirect:" + accepted.getRedirectUri(); log.debug("Redirecting accepted invitation for email:%s, id:%s to URL:%s".formatted(codeData.get(EMAIL), codeData.get("user_id"), redirect)); return redirect; } else if (SAML.equals(provider.getType())) { - setRequestAttributes(request, code, user); + setRequestAttributes(request, code, user, origin); SamlIdentityProviderDefinition definition = ObjectUtils.castInstance(provider.getConfig(), SamlIdentityProviderDefinition.class); @@ -149,7 +156,7 @@ public String acceptInvitePage(@RequestParam String code, Model model, HttpServl log.debug("Redirecting invitation for email:%s, id:%s single SAML IDP URL:%s".formatted(codeData.get(EMAIL), codeData.get("user_id"), redirect)); return redirect; } else if (OIDC10.equals(provider.getType()) || OAUTH20.equals(provider.getType())) { - setRequestAttributes(request, code, user); + setRequestAttributes(request, code, user, origin); AbstractExternalOAuthIdentityProviderDefinition definition = ObjectUtils.castInstance(provider.getConfig(), AbstractExternalOAuthIdentityProviderDefinition.class); @@ -190,9 +197,8 @@ private void transferErrorParameters(Model model, HttpServletRequest request) { } } - private void setRequestAttributes(HttpServletRequest request, String newCode, UaaUser user) { - RequestContextHolder.getRequestAttributes().setAttribute("IS_INVITE_ACCEPTANCE", true, RequestAttributes.SCOPE_SESSION); - RequestContextHolder.getRequestAttributes().setAttribute("user_id", user.getId(), RequestAttributes.SCOPE_SESSION); + private void setRequestAttributes(HttpServletRequest request, String newCode, UaaUser user, String origin) { + UaaHttpRequestUtils.setInvitationSessionAttributes(user.getId(), origin); HttpServletRequestWrapper wrapper = getNewCodeWrapper(request, newCode); SavedRequest savedRequest = new DefaultSavedRequest(wrapper); @@ -245,6 +251,7 @@ public String acceptInvitation(@RequestParam("password") String password, @RequestParam(value = "does_user_consent", required = false) boolean doesUserConsent, Model model, RedirectAttributes redirectAttributes, + HttpServletRequest request, HttpServletResponse response) { PasswordConfirmationValidation validation = new PasswordConfirmationValidation(password, passwordConfirmation); @@ -253,8 +260,10 @@ public String acceptInvitation(@RequestParam("password") String password, final ExpiringCode expiringCode = expiringCodeStore.retrieveCode(code, identityZoneManager.getCurrentIdentityZoneId()); - if (expiringCode == null || expiringCode.getData() == null) { - log.debug("Failing invitation. Code not found."); + if (expiringCode == null + || expiringCode.getData() == null + || (expiringCode.getIntent() != null && !INVITATION.name().equals(expiringCode.getIntent()))) { + log.debug("Failing invitation. Code not found or intent is invalid."); SecurityContextHolder.clearContext(); return handleUnprocessableEntity(model, response, "error_message_code", "code_expired", "invitations/accept_invite"); } @@ -285,8 +294,12 @@ public String acceptInvitation(@RequestParam("password") String password, } catch (HttpClientErrorException _) { return handleUnprocessableEntity(model, response, "error_message_code", "code_expired", "invitations/accept_invite"); } + UaaHttpRequestUtils.clearInvitationSessionAttributes(); String res = "redirect:/login?success=invite_accepted"; if (!invitation.getRedirectUri().equals("/home")) { + UaaSavedRequestAwareAuthenticationSuccessHandler.saveTrustedRedirect( + request.getSession(), + invitation.getRedirectUri()); res += "&" + FORM_REDIRECT_PARAMETER + "=" + URLEncoder.encode(invitation.getRedirectUri(), StandardCharsets.UTF_8); } return res; @@ -314,11 +327,28 @@ public String acceptLdapInvitation(@RequestParam("enterprise_username") String u @RequestParam("enterprise_password") String password, @RequestParam("enterprise_email") String email, @RequestParam String code, - Model model, HttpServletResponse response) { + Model model, HttpServletRequest request, HttpServletResponse response) { ExpiringCode expiringCode = expiringCodeStore.retrieveCode(code, identityZoneManager.getCurrentIdentityZoneId()); - if (expiringCode == null) { - return handleUnprocessableEntity(model, response, "error_message_code", "code_expired", "invitations/accept_enterprise.do"); + if (expiringCode == null + || (expiringCode.getIntent() != null && !INVITATION.name().equals(expiringCode.getIntent()))) { + return handleUnprocessableEntity(model, response, "error_message_code", "code_expired", "invitations/accept_invite"); + } + + Map data = JsonUtils.readValue(expiringCode.getData(), new TypeReference<>() { + }); + if (!OriginKeys.LDAP.equals(data.get(ORIGIN))) { + return handleUnprocessableEntity(model, response, "error_message_code", "code_expired", "invitations/accept_invite"); + } + + ScimUser user; + try { + user = userProvisioning.retrieve(data.get("user_id"), identityZoneManager.getCurrentIdentityZoneId()); + } catch (ScimResourceNotFoundException _) { + return handleUnprocessableEntity(model, response, "error_message_code", "code_expired", "invitations/accept_invite"); + } + if (!OriginKeys.LDAP.equals(user.getOrigin())) { + return handleUnprocessableEntity(model, response, "error_message_code", "code_expired", "invitations/accept_invite"); } String newCode = expiringCodeStore.generateCode(expiringCode.getData(), new Timestamp(System.currentTimeMillis() + (1000 * 60 * 10)), expiringCode.getIntent(), identityZoneManager.getCurrentIdentityZoneId()).getCode(); @@ -340,9 +370,6 @@ public String acceptLdapInvitation(@RequestParam("enterprise_username") String u Authentication authentication; try { authentication = authenticationManager.authenticate(token); - Map data = JsonUtils.readValue(expiringCode.getData(), new TypeReference<>() { - }); - ScimUser user = userProvisioning.retrieve(data.get("user_id"), identityZoneManager.getCurrentIdentityZoneId()); if (!user.getPrimaryEmail().equalsIgnoreCase(((ExtendedLdapUserDetails) authentication.getPrincipal()).getEmailAddress())) { model.addAttribute(EMAIL, data.get(EMAIL)); model.addAttribute("provider", OriginKeys.LDAP); @@ -356,6 +383,10 @@ public String acceptLdapInvitation(@RequestParam("enterprise_username") String u userProvisioning.update(user.getId(), user, identityZoneManager.getCurrentIdentityZoneId()); zoneAwareAuthenticationManager.getLdapAuthenticationManager(identityZoneManager.getCurrentIdentityZone(), ldapProvider).authenticate(token); AcceptedInvitation accept = invitationsService.acceptInvitation(newCode, ""); + UaaHttpRequestUtils.clearInvitationSessionAttributes(); + UaaSavedRequestAwareAuthenticationSuccessHandler.saveTrustedRedirect( + request.getSession(), + accept.getRedirectUri()); return "redirect:" + "/login?success=invite_accepted&form_redirect_uri=" + URLEncoder.encode(accept.getRedirectUri(), StandardCharsets.UTF_8); } else { return handleUnprocessableEntity(model, response, "error_message", "not authenticated", "invitations/accept_invite"); diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManager.java b/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManager.java index 3dbe68d06a6..eec0b15e730 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManager.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManager.java @@ -94,7 +94,6 @@ import org.springframework.util.StringUtils; import org.springframework.web.client.HttpClientErrorException; import org.springframework.web.client.RestTemplate; -import org.springframework.web.context.request.RequestAttributes; import org.springframework.web.context.request.RequestContextHolder; import org.springframework.web.context.request.ServletRequestAttributes; @@ -138,6 +137,8 @@ import static org.cloudfoundry.identity.uaa.provider.ExternalIdentityProviderDefinition.PHONE_NUMBER_ATTRIBUTE_NAME; import static org.cloudfoundry.identity.uaa.provider.ExternalIdentityProviderDefinition.USER_NAME_ATTRIBUTE_NAME; import static org.cloudfoundry.identity.uaa.util.JwtTokenSignedByThisUAA.buildIdTokenValidator; +import static org.cloudfoundry.identity.uaa.util.UaaHttpRequestUtils.getInvitationOrigin; +import static org.cloudfoundry.identity.uaa.util.UaaHttpRequestUtils.getInvitedUserId; import static org.cloudfoundry.identity.uaa.util.UaaHttpRequestUtils.isAcceptedInvitationAuthentication; import static org.cloudfoundry.identity.uaa.util.UaaStringUtils.retainAllMatches; import static org.springframework.http.HttpMethod.GET; @@ -563,7 +564,10 @@ protected UaaUser userAuthenticated(Authentication request, UaaUser userFromRequ String email = userFromRequest.getEmail(); log.debug("ExternalOAuth user authenticated:{}", email); if (isInvitationAcceptance) { - String invitedUserId = (String) RequestContextHolder.currentRequestAttributes().getAttribute("user_id", RequestAttributes.SCOPE_SESSION); + if (!Objects.equals(authenticationData.getOrigin(), getInvitationOrigin())) { + throw new BadCredentialsException("OAuth identity provider does not match the invited identity provider."); + } + String invitedUserId = getInvitedUserId(); log.debug("ExternalOAuth user accepted invitation, user_id:{}", invitedUserId); userFromDb = new UaaUser(getUserDatabase().retrieveUserPrototypeById(invitedUserId)); if (email != null && !email.equalsIgnoreCase(userFromDb.getEmail())) { diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/SamlUaaAuthenticationUserManager.java b/server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/SamlUaaAuthenticationUserManager.java index cb140ee7f6b..89998b18024 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/SamlUaaAuthenticationUserManager.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/SamlUaaAuthenticationUserManager.java @@ -52,6 +52,8 @@ import static org.cloudfoundry.identity.uaa.provider.ExternalIdentityProviderDefinition.FAMILY_NAME_ATTRIBUTE_NAME; import static org.cloudfoundry.identity.uaa.provider.ExternalIdentityProviderDefinition.GIVEN_NAME_ATTRIBUTE_NAME; import static org.cloudfoundry.identity.uaa.provider.ExternalIdentityProviderDefinition.PHONE_NUMBER_ATTRIBUTE_NAME; +import static org.cloudfoundry.identity.uaa.util.UaaHttpRequestUtils.getInvitationOrigin; +import static org.cloudfoundry.identity.uaa.util.UaaHttpRequestUtils.getInvitedUserId; import static org.cloudfoundry.identity.uaa.util.UaaHttpRequestUtils.isAcceptedInvitationAuthentication; /** @@ -137,7 +139,10 @@ private UaaUser getAcceptedInvitationUser(UaaPrincipal samlPrincipal, CreateIfMi } context.setAddNew(false); - String invitedUserId = (String) RequestContextHolder.currentRequestAttributes().getAttribute("user_id", RequestAttributes.SCOPE_SESSION); + if (!Objects.equals(samlPrincipal.getOrigin(), getInvitationOrigin())) { + throw new BadCredentialsException("SAML identity provider does not match the invited identity provider."); + } + String invitedUserId = getInvitedUserId(); UaaUser user = userDatabase.retrieveUserById(invitedUserId); if (context.hasEmailAttribute()) { if (!context.getEmailAttribute().equalsIgnoreCase(user.getEmail())) { diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/scim/ScimUserProvisioning.java b/server/src/main/java/org/cloudfoundry/identity/uaa/scim/ScimUserProvisioning.java index 7026305f815..cc1cf412e88 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/scim/ScimUserProvisioning.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/scim/ScimUserProvisioning.java @@ -48,6 +48,13 @@ List retrieveByScimFilterOnlyActive( ScimUser verifyUser(String id, int version, String zoneId) throws ScimResourceNotFoundException, InvalidScimResourceException; + /** + * Atomically replaces the password and verifies an unverified user. + * + * @throws org.springframework.dao.OptimisticLockingFailureException if the user is already verified + */ + ScimUser verifyUserAndSetPassword(String id, String newPassword, boolean passwordChangeRequired, String zoneId) throws ScimResourceNotFoundException; + boolean checkPasswordMatches(String id, CharSequence password, String zoneId) throws ScimResourceNotFoundException; boolean checkPasswordChangeIndividuallyRequired(String id, String zoneId) throws ScimResourceNotFoundException; diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/scim/beans/ScimAopConfig.java b/server/src/main/java/org/cloudfoundry/identity/uaa/scim/beans/ScimAopConfig.java index b85be48b2e0..b15fb1e3bcf 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/scim/beans/ScimAopConfig.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/scim/beans/ScimAopConfig.java @@ -50,6 +50,12 @@ public void userVerified(ScimUser user) { scimEventPublisher.userVerified(user); } + @AfterReturning(pointcut = "execution(* *..ScimUserProvisioning+.verifyUserAndSetPassword(..)) && bean(scimUserProvisioning)", returning = "user") + public void userVerifiedAndPasswordChanged(ScimUser user) { + passwordEventPublisher.passwordChange(user.getId()); + scimEventPublisher.userVerified(user); + } + @AfterReturning(pointcut = "execution(* *..ScimUserEndpoints+.deleteUser(..)) && bean(scimUserEndpoints)", returning = "user") public void userDeleted(ScimUser user) { scimEventPublisher.userDeleted(user); diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/scim/jdbc/JdbcScimUserProvisioning.java b/server/src/main/java/org/cloudfoundry/identity/uaa/scim/jdbc/JdbcScimUserProvisioning.java index 74c6903a457..599faace05b 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/scim/jdbc/JdbcScimUserProvisioning.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/scim/jdbc/JdbcScimUserProvisioning.java @@ -97,6 +97,8 @@ public Logger getLogger() { public static final String VERIFY_USER_SQL = "update users set verified=? where id=? and identity_zone_id=?"; + public static final String VERIFY_USER_AND_SET_PASSWORD_SQL = "update users set lastModified=?, password=?, passwd_lastmodified=?, passwd_change_required=?, verified=? where id=? and identity_zone_id=? and verified=?"; + public static final String DELETE_USER_SQL = "delete from users where id=? and identity_zone_id=?"; public static final String CHANGE_PASSWORD_SQL = "update users set lastModified=?, password=?, passwd_lastmodified=? where id=? and identity_zone_id=?"; @@ -492,6 +494,32 @@ public ScimUser verifyUser(String id, int version, String zoneId) throws ScimRes return user; } + @Override + public ScimUser verifyUserAndSetPassword(String id, String newPassword, boolean passwordChangeRequired, String zoneId) + throws ScimResourceNotFoundException { + String encodedPassword = passwordEncoder.encode(newPassword); + int updated = jdbcTemplate.update(VERIFY_USER_AND_SET_PASSWORD_SQL, ps -> { + Timestamp timestamp = new Timestamp(System.currentTimeMillis()); + ps.setTimestamp(1, timestamp); + ps.setString(2, encodedPassword); + ps.setTimestamp(3, getPasswordLastModifiedTimestamp(timestamp)); + ps.setBoolean(4, passwordChangeRequired); + ps.setBoolean(5, true); + ps.setString(6, id); + ps.setString(7, zoneId); + ps.setBoolean(8, false); + }); + + ScimUser user = retrieve(id, zoneId); + if (updated == 0) { + throw new OptimisticLockingFailureException("Attempt to activate already verified user " + id); + } + if (updated > 1) { + throw new IncorrectResultSizeDataAccessException(1); + } + return user; + } + protected ScimUser deleteUser(ScimUser user, int version, String zoneId) { int updated = deleteUser(user.getId(), version, zoneId); if (updated == 0) { diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/util/UaaHttpRequestUtils.java b/server/src/main/java/org/cloudfoundry/identity/uaa/util/UaaHttpRequestUtils.java index 4e35d6d6492..dfa7d351fd4 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/util/UaaHttpRequestUtils.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/util/UaaHttpRequestUtils.java @@ -70,6 +70,9 @@ public abstract class UaaHttpRequestUtils { private static final Logger logger = LoggerFactory.getLogger(UaaHttpRequestUtils.class); + private static final String INVITATION_ACCEPTANCE_ATTRIBUTE = "IS_INVITE_ACCEPTANCE"; + private static final String INVITED_USER_ID_ATTRIBUTE = "user_id"; + private static final String INVITATION_ORIGIN_ATTRIBUTE = "invitation_origin"; record HttpClientConfig( int poolSize, @@ -259,20 +262,42 @@ private static String encodeParameter(String value) { } public static boolean isAcceptedInvitationAuthentication() { + return Boolean.TRUE.equals(getInvitationSessionAttribute(INVITATION_ACCEPTANCE_ATTRIBUTE)); + } + + public static String getInvitedUserId() { + return (String) getInvitationSessionAttribute(INVITED_USER_ID_ATTRIBUTE); + } + + public static String getInvitationOrigin() { + return (String) getInvitationSessionAttribute(INVITATION_ORIGIN_ATTRIBUTE); + } + + public static void setInvitationSessionAttributes(String userId, String origin) { + RequestAttributes attributes = RequestContextHolder.currentRequestAttributes(); + attributes.setAttribute(INVITATION_ACCEPTANCE_ATTRIBUTE, true, RequestAttributes.SCOPE_SESSION); + attributes.setAttribute(INVITED_USER_ID_ATTRIBUTE, userId, RequestAttributes.SCOPE_SESSION); + attributes.setAttribute(INVITATION_ORIGIN_ATTRIBUTE, origin, RequestAttributes.SCOPE_SESSION); + } + + public static void clearInvitationSessionAttributes() { try { - RequestAttributes attr = RequestContextHolder.currentRequestAttributes(); - if (attr != null) { - Boolean result = (Boolean) attr.getAttribute("IS_INVITE_ACCEPTANCE", RequestAttributes.SCOPE_SESSION); - if (result != null) { - return result; - } - } + RequestAttributes attributes = RequestContextHolder.currentRequestAttributes(); + attributes.removeAttribute(INVITATION_ACCEPTANCE_ATTRIBUTE, RequestAttributes.SCOPE_SESSION); + attributes.removeAttribute(INVITED_USER_ID_ATTRIBUTE, RequestAttributes.SCOPE_SESSION); + attributes.removeAttribute(INVITATION_ORIGIN_ATTRIBUTE, RequestAttributes.SCOPE_SESSION); } catch (IllegalStateException _) { - //nothing bound on thread. - logger.debug("Unable to retrieve request attributes looking for invitation."); + logger.debug("Unable to retrieve request attributes while clearing invitation."); + } + } + private static Object getInvitationSessionAttribute(String name) { + try { + return RequestContextHolder.currentRequestAttributes().getAttribute(name, RequestAttributes.SCOPE_SESSION); + } catch (IllegalStateException _) { + logger.debug("Unable to retrieve request attributes looking for invitation."); + return null; } - return false; } private static class UaaConnectionKeepAliveStrategy implements ConnectionKeepAliveStrategy { diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/web/UaaSavedRequestAwareAuthenticationSuccessHandler.java b/server/src/main/java/org/cloudfoundry/identity/uaa/web/UaaSavedRequestAwareAuthenticationSuccessHandler.java index 4d7269ddee9..bd2883010e9 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/web/UaaSavedRequestAwareAuthenticationSuccessHandler.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/web/UaaSavedRequestAwareAuthenticationSuccessHandler.java @@ -18,6 +18,7 @@ import jakarta.servlet.ServletException; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; +import jakarta.servlet.http.HttpSession; import lombok.extern.slf4j.Slf4j; import org.cloudfoundry.identity.uaa.util.UaaStringUtils; import org.cloudfoundry.identity.uaa.util.UaaUrlUtils; @@ -33,10 +34,14 @@ import java.util.List; import java.util.Optional; +import static org.cloudfoundry.identity.uaa.util.SessionUtils.SAVED_REQUEST_SESSION_ATTRIBUTE; + @Slf4j public class UaaSavedRequestAwareAuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler { public static final String URI_OVERRIDE_ATTRIBUTE = "override.redirect_uri"; public static final String FORM_REDIRECT_PARAMETER = "form_redirect_uri"; + private static final String TRUSTED_REDIRECT_SESSION_ATTRIBUTE = + UaaSavedRequestAwareAuthenticationSuccessHandler.class.getName() + ".TRUSTED_REDIRECT"; private final HttpSessionRequestCache requestCache = new HttpSessionRequestCache(); @@ -44,6 +49,14 @@ public UaaSavedRequestAwareAuthenticationSuccessHandler() { requestCache.setMatchingRequestParameterName(null); } + public static void saveTrustedRedirect(HttpSession session, String redirectUri) { + if (session == null || !UaaStringUtils.hasText(redirectUri)) { + return; + } + session.setAttribute(TRUSTED_REDIRECT_SESSION_ATTRIBUTE, redirectUri); + session.removeAttribute(SAVED_REQUEST_SESSION_ATTRIBUTE); + } + @Override public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws ServletException, IOException { SavedRequest savedRequest = this.requestCache.getRequest(request, response); @@ -75,15 +88,29 @@ public void onAuthenticationSuccess(HttpServletRequest request, HttpServletRespo @Override public String determineTargetUrl(HttpServletRequest request, HttpServletResponse response) { + String trustedRedirect = consumeTrustedRedirect(request); Object redirectAttribute = request.getAttribute(URI_OVERRIDE_ATTRIBUTE); String redirectFormParam = request.getParameter(FORM_REDIRECT_PARAMETER); if (redirectAttribute != null) { log.debug("Returning redirectAttribute saved URI: {}", redirectAttribute); return (String) redirectAttribute; + } else if (UaaStringUtils.hasText(trustedRedirect)) { + log.debug("Returning server-validated saved URI: {}", trustedRedirect); + return trustedRedirect; } else if (UaaUrlUtils.uriHasMatchingHost(redirectFormParam, request.getServerName())) { return redirectFormParam; } else { return super.determineTargetUrl(request, response); } } + + private String consumeTrustedRedirect(HttpServletRequest request) { + HttpSession session = request.getSession(false); + if (session == null) { + return null; + } + Object redirect = session.getAttribute(TRUSTED_REDIRECT_SESSION_ATTRIBUTE); + session.removeAttribute(TRUSTED_REDIRECT_SESSION_ATTRIBUTE); + return redirect instanceof String string ? string : null; + } } diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/zone/ZonePathContextRewritingFilter.java b/server/src/main/java/org/cloudfoundry/identity/uaa/zone/ZonePathContextRewritingFilter.java index 72969fcd961..ebe6be77cd5 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/zone/ZonePathContextRewritingFilter.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/zone/ZonePathContextRewritingFilter.java @@ -115,7 +115,7 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse if (DEFAULT_ZONE_SUBDOMAIN_PATH.equalsIgnoreCase(subdomain)) { // /z/default/... keeps /z/default in context path (like any other zone); same session as root via session key mapping. // Use canonical "default" in path so session key mapping (endsWith "/z/default") matches. - // Do not set ZONE_SUBDOMAIN_FROM_PATH so IdentityZoneResolvingFilter resolves default zone from hostname. + // An empty path subdomain explicitly selects the default zone and prevents a tenant hostname from taking precedence. String newContextPath = getNewContextPath(contextPath, DEFAULT_ZONE_SUBDOMAIN_PATH); HttpServletRequest wrappedRequest = new ZonePathRewrittenRequest( request, @@ -124,6 +124,7 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse pathResult.pathInfo() ); wrappedRequest.setAttribute(ZONE_ORIGINAL_CONTEXT_PATH, contextPath); + wrappedRequest.setAttribute(ZONE_SUBDOMAIN_FROM_PATH, ""); HttpServletResponse wrappedResponse = new CookiePathRewritingResponse(response, contextPath); filterChain.doFilter(wrappedRequest, wrappedResponse); return; diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpointsTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpointsTests.java index 7d046592d49..1c2e298f107 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpointsTests.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpointsTests.java @@ -120,6 +120,16 @@ void generateCodeWithoutIntent(String intent) { verify(spiedExpiringCodeStore, never()).generateCode(any(), any(), any(), any()); } + @Test + void generateCodeWithNullBody() { + assertThatThrownBy(() -> codeStoreEndpoints.generateCode(null)) + .isInstanceOf(CodeStoreException.class) + .hasMessage("intent is required. Known intents: EMAIL, INVITATION, REGISTRATION; custom values are accepted.") + .extracting("status") + .isEqualTo(HttpStatus.BAD_REQUEST); + verify(spiedExpiringCodeStore, never()).generateCode(any(), any(), any(), any()); + } + @Test void generateCodeWithNullData() { Timestamp expiresAt = new Timestamp(currentTime.get() + 60000); diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/EmailInvitationsServiceTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/EmailInvitationsServiceTests.java index 43cb3fce808..80638af9115 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/EmailInvitationsServiceTests.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/EmailInvitationsServiceTests.java @@ -34,7 +34,7 @@ import static org.cloudfoundry.identity.uaa.invitations.EmailInvitationsService.USER_ID; import static org.cloudfoundry.identity.uaa.oauth.common.util.OAuth2Utils.CLIENT_ID; import static org.cloudfoundry.identity.uaa.oauth.common.util.OAuth2Utils.REDIRECT_URI; -import static org.mockito.ArgumentMatchers.any; +import static org.mockito.ArgumentMatchers.anyBoolean; import static org.mockito.Mockito.anyInt; import static org.mockito.Mockito.anyString; import static org.mockito.Mockito.doThrow; @@ -78,8 +78,9 @@ void setUp() { void acceptInvitationNoClientId() { ScimUser user = new ScimUser("user-id-001", "user@example.com", "first", "last"); user.setOrigin(UAA); + user.setVerified(false); when(mockScimUserProvisioning.retrieve(eq("user-id-001"), eq(zoneId))).thenReturn(user); - when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(zoneId))).thenReturn(user); + when(mockScimUserProvisioning.verifyUserAndSetPassword(anyString(), anyString(), eq(false), eq(zoneId))).thenReturn(user); doThrow(NoSuchClientException.class).when(mockClientDetailsService).loadClientByClientId(null, zoneId); Map userData = new HashMap<>(); @@ -89,8 +90,7 @@ void acceptInvitationNoClientId() { when(mockExpiringCodeStore.retrieveCode(anyString(), eq(zoneId))).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(userData), INVITATION.name())); String redirectLocation = emailInvitationsService.acceptInvitation("code", "password").getRedirectUri(); - verify(mockScimUserProvisioning).verifyUser(user.getId(), user.getVersion(), zoneId); - verify(mockScimUserProvisioning).changePassword(user.getId(), null, "password", zoneId); + verify(mockScimUserProvisioning).verifyUserAndSetPassword(user.getId(), "password", false, zoneId); assertThat(redirectLocation).isEqualTo("/home"); } @@ -110,6 +110,7 @@ void nonMatchingCodeIntent() { void acceptInvitation_withoutPasswordUpdate() { ScimUser user = new ScimUser("user-id-001", "user@example.com", "first", "last"); user.setOrigin(UAA); + user.setVerified(false); UaaClientDetails clientDetails = new UaaClientDetails("client-id", null, null, null, null, "http://example.com/*/"); when(mockClientDetailsService.loadClientByClientId("acmeClientId", zoneId)).thenReturn(clientDetails); @@ -153,7 +154,8 @@ void acceptInvitation_onlyMarksInternalUsersAsVerified() { void acceptInvitationWithClientNotFound() { ScimUser user = new ScimUser("user-id-001", "user@example.com", "first", "last"); user.setOrigin(OriginKeys.UAA); - when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(zoneId))).thenReturn(user); + user.setVerified(false); + when(mockScimUserProvisioning.verifyUserAndSetPassword(anyString(), anyString(), eq(false), eq(zoneId))).thenReturn(user); when(mockScimUserProvisioning.retrieve(eq("user-id-001"), eq(zoneId))).thenReturn(user); doThrow(new NoSuchClientException("Client not found")).when(mockClientDetailsService).loadClientByClientId("client-not-found", zoneId); @@ -165,8 +167,7 @@ void acceptInvitationWithClientNotFound() { String redirectLocation = emailInvitationsService.acceptInvitation("code", "password").getRedirectUri(); - verify(mockScimUserProvisioning).verifyUser(user.getId(), user.getVersion(), zoneId); - verify(mockScimUserProvisioning).changePassword(user.getId(), null, "password", zoneId); + verify(mockScimUserProvisioning).verifyUserAndSetPassword(user.getId(), "password", false, zoneId); assertThat(redirectLocation).isEqualTo("/home"); } @@ -174,9 +175,10 @@ void acceptInvitationWithClientNotFound() { void acceptInvitationWithValidRedirectUri() { ScimUser user = new ScimUser("user-id-001", "user@example.com", "first", "last"); user.setOrigin(UAA); + user.setVerified(false); UaaClientDetails clientDetails = new UaaClientDetails("client-id", null, null, null, null, "http://example.com/*/"); when(mockScimUserProvisioning.retrieve(eq("user-id-001"), eq(zoneId))).thenReturn(user); - when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(zoneId))).thenReturn(user); + when(mockScimUserProvisioning.verifyUserAndSetPassword(anyString(), anyString(), eq(false), eq(zoneId))).thenReturn(user); when(mockClientDetailsService.loadClientByClientId("acmeClientId", zoneId)).thenReturn(clientDetails); Map userData = new HashMap<>(); @@ -188,8 +190,7 @@ void acceptInvitationWithValidRedirectUri() { String redirectLocation = emailInvitationsService.acceptInvitation("code", "password").getRedirectUri(); - verify(mockScimUserProvisioning).verifyUser(user.getId(), user.getVersion(), zoneId); - verify(mockScimUserProvisioning).changePassword(user.getId(), null, "password", zoneId); + verify(mockScimUserProvisioning).verifyUserAndSetPassword(user.getId(), "password", false, zoneId); assertThat(redirectLocation).isEqualTo("http://example.com/redirect/"); } @@ -197,8 +198,9 @@ void acceptInvitationWithValidRedirectUri() { void acceptInvitationWithInvalidRedirectUri() { ScimUser user = new ScimUser("user-id-001", "user@example.com", "first", "last"); user.setOrigin(UAA); + user.setVerified(false); UaaClientDetails clientDetails = new UaaClientDetails("client-id", null, null, null, null, "http://example.com/redirect"); - when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(zoneId))).thenReturn(user); + when(mockScimUserProvisioning.verifyUserAndSetPassword(anyString(), anyString(), eq(false), eq(zoneId))).thenReturn(user); when(mockScimUserProvisioning.retrieve(eq("user-id-001"), eq(zoneId))).thenReturn(user); when(mockClientDetailsService.loadClientByClientId("acmeClientId", zoneId)).thenReturn(clientDetails); Map userData = new HashMap<>(); @@ -210,8 +212,7 @@ void acceptInvitationWithInvalidRedirectUri() { String redirectLocation = emailInvitationsService.acceptInvitation("code", "password").getRedirectUri(); - verify(mockScimUserProvisioning).verifyUser(user.getId(), user.getVersion(), zoneId); - verify(mockScimUserProvisioning).changePassword(user.getId(), null, "password", zoneId); + verify(mockScimUserProvisioning).verifyUserAndSetPassword(user.getId(), "password", false, zoneId); assertThat(redirectLocation).isEqualTo("/home"); } @@ -219,8 +220,8 @@ void acceptInvitationWithInvalidRedirectUri() { void acceptInvitation_existingUser_withPassword_doesNotChangePassword() { ScimUser user = new ScimUser("user-id-001", "user@example.com", "first", "last"); user.setOrigin(UAA); + user.setVerified(true); when(mockScimUserProvisioning.retrieve(eq("user-id-001"), eq(zoneId))).thenReturn(user); - when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(zoneId))).thenReturn(user); doThrow(NoSuchClientException.class).when(mockClientDetailsService).loadClientByClientId(null, zoneId); Map userData = new HashMap<>(); @@ -234,16 +235,42 @@ void acceptInvitation_existingUser_withPassword_doesNotChangePassword() { emailInvitationsService.acceptInvitation("code", "attackerChosenPassword"); + verify(mockScimUserProvisioning, never()).verifyUser(anyString(), anyInt(), anyString()); + verify(mockScimUserProvisioning, never()).verifyUserAndSetPassword(anyString(), anyString(), anyBoolean(), anyString()); + } + + @Test + void acceptInvitation_existingUnverifiedUser_doesNotChangePassword() { + ScimUser user = new ScimUser("user-id-001", "user@example.com", "first", "last"); + user.setOrigin(UAA); + user.setVerified(false); + when(mockScimUserProvisioning.retrieve(eq("user-id-001"), eq(zoneId))).thenReturn(user); + when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(zoneId))).thenReturn(user); + doThrow(NoSuchClientException.class).when(mockClientDetailsService).loadClientByClientId(null, zoneId); + + Map userData = new HashMap<>(); + userData.put(USER_ID, "user-id-001"); + userData.put(EMAIL, "user@example.com"); + userData.put(CLIENT_ID, null); + userData.put(InvitationsEndpoint.CREATED_NEW_USER, "false"); + when(mockExpiringCodeStore.retrieveCode(anyString(), eq(zoneId))) + .thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), + JsonUtils.writeValueAsString(userData), INVITATION.name())); + + emailInvitationsService.acceptInvitation("code", "submittedPassword"); + verify(mockScimUserProvisioning).verifyUser(user.getId(), user.getVersion(), zoneId); - verify(mockScimUserProvisioning, never()).changePassword(any(), any(), any(), any()); + verify(mockScimUserProvisioning, never()) + .verifyUserAndSetPassword(anyString(), anyString(), anyBoolean(), anyString()); } @Test void acceptInvitation_newUser_withPassword_stillChangesPassword() { ScimUser user = new ScimUser("user-id-002", "newuser@example.com", "first", "last"); user.setOrigin(UAA); + user.setVerified(false); when(mockScimUserProvisioning.retrieve(eq("user-id-002"), eq(zoneId))).thenReturn(user); - when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(zoneId))).thenReturn(user); + when(mockScimUserProvisioning.verifyUserAndSetPassword(anyString(), anyString(), eq(false), eq(zoneId))).thenReturn(user); doThrow(NoSuchClientException.class).when(mockClientDetailsService).loadClientByClientId(null, zoneId); Map userData = new HashMap<>(); @@ -257,7 +284,6 @@ void acceptInvitation_newUser_withPassword_stillChangesPassword() { emailInvitationsService.acceptInvitation("code", "newUserPassword"); - verify(mockScimUserProvisioning).verifyUser(user.getId(), user.getVersion(), zoneId); - verify(mockScimUserProvisioning).changePassword(user.getId(), null, "newUserPassword", zoneId); + verify(mockScimUserProvisioning).verifyUserAndSetPassword(user.getId(), "newUserPassword", false, zoneId); } } diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java index 2ca5c744352..ca084ea8c92 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java @@ -40,6 +40,7 @@ import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Import; import org.springframework.context.support.ResourceBundleMessageSource; +import org.springframework.mock.web.MockHttpSession; import org.springframework.security.authentication.AnonymousAuthenticationToken; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.authentication.BadCredentialsException; @@ -208,6 +209,20 @@ void acceptInvitePage_for_unverifiedSamlUser() throws Exception { assertThat(result.getRequest().getSession().getAttribute("IS_INVITE_ACCEPTANCE")).isEqualTo(true); assertThat(result.getRequest().getSession().getAttribute("user_id")).isEqualTo("user-id-001"); + assertThat(result.getRequest().getSession().getAttribute("invitation_origin")).isEqualTo("test-saml"); + + MockHttpSession session = (MockHttpSession) result.getRequest().getSession(); + when(invitationsService.acceptInvitation("the_secret_code", "")) + .thenReturn(new AcceptedInvitation("https://client.example.com/callback", new ScimUser())); + + mockMvc.perform(get("/invitations/accept") + .session(session) + .param("code", "the_secret_code")) + .andExpect(redirectedUrl("https://client.example.com/callback")); + + assertThat(session.getAttribute("IS_INVITE_ACCEPTANCE")).isNull(); + assertThat(session.getAttribute("user_id")).isNull(); + assertThat(session.getAttribute("invitation_origin")).isNull(); } @Test @@ -234,6 +249,7 @@ void acceptInvitePage_for_unverifiedOIDCUser() throws Exception { assertThat(result.getRequest().getSession().getAttribute("IS_INVITE_ACCEPTANCE")).isEqualTo(true); assertThat(result.getRequest().getSession().getAttribute("user_id")).isEqualTo("user-id-001"); + assertThat(result.getRequest().getSession().getAttribute("invitation_origin")).isEqualTo("test-oidc"); } @Test @@ -292,6 +308,7 @@ void unverifiedLdapUser_acceptsInvite_byLoggingIn() throws Exception { ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f"); invitedUser.setPrimaryEmail("user@example.com"); + invitedUser.setOrigin(LDAP); when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser); when(invitationsService.acceptInvitation(anyString(), anyString())).thenReturn(new AcceptedInvitation("blah.test.com", new ScimUser())); @@ -338,6 +355,7 @@ void ldapInviteAcceptanceReissuesCodeWithItsIntent() throws Exception { ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f"); invitedUser.setPrimaryEmail("user@example.com"); + invitedUser.setOrigin(LDAP); when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser); when(invitationsService.acceptInvitation(anyString(), anyString())).thenReturn(new AcceptedInvitation("blah.test.com", new ScimUser())); @@ -355,6 +373,57 @@ void ldapInviteAcceptanceReissuesCodeWithItsIntent() throws Exception { verify(expiringCodeStore, times(1)).generateCode(anyString(), any(), eq(INVITATION.name()), eq(zoneId)); } + @Test + void ldapInviteWithWrongIntentIsRejectedBeforeAuthenticationOrMutation() throws Exception { + Map codeData = getInvitationsCode(LDAP); + String zoneId = IdentityZoneHolder.get().getId(); + when(expiringCodeStore.retrieveCode("the_secret_code", zoneId)) + .thenReturn(new ExpiringCode( + "code", + new Timestamp(System.currentTimeMillis()), + JsonUtils.writeValueAsString(codeData), + "wrong-intent")); + + mockMvc.perform(post("/invitations/accept_enterprise.do") + .param("enterprise_username", "test-ldap-user") + .param("enterprise_password", "password") + .param("enterprise_email", "email") + .param("code", "the_secret_code")) + .andExpect(status().isUnprocessableEntity()) + .andExpect(model().attribute("error_message_code", "code_expired")); + + verify(zoneAwareAuthenticationManager, never()).getLdapAuthenticationManager(any(), any()); + verify(scimUserProvisioning, never()).update(anyString(), any(), anyString()); + verify(invitationsService, never()).acceptInvitation(anyString(), anyString()); + } + + @Test + void ldapInviteForNonLdapUserIsRejectedBeforeAuthenticationOrMutation() throws Exception { + Map codeData = getInvitationsCode(LDAP); + String zoneId = IdentityZoneHolder.get().getId(); + when(expiringCodeStore.retrieveCode("the_secret_code", zoneId)) + .thenReturn(new ExpiringCode( + "code", + new Timestamp(System.currentTimeMillis()), + JsonUtils.writeValueAsString(codeData), + INVITATION.name())); + ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f"); + invitedUser.setOrigin(OriginKeys.UAA); + when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser); + + mockMvc.perform(post("/invitations/accept_enterprise.do") + .param("enterprise_username", "test-ldap-user") + .param("enterprise_password", "password") + .param("enterprise_email", "email") + .param("code", "the_secret_code")) + .andExpect(status().isUnprocessableEntity()) + .andExpect(model().attribute("error_message_code", "code_expired")); + + verify(zoneAwareAuthenticationManager, never()).getLdapAuthenticationManager(any(), any()); + verify(scimUserProvisioning, never()).update(anyString(), any(), anyString()); + verify(invitationsService, never()).acceptInvitation(anyString(), anyString()); + } + @Test void unverifiedLdapUser_acceptsInvite_byLoggingIn_bad_credentials() throws Exception { Map codeData = getInvitationsCode("ldap"); @@ -370,6 +439,9 @@ void unverifiedLdapUser_acceptsInvite_byLoggingIn_bad_credentials() throws Excep Authentication auth = mock(Authentication.class); when(auth.isAuthenticated()).thenReturn(true); when(ldapActual.authenticate(any())).thenThrow(new BadCredentialsException("bad creds")); + ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f"); + invitedUser.setOrigin(LDAP); + when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser); mockMvc.perform(post("/invitations/accept_enterprise.do") .param("enterprise_username", "test-ldap-user") @@ -401,6 +473,7 @@ void unverifiedLdapUser_acceptsInvite_byLoggingIn_whereEmailDoesNotMatchAuthenti ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f"); invitedUser.setPrimaryEmail("user@example.com"); + invitedUser.setOrigin(LDAP); when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser); when(expiringCodeStore.generateCode(anyString(), any(), eq(null), eq(zoneId))).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), null)); @@ -439,6 +512,7 @@ void ldapInviteEmailMismatchReissuesCodesWithTheirIntent() throws Exception { ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f"); invitedUser.setPrimaryEmail("user@example.com"); + invitedUser.setOrigin(LDAP); when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser); when(expiringCodeStore.generateCode(anyString(), any(), any(), eq(zoneId))).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name())); @@ -538,6 +612,28 @@ void missing_code() throws Exception { verify(invitationsService, never()).acceptInvitation(anyString(), anyString()); } + @Test + void acceptInviteWithWrongIntentIsRejectedBeforeCodeRegeneration() throws Exception { + MockHttpServletRequestBuilder post = startAcceptInviteFlow("password", "password"); + String zoneId = IdentityZoneHolder.get().getId(); + Map codeData = getInvitationsCode(OriginKeys.UAA); + when(expiringCodeStore.retrieveCode("thecode", zoneId)) + .thenReturn(new ExpiringCode( + "thecode", + new Timestamp(System.currentTimeMillis()), + JsonUtils.writeValueAsString(codeData), + "wrong-intent")); + + mockMvc.perform(post) + .andExpect(status().isUnprocessableEntity()) + .andExpect(model().attribute("error_message_code", "code_expired")) + .andExpect(view().name("invitations/accept_invite")); + + verify(expiringCodeStore, never()).generateCode(anyString(), any(), any(), eq(zoneId)); + verify(invitationsService, never()).acceptInvitation(anyString(), anyString()); + assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull(); + } + @Test void invalid_principal_id() throws Exception { MockHttpServletRequestBuilder post = startAcceptInviteFlow("a", "a"); diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerZonePathTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerZonePathTest.java index f2fb31c7abb..787862ee2c4 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerZonePathTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerZonePathTest.java @@ -244,6 +244,7 @@ void acceptInvitePage_for_unverifiedSamlUser(ZoneRequestPathMode mode) throws Ex assertThat(result.getRequest().getSession().getAttribute("IS_INVITE_ACCEPTANCE")).isEqualTo(true); assertThat(result.getRequest().getSession().getAttribute("user_id")).isEqualTo("user-id-001"); + assertThat(result.getRequest().getSession().getAttribute("invitation_origin")).isEqualTo("test-saml"); } @ParameterizedTest @@ -269,6 +270,7 @@ void acceptInvitePage_for_unverifiedOIDCUser(ZoneRequestPathMode mode) throws Ex assertThat(result.getRequest().getSession().getAttribute("IS_INVITE_ACCEPTANCE")).isEqualTo(true); assertThat(result.getRequest().getSession().getAttribute("user_id")).isEqualTo("user-id-001"); + assertThat(result.getRequest().getSession().getAttribute("invitation_origin")).isEqualTo("test-oidc"); } @ParameterizedTest @@ -332,6 +334,7 @@ void unverifiedLdapUser_acceptsInvite_byLoggingIn(ZoneRequestPathMode mode) thro ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f"); invitedUser.setPrimaryEmail("user@example.com"); + invitedUser.setOrigin(LDAP); when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser); when(invitationsService.acceptInvitation(anyString(), anyString())).thenReturn(new AcceptedInvitation("blah.test.com", new ScimUser())); @@ -381,6 +384,7 @@ void ldapInviteAcceptanceReissuesCodeWithItsIntent(ZoneRequestPathMode mode) thr ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f"); invitedUser.setPrimaryEmail("user@example.com"); + invitedUser.setOrigin(LDAP); when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser); when(invitationsService.acceptInvitation(anyString(), anyString())).thenReturn(new AcceptedInvitation("blah.test.com", new ScimUser())); @@ -399,6 +403,32 @@ void ldapInviteAcceptanceReissuesCodeWithItsIntent(ZoneRequestPathMode mode) thr verify(expiringCodeStore, times(1)).generateCode(anyString(), any(), eq(INVITATION.name()), eq(zoneId)); } + @ParameterizedTest + @EnumSource(ZoneRequestPathMode.class) + void ldapInviteWithWrongIntentIsRejectedBeforeAuthenticationOrMutation(ZoneRequestPathMode mode) throws Exception { + mode.setZone(); + Map codeData = getInvitationsCode(LDAP); + String zoneId = IdentityZoneHolder.get().getId(); + when(expiringCodeStore.retrieveCode("the_secret_code", zoneId)) + .thenReturn(new ExpiringCode( + "code", + new Timestamp(System.currentTimeMillis()), + JsonUtils.writeValueAsString(codeData), + "wrong-intent")); + + mockMvc.perform(requestPost(mode, "/invitations/accept_enterprise.do") + .param("enterprise_username", "test-ldap-user") + .param("enterprise_password", "password") + .param("enterprise_email", "email") + .param("code", "the_secret_code")) + .andExpect(status().isUnprocessableEntity()) + .andExpect(model().attribute("error_message_code", "code_expired")); + + verify(zoneAwareAuthenticationManager, never()).getLdapAuthenticationManager(any(), any()); + verify(scimUserProvisioning, never()).update(anyString(), any(), anyString()); + verify(invitationsService, never()).acceptInvitation(anyString(), anyString()); + } + @ParameterizedTest @EnumSource(ZoneRequestPathMode.class) void unverifiedLdapUser_acceptsInvite_byLoggingIn_bad_credentials(ZoneRequestPathMode mode) throws Exception { @@ -416,6 +446,9 @@ void unverifiedLdapUser_acceptsInvite_byLoggingIn_bad_credentials(ZoneRequestPat Authentication auth = mock(Authentication.class); when(auth.isAuthenticated()).thenReturn(true); when(ldapActual.authenticate(any())).thenThrow(new BadCredentialsException("bad creds")); + ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f"); + invitedUser.setOrigin(LDAP); + when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser); mockMvc.perform(requestPost(mode, "/invitations/accept_enterprise.do") .param("enterprise_username", "test-ldap-user") @@ -449,6 +482,7 @@ void unverifiedLdapUser_acceptsInvite_byLoggingIn_whereEmailDoesNotMatchAuthenti ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f"); invitedUser.setPrimaryEmail("user@example.com"); + invitedUser.setOrigin(LDAP); when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser); when(expiringCodeStore.generateCode(anyString(), any(), eq(null), eq(zoneId))).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), null)); @@ -489,6 +523,7 @@ void ldapInviteEmailMismatchReissuesCodesWithTheirIntent(ZoneRequestPathMode mod ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f"); invitedUser.setPrimaryEmail("user@example.com"); + invitedUser.setOrigin(LDAP); when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser); when(expiringCodeStore.generateCode(anyString(), any(), any(), eq(zoneId))).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name())); @@ -591,6 +626,30 @@ void missing_code(ZoneRequestPathMode mode) throws Exception { verify(invitationsService, never()).acceptInvitation(anyString(), anyString()); } + @ParameterizedTest + @EnumSource(ZoneRequestPathMode.class) + void acceptInviteWithWrongIntentIsRejectedBeforeCodeRegeneration(ZoneRequestPathMode mode) throws Exception { + mode.setZone(); + MockHttpServletRequestBuilder post = startAcceptInviteFlow(mode, "password", "password"); + String zoneId = IdentityZoneHolder.get().getId(); + Map codeData = getInvitationsCode(OriginKeys.UAA); + when(expiringCodeStore.retrieveCode("thecode", zoneId)) + .thenReturn(new ExpiringCode( + "thecode", + new Timestamp(System.currentTimeMillis()), + JsonUtils.writeValueAsString(codeData), + "wrong-intent")); + + mockMvc.perform(post) + .andExpect(status().isUnprocessableEntity()) + .andExpect(model().attribute("error_message_code", "code_expired")) + .andExpect(view().name("invitations/accept_invite")); + + verify(expiringCodeStore, never()).generateCode(anyString(), any(), any(), eq(zoneId)); + verify(invitationsService, never()).acceptInvitation(anyString(), anyString()); + assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull(); + } + @ParameterizedTest @EnumSource(ZoneRequestPathMode.class) void invalid_principal_id(ZoneRequestPathMode mode) throws Exception { diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerTest.java index 664228d673d..2e94233f66d 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerTest.java @@ -191,12 +191,15 @@ void invalidEmail() throws Exception { .param("email", "wrong") .param("password", "password") .param("password_confirmation", "password") - .param("client_id", "app"); + .param("client_id", "app") + .param("redirect_uri", "https://client.example.com/callback"); mockMvc.perform(post) .andExpect(status().isUnprocessableEntity()) .andExpect(view().name("accounts/new_activation_email")) - .andExpect(model().attribute("error_message_code", "invalid_email")); + .andExpect(model().attribute("error_message_code", "invalid_email")) + .andExpect(model().attribute("client_id", "app")) + .andExpect(model().attribute("redirect_uri", "https://client.example.com/callback")); } @Test diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/login/ChangeEmailControllerTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/login/ChangeEmailControllerTest.java index 074d942b493..2be3caa98c5 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/login/ChangeEmailControllerTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/login/ChangeEmailControllerTest.java @@ -171,13 +171,16 @@ void invalidEmail() throws Exception { MockHttpServletRequestBuilder post = post("/change_email.do") .contentType(APPLICATION_FORM_URLENCODED) .param("newEmail", "invalid") - .param("client_id", "app"); + .param("client_id", "app") + .param("redirect_uri", "https://client.example.com/callback"); mockMvc.perform(post) .andExpect(status().isUnprocessableEntity()) .andExpect(view().name("change_email")) .andExpect(model().attribute("error_message_code", "invalid_email")) - .andExpect(model().attribute("email", "user@example.com")); + .andExpect(model().attribute("email", "user@example.com")) + .andExpect(model().attribute("client_id", "app")) + .andExpect(model().attribute("redirect_uri", "https://client.example.com/callback")); } @Test diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java index c2d0ae03bcd..03c86c8e51d 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java @@ -31,9 +31,9 @@ import org.junit.jupiter.api.Test; import org.junit.jupiter.api.extension.ExtendWith; import org.mockito.ArgumentCaptor; -import org.mockito.InOrder; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Qualifier; +import org.springframework.dao.OptimisticLockingFailureException; import org.springframework.http.HttpStatus; import org.springframework.mock.web.MockHttpServletRequest; import org.springframework.security.core.context.SecurityContextHolder; @@ -53,16 +53,14 @@ import static org.assertj.core.api.Assertions.assertThat; import static org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType.REGISTRATION; import static org.mockito.ArgumentMatchers.any; -import static org.mockito.ArgumentMatchers.isNull; +import static org.mockito.ArgumentMatchers.anyBoolean; import static org.mockito.Mockito.anyInt; -import static org.mockito.Mockito.inOrder; import static org.mockito.Mockito.anyString; import static org.mockito.Mockito.doThrow; import static org.mockito.Mockito.eq; import static org.mockito.Mockito.mock; import static org.mockito.Mockito.never; import static org.mockito.Mockito.verifyNoInteractions; -import static org.mockito.ArgumentMatchers.anyBoolean; import static org.mockito.Mockito.verify; import static org.mockito.Mockito.when; @@ -294,15 +292,12 @@ void completeActivationDiscardsRegistrationPasswordAndRequiresPasswordReset() { AccountCreationService.AccountCreationResponse accountCreation = emailAccountCreationService.completeActivation("the_secret_code"); - // The password supplied on the registration form must be discarded (replaced with a value - // that is not it) and the change-required flag set while the account is still unverified, - // and the account must be verified last. Verifying first would briefly leave the account - // verified while still accepting the registration password. ArgumentCaptor passwordCaptor = ArgumentCaptor.forClass(String.class); - InOrder inOrder = inOrder(mockScimUserProvisioning); - inOrder.verify(mockScimUserProvisioning).changePassword(eq("newly-created-user-id"), isNull(), passwordCaptor.capture(), eq(currentIdentityZoneId)); - inOrder.verify(mockScimUserProvisioning).updatePasswordChangeRequired("newly-created-user-id", true, currentIdentityZoneId); - inOrder.verify(mockScimUserProvisioning).verifyUser(eq("newly-created-user-id"), anyInt(), eq(currentIdentityZoneId)); + verify(mockScimUserProvisioning).verifyUserAndSetPassword( + eq("newly-created-user-id"), + passwordCaptor.capture(), + eq(true), + eq(currentIdentityZoneId)); assertThat(passwordCaptor.getValue()).isNotEqualTo("password"); // An ownership-bound reset code must be issued so the confirming owner can set their own @@ -328,8 +323,7 @@ void completeActivationForACodeFromTheUserApiOnlyVerifiesTheUser() { AccountCreationService.AccountCreationResponse accountCreation = emailAccountCreationService.completeActivation("the_secret_code"); verify(mockScimUserProvisioning).verifyUser(eq("newly-created-user-id"), anyInt(), eq(currentIdentityZoneId)); - verify(mockScimUserProvisioning, never()).changePassword(anyString(), any(), anyString(), anyString()); - verify(mockScimUserProvisioning, never()).updatePasswordChangeRequired(anyString(), anyBoolean(), anyString()); + verify(mockScimUserProvisioning, never()).verifyUserAndSetPassword(anyString(), anyString(), anyBoolean(), anyString()); verifyNoInteractions(mockResetPasswordService); assertThat(accountCreation.getPasswordResetCode()).isNull(); assertThat(accountCreation.getRedirectLocation()).isEqualTo("home"); @@ -348,8 +342,31 @@ void completeActivationForAnAlreadyVerifiedAccountKeepsItsPassword() { // Another activation link for the same account stays valid after the account was confirmed. // Opening it must keep the password the owner has set and must not ask for another change. - verify(mockScimUserProvisioning, never()).changePassword(anyString(), any(), anyString(), anyString()); - verify(mockScimUserProvisioning, never()).updatePasswordChangeRequired(anyString(), anyBoolean(), anyString()); + verify(mockScimUserProvisioning, never()).verifyUserAndSetPassword(anyString(), anyString(), anyBoolean(), anyString()); + verifyNoInteractions(mockResetPasswordService); + assertThat(accountCreation.getPasswordResetCode()).isNull(); + } + + @Test + void concurrentActivationThatLosesTheVerificationRaceDoesNotIssueAResetCode() { + setUpForSuccess(""); + ScimUser verifiedUser = new ScimUser( + "newly-created-user-id", + "user@example.com", + "givenName", + "familyName"); + verifiedUser.setPrimaryEmail("user@example.com"); + verifiedUser.setVerified(true); + when(mockCodeStore.retrieveCode("the_secret_code", currentIdentityZoneId)).thenReturn(code); + when(mockScimUserProvisioning.retrieve(anyString(), eq(currentIdentityZoneId))) + .thenReturn(user, verifiedUser); + when(mockScimUserProvisioning.verifyUserAndSetPassword(anyString(), anyString(), eq(true), eq(currentIdentityZoneId))) + .thenThrow(new OptimisticLockingFailureException("already verified")); + when(mockClientDetailsService.loadClientByClientId(anyString(), anyString())).thenReturn(mockClientDetails); + + AccountCreationService.AccountCreationResponse accountCreation = + emailAccountCreationService.completeActivation("the_secret_code"); + verifyNoInteractions(mockResetPasswordService); assertThat(accountCreation.getPasswordResetCode()).isNull(); } @@ -477,6 +494,7 @@ private String setUpForSuccess(String userId, String redirectUri) { when(mockClientDetails.getClientId()).thenReturn("login"); when(mockClientDetails.getRegisteredRedirectUri()).thenReturn(Collections.singleton("http://example.com/*")); + when(mockScimUserProvisioning.verifyUserAndSetPassword(anyString(), anyString(), anyBoolean(), anyString())).thenReturn(user); return JsonUtils.writeValueAsString(data); } diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManagerIT.java b/server/src/test/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManagerIT.java index e18d0e8cde6..7bab1ae2ce0 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManagerIT.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManagerIT.java @@ -44,6 +44,7 @@ import org.cloudfoundry.identity.uaa.util.JsonUtils; import org.cloudfoundry.identity.uaa.util.SessionUtils; import org.cloudfoundry.identity.uaa.util.TimeServiceImpl; +import org.cloudfoundry.identity.uaa.util.UaaHttpRequestUtils; import org.cloudfoundry.identity.uaa.util.UaaRandomStringUtil; import org.cloudfoundry.identity.uaa.util.UaaTokenUtils; import org.cloudfoundry.identity.uaa.zone.IdentityZoneHolder; @@ -1060,6 +1061,27 @@ void invitedUser_becomesVerifiedOnAccept() { RequestContextHolder.resetRequestAttributes(); } + @Test + void invitedUser_isRejectedWhenIdentityProviderDoesNotMatchInvitation() { + try { + setUpInvitedUser(); + UaaHttpRequestUtils.setInvitationSessionAttributes("user-id", "other-origin"); + claims.remove("preferred_username"); + claims.put("preferred_username", "marissa@bloggs.com"); + mockToken(); + + assertThatThrownBy(() -> externalOAuthAuthenticationManager.authenticate(xCodeToken)) + .isInstanceOf(BadCredentialsException.class) + .hasMessageContaining("identity provider does not match"); + + ArgumentCaptor eventCaptor = ArgumentCaptor.forClass(ApplicationEvent.class); + verify(publisher, atLeast(0)).publishEvent(eventCaptor.capture()); + assertThat(eventCaptor.getAllValues()).noneMatch(InvitedUserAuthenticatedEvent.class::isInstance); + } finally { + RequestContextHolder.resetRequestAttributes(); + } + } + @Test void invitedVerifiedUser_isRejectedWhenTokenHasNoEmail() { try { @@ -1461,9 +1483,8 @@ private void setUpInvitedUser(boolean verified) { userDatabase.addUser(existingShadowUser); RequestAttributes attributes = new ServletRequestAttributes(new MockHttpServletRequest()); - attributes.setAttribute("IS_INVITE_ACCEPTANCE", true, RequestAttributes.SCOPE_SESSION); - attributes.setAttribute("user_id", existingShadowUser.getId(), RequestAttributes.SCOPE_SESSION); RequestContextHolder.setRequestAttributes(attributes); + UaaHttpRequestUtils.setInvitationSessionAttributes(existingShadowUser.getId(), ORIGIN); } // Asserts that the outgoing request body contains all the given substrings. diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUaaTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUaaTests.java index 07e2607d12f..d93a56d7b07 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUaaTests.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUaaTests.java @@ -30,6 +30,7 @@ import org.cloudfoundry.identity.uaa.user.UserInfo; import org.cloudfoundry.identity.uaa.util.TimeService; import org.cloudfoundry.identity.uaa.util.TimeServiceImpl; +import org.cloudfoundry.identity.uaa.util.UaaHttpRequestUtils; import org.cloudfoundry.identity.uaa.util.beans.DbUtils; import org.cloudfoundry.identity.uaa.web.UaaSavedRequestAwareAuthenticationSuccessHandler; import org.cloudfoundry.identity.uaa.zone.IdentityZone; @@ -508,6 +509,24 @@ void invitedUserAuthenticationWhenAuthenticatedEmailDoesNotMatchInvitedEmail() { assertThat(user.isVerified()).isFalse(); } + @Test + void invitedUserAuthenticationRejectsDifferentIdentityProvider() { + ScimUser scimUser = getInvitedUser(); + UaaHttpRequestUtils.setInvitationSessionAttributes(scimUser.getId(), "other-saml-provider"); + Map userAttributes = + getUserAttributes("Marissa-invited", null, "marissa.invited@test.org", null, null); + Saml2AuthenticationToken authenticationToken = + authenticationToken("marissa-invited", attributeStatements(userAttributes)); + + assertThatThrownBy(() -> authenticate(authenticationToken)) + .isInstanceOf(Saml2AuthenticationException.class) + .hasMessageContaining("identity provider does not match"); + + UaaUser user = userDatabase.retrieveUserById(scimUser.getId()); + assertThat(user.isVerified()).isFalse(); + assertThat(user.getUsername()).isEqualTo("marissa.invited@test.org"); + } + @Test void invitedVerifiedUserAuthenticationWhenAssertionHasNoEmail() { Map attributeMappings = new HashMap<>(); @@ -586,9 +605,8 @@ private ScimUser getInvitedUser(boolean verified, String username) { identityZoneManager.getCurrentIdentityZone().getId()); RequestAttributes attributes = new ServletRequestAttributes(new MockHttpServletRequest()); - attributes.setAttribute("IS_INVITE_ACCEPTANCE", true, RequestAttributes.SCOPE_SESSION); - attributes.setAttribute("user_id", scimUser.getId(), RequestAttributes.SCOPE_SESSION); RequestContextHolder.setRequestAttributes(attributes); + UaaHttpRequestUtils.setInvitationSessionAttributes(scimUser.getId(), OriginKeys.SAML); return scimUser; } diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/scim/jdbc/JdbcScimUserProvisioningTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/scim/jdbc/JdbcScimUserProvisioningTests.java index cacbec3094b..fc92cbcda37 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/scim/jdbc/JdbcScimUserProvisioningTests.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/scim/jdbc/JdbcScimUserProvisioningTests.java @@ -1139,6 +1139,41 @@ void updatedUserVerified() { assertThat(verified).isTrue(); } + @Test + void verifyUserAndSetPasswordOnlyUpdatesAnUnverifiedUser() { + String userId = createUserForDelete(jdbcTemplate, currentIdentityZoneId); + + ScimUser activatedUser = + jdbcScimUserProvisioning.verifyUserAndSetPassword(userId, "activation-password", true, currentIdentityZoneId); + + assertThat(activatedUser.isVerified()).isTrue(); + assertThat(jdbcScimUserProvisioning.checkPasswordMatches(userId, "activation-password", currentIdentityZoneId)).isTrue(); + assertThat(jdbcScimUserProvisioning.checkPasswordChangeIndividuallyRequired(userId, currentIdentityZoneId)).isTrue(); + + jdbcScimUserProvisioning.changePassword(userId, null, "owner-password", currentIdentityZoneId); + jdbcScimUserProvisioning.updatePasswordChangeRequired(userId, false, currentIdentityZoneId); + + assertThatThrownBy(() -> + jdbcScimUserProvisioning.verifyUserAndSetPassword(userId, "late-activation-password", true, currentIdentityZoneId)) + .isInstanceOf(OptimisticLockingFailureException.class); + assertThat(jdbcScimUserProvisioning.checkPasswordMatches(userId, "owner-password", currentIdentityZoneId)).isTrue(); + assertThat(jdbcScimUserProvisioning.checkPasswordChangeIndividuallyRequired(userId, currentIdentityZoneId)).isFalse(); + } + + @Test + void verifyUserAndSetPasswordCanLeavePasswordChangeNotRequired() { + String userId = createUserForDelete(jdbcTemplate, currentIdentityZoneId); + + jdbcScimUserProvisioning.verifyUserAndSetPassword( + userId, + "invitation-password", + false, + currentIdentityZoneId); + + assertThat(jdbcScimUserProvisioning.checkPasswordMatches(userId, "invitation-password", currentIdentityZoneId)).isTrue(); + assertThat(jdbcScimUserProvisioning.checkPasswordChangeIndividuallyRequired(userId, currentIdentityZoneId)).isFalse(); + } + @Test void createUserWithNoZoneDefaultsToUAAZone() { String id = UUID.randomUUID().toString(); diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/web/UaaSavedRequestAwareAuthenticationSuccessHandlerTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/web/UaaSavedRequestAwareAuthenticationSuccessHandlerTests.java index 92152cbaca0..f72961d2e31 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/web/UaaSavedRequestAwareAuthenticationSuccessHandlerTests.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/web/UaaSavedRequestAwareAuthenticationSuccessHandlerTests.java @@ -79,6 +79,19 @@ void invalidFormRedirectIsNotReturned() { assertThat(handler.determineTargetUrl(request, new MockHttpServletResponse())).isEqualTo("/"); } + @Test + void serverValidatedRedirectAllowsOffHostTargetAndIsConsumed() { + String redirectUri = "https://client.example.com/callback"; + HttpSession session = request.getSession(); + session.setAttribute(SPRING_SECURITY_SAVED_REQUEST, mock(SavedRequest.class)); + + UaaSavedRequestAwareAuthenticationSuccessHandler.saveTrustedRedirect(session, redirectUri); + + assertThat(session.getAttribute(SPRING_SECURITY_SAVED_REQUEST)).isNull(); + assertThat(handler.determineTargetUrl(request, new MockHttpServletResponse())).isEqualTo(redirectUri); + assertThat(handler.determineTargetUrl(request, new MockHttpServletResponse())).isEqualTo("/"); + } + @Test void onAuthenticationSuccess_noSavedRequest_hasRelayStateUrl_notWhitelisted() throws Exception { String redirectUri = "https://test.com/test2"; diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneResolvingFilterZonePathTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneResolvingFilterZonePathTests.java index 154a88f20bf..4535ad6e2c5 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneResolvingFilterZonePathTests.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneResolvingFilterZonePathTests.java @@ -171,6 +171,34 @@ void pathSubdomainAndDefaultZoneHost_continuesWithPathSubdomain() throws Excepti assertThat(chainInvoked.get()).isTrue(); assertThat(zoneInHolderWhenChainInvoked.get().getSubdomain()).isEqualTo("pathzone"); } + + @Test + void defaultPathAndHostSubdomain_returns400() throws Exception { + request.setAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH, ""); + request.setServerName("hostzone." + ROOT_HOST); + filter.setDefaultInternalHostnames(Collections.singleton(ROOT_HOST)); + + filter.doFilter(request, response, chainThatCapturesHolder()); + + assertThat(response.getStatus()).isEqualTo(MockHttpServletResponse.SC_BAD_REQUEST); + assertThat(response.getErrorMessage()).isEqualTo("Cannot use both subdomain and zone path"); + assertThat(chainInvoked.get()).isFalse(); + } + + @Test + void defaultPathAndDefaultZoneHost_continuesWithDefaultZone() throws Exception { + request.setAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH, ""); + request.setServerName(ROOT_HOST); + filter.setDefaultInternalHostnames(Collections.singleton(ROOT_HOST)); + IdentityZone uaaZone = IdentityZone.getUaa(); + when(dao.retrieveBySubdomain(eq(""))).thenReturn(uaaZone); + + filter.doFilter(request, response, chainThatCapturesHolder()); + + assertThat(response.getStatus()).isEqualTo(MockHttpServletResponse.SC_OK); + assertThat(chainInvoked.get()).isTrue(); + assertThat(zoneInHolderWhenChainInvoked.get()).isEqualTo(uaaZone); + } } // ---------- Path-based: the host must still be recognized when root domains are configured ---------- diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/zone/ZonePathContextRewritingFilterTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/zone/ZonePathContextRewritingFilterTests.java index 20b97272aca..9f81fd98cdd 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/zone/ZonePathContextRewritingFilterTests.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/zone/ZonePathContextRewritingFilterTests.java @@ -109,7 +109,7 @@ void pathWithEmptySubdomainSegment_rejectsWithBadRequest() throws Exception { } @Test - void pathWithDefaultZonePrefix_withContextPath_rewritesToIncludeZonePathAndDoesNotSetZoneSubdomainFromPath() throws Exception { + void pathWithDefaultZonePrefix_withContextPath_rewritesAndSelectsDefaultZone() throws Exception { request.setContextPath("/uaa"); request.setRequestURI("/uaa" + ZONE_PATH_PREFIX + DEFAULT_ZONE_SUBDOMAIN_PATH + "/login"); request.setServerName("localhost"); @@ -125,12 +125,12 @@ void pathWithDefaultZonePrefix_withContextPath_rewritesToIncludeZonePathAndDoesN assertThat(passed.getServletPath()).isEqualTo("/login"); assertThat(passed.getRequestURI()).isEqualTo("/uaa/z/" + DEFAULT_ZONE_SUBDOMAIN_PATH + "/login"); assertThat(passed.getPathInfo()).isNull(); - assertThat(passed.getAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH)).isNull(); + assertThat(passed.getAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH)).isEqualTo(""); assertThat(passed.getAttribute(ZonePathContextRewritingFilter.ZONE_ORIGINAL_CONTEXT_PATH)).isEqualTo("/uaa"); } @Test - void pathWithDefaultZonePrefix_withoutContextPath_rewritesToIncludeZonePathAndDoesNotSetZoneSubdomainFromPath() throws Exception { + void pathWithDefaultZonePrefix_withoutContextPath_rewritesAndSelectsDefaultZone() throws Exception { request.setContextPath(""); request.setRequestURI(ZONE_PATH_PREFIX + DEFAULT_ZONE_SUBDOMAIN_PATH + "/login"); request.setServerName("localhost"); @@ -144,7 +144,7 @@ void pathWithDefaultZonePrefix_withoutContextPath_rewritesToIncludeZonePathAndDo assertThat(passed.getContextPath()).isEqualTo("/z/" + DEFAULT_ZONE_SUBDOMAIN_PATH); assertThat(passed.getServletPath()).isEqualTo("/login"); assertThat(passed.getRequestURI()).isEqualTo("/z/" + DEFAULT_ZONE_SUBDOMAIN_PATH + "/login"); - assertThat(passed.getAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH)).isNull(); + assertThat(passed.getAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH)).isEqualTo(""); assertThat(passed.getAttribute(ZonePathContextRewritingFilter.ZONE_ORIGINAL_CONTEXT_PATH)).isEqualTo(""); } @@ -160,7 +160,7 @@ void pathWithDefaultZonePrefix_DEFAULT_caseInsensitive_rewritesSameAsLowercase() assertThat(passed.getContextPath()).isEqualTo("/uaa/z/" + DEFAULT_ZONE_SUBDOMAIN_PATH); assertThat(passed.getServletPath()).isEqualTo("/profile"); assertThat(passed.getRequestURI()).isEqualTo("/uaa/z/" + DEFAULT_ZONE_SUBDOMAIN_PATH + "/profile"); - assertThat(passed.getAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH)).isNull(); + assertThat(passed.getAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH)).isEqualTo(""); } @Test @@ -176,7 +176,7 @@ void pathWithDefaultZonePrefix_trailingSlash_rewritesWithServletPathEmptyAndPath assertThat(passed.getServletPath()).isEmpty(); assertThat(passed.getPathInfo()).isEqualTo("/"); assertThat(passed.getRequestURI()).isEqualTo("/uaa/z/" + DEFAULT_ZONE_SUBDOMAIN_PATH + "/"); - assertThat(passed.getAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH)).isNull(); + assertThat(passed.getAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH)).isEqualTo(""); } @Test diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcTests.java index 53fc87628d6..d59c95eacf7 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcTests.java @@ -8,7 +8,6 @@ import org.junit.jupiter.api.AfterEach; import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Nested; -import org.junit.jupiter.api.Test; import org.junit.jupiter.params.ParameterizedTest; import org.junit.jupiter.params.provider.NullSource; import org.junit.jupiter.params.provider.ValueSource; @@ -116,6 +115,19 @@ void generateCodeWithoutIntent(String intent) throws Exception { assertThat(jdbcTemplate.queryForObject("select count(*) from expiring_code_store", Integer.class)).isZero(); } + @ParameterizedTest + @ValueSource(strings = {"/Codes", "/Codes/"}) + void generateCodeWithNullBody(String url) throws Exception { + mockMvc.perform(post(url) + .header("Authorization", "Bearer " + loginToken) + .contentType(APPLICATION_JSON) + .accept(MediaType.APPLICATION_JSON) + .content("null")) + .andExpect(status().isBadRequest()); + + assertThat(jdbcTemplate.queryForObject("select count(*) from expiring_code_store", Integer.class)).isZero(); + } + @ParameterizedTest @ValueSource(strings = {"/Codes", "/Codes/"}) void generateCodeWithInvalidScope(String url) throws Exception { diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcZonePathTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcZonePathTests.java index 45f54f99def..458b0a79f0f 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcZonePathTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcZonePathTests.java @@ -12,7 +12,6 @@ import org.junit.jupiter.api.AfterEach; import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Nested; -import org.junit.jupiter.api.Test; import org.junit.jupiter.params.ParameterizedTest; import org.junit.jupiter.params.provider.EnumSource; import org.junit.jupiter.params.provider.NullSource; @@ -129,6 +128,19 @@ void generateCodeWithoutIntent(String intent) throws Exception { assertThat(jdbcTemplate.queryForObject("select count(*) from expiring_code_store", Integer.class)).isZero(); } + @ParameterizedTest + @ValueSource(strings = {"/Codes", "/Codes/"}) + void generateCodeWithNullBody(String url) throws Exception { + mockMvc.perform(post(url) + .header("Authorization", "Bearer " + loginToken) + .contentType(APPLICATION_JSON) + .accept(MediaType.APPLICATION_JSON) + .content("null")) + .andExpect(status().isBadRequest()); + + assertThat(jdbcTemplate.queryForObject("select count(*) from expiring_code_store", Integer.class)).isZero(); + } + @ParameterizedTest @ValueSource(strings = {"/Codes", "/Codes/"}) void generateCodeWithInvalidScope(String url) throws Exception { diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/PasswordResetEndpointMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/PasswordResetEndpointMockMvcTests.java index 1ff7ba8ea95..544b72f9f73 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/PasswordResetEndpointMockMvcTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/PasswordResetEndpointMockMvcTests.java @@ -19,10 +19,12 @@ import org.cloudfoundry.identity.uaa.util.JsonUtils; import org.cloudfoundry.identity.uaa.zone.IdentityZone; import org.cloudfoundry.identity.uaa.zone.IdentityZoneHolder; +import org.cloudfoundry.identity.uaa.zone.MultitenantJdbcClientDetailsService; import org.junit.jupiter.api.AfterEach; import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.mock.web.MockHttpSession; import org.springframework.test.web.servlet.MockMvc; import org.springframework.test.web.servlet.MvcResult; import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder; @@ -34,6 +36,7 @@ import java.util.HashMap; import java.util.Map; import java.util.Objects; +import java.util.Set; import java.util.regex.Matcher; import java.util.regex.Pattern; @@ -168,42 +171,61 @@ void changePasswordWithClientidAndRedirecturi() throws Exception { @Test void changePasswordDoWithClientidAndRedirecturi() throws Exception { - String code = getExpiringCode(mockMvc, "app", "http://localhost:8080/app/", loginToken, scimUser); - String email = scimUser.getUserName(); - - MockHttpServletRequestBuilder get = get("/reset_password") - .param("code", code) - .param("email", email); - - MvcResult result = mockMvc.perform(get) - .andExpect(status().isOk()) - .andReturn(); - assertThat(result.getResponse().getContentAsString()) - .contains("".formatted(email)); - - String resultingCodeString = getCodeFromPage(result); - - MockHttpServletRequestBuilder post = post("/reset_password.do") - .param("code", resultingCodeString) - .param("email", email) - .param("password", "newpass") - .param("password_confirmation", "newpass") - .with(cookieCsrf()); - - MvcResult resetResult = mockMvc.perform(post) - .andExpect(status().is3xxRedirection()) - .andReturn(); - assertRedirectsToLoginWithSingleFormRedirectUri(resetResult.getResponse().getRedirectedUrl(), "http://localhost:8080/app/"); - - post = post("/login.do") - .param("username", scimUser.getUserName()) - .param("password", "newpass") - .param("form_redirect_uri", "http://localhost:8080/app/") - .with(cookieCsrf()); - - mockMvc.perform(post) - .andExpect(status().is3xxRedirection()) - .andExpect(redirectedUrl("http://localhost:8080/app/")); + String clientId = "password-reset-" + generator.generate(); + String redirectUri = "https://client.example.com/callback"; + MultitenantJdbcClientDetailsService clientDetailsService = + webApplicationContext.getBean(MultitenantJdbcClientDetailsService.class); + clientDetailsService.addClientDetails( + MockMvcUtils.getClientDetailsModification( + clientId, + "secret", + Collections.singleton("oauth"), + Collections.singleton("uaa.none"), + Collections.singleton("authorization_code"), + "uaa.none", + Set.of(redirectUri)), + IdentityZoneHolder.get().getId()); + try { + String code = getExpiringCode(mockMvc, clientId, redirectUri, loginToken, scimUser); + String email = scimUser.getUserName(); + + MockHttpServletRequestBuilder get = get("/reset_password") + .param("code", code) + .param("email", email); + + MvcResult result = mockMvc.perform(get) + .andExpect(status().isOk()) + .andReturn(); + assertThat(result.getResponse().getContentAsString()) + .contains("".formatted(email)); + + String resultingCodeString = getCodeFromPage(result); + + MockHttpServletRequestBuilder post = post("/reset_password.do") + .param("code", resultingCodeString) + .param("email", email) + .param("password", "newpass") + .param("password_confirmation", "newpass") + .with(cookieCsrf()); + + MvcResult resetResult = mockMvc.perform(post) + .andExpect(status().is3xxRedirection()) + .andReturn(); + assertRedirectsToLoginWithSingleFormRedirectUri(resetResult.getResponse().getRedirectedUrl(), redirectUri); + + post = post("/login.do") + .session((MockHttpSession) resetResult.getRequest().getSession()) + .param("username", scimUser.getUserName()) + .param("password", "newpass") + .param("form_redirect_uri", redirectUri) + .with(cookieCsrf()); + + mockMvc.perform(post) + .andExpect(status().is3xxRedirection()) + .andExpect(redirectedUrl(redirectUri)); + } finally { + clientDetailsService.removeClientDetails(clientId, IdentityZoneHolder.get().getId()); + } } @Test From 4f3054990dd021ec824a11aa0520fa9f1e67fed6 Mon Sep 17 00:00:00 2001 From: Filip Hanik Date: Fri, 6 Nov 2026 08:01:37 -0800 Subject: [PATCH 10/10] fix: opening an old activation code for a user of another origin only verifies the user An activation code issued before codes carried the user_provisioned marker takes the self-service path. That path ends in a reset code that is looked up by username in the uaa origin, so for a user of another origin it could be the reset code of a different account with the same username. Completing activation for a user whose origin is not uaa now only verifies the user, as it did before the self-service path existed: no password change and no reset code. --- .../account/EmailAccountCreationService.java | 6 ++-- .../EmailAccountCreationServiceTests.java | 21 +++++++++++++ .../login/AccountsControllerMockMvcTests.java | 30 +++++++++++++++++++ 3 files changed, 55 insertions(+), 2 deletions(-) diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java index 56c2b4c8ea2..e9b75de15e2 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java @@ -137,9 +137,11 @@ public AccountCreationResponse completeActivation(String code) { return new AccountCreationResponse(user.getId(), user.getUserName(), user.getUserName(), getRedirect(clientId, redirectUri)); } - if (Boolean.parseBoolean(data.get(ScimUtils.USER_PROVISIONED))) { + if (Boolean.parseBoolean(data.get(ScimUtils.USER_PROVISIONED)) || !OriginKeys.UAA.equals(user.getOrigin())) { // The code was requested through the user API, so a caller that may create users set the password. - // Opening the link only has to verify the email address. + // Opening the link only has to verify the email address. The same goes for a user of another origin, + // whose password is not managed here: the reset code below is looked up by username in the uaa origin, + // so it could belong to a different account. user = scimUserProvisioning.verifyUser(user.getId(), user.getVersion(), zoneId); return new AccountCreationResponse(user.getId(), user.getUserName(), user.getUserName(), getRedirect(clientId, redirectUri)); } diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java index 03c86c8e51d..390bccd3cb2 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java @@ -371,6 +371,27 @@ void concurrentActivationThatLosesTheVerificationRaceDoesNotIssueAResetCode() { assertThat(accountCreation.getPasswordResetCode()).isNull(); } + @Test + void completeActivationForAnExternalUserOnlyVerifiesTheUser() { + setUpForSuccess(""); + user.setOrigin("some-external-origin"); + when(mockCodeStore.retrieveCode("the_secret_code", currentIdentityZoneId)).thenReturn(code); + when(mockScimUserProvisioning.retrieve(anyString(), eq(currentIdentityZoneId))).thenReturn(user); + when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(currentIdentityZoneId))).thenReturn(user); + when(mockClientDetailsService.loadClientByClientId(anyString(), anyString())).thenReturn(mockClientDetails); + + AccountCreationService.AccountCreationResponse accountCreation = emailAccountCreationService.completeActivation("the_secret_code"); + + // The code carries no marker, as codes issued before the marker existed. The self-service steps + // work on accounts of the uaa origin, and the reset code is looked up by username, so for another + // origin it could belong to a different account with that username. Only the user from the code is verified. + verify(mockScimUserProvisioning).verifyUser(eq("newly-created-user-id"), anyInt(), eq(currentIdentityZoneId)); + verify(mockScimUserProvisioning, never()).changePassword(anyString(), any(), anyString(), anyString()); + verify(mockScimUserProvisioning, never()).updatePasswordChangeRequired(anyString(), anyBoolean(), anyString()); + verifyNoInteractions(mockResetPasswordService); + assertThat(accountCreation.getPasswordResetCode()).isNull(); + } + @Test void completeActivation_usesAntPathMatching() { setUpForSuccess("http://redirect.uri/"); diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java index 2bbf546ceb3..8b9ce345a10 100644 --- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java +++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java @@ -7,6 +7,7 @@ import org.cloudfoundry.identity.uaa.account.EmailAccountCreationService; import org.cloudfoundry.identity.uaa.authentication.UaaPrincipal; import org.cloudfoundry.identity.uaa.client.UaaClientDetails; +import org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType; import org.cloudfoundry.identity.uaa.codestore.JdbcExpiringCodeStore; import org.cloudfoundry.identity.uaa.constants.OriginKeys; import org.cloudfoundry.identity.uaa.login.test.MockMvcTestClient; @@ -47,7 +48,9 @@ import org.springframework.web.util.UriComponents; import org.springframework.web.util.UriComponentsBuilder; +import java.sql.Timestamp; import java.util.Collections; +import java.util.Map; import org.springframework.web.util.UriUtils; import static org.assertj.core.api.Assertions.assertThat; @@ -493,6 +496,33 @@ void openingAnotherActivationLinkAfterPasswordSetupKeepsThePassword() throws Exc .andExpect(authenticated()); } + @Test + void openingAnOldActivationCodeOfAnExternalUserLeavesTheAccountWithTheSameUsernameAlone() throws Exception { + String zoneId = IdentityZoneHolder.get().getId(); + JdbcScimUserProvisioning provisioning = webApplicationContext.getBean(JdbcScimUserProvisioning.class); + createVerifiedUaaUser(userEmail); + + ScimUser external = new ScimUser(null, userEmail, "Given", "Family"); + external.setPrimaryEmail(userEmail); + external.setOrigin("some-external-origin"); + external.setVerified(false); + external = provisioning.createUser(external, "", zoneId); + + // a code from the user API issued before codes carried a marker + String code = webApplicationContext.getBean(JdbcExpiringCodeStore.class).generateCode( + JsonUtils.writeValueAsString(Map.of("user_id", external.getId(), "email", userEmail)), + new Timestamp(System.currentTimeMillis() + 60_000), ExpiringCodeType.REGISTRATION.name(), zoneId).getCode(); + + // the external user is verified; no reset code is issued for the uaa account with the same username + mockMvc.perform(get("/verify_user").param("code", code)) + .andExpect(status().isFound()) + .andExpect(redirectedUrl("/login?success=verify_success")); + assertThat(provisioning.retrieve(external.getId(), zoneId).isVerified()).isTrue(); + + loginWithAccount("") + .andExpect(authenticated()); + } + @Test void creatingAnAccountWithAnEmptyClientId() throws Exception { PredictableGenerator generator = new PredictableGenerator();