Package jetbrains.buildServer.serverSide.auth.impl

Class SecureTwoFactorPasswordManager

java.lang.Object

jetbrains.buildServer.serverSide.auth.impl.SecureTwoFactorPasswordManager

All Implemented Interfaces:

TwoFactorPasswordManager

public class SecureTwoFactorPasswordManager
extends Object
implements TwoFactorPasswordManager

Constructor Summary

Constructors

Constructor	Description
SecureTwoFactorPasswordManager(TwoFactorPasswordManager delegate, SecurityContextEx securityContext)

Method Summary

Modifier and Type	Method	Description
UUID	addDraftCredentials(SUser user, String secretKey, Set<String> recoveryKeys)	Adds new 2FA credentials (secret key and recovery keys) to be confirmed.
void	confirmSecretKey(SUser user, UUID uuid, int password)	Attempts to confirm 2FA credentials (secret key and recovery keys) for given user.
void	disable2FA(SUser user)	Disables 2FA for given user.
Date	getGracePeriodExpirationDate(SUser user)	Returns expiration date of user's grace period.
boolean	hasEnabled2FA(User user)	Checks whether provided user has enabled 2FA.
boolean	is2FAMandatoryForUser(SUser user)	Returns true when 2FA is mandatory for user.
void	refreshGracePeriod(SUser user)	Refreshes grace period for given user, when they can login without 2FA.
void	setRecoveryKeys(SUser user, Set<String> keys)	Receives plaintext recovery keys, hashes and adds new recovery keys for provided user.
boolean	shouldAsk2FA(SUser user)	Returns whether 2FA completion should be asked for provided user.
boolean	userBelongsToMandatory2FAGroup(SUser user)	Returns true when user belongs to mandatory 2FA group, false otherwise.
boolean	validatePassword(User user, int password)	Checks that user has provided correct TOTP password during login attempt.
boolean	validateRecoveryKey(SUser user, String key)	Checks that user has provided correct recovery key during login attempt.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface jetbrains.buildServer.serverSide.auth.TwoFactorPasswordManager

hasActiveGracePeriod

Constructor Detail

SecureTwoFactorPasswordManager

public SecureTwoFactorPasswordManager(@NotNull
                                      TwoFactorPasswordManager delegate,
                                      @NotNull
                                      SecurityContextEx securityContext)

Method Detail

validatePassword

public boolean validatePassword(@NotNull
                                User user,
                                int password)

Description copied from interface: TwoFactorPasswordManager

Checks that user has provided correct TOTP password during login attempt.

Specified by:

validatePassword in interface TwoFactorPasswordManager

Parameters:

user - user to authenticate

password - TOTP password defined by six digits

Returns:

true if password is correct, false otherwise

setRecoveryKeys

public void setRecoveryKeys(@NotNull
                            SUser user,
                            @NotNull
                            Set<String> keys)

Description copied from interface: TwoFactorPasswordManager

Receives plaintext recovery keys, hashes and adds new recovery keys for provided user. Old keys are discarded and no longer valid.

Specified by:

setRecoveryKeys in interface TwoFactorPasswordManager

Parameters:

user - user

keys - new set of recovery keys

validateRecoveryKey

public boolean validateRecoveryKey(@NotNull
                                   SUser user,
                                   @NotNull
                                   String key)

Description copied from interface: TwoFactorPasswordManager

Checks that user has provided correct recovery key during login attempt. If provided key exists, returns true and removes it (each key can be used only once).

Specified by:

validateRecoveryKey in interface TwoFactorPasswordManager

Parameters:

user - user to authenticate

key - recovery key

Returns:

true if recovery key is correct, false otherwise

disable2FA

public void disable2FA(@NotNull
                       SUser user)

Description copied from interface: TwoFactorPasswordManager

Disables 2FA for given user. Removes secret key and recovery keys

Specified by:

disable2FA in interface TwoFactorPasswordManager

Parameters:

user - user

hasEnabled2FA

public boolean hasEnabled2FA(@NotNull
                             User user)

Description copied from interface: TwoFactorPasswordManager

Checks whether provided user has enabled 2FA. 2FA is enabled if user has generated and confirmed secret key

Specified by:

hasEnabled2FA in interface TwoFactorPasswordManager

Parameters:

user - user

Returns:

true if user has set up 2FA, false otherwise

shouldAsk2FA

public boolean shouldAsk2FA(@NotNull
                            SUser user)

Description copied from interface: TwoFactorPasswordManager

Returns whether 2FA completion should be asked for provided user. For example, in difference to TwoFactorPasswordManager.hasEnabled2FA(User), returns true if user has not enabled 2FA and does not have grace period.

Specified by:

shouldAsk2FA in interface TwoFactorPasswordManager

Parameters:

user - user

Returns:

true if 2FA check is required for given user, false otherwise

refreshGracePeriod

public void refreshGracePeriod(@NotNull
                               SUser user)

Description copied from interface: TwoFactorPasswordManager

Refreshes grace period for given user, when they can login without 2FA. This setting is applicable only for users without 2FA in mandatory mode. If unapplicable - does nothing. Users with active 2FA should not have active grace period in any case.

Specified by:

refreshGracePeriod in interface TwoFactorPasswordManager

Parameters:

user - user to refresh

getGracePeriodExpirationDate

@Nullable
public Date getGracePeriodExpirationDate(@NotNull
                                         SUser user)

Description copied from interface: TwoFactorPasswordManager

Returns expiration date of user's grace period. If there is no active grace period, returns null instead.

Specified by:

getGracePeriodExpirationDate in interface TwoFactorPasswordManager

Parameters:

user - user

Returns:

date of grace period's expiration, null if user has no active grace period

addDraftCredentials

@NotNull
public UUID addDraftCredentials(@NotNull
                                SUser user,
                                @NotNull
                                String secretKey,
                                @NotNull
                                Set<String> recoveryKeys)

Description copied from interface: TwoFactorPasswordManager

Adds new 2FA credentials (secret key and recovery keys) to be confirmed. Before confirmation, TwoFactorPasswordManager.hasEnabled2FA(User) should return false. Unconfirmed credentials are stored in temporary storage with unique token as a key.

Specified by:

addDraftCredentials in interface TwoFactorPasswordManager

Parameters:

user - owner of unconfirmed credentials

secretKey - secret key

recoveryKeys - recovery keys

Returns:

UUID, which is used for key confirmation

confirmSecretKey

public void confirmSecretKey(@NotNull
                             SUser user,
                             @NotNull
                             UUID uuid,
                             int password)

Description copied from interface: TwoFactorPasswordManager

Attempts to confirm 2FA credentials (secret key and recovery keys) for given user. If the provided password is correct, credentials become bound to user and 2FA is considered enabled.

Specified by:

confirmSecretKey in interface TwoFactorPasswordManager

Parameters:

user - user

uuid - uuid, used to identify the user's unconfirmed credentials

password - 2FA 6-digit password for unconfirmed secret key

is2FAMandatoryForUser

public boolean is2FAMandatoryForUser(@NotNull
                                     SUser user)

Description copied from interface: TwoFactorPasswordManager

Returns true when 2FA is mandatory for user.

Specified by:

is2FAMandatoryForUser in interface TwoFactorPasswordManager

Parameters:

user - user

Returns:

see above

userBelongsToMandatory2FAGroup

public boolean userBelongsToMandatory2FAGroup(@NotNull
                                              SUser user)

Description copied from interface: TwoFactorPasswordManager

Returns true when user belongs to mandatory 2FA group, false otherwise. All members of this group have to set up 2FA before grace period ends, like global "Mandatory" mode.

Specified by:

userBelongsToMandatory2FAGroup in interface TwoFactorPasswordManager

Parameters:

user - user

Returns:

see above