def update_context_user(self):
# XXX what is this context user???
logger.notice('UPDATE CONTEXT USER CALLED')
raise NotImplementedError('update_context_user UN-implemented')
eppn = self.user.eppn
self.user = self.request.userdb_new.get_user_by_eppn(eppn)
retrieve_modified_ts(self.user, self.request.dashboard_userdb)
def set_email_verified(request, user, new_mail):
"""
Mark an e-mail address as verified on a user.
This process also includes *removing* the e-mail address from any other user
that had it as a verified e-mail address.
:param request: The HTTP request
:param user: The user
:param new_mail: The e-mail address to mark as verified
:type request: pyramid.request.Request
:type user: User
:type new_mail: str | unicode
:return: Status message
:rtype: str | unicode
"""
log.info('Trying to verify mail address for user {!r}.'.format(user))
log.debug('Mail address: {!s}.'.format(new_mail))
# Start by removing the email address from any other user that currently has it (verified)
old_user = request.userdb_new.get_user_by_mail(new_mail, raise_on_missing=False)
steal_count = 0
if old_user and old_user.user_id != user.user_id:
retrieve_modified_ts(old_user, request.dashboard_userdb)
old_user = _remove_mail_from_user(new_mail, old_user)
request.context.save_dashboard_user(old_user)
steal_count = 1
# Add the verified mail address to the requesting user
_add_mail_to_user(new_mail, user)
log.info('Mail address verified for user {!r}.'.format(user))
request.stats.count('verify_mail_stolen', steal_count)
request.stats.count('verify_mail_completed')
return _('Email {obj} verified')
def set_phone_verified(request, user, new_number):
"""
Mark a phone number as verified on a user.
This process also includes *removing* the phone number from any other user
that had it as a verified phone number.
:param request: The HTTP request
:param user: The user
:param new_number: The phone number to mark as verified
:type request: pyramid.request.Request
:type user: User
:type new_number: str | unicode
:return: Status message
:rtype: str | unicode
"""
log.info('Trying to verify phone number for user {!r}.'.format(user))
log.debug('Phone number: {!s}.'.format(new_number))
# Start by removing mobile number from any other user
old_user = request.userdb_new.get_user_by_phone(new_number, raise_on_missing=False)
steal_count = 0
if old_user and old_user.user_id != user.user_id:
retrieve_modified_ts(old_user, request.dashboard_userdb)
_remove_phone_from_user(new_number, old_user)
request.context.save_dashboard_user(old_user)
log.info('Removed phone number from user {!r}.'.format(old_user))
steal_count = 1
# Add the verified mobile number to the requesting user
_add_phone_to_user(new_number, user)
log.info('Phone number verified for user {!r}.'.format(user))
request.stats.count('dashboard/verify_mobile_stolen', steal_count)
request.stats.count('dashboard/verify_mobile_completed', 1)
return _('Phone {obj} verified')
def set_email_verified(request, user, new_mail):
"""
Mark an e-mail address as verified on a user.
This process also includes *removing* the e-mail address from any other user
that had it as a verified e-mail address.
:param request: The HTTP request
:param user: The user
:param new_mail: The e-mail address to mark as verified
:type request: pyramid.request.Request
:type user: User
:type new_mail: str | unicode
:return: Status message
:rtype: str | unicode
"""
log.info('Trying to verify mail address for user {!r}.'.format(user))
log.debug('Mail address: {!s}.'.format(new_mail))
# Start by removing the email address from any other user that currently has it (verified)
old_user = request.userdb_new.get_user_by_mail(new_mail, raise_on_missing=False)
steal_count = 0
if old_user and old_user.user_id != user.user_id:
retrieve_modified_ts(old_user, request.dashboard_userdb)
old_user = _remove_mail_from_user(new_mail, old_user)
request.context.save_dashboard_user(old_user)
steal_count = 1
# Add the verified mail address to the requesting user
_add_mail_to_user(new_mail, user)
log.info('Mail address verified for user {!r}.'.format(user))
request.stats.count('dashboard/verify_mail_stolen', steal_count)
request.stats.count('dashboard/verify_mail_completed', 1)
return _('Email {obj} verified')
def update_context_user(self):
# XXX what is this context user???
logger.notice('UPDATE CONTEXT USER CALLED')
raise NotImplementedError('update_context_user UN-implemented')
eppn = self.user.eppn
self.user = self.request.userdb_new.get_user_by_eppn(eppn)
retrieve_modified_ts(self.user, self.request.dashboard_userdb)
def reset_success(self, passwordform):
form_data = self.schema.serialize(passwordform)
hash_code = self.request.matchdict['code']
password_reset = self.request.db.reset_passwords.find_one(
{'hash_code': hash_code})
if password_reset.get('eppn'):
user = self.request.userdb_new.get_user_by_eppn(
password_reset['eppn'])
# Legacy password reset codes were connected to the user by email
elif password_reset.get('email'):
user = self.request.userdb_new.get_user_by_mail(
password_reset['email'])
log.debug("Loaded user {!s} from {!s}".format(user,
self.request.userdb))
if form_data.get('use_custom_password') == 'true':
log.debug(
"Password change for user {!r} (custom password).".format(
user))
new_password = form_data.get('custom_password')
self.request.stats.count('pwreset_custom_password')
else:
log.debug(
"Password change for user {!r} (suggested password).".format(
user))
new_password = self.get_suggested_password()
self.request.stats.count('pwreset_generated_password')
# Make user AL1 if password was reset by e-mail only
if password_reset['mechanism'] == 'email':
nin_count = user.nins.count
if nin_count:
retrieve_modified_ts(user, self.request.dashboard_userdb)
unverify_user_nins(self.request, user)
self.request.stats.count('pwreset_downgraded_NINs', nin_count)
if len(user.phone_numbers.to_list()):
retrieve_modified_ts(user, self.request.dashboard_userdb)
# We need to unverify a users phone numbers to make sure that an attacker can not
# verify the account again without control over the users phone number
# This should be changed to only unverify the phone numbers instead of removing them.
unverify_user_mobiles(self.request, user)
# Save new password
new_password = new_password.replace(' ', '')
ok = change_password(self.request, user, '', new_password)
if ok:
self.request.db.reset_passwords.remove(
{'_id': password_reset['_id']})
self.request.stats.count('pwreset_changed_password')
url = self.request.route_url('profile-editor')
reset = True
else:
self.request.stats.count('pwreset_password_change_failed')
url = self.request.route_url('reset-password')
reset = False
return {'url': url, 'reset': reset}
def set_phone_verified(request, user, new_number):
"""
Mark a phone number as verified on a user.
This process also includes *removing* the phone number from any other user
that had it as a verified phone number.
:param request: The HTTP request
:param user: The user
:param new_number: The phone number to mark as verified
:type request: pyramid.request.Request
:type user: User
:type new_number: str | unicode
:return: Status message
:rtype: str | unicode
"""
log.info('Trying to verify phone number for user {!r}.'.format(user))
log.debug('Phone number: {!s}.'.format(new_number))
# Start by removing mobile number from any other user
old_user = request.userdb_new.get_user_by_phone(new_number, raise_on_missing=False)
steal_count = 0
if old_user and old_user.user_id != user.user_id:
retrieve_modified_ts(old_user, request.dashboard_userdb)
_remove_phone_from_user(new_number, old_user)
request.context.save_dashboard_user(old_user)
log.info('Removed phone number from user {!r}.'.format(old_user))
steal_count = 1
# Add the verified mobile number to the requesting user
_add_phone_to_user(new_number, user)
log.info('Phone number verified for user {!r}.'.format(user))
request.stats.count('verify_mobile_stolen', steal_count)
request.stats.count('verify_mobile_completed')
return _('Phone {obj} verified')
def get_user(self):
logger.debug("Looking for verification code {!r}".format(self.request.matchdict['code']))
verification_code = self.request.db.verifications.find_one({
'code': self.request.matchdict['code'],
})
if verification_code is None:
raise HTTPNotFound()
user = self.request.userdb_new.get_user_by_id(verification_code['user_oid'])
retrieve_modified_ts(user, self.request.dashboard_userdb)
return user
def save_success(self, passwordform):
authn_ts = self.request.session.get('reauthn-for-chpass', None)
if authn_ts is None:
raise HTTPBadRequest(_('No authentication info'))
now = datetime.utcnow()
delta = now - datetime.fromtimestamp(authn_ts)
# XXX put the reauthn timeout in the settings
if int(delta.total_seconds()) > 600:
msg = _('Stale authentication info. Please try again.')
self.request.session.flash('error|' + msg)
raise HTTPFound(self.context.route_url('profile-editor'))
user = get_session_user(self.request)
log.debug('Removing Authn ts for user {!r} before'
' changing the password'.format(user))
del self.request.session['reauthn-for-chpass']
passwords_data = self.schema.serialize(passwordform)
if passwords_data.get('use_custom_password') == 'true':
# The user has entered his own password and it was verified by
# validators
log.debug(
"Password change for user {!r} (custom password).".format(
user))
new_password = passwords_data.get('custom_password')
else:
# If the user has selected the suggested password, then it should
# be in session
log.debug(
"Password change for user {!r} (suggested password).".format(
user))
new_password = self.get_suggested_password()
new_password = new_password.replace(' ', '')
old_password = passwords_data['old_password']
# Load user from database to ensure we are working on an up-to-date set of credentials.
# XXX this refresh is a bit redundant with the same thing being done in OldPasswordValidator.
user = self.request.userdb_new.get_user_by_id(user.user_id)
log.debug("Refreshed user {!s} from {!s}".format(
user, self.request.userdb_new))
retrieve_modified_ts(user, self.request.dashboard_userdb)
self.changed = change_password(self.request, user, old_password,
new_password)
if self.changed:
message = 'success|' + _(
'Your password has been successfully updated')
else:
message = 'error|' + _(
'An error has occured while updating your password, '
'please try again or contact support if the problem persists.')
self.request.session.flash(message)
raise HTTPFound(self.context.route_url('profile-editor'))
def reset_success(self, passwordform):
form_data = self.schema.serialize(passwordform)
hash_code = self.request.matchdict['code']
password_reset = self.request.db.reset_passwords.find_one({'hash_code': hash_code})
if password_reset.get('eppn'):
user = self.request.userdb_new.get_user_by_eppn(password_reset['eppn'])
# Legacy password reset codes were connected to the user by email
elif password_reset.get('email'):
user = self.request.userdb_new.get_user_by_mail(password_reset['email'])
log.debug("Loaded user {!s} from {!s}".format(user, self.request.userdb))
if form_data.get('use_custom_password') == 'true':
log.debug("Password change for user {!r} (custom password).".format(user))
new_password = form_data.get('custom_password')
self.request.stats.count('pwreset_custom_password')
else:
log.debug("Password change for user {!r} (suggested password).".format(user))
new_password = self.get_suggested_password()
self.request.stats.count('pwreset_generated_password')
# Make user AL1 if password was reset by e-mail only
if password_reset['mechanism'] == 'email':
nin_count = user.nins.count
if nin_count:
retrieve_modified_ts(user, self.request.dashboard_userdb)
unverify_user_nins(self.request, user)
self.request.stats.count('pwreset_downgraded_NINs', nin_count)
if len(user.phone_numbers.to_list()):
retrieve_modified_ts(user, self.request.dashboard_userdb)
# We need to unverify a users phone numbers to make sure that an attacker can not
# verify the account again without control over the users phone number
# This should be changed to only unverify the phone numbers instead of removing them.
unverify_user_mobiles(self.request, user)
# Save new password
new_password = new_password.replace(' ', '')
ok = change_password(self.request, user, '', new_password)
if ok:
self.request.db.reset_passwords.remove({'_id': password_reset['_id']})
self.request.stats.count('pwreset_changed_password')
url = self.request.route_url('profile-editor')
reset = True
else:
self.request.stats.count('pwreset_password_change_failed')
url = self.request.route_url('reset-password')
reset = False
return {
'url': url,
'reset': reset
}
def reset_success(self, passwordform):
form_data = self.schema.serialize(passwordform)
hash_code = self.request.matchdict['code']
password_reset = self.request.db.reset_passwords.find_one({'hash_code': hash_code})
user = self.request.userdb_new.get_user_by_mail(password_reset['email'])
log.debug("Loaded user {!s} from {!s}".format(user, self.request.userdb))
if form_data.get('use_custom_password') == 'true':
log.debug("Password change for user {!r} (custom password).".format(user))
new_password = form_data.get('custom_password')
self.request.stats.count('dashboard/pwreset_custom_password', 1)
else:
log.debug("Password change for user {!r} (suggested password).".format(user))
new_password = self.get_suggested_password()
self.request.stats.count('dashboard/pwreset_generated_password', 1)
# Make user AL1 if password was reset by e-mail only
if password_reset['mechanism'] == 'email':
retrieve_modified_ts(user, self.request.dashboard_userdb)
sync_user = False
nin_count = len(user.nins.to_list())
if nin_count:
unverify_user_nins(self.request, user)
sync_user = True
self.request.stats.count('dashboard/pwreset_downgraded_NINs', nin_count)
if len(user.phone_numbers.to_list()):
# We need to unverify a users phone numbers to make sure that an attacker can not
# verify the account again without control over the users phone number
unverify_user_mobiles(self.request, user)
sync_user = True
if sync_user:
# Do not perform a sync if no changes where made, there is a corner case
# where the user has not been created yet
self.request.amrelay.request_sync(user)
# Save new password
new_password = new_password.replace(' ', '')
ok = change_password(self.request, user, '', new_password)
if ok:
self.request.db.reset_passwords.remove({'_id': password_reset['_id']})
self.request.stats.count('dashboard/pwreset_changed_password', 1)
url = self.request.route_url('profile-editor')
reset = True
else:
self.request.stats.count('dashboard/pwreset_password_change_failed', 1)
url = self.request.route_url('reset-password')
reset = False
return {
'url': url,
'reset': reset
}
def sync_user(request, context, old_user):
user = request.userdb.get_user_by_id(old_user.user_id)
if isinstance(user, DashboardUser):
retrieve_modified_ts(user, request.dashboard_userdb)
else:
user.retrieve_modified_ts(request.db.profiles)
if context.workmode == 'personal':
store_session_user(request, user)
else:
store_session_user(request, user, edit_user = True)
return user
def sync_user(request, context, old_user):
user = request.userdb.get_user_by_id(old_user.user_id)
if isinstance(user, DashboardUser):
retrieve_modified_ts(user, request.dashboard_userdb)
else:
user.retrieve_modified_ts(request.db.profiles)
if context.workmode == 'personal':
store_session_user(request, user)
else:
store_session_user(request, user, edit_user=True)
return user
def get_user(self):
logger.debug("Looking for verification code {!r}".format(
self.request.matchdict['code']))
verification_code = self.request.db.verifications.find_one({
'code':
self.request.matchdict['code'],
})
if verification_code is None:
raise HTTPNotFound()
user = self.request.userdb_new.get_user_by_id(
verification_code['user_oid'])
retrieve_modified_ts(user, self.request.dashboard_userdb)
return user
def verify_mb_action(self, data, post_data):
"""
Verify a users identity using their mobile phone subscriber records.
Only the active (the last one) NIN can be verified
"""
nin, index = data.split()
index = int(index)
nins = get_not_verified_nins_list(self.request, self.user)
if len(nins) > index:
new_nin = nins[index]
if new_nin != nin:
return self.sync_user()
else:
return self.sync_user()
# if index != len(nins) - 1:
# message = _("The provided nin can't be verified. You only "
# 'can verify the last one')
# return {
# 'result': 'bad',
# 'message': get_localizer(self.request).translate(message),
# }
validation = validate_nin_by_mobile(self.request, self.user, nin)
result = validation['success'] and 'success' or 'error'
model_name = 'norEduPersonNIN'
if result == 'success':
session_user = get_session_user(self.request, legacy_user = False)
retrieve_modified_ts(session_user, self.request.dashboard_userdb)
set_nin_verified(self.request, session_user, nin)
try:
#self.user.save(self.request)
self.request.context.save_dashboard_user(session_user)
logger.info("Verified by mobile, {!s} saved for user {!r}.".format(model_name, session_user))
# Save the state in the verifications collection
save_as_verified(self.request, 'norEduPersonNIN', session_user, nin)
except UserOutOfSync:
logger.info("Verified {!s} NOT saved for user {!r}. User out of sync.".format(model_name, session_user))
raise
settings = self.request.registry.settings
msg = get_localizer(self.request).translate(validation['message'],
mapping={
'service_name': settings.get('mobile_service_name', 'Navet'),
})
return {
'result': result,
'message': msg,
}
def test_verify_existant_nin_by_mobile(self):
email = self.no_nin_user_email
self.set_logged(email)
user = self.userdb_new.get_user_by_mail(email)
dashboard_user = DashboardUser(data=user.to_dict())
retrieve_modified_ts(dashboard_user, self.dashboard_db)
self.assertEqual(dashboard_user.nins.count, 0)
# Add a verified phone number to the user in the central userdb
dashboard_user.phone_numbers.add(
PhoneNumber(data={
'number': '666666666',
'primary': True,
'verified': True
}))
self.dashboard_db.save(dashboard_user)
# First we add a nin...
nin = '200010100001'
response_form = self.testapp.get('/profile/nins/')
form = response_form.forms[self.formname]
from eduiddashboard.msgrelay import MsgRelay
with patch.multiple(MsgRelay,
nin_validator=return_true,
nin_reachable=return_true):
form['norEduPersonNIN'].value = nin
form.submit('add')
# and then we verify it
self.testapp.get('/profile/nins/')
from eduiddashboard.views import nins
with patch.object(nins, 'validate_nin_by_mobile', clear=True):
nins.validate_nin_by_mobile.return_value = {
'success': True,
'message': u'Ok',
}
response = self.testapp.post('/profile/nins-actions/', {
'identifier': nin + ' 0',
'action': 'verify_mb'
})
response_json = json.loads(response.body)
self.assertEqual(response_json['message'], 'Ok')
user = self.dashboard_db.get_user_by_mail(email)
self.assertEqual(user.nins.count, 1)
self.assertEqual(user.nins.to_list_of_dicts()[0]['number'], nin)
def save_success(self, passwordform):
authn_ts = self.request.session.get('reauthn-for-chpass', None)
if authn_ts is None:
raise HTTPBadRequest(_('No authentication info'))
now = datetime.utcnow()
delta = now - datetime.fromtimestamp(authn_ts)
# XXX put the reauthn timeout in the settings
if int(delta.total_seconds()) > 600:
msg = _('Stale authentication info. Please try again.')
self.request.session.flash('error|' + msg)
raise HTTPFound(self.context.route_url('profile-editor'))
user = get_session_user(self.request)
log.debug('Removing Authn ts for user {!r} before'
' changing the password'.format(user))
del self.request.session['reauthn-for-chpass']
passwords_data = self.schema.serialize(passwordform)
if passwords_data.get('use_custom_password') == 'true':
# The user has entered his own password and it was verified by
# validators
log.debug("Password change for user {!r} (custom password).".format(user))
new_password = passwords_data.get('custom_password')
else:
# If the user has selected the suggested password, then it should
# be in session
log.debug("Password change for user {!r} (suggested password).".format(user))
new_password = self.get_suggested_password()
new_password = new_password.replace(' ', '')
old_password = passwords_data['old_password']
# Load user from database to ensure we are working on an up-to-date set of credentials.
# XXX this refresh is a bit redundant with the same thing being done in OldPasswordValidator.
user = self.request.userdb_new.get_user_by_id(user.user_id)
log.debug("Refreshed user {!s} from {!s}".format(user, self.request.userdb_new))
retrieve_modified_ts(user, self.request.dashboard_userdb)
self.changed = change_password(self.request, user, old_password, new_password)
if self.changed:
message = 'success|' + _('Your password has been successfully updated')
else:
message = 'error|' + _('An error has occured while updating your password, '
'please try again or contact support if the problem persists.')
self.request.session.flash(message)
raise HTTPFound(self.context.route_url('profile-editor'))
def test_verify_existant_nin_by_mobile(self):
email = self.no_nin_user_email
self.set_logged(email)
user = self.userdb_new.get_user_by_mail(email)
dashboard_user = DashboardUser(data=user.to_dict())
retrieve_modified_ts(dashboard_user, self.dashboard_db)
self.assertEqual(dashboard_user.nins.count, 0)
# Add a verified phone number to the user in the central userdb
dashboard_user.phone_numbers.add(PhoneNumber(data={
'number': '666666666',
'primary': True,
'verified': True
}))
self.dashboard_db.save(dashboard_user)
# First we add a nin...
nin = '200010100001'
response_form = self.testapp.get('/profile/nins/')
form = response_form.forms[self.formname]
from eduiddashboard.msgrelay import MsgRelay
with patch.multiple(MsgRelay, nin_validator=return_true,
nin_reachable=return_true):
form['norEduPersonNIN'].value = nin
form.submit('add')
# and then we verify it
self.testapp.get('/profile/nins/')
from eduiddashboard.views import nins
with patch.object(nins, 'validate_nin_by_mobile', clear=True):
nins.validate_nin_by_mobile.return_value = {
'success': True,
'message': u'Ok',
}
response = self.testapp.post(
'/profile/nins-actions/',
{'identifier': nin + ' 0', 'action': 'verify_mb'}
)
response_json = json.loads(response.body)
self.assertEqual(response_json['message'], 'Ok')
user = self.dashboard_db.get_user_by_mail(email)
self.assertEqual(user.nins.count, 1)
self.assertEqual(user.nins.to_list_of_dicts()[0]['number'], nin)
def _search_user(self, text):
"""
Find a user matching email, mobile or NIN.
@param text: search string
@return: user object
"""
if validate_email_format(text):
user = self.request.userdb_new.get_user_by_mail(normalize_email(text), raise_on_missing=True)
elif text.startswith(u'0') or text.startswith(u'+'):
text = normalize_to_e_164(self.request, text)
user = self.request.userdb_new.get_user_by_phone(text)
else:
user = self.request.userdb_new.get_user_by_nin(text)
log.debug("Found user {!r} using input {!s}.".format(user, text))
retrieve_modified_ts(user, self.request.dashboard_userdb)
return user
def _search_user(self, text):
"""
Find a user matching email, mobile or NIN.
@param text: search string
@return: user object
"""
if validate_email_format(text):
user = self.request.userdb_new.get_user_by_mail(
normalize_email(text), raise_on_missing=True)
elif text.startswith(u'0') or text.startswith(u'+'):
text = normalize_to_e_164(self.request, text)
user = self.request.userdb_new.get_user_by_phone(text)
else:
user = self.request.userdb_new.get_user_by_nin(text)
log.debug("Found user {!r} using input {!s}.".format(user, text))
retrieve_modified_ts(user, self.request.dashboard_userdb)
return user
def test_verify_nin_by_mobile(self):
email = self.no_nin_user_email
self.set_logged(email)
user = self.userdb_new.get_user_by_mail(email)
dashboard_user = DashboardUser(data=user.to_dict())
self.assertEqual(user.nins.count, 0)
# Add a verified phone number to the user in the central userdb
dashboard_user.phone_numbers.add(
PhoneNumber(data={
'number': '666666666',
'primary': True,
'verified': True
}))
dashboard_user.modified_ts = None
self.userdb_new.save(dashboard_user)
retrieve_modified_ts(dashboard_user, self.dashboard_db)
self.dashboard_db.save(dashboard_user)
# First we add a nin...
new_nin = '200010100001'
response_form = self.testapp.get('/profile/nins/')
form = response_form.forms[self.formname]
from eduiddashboard.lookuprelay import LookupMobileRelay
with patch.object(LookupMobileRelay, 'find_NIN_by_mobile', clear=True):
LookupMobileRelay.find_NIN_by_mobile.return_value = new_nin
from eduiddashboard.msgrelay import MsgRelay
with patch.object(MsgRelay, 'get_full_postal_address', clear=True):
MsgRelay.get_full_postal_address.return_value = {
'Address2': u'StreetName 104',
'PostalCode': u'74142',
'City': u'STOCKHOLM',
}
form['norEduPersonNIN'].value = new_nin
form.submit('add_by_mobile')
user = self.dashboard_db.get_user_by_mail(email)
self.assertEqual(user.nins.count, 1)
self.assertEqual(user.nins.primary.number, new_nin)
def _get_user_by_eppn(request, eppn, legacy_user):
"""
Fetch a user in either legacy format or the new eduid_userdb.User format.
:param request: Pyramid request object
:param eppn: eduPersonPrincipalName
:param legacy_user: Use old format or not
:type eppn: str | unicode
:type legacy_user: bool
:return: DashboardUser
:rtype: eduid_userdb.User | eduid_userdb.dashboard.DashboardLegacyUser
"""
if legacy_user:
user = request.userdb.get_user_by_eppn(eppn)
logger.debug('Loading modified_ts from dashboard db (profiles) for user {!r}'.format(user))
user.retrieve_modified_ts(request.db.profiles)
return user
user = request.userdb_new.get_user_by_eppn(eppn)
retrieve_modified_ts(user, request.dashboard_userdb)
return user
def change_password(request, user, old_password, new_password):
"""
Change the user password, deleting old credentials
@param request: Request object
@param user: User object
@param old_password: Old password, if supplied (i.e. not a password reset)
@param new_password: New password
@type request: Request
@type user: User
@type old_password: str or unicode or None
"""
vccs_url = request.registry.settings.get('vccs_url')
log.debug("Changing password user {!s}\nTIMESTAMP 1 {!s}".format(user, user.modified_ts))
added = add_credentials(vccs_url, old_password, new_password, user)
log.debug("Changing password user {!s}\nTIMESTAMP 2 {!s}".format(user, user.modified_ts))
if added:
retrieve_modified_ts(user, request.dashboard_userdb)
user.terminated = False
request.context.save_dashboard_user(user)
return added
def test_verify_nin_by_mobile(self):
email = self.no_nin_user_email
self.set_logged(email)
user = self.userdb_new.get_user_by_mail(email)
dashboard_user = DashboardUser(data=user.to_dict())
self.assertEqual(user.nins.count, 0)
# Add a verified phone number to the user in the central userdb
dashboard_user.phone_numbers.add(PhoneNumber(data={
'number': '666666666',
'primary': True,
'verified': True
}))
dashboard_user.modified_ts = None
self.userdb_new.save(dashboard_user)
retrieve_modified_ts(dashboard_user, self.dashboard_db)
self.dashboard_db.save(dashboard_user)
# First we add a nin...
new_nin = '200010100001'
response_form = self.testapp.get('/profile/nins/')
form = response_form.forms[self.formname]
from eduiddashboard.lookuprelay import LookupMobileRelay
with patch.object(LookupMobileRelay, 'find_NIN_by_mobile', clear=True):
LookupMobileRelay.find_NIN_by_mobile.return_value = new_nin
from eduiddashboard.msgrelay import MsgRelay
with patch.object(MsgRelay, 'get_full_postal_address', clear=True):
MsgRelay.get_full_postal_address.return_value = {
'Address2': u'StreetName 104',
'PostalCode': u'74142',
'City': u'STOCKHOLM',
}
form['norEduPersonNIN'].value = new_nin
form.submit('add_by_mobile')
user = self.dashboard_db.get_user_by_mail(email)
self.assertEqual(user.nins.count, 1)
self.assertEqual(user.nins.primary.number, new_nin)
def set_nin_verified(request, user, new_nin, reference=None):
"""
Mark a National Identity Number (NIN) as verified on a user.
This process also includes *removing* the NIN from any other user
that had it as a verified NIN.
:param request: The HTTP request
:param user: The user
:param new_nin: The National Identity Number to mark as verified
:param reference: A reference to the verification code - used for audit logging
:type request: pyramid.request.Request
:type user: User
:type new_nin: str | unicode
:return: Status message
:rtype: str | unicode
"""
log.info('Trying to verify NIN for user {!r}.'.format(user))
log.debug('NIN: {!s}.'.format(new_nin))
# Start by removing nin from any other user
old_user = request.userdb_new.get_user_by_nin(new_nin, raise_on_missing=False)
log.debug('Searched for NIN {!r} in {!s}: {!r}'.format(new_nin, request.userdb_new, old_user))
steal_count = 0
if old_user and old_user.user_id != user.user_id:
retrieve_modified_ts(old_user, request.dashboard_userdb)
_remove_nin_from_user(new_nin, old_user)
request.context.save_dashboard_user(old_user)
log.info('Removed NIN and associated addresses from user {!r}.'.format(old_user))
steal_count = 1
# Add the verified nin to the requesting user
_add_nin_to_user(new_nin, user)
_nin_verified_transaction_audit(request, reference)
log.info('NIN verified for user {!r}.'.format(user))
request.stats.count('dashboard/verify_nin_stolen', steal_count)
request.stats.count('dashboard/verify_nin_completed', 1)
return _('National identity number {obj} verified')
def set_nin_verified(request, user, new_nin, reference=None):
"""
Mark a National Identity Number (NIN) as verified on a user.
This process also includes *removing* the NIN from any other user
that had it as a verified NIN.
:param request: The HTTP request
:param user: The user
:param new_nin: The National Identity Number to mark as verified
:param reference: A reference to the verification code - used for audit logging
:type request: pyramid.request.Request
:type user: User
:type new_nin: str | unicode
:return: Status message
:rtype: str | unicode
"""
log.info('Trying to verify NIN for user {!r}.'.format(user))
log.debug('NIN: {!s}.'.format(new_nin))
# Start by removing nin from any other user
old_user = request.userdb_new.get_user_by_nin(new_nin, raise_on_missing=False)
log.debug('Searched for NIN {!r} in {!s}: {!r}'.format(new_nin, request.userdb_new, old_user))
steal_count = 0
if old_user and old_user.user_id != user.user_id:
retrieve_modified_ts(old_user, request.dashboard_userdb)
_remove_nin_from_user(new_nin, old_user)
request.context.save_dashboard_user(old_user)
log.info('Removed NIN and associated addresses from user {!r}.'.format(old_user))
steal_count = 1
# Add the verified nin to the requesting user
_add_nin_to_user(new_nin, user)
_nin_verified_transaction_audit(request, reference)
log.info('NIN verified for user {!r}.'.format(user))
request.stats.count('verify_nin_stolen', steal_count)
request.stats.count('verify_nin_completed')
return _('National identity number {obj} verified')
def change_password(request, user, old_password, new_password):
"""
Change the user password, deleting old credentials
@param request: Request object
@param user: User object
@param old_password: Old password, if supplied (i.e. not a password reset)
@param new_password: New password
@type request: Request
@type user: User
@type old_password: str or unicode or None
"""
vccs_url = request.registry.settings.get('vccs_url')
log.debug("Changing password user {!s}\nTIMESTAMP 1 {!s}".format(
user, user.modified_ts))
added = add_credentials(vccs_url, old_password, new_password, user)
log.debug("Changing password user {!s}\nTIMESTAMP 2 {!s}".format(
user, user.modified_ts))
if added:
retrieve_modified_ts(user, request.dashboard_userdb)
user.terminated = False
request.context.save_dashboard_user(user)
return added
def _get_user_by_eppn(request, eppn, legacy_user):
"""
Fetch a user in either legacy format or the new eduid_userdb.User format.
:param request: Pyramid request object
:param eppn: eduPersonPrincipalName
:param legacy_user: Use old format or not
:type eppn: str | unicode
:type legacy_user: bool
:return: DashboardUser
:rtype: eduid_userdb.User | eduid_userdb.dashboard.DashboardLegacyUser
"""
if legacy_user:
user = request.userdb.get_user_by_eppn(eppn)
logger.debug(
'Loading modified_ts from dashboard db (profiles) for user {!r}'.
format(user))
user.retrieve_modified_ts(request.db.profiles)
return user
user = request.userdb_new.get_user_by_eppn(eppn)
retrieve_modified_ts(user, request.dashboard_userdb)
return user
def add_success_other(self, ninform):
newnin = self.schema.serialize(ninform)
newnin = newnin['norEduPersonNIN']
newnin = normalize_nin(newnin)
old_user = self.request.db.profiles.find_one({
'norEduPersonNIN': newnin
})
if old_user:
old_user = DashboardUser(data=old_user)
retrieve_modified_ts(old_user, self.request.dashboard_userdb)
old_user.nins.remove(newnin)
self.context.save_dashboard_user(old_user)
primary = False
if self.user.nins.count == 0:
primary = True
newnin_obj = Nin(number=newnin, application='dashboard',
verified=True, primary=primary)
self.user.nins.add(newnin_obj)
try:
self.context.save_dashboard_user(self.user)
except UserOutOfSync:
message = _('Your user profile is out of sync. Please '
'reload the page and try again.')
else:
message = _('Your national identity number has been confirmed')
# Save the state in the verifications collection
save_as_verified(self.request, 'norEduPersonNIN', self.user, newnin)
self.request.session.flash(
get_localizer(self.request).translate(message),
queue='forms')
self.request.stats.count('nin_add_other')
def test_reset_password_unterminates_account(self):
email = '*****@*****.**'
# Set up a bunch of faked passwords to make sure they are all revoked
user = self.userdb_new.get_user_by_mail(email)
dashboard_user = DashboardUser(data=user.to_dict())
retrieve_modified_ts(dashboard_user, self.dashboard_db)
for i in range(7):
pw = Password(
credential_id=ObjectId(),
salt=str(i) * 64,
application='dashboard_unittest',
)
dashboard_user.passwords.add(pw)
self.dashboard_db.save(dashboard_user)
logging.log(logging.DEBUG,
"Fetching /profile/security\n\n" + ('-=-' * 30) + "\n\n")
request = self.set_logged(email=email)
response = self.testapp.get('/profile/security/')
form = response.forms['terminate-account-form']
# Verify the user has eight passwords
user = self.dashboard_db.get_user_by_mail(email)
self.assertEqual(
len(user.credentials.filter(Password).to_list_of_dicts()), 8)
logging.log(
logging.DEBUG,
"Submitting termination request\n\n" + ('-=-' * 30) + "\n\n")
form_response = form.submit('submit')
self.assertEqual(form_response.status, '302 Found')
self.assertIn('authn.example.com', form_response.location)
with patch('eduiddashboard.vccs.get_vccs_client'):
from eduiddashboard.vccs import get_vccs_client
get_vccs_client.return_value = FakeVCCSClient(fake_response={
'revoke_creds_response': {
'version': 1,
'success': True,
},
})
with patch('eduiddashboard.views.portal.send_termination_mail'):
from eduiddashboard.views.portal import send_termination_mail
send_termination_mail.return_value = None
store_session_user(request, self.user)
self.set_logged(email=self.user.mail_addresses.primary.email,
extra_session_data={
'reauthn-for-termination': int(time.time())
})
response = self.testapp.get('/profile/account-terminated/')
# Verify the user doesn't have ANY passwords and IS terminated at this point
user = self.dashboard_db.get_user_by_mail(email)
self.assertEqual(user.passwords.count, 0)
self.assertTrue(user.terminated)
logging.log(
logging.DEBUG,
"Password reset of terminated user\n\n" + ('-=-' * 30) + "\n\n")
# Do a password reset, which should resurrect the terminated user
hash_code = '123456'
date = datetime.now(pytz.utc)
self.db.reset_passwords.insert({
'email': email,
'hash_code': hash_code,
'mechanism': 'email',
'created_at': date
})
response = self.testapp.get(
'/profile/reset-password/{0}/'.format(hash_code))
self.assertIn('Please choose a new password for your eduID account',
response.text)
form = response.forms['resetpasswordstep2view-form']
with patch('eduiddashboard.vccs.get_vccs_client'):
from eduiddashboard.vccs import get_vccs_client
get_vccs_client.return_value = FakeVCCSClient()
form.submit('reset')
# Verify the user has a password and is NOT terminated again
user = self.dashboard_db.get_user_by_mail(email)
self.assertEqual(
len(user.credentials.filter(Password).to_list_of_dicts()), 1)
self.assertFalse(user.terminated)
def verify_code(request, model_name, code):
"""
Verify a code and act accordingly to the model_name ('norEduPersonNIN', 'mobile', or 'mailAliases').
This is what turns an unconfirmed NIN/mobile/e-mail into a confirmed one.
:param request: The HTTP request
:param model_name: 'norEduPersonNIN', 'mobile', or 'mailAliases'
:param code: The user supplied code
:type request: pyramid.request.Request
:return: string of verified data
"""
assert model_name in ['norEduPersonNIN', 'phone', 'mailAliases']
this_verification = request.db.verifications.find_one(
{
"model_name": model_name,
"code": code,
})
if not this_verification:
log.error("Could not find verification record for code {!r}, model {!r}".format(code, model_name))
return
reference = unicode(this_verification['_id'])
obj_id = this_verification['obj_id']
if not obj_id:
return None
user = get_session_user(request, legacy_user=False)
retrieve_modified_ts(user, request.dashboard_userdb)
assert_error_msg = 'Requesting users ID does not match verifications user ID'
assert user.user_id == this_verification['user_oid'], assert_error_msg
if model_name == 'norEduPersonNIN':
msg = set_nin_verified(request, user, obj_id, reference)
elif model_name == 'phone':
msg = set_phone_verified(request, user, obj_id)
elif model_name == 'mailAliases':
msg = set_email_verified(request, user, obj_id)
else:
raise NotImplementedError('Unknown validation model_name: {!r}'.format(model_name))
try:
request.context.save_dashboard_user(user)
log.info("Verified {!s} saved for user {!r}.".format(model_name, user))
verified = {
'verified': True,
'verified_timestamp': datetime.utcnow()
}
this_verification.update(verified)
request.db.verifications.update({'_id': this_verification['_id']}, this_verification)
log.info("Code {!r} ({!s}) marked as verified".format(code, obj_id))
except UserOutOfSync:
log.info("Verified {!s} NOT saved for user {!r}. User out of sync.".format(model_name, user))
raise
else:
msg = get_localizer(request).translate(msg)
request.session.flash(msg.format(obj=obj_id), queue='forms')
request.stats.count('dashboard/verify_code_completed', 1)
return obj_id
def test_reset_password_unterminates_account(self):
email = '*****@*****.**'
# Set up a bunch of faked passwords to make sure they are all revoked
user = self.userdb_new.get_user_by_mail(email)
dashboard_user = DashboardUser(data=user.to_dict())
retrieve_modified_ts(dashboard_user, self.dashboard_db)
for i in range(7):
pw = Password(credential_id=ObjectId(),
salt=str(i) * 64,
application='dashboard_unittest',
)
dashboard_user.passwords.add(pw)
self.dashboard_db.save(dashboard_user)
logging.log(logging.DEBUG, "Fetching /profile/security\n\n" + ('-=-' * 30) + "\n\n")
request = self.set_logged(email=email)
response = self.testapp.get('/profile/security/')
form = response.forms['terminate-account-form']
# Verify the user has eight passwords
user = self.dashboard_db.get_user_by_mail(email)
self.assertEqual(len(user.credentials.filter(Password).to_list_of_dicts()), 8)
logging.log(logging.DEBUG, "Submitting termination request\n\n" + ('-=-' * 30) + "\n\n")
form_response = form.submit('submit')
self.assertEqual(form_response.status, '302 Found')
self.assertIn('authn.example.com', form_response.location)
with patch('eduiddashboard.vccs.get_vccs_client'):
from eduiddashboard.vccs import get_vccs_client
get_vccs_client.return_value = FakeVCCSClient(fake_response={
'revoke_creds_response': {
'version': 1,
'success': True,
},
})
with patch('eduiddashboard.views.portal.send_termination_mail'):
from eduiddashboard.views.portal import send_termination_mail
send_termination_mail.return_value = None
store_session_user(request, self.user)
self.set_logged(email = self.user.mail_addresses.primary.email,
extra_session_data = {'reauthn-for-termination': int(time.time())})
response = self.testapp.get('/profile/account-terminated/')
# Verify the user doesn't have ANY passwords and IS terminated at this point
user = self.dashboard_db.get_user_by_mail(email)
self.assertEqual(user.passwords.count, 0)
self.assertTrue(user.terminated)
logging.log(logging.DEBUG, "Password reset of terminated user\n\n" + ('-=-' * 30) + "\n\n")
# Do a password reset, which should resurrect the terminated user
hash_code = '123456'
date = datetime.now(pytz.utc)
self.db.reset_passwords.insert({
'email': email,
'hash_code': hash_code,
'mechanism': 'email',
'created_at': date
})
response = self.testapp.get('/profile/reset-password/{0}/'.format(hash_code))
self.assertIn('Please choose a new password for your eduID account', response.text)
form = response.forms['resetpasswordstep2view-form']
with patch('eduiddashboard.vccs.get_vccs_client'):
from eduiddashboard.vccs import get_vccs_client
get_vccs_client.return_value = FakeVCCSClient()
form.submit('reset')
# Verify the user has a password and is NOT terminated again
user = self.dashboard_db.get_user_by_mail(email)
self.assertEqual(len(user.credentials.filter(Password).to_list_of_dicts()), 1)
self.assertFalse(user.terminated)
def verify_code(request, model_name, code):
"""
Verify a code and act accordingly to the model_name ('norEduPersonNIN', 'phone', or 'mailAliases').
This is what turns an unconfirmed NIN/mobile/e-mail into a confirmed one.
:param request: The HTTP request
:param model_name: 'norEduPersonNIN', 'phone', or 'mailAliases'
:param code: The user supplied code
:type request: pyramid.request.Request
:return: string of verified data
"""
assert model_name in ['norEduPersonNIN', 'phone', 'mailAliases']
this_verification = request.db.verifications.find_one(
{
"model_name": model_name,
"code": code,
})
if not this_verification:
log.error("Could not find verification record for code {!r}, model {!r}".format(code, model_name))
return
reference = unicode(this_verification['_id'])
obj_id = this_verification['obj_id']
if not obj_id:
return None
user = get_session_user(request, legacy_user=False)
retrieve_modified_ts(user, request.dashboard_userdb)
assert_error_msg = 'Requesting users ID does not match verifications user ID'
assert user.user_id == this_verification['user_oid'], assert_error_msg
if model_name == 'norEduPersonNIN':
msg = set_nin_verified(request, user, obj_id, reference)
elif model_name == 'phone':
msg = set_phone_verified(request, user, obj_id)
elif model_name == 'mailAliases':
msg = set_email_verified(request, user, obj_id)
else:
raise NotImplementedError('Unknown validation model_name: {!r}'.format(model_name))
try:
request.context.save_dashboard_user(user)
log.info("Verified {!s} saved for user {!r}.".format(model_name, user))
verified = {
'verified': True,
'verified_timestamp': datetime.utcnow()
}
this_verification.update(verified)
request.db.verifications.update({'_id': this_verification['_id']}, this_verification)
log.info("Code {!r} ({!s}) marked as verified".format(code, obj_id))
except UserOutOfSync:
log.info("Verified {!s} NOT saved for user {!r}. User out of sync.".format(model_name, user))
raise
else:
msg = get_localizer(request).translate(msg)
request.session.flash(msg.format(obj=obj_id), queue='forms')
request.stats.count('verify_code_completed')
return obj_id
