Package org.ametys.plugins.core.authentication

Class MultifactorAuthenticationManager

java.lang.Object

org.ametys.runtime.plugin.component.AbstractLogEnabled

org.ametys.plugins.core.authentication.MultifactorAuthenticationManager

All Implemented Interfaces:

LogEnabled, Disposable, Initializable, Component, Contextualizable, Serviceable

Direct Known Subclasses:

MultifactorAuthenticationManager

public class MultifactorAuthenticationManager
extends AbstractLogEnabled
implements Component, Serviceable, Initializable, Contextualizable, Disposable

The component to handle Multifactor authentication Provides methods to generate, send and check MFA codes

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	MultifactorAuthenticationManager.MultifactorAuthenticationCode	Record to get MFA code and its expiration date

Field Summary

Fields

Modifier and Type	Field	Description
protected Context	_context	The coccon context
protected Map<String,MultifactorAuthenticationCryptoHelper>	_cryptoHelpers	The crypto helpers by user population
protected CurrentUserProvider	_currentUserProvider	The current user provider
protected String	_datasourceId	The id of the data source storing the user's secrets
protected I18nUtils	_i18nUtils	I18n utils
protected ServiceManager	_serviceManager	The service manager
protected SQLDatabaseTypeExtensionPoint	_sqlDatabaseTypeExtensionPoint	The extension point for SQL database types
protected UserManager	_userManager	The user manager
static final String	ROLE	Avalon Role

Constructor Summary

Constructors

Constructor	Description
MultifactorAuthenticationManager()

Method Summary

Modifier and Type	Method	Description
protected I18nizableText	_getMailSubjectPrefix(Request request)	Retrieves the prefix of mail's subject
void	authenticationApplicationForCurrentUser(boolean value)	Activate/deactivate the multifactor authentication by application for the current user.
void	contextualize(Context context)
void	dispose()
MultifactorAuthenticationManager.MultifactorAuthenticationCode	generateMultifactorAuthenticationCode(UserIdentity userIdentity)	Generate the multifactor authentication code
dev.samstevens.totp.qr.QrData	getCurrentUserQrData()	Retrieves the QrData containing the current user secret
int	getEmailCodeDuration()	Email code validity duration
Map<String,Object>	getUserSecretForCurrentUser()	Check if the current user has activated multifactor authentication by application and gets its secret
void	initialize()
void	initializeMFACryptoComponent(UserPopulation userPopulation)	Initialize the MultifactorAuthenticationCryptoHelper for the given user population A key file will be generated for secret encrypting/decrypting
boolean	isAuthenticationApplicationActivated(UserIdentity userIdentity)	Check if the given user has activated multifactor authentication by application
boolean	isValidMultifactorAuthenticationCode(UserIdentity userIdentity, String multifactorAuthenticationCode)	Check if the given code is valid
String	renewSecret(UserIdentity userIdentity)	Creates a new secret for the user
String	renewSecretForCurrentUser()	Creates a new secret for the current user
void	sendMultifactorAuthenticationCodeByMail(Request request, UserIdentity userIdentity, String multifactorAuthenticationCode)	Generate a MFA code and send it by mail to the given user
void	service(ServiceManager manager)

Methods inherited from class org.ametys.runtime.plugin.component.AbstractLogEnabled

getLogger, setLogger

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

ROLE

public static final String ROLE

Avalon Role

_serviceManager

protected ServiceManager _serviceManager

The service manager

_context

protected Context _context

The coccon context

_i18nUtils

protected I18nUtils _i18nUtils

I18n utils

_userManager

protected UserManager _userManager

The user manager

_sqlDatabaseTypeExtensionPoint

protected SQLDatabaseTypeExtensionPoint _sqlDatabaseTypeExtensionPoint

The extension point for SQL database types

_currentUserProvider

protected CurrentUserProvider _currentUserProvider

The current user provider

_cryptoHelpers

protected Map<String,MultifactorAuthenticationCryptoHelper> _cryptoHelpers

The crypto helpers by user population

_datasourceId

protected String _datasourceId

The id of the data source storing the user's secrets

Constructor Details

MultifactorAuthenticationManager

public MultifactorAuthenticationManager()

Method Details

service

public void service(ServiceManager manager)
             throws ServiceException

Specified by:

service in interface Serviceable

Throws:

ServiceException

initialize

public void initialize()
                throws Exception

Specified by:

initialize in interface Initializable

Throws:

Exception

contextualize

public void contextualize(Context context)
                   throws ContextException

Specified by:

contextualize in interface Contextualizable

Throws:

ContextException

dispose

public void dispose()

Specified by:

dispose in interface Disposable

getEmailCodeDuration

public int getEmailCodeDuration()

Email code validity duration

Returns:

The number of seconds

initializeMFACryptoComponent

public void initializeMFACryptoComponent(UserPopulation userPopulation)
                                  throws IllegalStateException

Initialize the MultifactorAuthenticationCryptoHelper for the given user population A key file will be generated for secret encrypting/decrypting

Parameters:

userPopulation - the user population

Throws:

IllegalStateException - If an error occurs during helper setup

generateMultifactorAuthenticationCode

public MultifactorAuthenticationManager.MultifactorAuthenticationCode generateMultifactorAuthenticationCode(UserIdentity userIdentity)
                                                                                                     throws RuntimeException

Generate the multifactor authentication code

Parameters:

userIdentity - the user trying to connect

Returns:

The generated the multifactor authentication code, or null if the code couldn't have bee generated

Throws:

RuntimeException - if an error occurs while getting or generating the secret or generating the MFA code

getUserSecretForCurrentUser

public Map<String,Object> getUserSecretForCurrentUser()

Check if the current user has activated multifactor authentication by application and gets its secret

Returns:

A map with key "active" true if the current user has activated multifactor authentication by application, false otherwise, and key "secret" with its secret

renewSecretForCurrentUser

public String renewSecretForCurrentUser()

Creates a new secret for the current user

Returns:

The new secret

isAuthenticationApplicationActivated

public boolean isAuthenticationApplicationActivated(UserIdentity userIdentity)

Check if the given user has activated multifactor authentication by application

Parameters:

userIdentity - the user identity to check

Returns:

true if the given user has activated multifactor authentication by application, false otherwise

authenticationApplicationForCurrentUser

public void authenticationApplicationForCurrentUser(boolean value)

Activate/deactivate the multifactor authentication by application for the current user.

Parameters:

value - True to activate. False to deactivate

getCurrentUserQrData

public dev.samstevens.totp.qr.QrData getCurrentUserQrData()

Retrieves the QrData containing the current user secret

Returns:

the QrData for the current user

isValidMultifactorAuthenticationCode

public boolean isValidMultifactorAuthenticationCode(UserIdentity userIdentity,
 String multifactorAuthenticationCode)
                                             throws RuntimeException

Check if the given code is valid

Parameters:

userIdentity - the user trying to connect

multifactorAuthenticationCode - the code submitted by the user

Returns:

true if the given code is valid, false otherwise

Throws:

RuntimeException - if an error occurs while getting the secret from the datasource

renewSecret

public String renewSecret(UserIdentity userIdentity)

Creates a new secret for the user

Parameters:

userIdentity - The user to change

Returns:

The new secret

sendMultifactorAuthenticationCodeByMail

public void sendMultifactorAuthenticationCodeByMail(Request request,
 UserIdentity userIdentity,
 String multifactorAuthenticationCode)
                                             throws RuntimeException

Generate a MFA code and send it by mail to the given user

Parameters:

request - the request

userIdentity - the user trying to connect

multifactorAuthenticationCode - the multifactor authentication code to send

Throws:

RuntimeException - if an error occurs while sending the mail with the code

_getMailSubjectPrefix

protected I18nizableText _getMailSubjectPrefix(Request request)

Retrieves the prefix of mail's subject

Parameters:

request - the request

Returns:

the prefix of mail's subject