Changeset 8040 for branches/3.19-stable

Timestamp:

Jun 2, 2022, 10:00:56 AM (10 months ago)

Author:

Nicklas Nordborg

Message:

References #2278: Improvements to login page for better extensions

Added a verifyOnly flag to the LoginRequest class which means that the login procedure is aborted after the login information has been verified. This also works when a user is logged in and is needed for the "Switch user" functionality with the first step of the WebAuthn authentication.

Location:

branches/3.19-stable/src/core/net/sf/basedb/core

Files:

• SessionControl.java (modified) (3 diffs)
• authentication/LoginRequest.java (modified) (3 diffs)

branches/3.19-stable/src/core/net/sf/basedb/core/SessionControl.java

@@ -576 +576 @@
     updateLastAccess();
     // Are we already logged in?
-    if (isLoggedIn())
-    {
-      throw new AlreadyLoggedInException(loginInfo.userLogin);
-    }
     if (loginRequest == null) throw new InvalidUseOfNullException("loginRequest");
     if (loginRequest.getLogin() == null) throw new InvalidUseOfNullException("loginRequest.login");
+    if (isLoggedIn() && !loginRequest.isVerifyOnly())
+    {
+      throw new AlreadyLoggedInException(loginInfo.userLogin);
+    }
 
     org.hibernate.Session session = null;
@@ -617 +617 @@
         throw new LoginException(ex.getMessage(), ex);
       }
+      
+      // Return now if the login request is for verification only
+      if (loginRequest.isVerifyOnly()) return;
       
       // The login was ok so far... check device verification
@@ -1298 +1301 @@
     currentContexts.clear();
     allowedClients.clear();
-    sessionSettings.clear();
     loginInfo = null;
   }

branches/3.19-stable/src/core/net/sf/basedb/core/authentication/LoginRequest.java

@@ -24 +24 @@
 import java.util.HashMap;
 import java.util.Map;
+
+import net.sf.basedb.core.SessionControl;
 
 /**
@@ -34 +36 @@
 public class LoginRequest
 {
-
+  private boolean verifyOnly;
   private int userId;
   private String login;
@@ -86 +88 @@
   }
 
+  /**
+    Set a flag to indicate if the login request should only verify
+    the login parameters and not do a full login.
+    @since 3.19.3
+  */
+  public void setVerifyOnly(boolean verifyOnly)
+  {
+    this.verifyOnly = verifyOnly;
+  }
+  
+  /**
+    If this flag is set, the login parameters are only verified and
+    the actual login is aborted. If the verification is successful, the
+    {@link SessionControl#login(LoginRequest)} returns normally, otherwise
+    an exception is thrown.
+    @since 3.19.3
+  */
+  public boolean isVerifyOnly()
+  {
+    return verifyOnly;
+  }
   
   /**