Develop Reference

How does editing a user's role in spring security modify the user's password/access?

When I edit a user's roles through a page in my application it somehow modifies the user's password. I cant for the life of me figure out where I am changing the user's password in my code. I even went so far as to print out the hashed password after I call Save in the user service and they still match! But when I log out and try to log back in with the user's same credentials Spring says the credentials are invalid. Oddly enough, this only happens when I change the roles, if I change just the name or email address the issue doesn't present.
This is my save method in userServiceImpl
#Override
public void save(User user) {
System.out.println("User trying to save");
user.setPassword(bCryptPasswordEncoder.encode(user.getPassword()));
userRepository.save(user);
}
And this is the controller for editing (I know it's a mess and needs to be cleaned up A LOT!)
#PostMapping("/users/edit")
public String editUser(#ModelAttribute("userForm") User user, BindingResult bindingResult, Model model) {
model.addAttribute("highestRole", getHighestRole(user.getUserName(), userService));
model.addAttribute("pageTitle", "AIM - Edit User Id:" + user.getId());
model.addAllAttributes(getUserAttributes());
model.addAttribute("roles", roleRepository.findAll());
userValidator.validate(user, bindingResult);
if (bindingResult.hasErrors()) {
return "user_edit";
}
User userFromDB = userService.findById(user.getId());
if (!user.getFirstName().equals(userFromDB.getFirstName())) {
userFromDB.setFirstName(user.getFirstName());
}
if (!user.getLastName().equals(userFromDB.getLastName())) {
userFromDB.setLastName(user.getLastName());
}
if (!user.getEmail().equals(userFromDB.getEmail())) {
userFromDB.setEmail(user.getEmail());
}
System.out.println("form password length: " + user.getPassword().length());
if (user.getPassword().length() != 0 && !bCryptPasswordEncoder.matches(user.getPassword(), userFromDB.getPassword())) {
userFromDB.setPassword(user.getPassword());
System.out.println("Changed password");
}
String currentHighestRole = getHighestRole(userFromDB.getUserName(), userService);
String newHighestRole = getHighestRoleFromUser(user);
System.out.println("Role set for current user = " + userFromDB.getRoles().toString());
System.out.println("Role set for new user = " + user.getRoles().toString());
if (!currentHighestRole.equals(newHighestRole)) {
// Ensure that at least one Super User remains
if (currentHighestRole == "SUPER_USER") {
List<User> userList = userService.getAllUsers();
int countOfSuperUsers = 0;
for (User u : userList) {
if (getHighestRoleFromUser(u).equals("SUPER_USER")) countOfSuperUsers++;
}
if (countOfSuperUsers <= 1)
return "redirect:/users/viewAll?alert=error&message=Cannot reduce Super User's role. At a minimum, there must be at least one Super User within the application.";
}
// Create new set of roles for user
Set<Role> newRoleSet = new HashSet<>();
for (Role role : roleRepository.findAll()) {
if (newHighestRole.equals(role.getName())) {
newRoleSet.add(role);
System.out.println("Setting highest role to: " + role.getName());
break;
}
}
System.out.println("New role set looks like this: " + newRoleSet.toString());
userFromDB.setRoles(newRoleSet);
}
userService.save(userFromDB);
System.out.println("Highest role attribute on page = " + getHighestRole(user.getUserName(), userService));
User newUser = userService.findByUsername(userFromDB.getUserName());
System.out.println("Password After Save:" + newUser.getPassword());
return "redirect:/users/view?id=" + user.getId();
}
I should also add that my intent is for a SUPER_USER to be able edit anything about a user, including the password, but if the password fields are left blank then the password would remain unaltered.

What URL to hit to log out of Facebook through java APIs?

I am using the below code to log into Facebook. Once i get the code, using that i get access token and then query graph api and get some basic details.
#RequestMapping(value = "/fblogin")
public String inititateFBlogin(ModelMap model) {
System.out.println("in FB login ");
String fbAuthURL = fbConnectionService.getFBAuthUrl();
return "redirect:"+fbAuthURL;
}
public String getFBAuthUrl() {
String fbLoginUrl = "";
try {
fbLoginUrl = "http://www.facebook.com/dialog/oauth?" + "client_id="
+ FBConnection.FB_APP_ID + "&redirect_uri="
+ URLEncoder.encode(FBConnection.REDIRECT_URI, "UTF-8")
+ "&scope=email";
} catch (UnsupportedEncodingException e) {
e.printStackTrace();
}
return fbLoginUrl;
}
But to logout , i am hitting the URL in below format.
//https://www.facebook.com/logout.php?next=[YourAppURL]&access_token=[ValidAccessToken]
#RequestMapping(value = "/fblogout", method=GET)
public String fbLogOut(ModelMap model) {
String fbLogoutURL = "https://www.facebook.com/logout.php?confirm=1&next=";
String appURL = "http://localhost:15005/abc";
String accessToken = accessTokenFB ;
String logOutURL = fbLogoutURL+appURL+"&access_token="+accessToken;
return "redirect:"+logOutURL;
}
But looks like the above FB url always redirects to the FB homepage.
Is there any way that i can log out by simply calling any FB service through java, I would rather avoid going down to the javascript SDK.
Many thanks.

You can logout an access token by sending a DELETE (instead of GET/POST) request to /me/permissions
https://developers.facebook.com/docs/facebook-login/permissions/requesting-and-revoking
https://developers.facebook.com/docs/graph-api/reference/user/permissions/
curl -X DELETE https://graph.facebook.com/me/permissions?access_token=ABC

How to integrate paypal rest api in spring JPA application. ERROR CODE 400

As per the java SDK provided here , I created a new project and tried to integrate the codes to make paypal api calls. But when I run the application, it gives me error as :-
Error code : 401 with response : Server returned HTTP response code: 401 for URL: https://api.sandbox.paypal.com/v1/payments/payment
Here is my controller class
package com.main.controller;
public class PaymentController{
#RequestMapping(method = RequestMethod.POST, produces = "application/JSON")
public Payment getString(){
InputStream is = PaymentController.class
.getResourceAsStream("/sdk_config.properties");
try {
PayPalResource.initConfig(is);
System.out.println("initiialization done");
} catch (PayPalRESTException e) {
System.out.println("Paypal Rest Exception : " + e.getMessage());
}
Map<String, String > map = new HashMap<String, String>();
map.put("mode", "sandbox");
String clientID = "AYDNebhrsuqiUKPU_ab-tCvGGVkzaxw2y4bIJFIl4rMuCW..........................";
String clientSecret="ENgjkFRgy1yGhal0aobwdF8kLNglkDaDeDItLN-lgQJZV4W1FpNQ27g3FC...............";
try {
accessToken = new OAuthTokenCredential(clientID, clientSecret,map).getAccessToken();
} catch (PayPalRESTException e) {
// TODO Auto-generated catch block
System.out.println("Cannot make the OAuthentication :" + e.getMessage());
}
Payment payment = createPayment();
return payment;
}
public Payment createPayment(){
Address billingAddress = new Address();
billingAddress.setCity("Johnstown");
billingAddress.setCountryCode("US");
billingAddress.setLine1("52 N Main ST");
billingAddress.setPostalCode("43210");
billingAddress.setState("OH");
CreditCard creditCard = new CreditCard();
creditCard.setBillingAddress(billingAddress);
creditCard.setCvv2(111);
creditCard.setExpireMonth(11);
creditCard.setExpireYear(2018);
creditCard.setFirstName("Joe");
creditCard.setLastName("Shopper");
creditCard.setNumber("5500005555555559");
creditCard.setType("mastercard");
Details details = new Details();
details.setShipping("1");
details.setSubtotal("5");
details.setTax("1");
Amount amount = new Amount();
amount.setCurrency("USD");
amount.setTotal("7");
amount.setDetails(details);
Transaction transaction = new Transaction();
transaction.setAmount(amount);
transaction
.setDescription("This is the payment transaction description.");
List<Transaction> transactions = new ArrayList<Transaction>();
transactions.add(transaction);
FundingInstrument fundingInstrument = new FundingInstrument();
fundingInstrument.setCreditCard(creditCard);
List<FundingInstrument> fundingInstrumentList = new ArrayList<FundingInstrument>();
fundingInstrumentList.add(fundingInstrument);
Payer payer = new Payer();
payer.setFundingInstruments(fundingInstrumentList);
payer.setPaymentMethod("credit_card");
Payment payment = new Payment();
payment.setIntent("sale");
payment.setPayer(payer);
payment.setTransactions(transactions);
Payment createdPayment = null;
try {
String accessToken = GenerateAccessToken.getAccessToken();
String realAccessToken = "A101.kPIsO7eGXhg420XIjnZmPboCS27CeDF6TZjVfGR31f6ja1IotK3e6U-E_k9MwOO5.....";
/*
* String requestId = Long.toString(System.nanoTime(); APIContext
* apiContext = new APIContext(accessToken, requestId ));
*/
createdPayment = payment.create(apiContext);
System.out.println("Created payment with id = " + createdPayment.getId()
+ " and status = " + createdPayment.getState());
} catch (PayPalRESTException e) {
System.out.println("Cannot make the payment from here: " + e.getMessage());
}
return createdPayment;
}
}
UPDATE :- I have added client_id and secret authentication credentials and now I get is 400 error which is Validation Error

401 is Unauthorized. So, at first you have to authorized and create authorized token. Here is example how to create you first call.
Make a /token call using your application's OAuth keys for the basic authentication values (the keys are the values of your client_id and secret). In the request body, set grant_type to client_credentials. When you run the command, PayPal generates and returns a new access token.
Add your token to your payment which you want to create.
Look at this line in this Sample: https://github.com/paypal/PayPal-Java-SDK/blob/master/rest-api-sample/src/main/java/com/paypal/api/sample/FuturePaymentSample.java#L62
So use Sandbox and something like that:
Map<String, String> configurationMap = new HashMap<String, String>();
configurationMap.put("mode", "sandbox");
APIContext apiContext = new APIContext();
apiContext.setConfigurationMap(configurationMap);
tokeninfo = Tokeninfo.createFromAuthorizationCodeForFpp(apiContext, params);
tokeninfo.setAccessToken(tokeninfo.getTokenType() + " " + tokeninfo.getAccessToken());
After that you should be able to call tokeninfo.getAccessToken() for creating payment.

Having trouble implementing Stormpath form Login/Authentication alongside REST oAuth authentication in the same application

We're using stormpath with Java & also trying to combine form Login with REST API authentication on the same application.
I've setup stormpath servlet plugin as described here https://docs.stormpath.com/java/servlet-plugin/quickstart.html... This works very fine.
Now, on the same application, we have APIs where I've implemented oAuth authentication with stormpath see here http://docs.stormpath.com/guides/api-key-management/
The first request for an access-token works fine by sending Basic Base64(keyId:keySecret) in the request header and grant_type = client_credentials in the body. Access tokens are being returned nicely. However trying to authenticate subsequent requests with the header Bearer <the-obtained-access-token> does not even hit the application before
returning the following json error message...
{
"error": "invalid_client",
"error_description": "access_token is invalid."
}
This is confusing because I've set breakpoints all over the application and I'm pretty sure that the API request doesn't hit the anywhere within the application before stormpath kicks in and returns this error. And even if stormpath somehow intercepts the request before getting to the REST interface, this message doesn't make any sense to me because i'm certainly making the subsequent API calls with a valid access-token obtained from the first call to get access-token.
I have run out of ideas why this could be happening but i'm suspecting that it may have something to do with stormpath config especially with a combination
of form Login/Authentication for web views and oAuth Athentication for REST endpoints. With that said, here's what my stormpath.properties looks like. Hope this could help point at anything I may be doing wrong.
stormpath.application.href=https://api.stormpath.com/v1/applications/[app-id]
stormpath.web.filters.authr=com.app.security.AuthorizationFilter
stormpath.web.request.event.listener = com.app.security.AuthenticationListener
stormpath.web.uris./resources/**=anon
stormpath.web.uris./assets/**=anon
stormpath.web.uris./v1.0/**=anon
stormpath.web.uris./** = authc,authr
stormpath.web.uris./**/**=authc,authr
Help with this would be highly appreciated.

The problem might be related to an incorrect request.
Is it possible for you to try this code in your app?:
private boolean verify(String accessToken) throws OauthAuthenticationException {
HttpRequest request = createRequestForOauth2AuthenticatedOperation(accessToken);
AccessTokenResult result = Applications.oauthRequestAuthenticator(application)
.authenticate(request);
System.out.println(result.getAccount().getEmail() + " was successfully verified, you can allow your protect operation to continue");
return true;
}
private HttpRequest createRequestForOauth2AuthenticatedOperation(String token) {
try {
Map<String, String[]> headers = new LinkedHashMap<String, String[]>();
headers.put("Accept", new String[]{"application/json"});
headers.put("Authorization", new String[]{"Bearer " + token});
HttpRequest request = HttpRequests.method(HttpMethod.GET)
.headers(headers)
.build();
return request;
} catch (Exception e) {
e.printStackTrace();
return null;
}
}

I've prepared an example that demonstrates oauth token creation as well as authorized access to protected pages using access tokens.
It builds off of the servlet example in the Stormpath SDK. The repo can be found here: https://github.com/stormpath/stormpath-java-oauth-servlet-sample
It demonstrates running a servlet application and having an out-of-band program get and use oauth tokens to access protected resources.
The core of the oauth part is in TokenAuthTest.java:
public class TokenAuthTest {
public static void main(String[] args) throws Exception {
String command = System.getProperty("command");
if (command == null || !("getToken".equals(command) || "getPage".equals(command))) {
System.err.println("Must supply a command:");
System.err.println("\t-Dcommand=getToken OR");
System.err.println("\t-Dcommand=getPage OR");
System.exit(1);
}
if ("getToken".equals(command)) {
getToken();
} else {
getPage();
}
}
private static final String APP_URL = "http://localhost:8080";
private static final String OAUTH_URI = "/oauth/token";
private static final String PROTECTED_URI = "/dashboard";
private static void getToken() throws Exception {
String username = System.getProperty("username");
String password = System.getProperty("password");
if (username == null || password == null) {
System.err.println("Must supply -Dusername=<username> -Dpassword=<password> on the command line");
System.exit(1);
}
PostMethod method = new PostMethod(APP_URL + OAUTH_URI);
method.setRequestHeader("Origin", APP_URL);
method.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
method.addParameter("grant_type", "password");
method.addParameter("username", username);
method.addParameter("password", password);
HttpClient client = new HttpClient();
client.executeMethod(method);
BufferedReader br = new BufferedReader(new InputStreamReader(method.getResponseBodyAsStream()));
String readLine;
while(((readLine = br.readLine()) != null)) {
System.out.println(readLine);
}
}
private static void getPage() throws Exception {
String token = System.getProperty("token");
if (token == null) {
System.err.println("Must supply -Dtoken=<access token> on the command line");
System.exit(1);
}
GetMethod method = new GetMethod(APP_URL + PROTECTED_URI);
HttpClient client = new HttpClient();
System.out.println("Attempting to retrieve " + PROTECTED_URI + " without token...");
int returnCode = client.executeMethod(method);
System.out.println("return code: " + returnCode);
System.out.println();
System.out.println("Attempting to retrieve " + PROTECTED_URI + " with token...");
method.addRequestHeader("Authorization", "Bearer " + token);
returnCode = client.executeMethod(method);
System.out.println("return code: " + returnCode);
}
}

getting exception Authentication failed for token submission in apache shiro

i am new in apache shiro.i am getting exception when i execute this statement.
currentUser.login(token);
exception is
errororg.apache.shiro.authc.AuthenticationException: Authentication failed for token submission [org.apache.shiro.authc.UsernamePasswordToken - abc#gmail.com, rememberMe=true]. Possible unexpected error? (Typical or expected login exceptions should extend from AuthenticationException).
i am invoking this method for login.the code is.
public boolean authorize(String username,String password)
{
Boolean status=false;
log.debug("the user id "+username+"passwrodD::"+password);
Realm realm = new JdbcRealm();
DefaultSecurityManager securityManager = new DefaultSecurityManager(realm);
UsernamePasswordToken token = new UsernamePasswordToken(username, password);
token.setRememberMe(true);
SecurityUtils.setSecurityManager(securityManager);
Subject currentUser = SecurityUtils.getSubject();
Response r = null;
log.debug("before process for login");
try
{
currentUser.login(token); //This throws an error upon form submission
r = Response.ok().entity(token).build();
}
catch (UnknownAccountException uae ) {
//username wasn't in the system, show them an error message?
System.out.println("the user name is invalid");
} catch ( IncorrectCredentialsException ice ) {
//password didn't match, try again?
System.out.println("the password name is invalid");
} catch ( LockedAccountException lae ) {
//account for that username is locked - can't login. Show them a message?
} catch ( AuthenticationException ae ) {
//unexpected condition - error?
System.out.println("unexpect error"+ae);
}
return status;
}
my shiro.ini file
[main]
jdbcRealm = org.apache.shiro.realm.jdbc.JdbcRealm
jdbcRealm.permissionsLookupEnabled = true
jdbcRealm.authenticationQuery =select User_Password FROM user_master where User_id=?
ds = com.mysql.jdbc.jdbc2.optional.MysqlDataSource
ds.serverName = localhost
ds.user = root
ds.password = root
ds.databaseName = test
jdbcRealm.dataSource = $ds
[users]
[roles]
[urls]
i include listener and filter in my web.xml file.
i change the authenticationQuery to my query. and when i am executing i am getting this above error. and also i do know is it right way to modify or override query.

I think the problem is that you are missing securityManager.realm = $jdbcRealm in your shiro.ini

I just got this exception, and the problem was I was setting securityManager.realm incorrectly in shiro.ini. This is what I had:
[main]
fooRealm = com.company.foo.Realm
securityManager.realms = fooRealm
This is what fixed it (I was missing a $):
[main]
fooRealm = com.company.foo.Realm
securityManager.realms = $fooRealm