Package org.exoplatform.portal.rest

Class UserAccountConfirmation

java.lang.Object
org.exoplatform.portal.rest.UserAccountConfirmation
public final class UserAccountConfirmation extends Object
Server-side guard of the administrator actions on user accounts: an action is applied only from a session the administrator confirmed with a one-time password. The confirmation is a marker on the HTTP session of the webapp serving the request, set by the confirmation endpoint only, and read here together with the confirmation settings (the switch and the technical accounts): no header and no credential is ever considered.

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    OTP_REQUIRED
    Body of the 403 answered to an unconfirmed session
    static final String
    SESSION_ATTRIBUTE
    Session attribute holding the user name whose actions are confirmed

  • Method Summary

    Modifier and Type
    Method
    Description
    static void
    confirm(jakarta.servlet.http.HttpServletRequest request, String username)
    Marks the request's session as confirmed for the designated user
    static boolean
    isConfirmed(jakarta.servlet.http.HttpServletRequest request)
     
    static javax.ws.rs.core.Response
    otpRequired()
     

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • SESSION_ATTRIBUTE

      public static final String SESSION_ATTRIBUTE
      Session attribute holding the user name whose actions are confirmed
      See Also:

    • OTP_REQUIRED

      public static final String OTP_REQUIRED
      Body of the 403 answered to an unconfirmed session
      See Also:

  • Method Details

    • isConfirmed

      public static boolean isConfirmed(jakarta.servlet.http.HttpServletRequest request)
      Parameters:
      request - current request, null when none is bound
      Returns:
      true when the request may perform a guarded action: the confirmation is switched off, or the user is an exempted technical account, or the session carries the confirmation of this very user

    • confirm

      public static void confirm(jakarta.servlet.http.HttpServletRequest request, String username)
      Marks the request's session as confirmed for the designated user
      Parameters:
      request - current request
      username - user who confirmed the one-time password

    • otpRequired

      public static javax.ws.rs.core.Response otpRequired()
      Returns:
      the response answered to a guarded request from an unconfirmed session