Added forms for login actions + some refactoring to required user actions

services/src/main/java/org/keycloak/services/email/EmailSender.java

@@ -23,9 +23,8 @@ package org.keycloak.services.email;
 
 import java.net.URI;
 import java.util.Map.Entry;
-import java.util.concurrent.TimeUnit;
-import java.util.List;
 import java.util.Properties;
+import java.util.concurrent.TimeUnit;
 
 import javax.mail.Message;
 import javax.mail.MessagingException;
@@ -38,6 +37,7 @@ import javax.ws.rs.core.UriBuilder;
 import javax.ws.rs.core.UriInfo;
 
 import org.jboss.resteasy.logging.Logger;
+import org.keycloak.services.managers.AccessCodeEntry;
 import org.keycloak.services.models.RealmModel;
 import org.keycloak.services.models.UserModel;
 import org.keycloak.services.resources.AccountService;
@@ -78,12 +78,9 @@ public class EmailSender {
         transport.sendMessage(msg, new InternetAddress[] { new InternetAddress(address) });
     }
 
-    public void sendEmailVerification(UserModel user, RealmModel realm, String code, UriInfo uriInfo) {
-        UriBuilder builder = Urls.accountBase(uriInfo.getBaseUri()).path(AccountService.class, "processEmailVerification");
-        for (Entry<String, List<String>> e : uriInfo.getQueryParameters().entrySet()) {
-            builder.queryParam(e.getKey(), e.getValue().toArray());
-        }
-        builder.queryParam("code", code);
+    public void sendEmailVerification(UserModel user, RealmModel realm, AccessCodeEntry accessCode, UriInfo uriInfo) {
+        UriBuilder builder = Urls.accountBase(uriInfo.getBaseUri()).path(AccountService.class, "emailVerification");
+        builder.queryParam("key", accessCode.getId());
 
         URI uri = builder.build(realm.getId());
 
@@ -99,12 +96,9 @@ public class EmailSender {
         }
     }
 
-    public void sendPasswordReset(UserModel user, RealmModel realm, String code, UriInfo uriInfo) {
+    public void sendPasswordReset(UserModel user, RealmModel realm, AccessCodeEntry accessCode, UriInfo uriInfo) {
         UriBuilder builder = Urls.accountBase(uriInfo.getBaseUri()).path(AccountService.class, "passwordPage");
-        for (Entry<String, List<String>> e : uriInfo.getQueryParameters().entrySet()) {
-            builder.queryParam(e.getKey(), e.getValue().toArray());
-        }
-        builder.queryParam("code", code);
+        builder.queryParam("key", accessCode.getId());
 
         URI uri = builder.build(realm.getId());
 

services/src/main/java/org/keycloak/services/models/UserModel.java

@@ -54,6 +54,6 @@ public interface UserModel {
     void setTotp(boolean totp);
 
     public static enum RequiredAction {
-        VERIFY_EMAIL, UPDATE_PROFILE, CONFIGURE_TOTP, RESET_PASSWORD
+        VERIFY_EMAIL, UPDATE_PROFILE, CONFIGURE_TOTP, UPDATE_PASSWORD
     }
 }

services/src/main/java/org/keycloak/services/resources/AccountService.java

@@ -28,7 +28,6 @@ import javax.ws.rs.Consumes;
 import javax.ws.rs.GET;
 import javax.ws.rs.POST;
 import javax.ws.rs.Path;
-import javax.ws.rs.QueryParam;
 import javax.ws.rs.core.Context;
 import javax.ws.rs.core.HttpHeaders;
 import javax.ws.rs.core.MediaType;
@@ -45,7 +44,6 @@ import org.keycloak.representations.idm.CredentialRepresentation;
 import org.keycloak.services.email.EmailSender;
 import org.keycloak.services.managers.AccessCodeEntry;
 import org.keycloak.services.managers.AuthenticationManager;
-import org.keycloak.services.managers.ResourceAdminManager;
 import org.keycloak.services.managers.TokenManager;
 import org.keycloak.services.messages.Messages;
 import org.keycloak.services.models.RealmModel;
@@ -54,7 +52,6 @@ import org.keycloak.services.models.UserModel;
 import org.keycloak.services.models.UserModel.RequiredAction;
 import org.keycloak.services.resources.flows.Flows;
 import org.keycloak.services.resources.flows.FormFlows;
-import org.keycloak.services.resources.flows.OAuthFlows;
 import org.keycloak.services.validation.Validation;
 import org.picketlink.idm.credential.util.TimeBasedOTP;
 
@@ -116,9 +113,8 @@ public class AccountService {
             accessCodeEntry.getRequiredActions().remove(UserModel.RequiredAction.UPDATE_PROFILE);
         }
 
-        Response response = redirectOauth(user, accessCodeEntry);
-        if (response != null) {
-            return response;
+        if (accessCodeEntry != null) {
+            return redirectOauth(user, accessCodeEntry);
         } else {
             return Flows.forms(realm, request, uriInfo).setUser(user).forwardToAccount();
         }
@@ -207,34 +203,88 @@ public class AccountService {
 
         user.setTotp(true);
 
-        Response response = redirectOauth(user, accessCodeEntry);
-        if (response != null) {
-            return response;
+        if (accessCodeEntry != null) {
+            return redirectOauth(user, accessCodeEntry);
         } else {
             return Flows.forms(realm, request, uriInfo).setUser(user).forwardToTotp();
         }
     }
 
-    @Path("email-verify")
+    @Path("password-reset")
     @GET
-    public Response processEmailVerification() {
-        AccessCodeEntry accessCodeEntry = getAccessCodeEntry(RequiredAction.VERIFY_EMAIL);
-        UserModel user = accessCodeEntry != null ? getUserFromAccessCode(accessCodeEntry) : null;
-        if (user == null) {
-            return Response.status(Status.FORBIDDEN).build();
+    public Response passwordReset() {
+        return Flows.forms(realm, request, uriInfo).forwardToPasswordReset();
+    }
+
+    @Path("password-reset")
+    @POST
+    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
+    public Response sendPasswordReset(final MultivaluedMap<String, String> formData) {
+        String username = formData.getFirst("username");
+        String email = formData.getFirst("email");
+
+        String scopeParam = uriInfo.getQueryParameters().getFirst("scope");
+        String state = uriInfo.getQueryParameters().getFirst("state");
+        String redirect = uriInfo.getQueryParameters().getFirst("redirect_uri");
+        String clientId = uriInfo.getQueryParameters().getFirst("client_id");
+
+        UserModel client = realm.getUser(clientId);
+        if (client == null) {
+            return Flows.oauth(realm, request, uriInfo, authManager, tokenManager).forwardToSecurityFailure(
+                    "Unknown login requester.");
+        }
+        if (!client.isEnabled()) {
+            return Flows.oauth(realm, request, uriInfo, authManager, tokenManager).forwardToSecurityFailure(
+                    "Login requester not enabled.");
         }
 
-        user.setEmailVerified(true);
-        user.removeRequiredAction(UserModel.RequiredAction.VERIFY_EMAIL);
-        if (accessCodeEntry != null) {
-            accessCodeEntry.getRequiredActions().remove(UserModel.RequiredAction.VERIFY_EMAIL);
+        UserModel user = realm.getUser(username);
+        if (user == null || !email.equals(user.getEmail())) {
+            Flows.forms(realm, request, uriInfo).setError("Invalid username or email")
+                    .forwardToAction(RequiredAction.UPDATE_PASSWORD);
         }
 
-        Response response = redirectOauth(user, accessCodeEntry);
-        if (response != null) {
-            return response;
+        Set<RequiredAction> requiredActions = new HashSet<RequiredAction>(user.getRequiredActions());
+        requiredActions.add(RequiredAction.UPDATE_PASSWORD);
+
+        AccessCodeEntry accessCode = tokenManager.createAccessCode(scopeParam, state, redirect, realm, client, user);
+        accessCode.setRequiredActions(requiredActions);
+        accessCode.setExpiration(System.currentTimeMillis() / 1000 + realm.getAccessCodeLifespanUserAction());
+
+        new EmailSender().sendPasswordReset(user, realm, accessCode, uriInfo);
+
+        return Flows.forms(realm, request, uriInfo).forwardToPasswordReset();
+    }
+
+    @Path("email-verification")
+    @GET
+    public Response emailVerification() {
+        if (uriInfo.getQueryParameters().containsKey("key")) {
+            AccessCodeEntry accessCode = tokenManager.getAccessCode(uriInfo.getQueryParameters().getFirst("key"));
+            if (accessCode == null || accessCode.isExpired()
+                    || !accessCode.getRequiredActions().contains(RequiredAction.VERIFY_EMAIL)) {
+                return Response.status(Status.FORBIDDEN).build();
+            }
+
+            String loginName = accessCode.getUser().getLoginName();
+            UserModel user = realm.getUser(loginName);
+            user.setEmailVerified(true);
+            user.removeRequiredAction(RequiredAction.VERIFY_EMAIL);
+
+            accessCode.getRequiredActions().remove(RequiredAction.VERIFY_EMAIL);
+
+            return redirectOauth(user, accessCode);
         } else {
-            return Flows.forms(realm, request, uriInfo).setUser(user).forwardToVerifyEmail();
+            AccessCodeEntry accessCode = getAccessCodeEntry(RequiredAction.VERIFY_EMAIL);
+            UserModel user = accessCode != null ? getUserFromAccessCode(accessCode) : null;
+            if (user == null) {
+                return Response.status(Status.FORBIDDEN).build();
+            }
+
+            new EmailSender().sendEmailVerification(user, realm, accessCode, uriInfo);
+
+            return Flows.forms(realm, request, uriInfo).setAccessCode(accessCode).setUser(user)
+                    .forwardToAction(RequiredAction.VERIFY_EMAIL);
         }
     }
 
@@ -245,17 +295,11 @@ public class AccountService {
 
         Set<RequiredAction> requiredActions = user.getRequiredActions();
         if (!requiredActions.isEmpty()) {
-            return Flows.forms(realm, request, uriInfo).setCode(accessCode.getCode()).setUser(user)
+            return Flows.forms(realm, request, uriInfo).setAccessCode(accessCode).setUser(user)
                     .forwardToAction(requiredActions.iterator().next());
         } else {
-            String redirect = uriInfo.getQueryParameters().getFirst("redirect_uri");
-            if (redirect != null) {
-                String state = uriInfo.getQueryParameters().getFirst("state");
-                return Flows.oauth(realm, request, uriInfo, authManager, tokenManager).redirectAccessCode(accessCode, state,
-                        redirect);
-            } else {
-                return null;
-            }
+            return Flows.oauth(realm, request, uriInfo, authManager, tokenManager).redirectAccessCode(accessCode,
+                    accessCode.getState(), accessCode.getRedirectUri());
         }
     }
 
@@ -263,12 +307,14 @@ public class AccountService {
     @POST
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     public Response processPasswordUpdate(final MultivaluedMap<String, String> formData) {
-        AccessCodeEntry accessCodeEntry = getAccessCodeEntry(RequiredAction.RESET_PASSWORD);
-        UserModel user = accessCodeEntry != null ? getUserFromAccessCode(accessCodeEntry) : getUserFromAuthManager();
+        AccessCodeEntry accessCode = getAccessCodeEntry(RequiredAction.UPDATE_PASSWORD);
+        UserModel user = accessCode != null ? getUserFromAccessCode(accessCode) : getUserFromAuthManager();
         if (user == null) {
             return Response.status(Status.FORBIDDEN).build();
         }
 
+        boolean loginAction = accessCode != null;
+
         FormFlows forms = Flows.forms(realm, request, uriInfo).setUser(user);
 
         String password = formData.getFirst("password");
@@ -283,7 +329,7 @@ public class AccountService {
             error = Messages.INVALID_PASSWORD_CONFIRM;
         }
 
-        if (accessCodeEntry == null) {
+        if (!loginAction) {
             if (Validation.isEmpty(password)) {
                 error = Messages.MISSING_PASSWORD;
             } else if (!realm.validatePassword(user, password)) {
@@ -301,15 +347,16 @@ public class AccountService {
 
         realm.updateCredential(user, credentials);
 
-        user.removeRequiredAction(RequiredAction.RESET_PASSWORD);
-        if (accessCodeEntry != null) {
-            accessCodeEntry.getRequiredActions().remove(UserModel.RequiredAction.RESET_PASSWORD);
+        user.removeRequiredAction(RequiredAction.UPDATE_PASSWORD);
+        if (accessCode != null) {
+            accessCode.getRequiredActions().remove(UserModel.RequiredAction.UPDATE_PASSWORD);
         }
 
-        authManager.expireIdentityCookie(realm, uriInfo);
-        new ResourceAdminManager().singleLogOut(realm, user.getLoginName());
-
-        return Flows.forms(realm, request, uriInfo).forwardToLogin();
+        if (accessCode != null) {
+            return redirectOauth(user, accessCode);
+        } else {
+            return Flows.forms(realm, request, uriInfo).setUser(user).forwardToPassword();
+        }
     }
 
     @Path("")
@@ -348,61 +395,21 @@ public class AccountService {
     @Path("password")
     @GET
     public Response passwordPage() {
-        UserModel user = getUserFromAuthManager();
+        if (uriInfo.getQueryParameters().containsKey("key")) {
+            AccessCodeEntry accessCode = tokenManager.getAccessCode(uriInfo.getQueryParameters().getFirst("key"));
+            if (accessCode == null || accessCode.isExpired()
+                    || !accessCode.getRequiredActions().contains(RequiredAction.UPDATE_PASSWORD)) {
+                return Response.status(Status.FORBIDDEN).build();
+            }
 
-        // TODO Remove when we have a separate login-reset-password page
-        if (user == null) {
-            AccessCodeEntry accessCodeEntry = getAccessCodeEntry(RequiredAction.RESET_PASSWORD);
-            user = accessCodeEntry != null ? getUserFromAccessCode(accessCodeEntry) : null;
-        }
-
-        if (user != null) {
-            return Flows.forms(realm, request, uriInfo).setUser(user).forwardToPassword();
+            return Flows.forms(realm, request, uriInfo).setAccessCode(accessCode)
+                    .forwardToAction(RequiredAction.UPDATE_PASSWORD);
         } else {
-            return Response.status(Status.FORBIDDEN).build();
+            UserModel user = getUserFromAuthManager();
+            if (user == null) {
+                return Response.status(Status.FORBIDDEN).build();
+            }
+            return Flows.forms(realm, request, uriInfo).setUser(user).forwardToPassword();
         }
     }
-
-    @Path("password-reset")
-    @GET
-    public Response resetPassword(@QueryParam("username") final String username,
-            @QueryParam("client_id") final String clientId, @QueryParam("scope") final String scopeParam,
-            @QueryParam("state") final String state, @QueryParam("redirect_uri") final String redirect) {
-
-        OAuthFlows oauth = Flows.oauth(realm, request, uriInfo, authManager, tokenManager);
-
-        if (!realm.isEnabled()) {
-            return oauth.forwardToSecurityFailure("Realm not enabled.");
-        }
-        if (!realm.isResetPasswordAllowed()) {
-            return oauth.forwardToSecurityFailure("Password reset not permitted, contact admin.");
-        }
-
-        UserModel client = realm.getUser(clientId);
-        if (client == null) {
-            return oauth.forwardToSecurityFailure("Unknown login requester.");
-        }
-        if (!client.isEnabled()) {
-            return oauth.forwardToSecurityFailure("Login requester not enabled.");
-        }
-
-        // String username = formData.getFirst("username");
-        UserModel user = realm.getUser(username);
-
-        Set<RequiredAction> requiredActions = new HashSet<RequiredAction>(user.getRequiredActions());
-        requiredActions.add(RequiredAction.RESET_PASSWORD);
-
-        AccessCodeEntry accessCode = tokenManager.createAccessCode(scopeParam, state, redirect, realm, client, user);
-        accessCode.setRequiredActions(requiredActions);
-        accessCode.setExpiration(System.currentTimeMillis() / 1000 + realm.getAccessCodeLifespanUserAction());
-
-        if (user.getEmail() == null) {
-            return oauth.forwardToSecurityFailure("Email address not set, contact admin");
-        }
-
-        new EmailSender().sendPasswordReset(user, realm, accessCode.getCode(), uriInfo);
-        // TODO Add info message
-        return Flows.forms(realm, request, uriInfo).forwardToLogin();
-    }
-
 }

services/src/main/java/org/keycloak/services/resources/flows/FormFlows.java

@@ -28,6 +28,7 @@ import org.jboss.resteasy.spi.HttpRequest;
 import org.jboss.resteasy.spi.ResteasyUriInfo;
 import org.keycloak.services.FormService;
 import org.keycloak.services.email.EmailSender;
+import org.keycloak.services.managers.AccessCodeEntry;
 import org.keycloak.services.models.RealmModel;
 import org.keycloak.services.models.UserModel;
 import org.keycloak.services.models.UserModel.RequiredAction;
@@ -60,7 +61,7 @@ public class FormFlows {
     private UserModel userModel;
 
     private boolean socialRegistration;
-    private String code;
+    private AccessCodeEntry accessCode;
     private UriInfo uriInfo;
 
     FormFlows(RealmModel realm, HttpRequest request, UriInfo uriInfo) {
@@ -72,15 +73,16 @@ public class FormFlows {
     public Response forwardToAction(RequiredAction action) {
         switch (action) {
             case CONFIGURE_TOTP:
-                return forwardToTotp();
+                return forwardToForm(Pages.LOGIN_CONFIG_TOTP);
             case UPDATE_PROFILE:
-                return forwardToAccount();
-            case RESET_PASSWORD:
-                return forwardToPassword();
+                return forwardToForm(Pages.LOGIN_UPDATE_PROFILE);
+            case UPDATE_PASSWORD:
+                return forwardToForm(Pages.LOGIN_UPDATE_PASSWORD);
             case VERIFY_EMAIL:
-                return forwardToVerifyEmail();
+                new EmailSender().sendEmailVerification(userModel, realm, accessCode, uriInfo);
+                return forwardToForm(Pages.LOGIN_VERIFY_EMAIL);
             default:
-                return null; // TODO
+                return Response.serverError().build();
         }
     }
 
@@ -107,8 +109,8 @@ public class FormFlows {
             uriBuilder.replaceQueryParam(k, queryParameterMap.get(k).toArray());
         }
 
-        if (code != null){
-            uriBuilder.queryParam(CODE, code);
+        if (accessCode != null) {
+            uriBuilder.queryParam(CODE, accessCode.getCode());
         }
 
         URI baseURI = uriBuilder.build();
@@ -135,6 +137,10 @@ public class FormFlows {
         return forwardToForm(Pages.LOGIN);
     }
 
+    public Response forwardToPasswordReset() {
+        return forwardToForm(Pages.LOGIN_RESET_PASSWORD);
+    }
+
     public Response forwardToLoginTotp() {
         return forwardToForm(Pages.LOGIN_TOTP);
     }
@@ -155,13 +161,8 @@ public class FormFlows {
         return forwardToForm(Pages.TOTP);
     }
 
-    public Response forwardToVerifyEmail() {
-        new EmailSender().sendEmailVerification(userModel, realm, code, uriInfo);
-        return forwardToForm(Pages.VERIFY_EMAIL);
-    }
-
-    public FormFlows setCode(String code) {
-        this.code = code;
+    public FormFlows setAccessCode(AccessCodeEntry accessCode) {
+        this.accessCode = accessCode;
         return this;
     }
 

services/src/main/java/org/keycloak/services/resources/flows/OAuthFlows.java

@@ -97,7 +97,7 @@ public class OAuthFlows {
         if (!requiredActions.isEmpty()) {
             accessCode.setRequiredActions(new HashSet<UserModel.RequiredAction>(requiredActions));
             accessCode.setExpiration(System.currentTimeMillis() / 1000 + realm.getAccessCodeLifespanUserAction());
-            return Flows.forms(realm, request, uriInfo).setCode(accessCode.getCode()).setUser(user)
+            return Flows.forms(realm, request, uriInfo).setAccessCode(accessCode).setUser(user)
                     .forwardToAction(user.getRequiredActions().iterator().next());
         }
 

services/src/main/java/org/keycloak/services/resources/flows/Pages.java

@@ -34,10 +34,18 @@ public class Pages {
 
     public final static String LOGIN_TOTP = "/forms/login-totp.ftl";
 
+    public final static String LOGIN_CONFIG_TOTP = "/forms/login-config-totp.ftl";
+
+    public final static String LOGIN_VERIFY_EMAIL = "/forms/login-verify-email.ftl";
+
     public final static String OAUTH_GRANT = "/saas/oauthGrantForm.jsp";
 
     public final static String PASSWORD = "/forms/password.ftl";
 
+    public final static String LOGIN_RESET_PASSWORD = "/forms/login-reset-password.ftl";
+
+    public final static String LOGIN_UPDATE_PASSWORD = "/forms/login-update-password.ftl";
+
     public final static String REGISTER = "/forms/register.ftl";
 
     public final static String SECURITY_FAILURE = "/saas/securityFailure.jsp";
@@ -46,6 +54,6 @@ public class Pages {
 
     public final static String TOTP = "/forms/totp.ftl";
 
-    public final static String VERIFY_EMAIL = "/forms/verify-email.ftl";
+    public final static String LOGIN_UPDATE_PROFILE = "/forms/login-update-profile.ftl";
 
 }

services/src/main/java/org/keycloak/services/resources/flows/Urls.java

@@ -55,6 +55,14 @@ public class Urls {
         return accountBase(baseUri).path(AccountService.class, "totpPage").build(realmId);
     }
 
+    public static URI accountEmailVerification(URI baseUri, String realmId) {
+        return accountBase(baseUri).path(AccountService.class, "emailVerification").build(realmId);
+    }
+
+    public static URI accountPasswordReset(URI baseUri, String realmId) {
+        return accountBase(baseUri).path(AccountService.class, "passwordReset").build(realmId);
+    }
+
     private static UriBuilder realmBase(URI baseUri) {
         return UriBuilder.fromUri(baseUri).path(RealmsResource.class);
     }