securityQA.js revision 487748a7e7bbdf5f3edf3de319d94a3f6fca65ae
/**
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
*
* Copyright (c) 2011-2012 ForgeRock AS. All rights reserved.
*
* The contents of this file are subject to the terms
* of the Common Development and Distribution License
* (the License). You may not use this file except in
* compliance with the License.
*
* You can obtain a copy of the License at
* See the License for the specific language governing
* permission and limitations under the License.
*
* When distributing Covered Code, include this CDDL
* Header Notice in each file and include the License file
* If applicable, add the following below the CDDL Header,
* with the fields enclosed by brackets [] replaced by
* your own identifying information:
* "Portions Copyrighted [year] [name of copyright owner]"
*/
/**
* @author jfeasel
*
* This script checks if security answer passed in parameters
* equals user's security answer.
*
* It may reset the password as part of the request, if a new one is present
*
* This endpoint expects these parameters:
*
* _action: one of (securityQuestionForUserName|checkSecurityAnswerForUserName|setNewPasswordForUserName)
* securityAnswer : answer to security question; used by actions checkSecurityAnswerForUserName and setNewPasswordForUserName
* newPassword: new password to assign to user; used by action setNewPasswordForUserName
*
*/
throw {
"code" : 403,
"message" : "Access denied"
};
}
(function () {
var response = {},
userQuery = {},
user = {},
patch = [];
if (
userQuery = openidm.query("managed/user", {"_queryId": "for-userName", "uid": request.params.uid } );
}
else if (
try {
user.securityAnswerAttempts = (typeof (user.securityAnswerAttempts) === "number") ? user.securityAnswerAttempts+1 : 1;
// This could throw a policy violation if there is one in place enforcing a maximum number of attempts
openidm.patch("managed/user/" + user._id, null, [{"operation" : "replace", "field" : "securityAnswerAttempts", "value": user.securityAnswerAttempts}]);
if(!user.securityAnswer || openidm.decrypt(user.securityAnswer) !== request.params.securityAnswer) {
throw "Incorrect Answer";
} else {
} else {
// used by the UI to validate passwords before actually submitting them to be changed
}
}
}
catch (err) {
openidm.patch("managed/user/" + user._id, null, [{"operation" : "replace", "field" : "lastSecurityAnswerAttempt", "value" : (new Date()).toString()}]);
}
}
}
}
}
else { // apparently they have provided an unsupported action
throw {
"code" : 403,
"message" : "Access denied"
};
}
return response;
}());