25124 enforcing password requirements

java/code/src/com/redhat/rhn/common/conf/UserDefaults.java

@@ -20,8 +20,6 @@
  */
 public class UserDefaults {
     private static UserDefaults instance = new UserDefaults();
-    public static final String MAX_PASSWORD_LENGTH = "max_passwd_len";
-    public static final String MIN_PASSWORD_LENGTH = "min_passwd_len";
     public static final String MAX_USER_LENGTH = "max_user_len";
     public static final String MIN_USER_LENGTH = "min_user_len";
     public static final String MAX_EMAIL_LENGTH = "min_email_len";
@@ -33,20 +31,6 @@ public static UserDefaults get() {
         return instance;
     }
 
-    /**
-     * @return the max password length
-     */
-    public int getMaxPasswordLength() {
-        return Config.get().getInt(MAX_PASSWORD_LENGTH, 32);
-    }
-
-    /**
-     * @return the min password length
-     */
-    public int getMinPasswordLength() {
-        return Config.get().getInt(MIN_PASSWORD_LENGTH, 5);
-    }
-
     /**
      * @return the max login name length
      */

java/code/src/com/redhat/rhn/common/hibernate/AnnotationRegistry.java

@@ -26,6 +26,7 @@
 import com.redhat.rhn.domain.cloudpayg.PaygCredentialsProduct;
 import com.redhat.rhn.domain.cloudpayg.PaygSshData;
 import com.redhat.rhn.domain.common.ProvisionState;
+import com.redhat.rhn.domain.common.RhnConfiguration;
 import com.redhat.rhn.domain.config.ConfigChannel;
 import com.redhat.rhn.domain.config.ConfigChannelType;
 import com.redhat.rhn.domain.config.ConfigFile;
@@ -254,6 +255,7 @@ private AnnotationRegistry() {
             ProjectSource.class,
             ProvisionState.class,
             PtfFilter.class,
+            RhnConfiguration.class,
             RecurringConfigChannel.class,
             RecurringHighstate.class,
             RecurringInternalState.class,

java/code/src/com/redhat/rhn/common/util/CryptHelper.java

@@ -15,7 +15,8 @@
 
 package com.redhat.rhn.common.util;
 
-import com.redhat.rhn.common.conf.UserDefaults;
+import com.redhat.rhn.domain.common.RhnConfiguration;
+import com.redhat.rhn.domain.common.RhnConfigurationFactory;
 
 import org.apache.commons.lang3.RandomStringUtils;
 
@@ -122,7 +123,10 @@ public static String getRandomPasswordForPamAuth() {
         // we set use pam authentication, yet the password field
         // in the database is NOT NULL.  So we have to create this
         // stupid HACK!  Actually this is beyond HACK.
-        return RandomStringUtils.random(UserDefaults.get().getMaxPasswordLength(), 0, 0,
+        RhnConfigurationFactory factory = RhnConfigurationFactory.getSingleton();
+        return RandomStringUtils.random(
+                factory.getIntegerConfiguration(RhnConfiguration.KEYS.PSW_CHECK_LENGTH_MAX).getValue(),
+                0, 0,
                 true, true, null, new SecureRandom());
     }
 }

java/code/src/com/redhat/rhn/common/util/validation/password/PasswordPolicy.java

@@ -0,0 +1,196 @@
+/*
+ * Copyright (c) 2024 SUSE LLC
+ *
+ * This software is licensed to you under the GNU General Public License,
+ * version 2 (GPLv2). There is NO WARRANTY for this software, express or
+ * implied, including the implied warranties of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. You should have received a copy of GPLv2
+ * along with this software; if not, see
+ * http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *
+ * Red Hat trademarks are not licensed under GPLv2. No permission is
+ * granted to use or replicate Red Hat trademarks that are incorporated
+ * in this software or its documentation.
+ */
+
+package com.redhat.rhn.common.util.validation.password;
+
+import com.redhat.rhn.domain.common.RhnConfiguration;
+import com.redhat.rhn.domain.common.RhnConfigurationFactory;
+
+public class PasswordPolicy {
+    private boolean upperCharFlag;
+    private boolean lowerCharFlag;
+    private boolean digitFlag;
+    private boolean specialCharFlag;
+    private String specialChars;
+    private boolean consecutiveCharsFlag;
+    private boolean restrictedOccurrenceFlag;
+    private int maxCharacterOccurrence;
+    private int minLength;
+    private int maxLength;
+
+    /**
+     * Class that holds the settings for the user password checks
+     * @param upperCharFlagIn check upper char in password
+     * @param lowerCharFlagIn check lower char in password
+     * @param digitFlagIn check digit in password
+     * @param specialCharFlagIn check special char in password
+     * @param specialCharsIn string with special chars
+     * @param consecutiveCharsFlagIn check consecutive characters
+     * @param restrictedOccurrenceFlagIn check restricted occurrence
+     * @param maxCharacterOccurrenceIn max number of occurrence
+     * @param minLengthIn minimum password length
+     * @param maxLengthIn maximum password length
+     */
+    public PasswordPolicy(
+            boolean upperCharFlagIn, boolean lowerCharFlagIn,
+            boolean digitFlagIn, boolean specialCharFlagIn,
+            String specialCharsIn, boolean consecutiveCharsFlagIn,
+            boolean restrictedOccurrenceFlagIn, int maxCharacterOccurrenceIn,
+            int minLengthIn, int maxLengthIn
+    ) {
+        upperCharFlag = upperCharFlagIn;
+        lowerCharFlag = lowerCharFlagIn;
+        digitFlag = digitFlagIn;
+        specialCharFlag = specialCharFlagIn;
+        specialChars = specialCharsIn;
+        consecutiveCharsFlag = consecutiveCharsFlagIn;
+        restrictedOccurrenceFlag = restrictedOccurrenceFlagIn;
+        maxCharacterOccurrence = maxCharacterOccurrenceIn;
+        minLength = minLengthIn;
+        maxLength = maxLengthIn;
+    }
+
+    /**
+     * Class that holds the settings for the user password checks
+     */
+    public PasswordPolicy() {
+    }
+
+    /**
+     * Helper method to build checks settings from SatConfiguration
+     * @return the settings for the user password settings
+     */
+    public static PasswordPolicy buildFromFactory() {
+        RhnConfigurationFactory factory = RhnConfigurationFactory.getSingleton();
+        return new PasswordPolicy(
+                factory.getBooleanConfiguration(RhnConfiguration.KEYS.PSW_CHECK_UPPER_CHAR_FLAG).getValue(),
+                factory.getBooleanConfiguration(RhnConfiguration.KEYS.PSW_CHECK_LOWER_CHAR_FLAG).getValue(),
+                factory.getBooleanConfiguration(RhnConfiguration.KEYS.PSW_CHECK_DIGIT_FLAG).getValue(),
+                factory.getBooleanConfiguration(RhnConfiguration.KEYS.PSW_CHECK_SPECIAL_CHAR_FLAG).getValue(),
+                factory.getStringConfiguration(RhnConfiguration.KEYS.PSW_CHECK_SPECIAL_CHARACTERS).getValue(),
+                factory.getBooleanConfiguration(RhnConfiguration.KEYS.PSW_CHECK_CONSECUTIVE_CHAR_FLAG).getValue(),
+                factory.getBooleanConfiguration(RhnConfiguration.KEYS.PSW_CHECK_RESTRICTED_OCCURRENCE_FLAG).getValue(),
+                factory.getIntegerConfiguration(RhnConfiguration.KEYS.PSW_CHECK_MAX_OCCURRENCE).getValue(),
+                factory.getIntegerConfiguration(RhnConfiguration.KEYS.PSW_CHECK_LENGTH_MIN).getValue(),
+                factory.getIntegerConfiguration(RhnConfiguration.KEYS.PSW_CHECK_LENGTH_MAX).getValue()
+        );
+    }
+
+
+    /**
+     * Helper method to get the defaults checks settings from SatConfiguration
+     * @return the default settings for the user password settings
+     */
+    public static PasswordPolicy buildFromDefaults() {
+            RhnConfigurationFactory factory = RhnConfigurationFactory.getSingleton();
+            return new PasswordPolicy(
+                    factory.getBooleanConfiguration(
+                            RhnConfiguration.KEYS.PSW_CHECK_UPPER_CHAR_FLAG).getDefaultValue(),
+                    factory.getBooleanConfiguration(RhnConfiguration.KEYS.PSW_CHECK_LOWER_CHAR_FLAG).getDefaultValue(),
+                    factory.getBooleanConfiguration(RhnConfiguration.KEYS.PSW_CHECK_DIGIT_FLAG).getDefaultValue(),
+                    factory.getBooleanConfiguration(
+                            RhnConfiguration.KEYS.PSW_CHECK_SPECIAL_CHAR_FLAG).getDefaultValue(),
+                    factory.getStringConfiguration(
+                            RhnConfiguration.KEYS.PSW_CHECK_SPECIAL_CHARACTERS).getDefaultValue(),
+                    factory.getBooleanConfiguration(
+                            RhnConfiguration.KEYS.PSW_CHECK_CONSECUTIVE_CHAR_FLAG).getDefaultValue(),
+                    factory.getBooleanConfiguration(
+                            RhnConfiguration.KEYS.PSW_CHECK_RESTRICTED_OCCURRENCE_FLAG).getDefaultValue(),
+                    factory.getIntegerConfiguration(RhnConfiguration.KEYS.PSW_CHECK_MAX_OCCURRENCE).getDefaultValue(),
+                    factory.getIntegerConfiguration(RhnConfiguration.KEYS.PSW_CHECK_LENGTH_MIN).getDefaultValue(),
+                    factory.getIntegerConfiguration(RhnConfiguration.KEYS.PSW_CHECK_LENGTH_MAX).getDefaultValue()
+            );
+        }
+
+    public boolean isUpperCharFlag() {
+        return upperCharFlag;
+    }
+
+    public void setUpperCharFlag(boolean upperCharFlagIn) {
+        upperCharFlag = upperCharFlagIn;
+    }
+
+    public boolean isLowerCharFlag() {
+        return lowerCharFlag;
+    }
+
+    public void setLowerCharFlag(boolean lowerCharFlagIn) {
+        lowerCharFlag = lowerCharFlagIn;
+    }
+
+    public boolean isDigitFlag() {
+        return digitFlag;
+    }
+
+    public void setDigitFlag(boolean digitFlagIn) {
+        digitFlag = digitFlagIn;
+    }
+
+    public boolean isSpecialCharFlag() {
+        return specialCharFlag;
+    }
+
+    public void setSpecialCharFlag(boolean specialCharFlagIn) {
+        specialCharFlag = specialCharFlagIn;
+    }
+
+    public String getSpecialChars() {
+        return specialChars;
+    }
+
+    public void setSpecialChars(String specialCharsIn) {
+        specialChars = specialCharsIn;
+    }
+
+    public boolean isConsecutiveCharsFlag() {
+        return consecutiveCharsFlag;
+    }
+
+    public void setConsecutiveCharsFlag(boolean consecutiveCharsFlagIn) {
+        consecutiveCharsFlag = consecutiveCharsFlagIn;
+    }
+
+    public boolean isRestrictedOccurrenceFlag() {
+        return restrictedOccurrenceFlag;
+    }
+
+    public void setRestrictedOccurrenceFlag(boolean restrictedOccurrenceFlagIn) {
+        restrictedOccurrenceFlag = restrictedOccurrenceFlagIn;
+    }
+
+    public int getMaxCharacterOccurrence() {
+        return maxCharacterOccurrence;
+    }
+
+    public void setMaxCharacterOccurrence(int maxCharacterOccurrenceIn) {
+        maxCharacterOccurrence = maxCharacterOccurrenceIn;
+    }
+
+    public int getMinLength() {
+        return minLength;
+    }
+
+    public void setMinLength(int minLengthIn) {
+        minLength = minLengthIn;
+    }
+
+    public int getMaxLength() {
+        return maxLength;
+    }
+
+    public void setMaxLength(int maxLengthIn) {
+        maxLength = maxLengthIn;
+    }
+}

java/code/src/com/redhat/rhn/common/util/validation/password/PasswordPolicyCheckFail.java

@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2024 SUSE LLC
+ *
+ * This software is licensed to you under the GNU General Public License,
+ * version 2 (GPLv2). There is NO WARRANTY for this software, express or
+ * implied, including the implied warranties of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. You should have received a copy of GPLv2
+ * along with this software; if not, see
+ * http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *
+ * Red Hat trademarks are not licensed under GPLv2. No permission is
+ * granted to use or replicate Red Hat trademarks that are incorporated
+ * in this software or its documentation.
+ */
+
+package com.redhat.rhn.common.util.validation.password;
+
+import com.redhat.rhn.common.localization.LocalizationService;
+import com.redhat.rhn.common.validator.ValidatorError;
+
+public class PasswordPolicyCheckFail {
+    private final String localizedMessageId;
+    private final String configurationParameter;
+
+    protected PasswordPolicyCheckFail(String localizedMessageIdIn, String configurationParameterIn) {
+        localizedMessageId = localizedMessageIdIn;
+        configurationParameter = configurationParameterIn;
+    }
+
+    public String getLocalizedMessageId() {
+        return localizedMessageId;
+    }
+
+    public String getConfigurationParameter() {
+        return configurationParameter;
+    }
+
+    public String getLocalizedErrorMessage() {
+        return LocalizationService.getInstance().getMessage(getLocalizedMessageId(), getConfigurationParameter());
+    }
+
+    /**
+     * Helper method for converting to ValidatorError for UserCommands
+     * @return the validator error
+     */
+    public ValidatorError toValidatorError() {
+        return new ValidatorError(getLocalizedMessageId(), getConfigurationParameter());
+    }
+
+}

java/code/src/com/redhat/rhn/common/util/validation/password/PasswordValidationException.java

@@ -0,0 +1,42 @@
+/*
+ * Copyright (c) 2024 SUSE LLC
+ *
+ * This software is licensed to you under the GNU General Public License,
+ * version 2 (GPLv2). There is NO WARRANTY for this software, express or
+ * implied, including the implied warranties of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. You should have received a copy of GPLv2
+ * along with this software; if not, see
+ * http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *
+ * Red Hat trademarks are not licensed under GPLv2. No permission is
+ * granted to use or replicate Red Hat trademarks that are incorporated
+ * in this software or its documentation.
+ */
+
+package com.redhat.rhn.common.util.validation.password;
+
+import java.util.List;
+import java.util.stream.Collectors;
+
+public class PasswordValidationException extends IllegalArgumentException {
+    private final transient List<PasswordPolicyCheckFail> validationErrors;
+
+    /**
+     * Exception class for password validation
+     * @param validationErrorsIn a list of validation errors
+     */
+    public PasswordValidationException(List<PasswordPolicyCheckFail> validationErrorsIn) {
+        validationErrors = validationErrorsIn;
+    }
+
+    public List<PasswordPolicyCheckFail> getValidationErrors() {
+        return validationErrors;
+    }
+
+    @Override
+    public String getMessage() {
+        return "Password validation errors: " + getValidationErrors().stream()
+                .map(PasswordPolicyCheckFail::getLocalizedMessageId)
+                .collect(Collectors.joining("; "));
+    }
+}