mirror of
https://github.com/bitwarden/server.git
synced 2025-07-01 08:02:49 -05:00
624 lines
26 KiB
C#
624 lines
26 KiB
C#
using System.ComponentModel.DataAnnotations;
|
|
using System.Reflection;
|
|
using System.Security.Claims;
|
|
using System.Text.Json;
|
|
using Bit.Core.Context;
|
|
using Bit.Core.Entities;
|
|
using Bit.Core.Enums;
|
|
using Bit.Core.Identity;
|
|
using Bit.Core.Models;
|
|
using Bit.Core.Models.Api;
|
|
using Bit.Core.Models.Data.Organizations;
|
|
using Bit.Core.Repositories;
|
|
using Bit.Core.Services;
|
|
using Bit.Core.Settings;
|
|
using Bit.Core.Utilities;
|
|
using IdentityServer4.Validation;
|
|
using Microsoft.AspNetCore.Identity;
|
|
using Microsoft.Extensions.Logging;
|
|
|
|
namespace Bit.Core.IdentityServer
|
|
{
|
|
public abstract class BaseRequestValidator<T> where T : class
|
|
{
|
|
private UserManager<User> _userManager;
|
|
private readonly IDeviceRepository _deviceRepository;
|
|
private readonly IDeviceService _deviceService;
|
|
private readonly IUserService _userService;
|
|
private readonly IEventService _eventService;
|
|
private readonly IOrganizationDuoWebTokenProvider _organizationDuoWebTokenProvider;
|
|
private readonly IOrganizationRepository _organizationRepository;
|
|
private readonly IOrganizationUserRepository _organizationUserRepository;
|
|
private readonly IApplicationCacheService _applicationCacheService;
|
|
private readonly IMailService _mailService;
|
|
private readonly ILogger<ResourceOwnerPasswordValidator> _logger;
|
|
private readonly ICurrentContext _currentContext;
|
|
private readonly GlobalSettings _globalSettings;
|
|
private readonly IPolicyRepository _policyRepository;
|
|
private readonly IUserRepository _userRepository;
|
|
private readonly ICaptchaValidationService _captchaValidationService;
|
|
|
|
public BaseRequestValidator(
|
|
UserManager<User> userManager,
|
|
IDeviceRepository deviceRepository,
|
|
IDeviceService deviceService,
|
|
IUserService userService,
|
|
IEventService eventService,
|
|
IOrganizationDuoWebTokenProvider organizationDuoWebTokenProvider,
|
|
IOrganizationRepository organizationRepository,
|
|
IOrganizationUserRepository organizationUserRepository,
|
|
IApplicationCacheService applicationCacheService,
|
|
IMailService mailService,
|
|
ILogger<ResourceOwnerPasswordValidator> logger,
|
|
ICurrentContext currentContext,
|
|
GlobalSettings globalSettings,
|
|
IPolicyRepository policyRepository,
|
|
IUserRepository userRepository,
|
|
ICaptchaValidationService captchaValidationService)
|
|
{
|
|
_userManager = userManager;
|
|
_deviceRepository = deviceRepository;
|
|
_deviceService = deviceService;
|
|
_userService = userService;
|
|
_eventService = eventService;
|
|
_organizationDuoWebTokenProvider = organizationDuoWebTokenProvider;
|
|
_organizationRepository = organizationRepository;
|
|
_organizationUserRepository = organizationUserRepository;
|
|
_applicationCacheService = applicationCacheService;
|
|
_mailService = mailService;
|
|
_logger = logger;
|
|
_currentContext = currentContext;
|
|
_globalSettings = globalSettings;
|
|
_policyRepository = policyRepository;
|
|
_userRepository = userRepository;
|
|
_captchaValidationService = captchaValidationService;
|
|
}
|
|
|
|
protected async Task ValidateAsync(T context, ValidatedTokenRequest request,
|
|
CustomValidatorRequestContext validatorContext)
|
|
{
|
|
var isBot = (validatorContext.CaptchaResponse?.IsBot ?? false);
|
|
if (isBot)
|
|
{
|
|
_logger.LogInformation(Constants.BypassFiltersEventId,
|
|
"Login attempt for {0} detected as a captcha bot with score {1}.",
|
|
request.UserName, validatorContext.CaptchaResponse.Score);
|
|
}
|
|
|
|
var twoFactorToken = request.Raw["TwoFactorToken"]?.ToString();
|
|
var twoFactorProvider = request.Raw["TwoFactorProvider"]?.ToString();
|
|
var twoFactorRemember = request.Raw["TwoFactorRemember"]?.ToString() == "1";
|
|
var twoFactorRequest = !string.IsNullOrWhiteSpace(twoFactorToken) &&
|
|
!string.IsNullOrWhiteSpace(twoFactorProvider);
|
|
|
|
var valid = await ValidateContextAsync(context, validatorContext);
|
|
var user = validatorContext.User;
|
|
if (!valid)
|
|
{
|
|
await UpdateFailedAuthDetailsAsync(user, false, !validatorContext.KnownDevice);
|
|
}
|
|
if (!valid || isBot)
|
|
{
|
|
await BuildErrorResultAsync("Username or password is incorrect. Try again.", false, context, user);
|
|
return;
|
|
}
|
|
|
|
var (isTwoFactorRequired, requires2FABecauseNewDevice, twoFactorOrganization) = await RequiresTwoFactorAsync(user, request);
|
|
if (isTwoFactorRequired)
|
|
{
|
|
// Just defaulting it
|
|
var twoFactorProviderType = TwoFactorProviderType.Authenticator;
|
|
if (!twoFactorRequest || !Enum.TryParse(twoFactorProvider, out twoFactorProviderType))
|
|
{
|
|
await BuildTwoFactorResultAsync(user, twoFactorOrganization, context, requires2FABecauseNewDevice);
|
|
return;
|
|
}
|
|
|
|
BeforeVerifyTwoFactor(user, twoFactorProviderType, requires2FABecauseNewDevice);
|
|
|
|
var verified = await VerifyTwoFactor(user, twoFactorOrganization,
|
|
twoFactorProviderType, twoFactorToken);
|
|
|
|
AfterVerifyTwoFactor(user, twoFactorProviderType, requires2FABecauseNewDevice);
|
|
|
|
if ((!verified || isBot) && twoFactorProviderType != TwoFactorProviderType.Remember)
|
|
{
|
|
await UpdateFailedAuthDetailsAsync(user, true, !validatorContext.KnownDevice);
|
|
await BuildErrorResultAsync("Two-step token is invalid. Try again.", true, context, user);
|
|
return;
|
|
}
|
|
else if ((!verified || isBot) && twoFactorProviderType == TwoFactorProviderType.Remember)
|
|
{
|
|
// Delay for brute force.
|
|
await Task.Delay(2000);
|
|
await BuildTwoFactorResultAsync(user, twoFactorOrganization, context, requires2FABecauseNewDevice);
|
|
return;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
twoFactorRequest = false;
|
|
twoFactorRemember = false;
|
|
twoFactorToken = null;
|
|
}
|
|
|
|
// Returns true if can finish validation process
|
|
if (await IsValidAuthTypeAsync(user, request.GrantType))
|
|
{
|
|
var device = await SaveDeviceAsync(user, request);
|
|
if (device == null)
|
|
{
|
|
await BuildErrorResultAsync("No device information provided.", false, context, user);
|
|
return;
|
|
}
|
|
await BuildSuccessResultAsync(user, context, device, twoFactorRequest && twoFactorRemember);
|
|
}
|
|
else
|
|
{
|
|
SetSsoResult(context, new Dictionary<string, object>
|
|
{{
|
|
"ErrorModel", new ErrorResponseModel("SSO authentication is required.")
|
|
}});
|
|
}
|
|
}
|
|
|
|
protected abstract Task<bool> ValidateContextAsync(T context, CustomValidatorRequestContext validatorContext);
|
|
|
|
protected async Task BuildSuccessResultAsync(User user, T context, Device device, bool sendRememberToken)
|
|
{
|
|
await _eventService.LogUserEventAsync(user.Id, EventType.User_LoggedIn);
|
|
|
|
var claims = new List<Claim>();
|
|
|
|
if (device != null)
|
|
{
|
|
claims.Add(new Claim("device", device.Identifier));
|
|
}
|
|
|
|
var customResponse = new Dictionary<string, object>();
|
|
if (!string.IsNullOrWhiteSpace(user.PrivateKey))
|
|
{
|
|
customResponse.Add("PrivateKey", user.PrivateKey);
|
|
}
|
|
|
|
if (!string.IsNullOrWhiteSpace(user.Key))
|
|
{
|
|
customResponse.Add("Key", user.Key);
|
|
}
|
|
|
|
customResponse.Add("ForcePasswordReset", user.ForcePasswordReset);
|
|
customResponse.Add("ResetMasterPassword", string.IsNullOrWhiteSpace(user.MasterPassword));
|
|
customResponse.Add("Kdf", (byte)user.Kdf);
|
|
customResponse.Add("KdfIterations", user.KdfIterations);
|
|
|
|
if (sendRememberToken)
|
|
{
|
|
var token = await _userManager.GenerateTwoFactorTokenAsync(user,
|
|
CoreHelpers.CustomProviderName(TwoFactorProviderType.Remember));
|
|
customResponse.Add("TwoFactorToken", token);
|
|
}
|
|
|
|
await ResetFailedAuthDetailsAsync(user);
|
|
await SetSuccessResult(context, user, claims, customResponse);
|
|
}
|
|
|
|
protected async Task BuildTwoFactorResultAsync(User user, Organization organization, T context, bool requires2FABecauseNewDevice)
|
|
{
|
|
var providerKeys = new List<byte>();
|
|
var providers = new Dictionary<string, Dictionary<string, object>>();
|
|
|
|
var enabledProviders = new List<KeyValuePair<TwoFactorProviderType, TwoFactorProvider>>();
|
|
if (organization?.GetTwoFactorProviders() != null)
|
|
{
|
|
enabledProviders.AddRange(organization.GetTwoFactorProviders().Where(
|
|
p => organization.TwoFactorProviderIsEnabled(p.Key)));
|
|
}
|
|
|
|
if (user.GetTwoFactorProviders() != null)
|
|
{
|
|
foreach (var p in user.GetTwoFactorProviders())
|
|
{
|
|
if (await _userService.TwoFactorProviderIsEnabledAsync(p.Key, user))
|
|
{
|
|
enabledProviders.Add(p);
|
|
}
|
|
}
|
|
}
|
|
|
|
if (!enabledProviders.Any())
|
|
{
|
|
if (!requires2FABecauseNewDevice)
|
|
{
|
|
await BuildErrorResultAsync("No two-step providers enabled.", false, context, user);
|
|
return;
|
|
}
|
|
|
|
var emailProvider = new TwoFactorProvider
|
|
{
|
|
MetaData = new Dictionary<string, object> { ["Email"] = user.Email.ToLowerInvariant() },
|
|
Enabled = true
|
|
};
|
|
enabledProviders.Add(new KeyValuePair<TwoFactorProviderType, TwoFactorProvider>(
|
|
TwoFactorProviderType.Email, emailProvider));
|
|
user.SetTwoFactorProviders(new Dictionary<TwoFactorProviderType, TwoFactorProvider>
|
|
{
|
|
[TwoFactorProviderType.Email] = emailProvider
|
|
});
|
|
}
|
|
|
|
foreach (var provider in enabledProviders)
|
|
{
|
|
providerKeys.Add((byte)provider.Key);
|
|
var infoDict = await BuildTwoFactorParams(organization, user, provider.Key, provider.Value);
|
|
providers.Add(((byte)provider.Key).ToString(), infoDict);
|
|
}
|
|
|
|
SetTwoFactorResult(context,
|
|
new Dictionary<string, object>
|
|
{
|
|
{ "TwoFactorProviders", providers.Keys },
|
|
{ "TwoFactorProviders2", providers }
|
|
});
|
|
|
|
if (enabledProviders.Count() == 1 && enabledProviders.First().Key == TwoFactorProviderType.Email)
|
|
{
|
|
// Send email now if this is their only 2FA method
|
|
await _userService.SendTwoFactorEmailAsync(user, requires2FABecauseNewDevice);
|
|
}
|
|
}
|
|
|
|
protected async Task BuildErrorResultAsync(string message, bool twoFactorRequest, T context, User user)
|
|
{
|
|
if (user != null)
|
|
{
|
|
await _eventService.LogUserEventAsync(user.Id,
|
|
twoFactorRequest ? EventType.User_FailedLogIn2fa : EventType.User_FailedLogIn);
|
|
}
|
|
|
|
if (_globalSettings.SelfHosted)
|
|
{
|
|
_logger.LogWarning(Constants.BypassFiltersEventId,
|
|
string.Format("Failed login attempt{0}{1}", twoFactorRequest ? ", 2FA invalid." : ".",
|
|
$" {_currentContext.IpAddress}"));
|
|
}
|
|
|
|
await Task.Delay(2000); // Delay for brute force.
|
|
SetErrorResult(context,
|
|
new Dictionary<string, object>
|
|
{{
|
|
"ErrorModel", new ErrorResponseModel(message)
|
|
}});
|
|
}
|
|
|
|
protected abstract void SetTwoFactorResult(T context, Dictionary<string, object> customResponse);
|
|
|
|
protected abstract void SetSsoResult(T context, Dictionary<string, object> customResponse);
|
|
|
|
protected abstract Task SetSuccessResult(T context, User user, List<Claim> claims,
|
|
Dictionary<string, object> customResponse);
|
|
|
|
protected abstract void SetErrorResult(T context, Dictionary<string, object> customResponse);
|
|
|
|
private async Task<Tuple<bool, bool, Organization>> RequiresTwoFactorAsync(User user, ValidatedTokenRequest request)
|
|
{
|
|
if (request.GrantType == "client_credentials")
|
|
{
|
|
// Do not require MFA for api key logins
|
|
return new Tuple<bool, bool, Organization>(false, false, null);
|
|
}
|
|
|
|
var individualRequired = _userManager.SupportsUserTwoFactor &&
|
|
await _userManager.GetTwoFactorEnabledAsync(user) &&
|
|
(await _userManager.GetValidTwoFactorProvidersAsync(user)).Count > 0;
|
|
|
|
Organization firstEnabledOrg = null;
|
|
var orgs = (await _currentContext.OrganizationMembershipAsync(_organizationUserRepository, user.Id))
|
|
.ToList();
|
|
if (orgs.Any())
|
|
{
|
|
var orgAbilities = await _applicationCacheService.GetOrganizationAbilitiesAsync();
|
|
var twoFactorOrgs = orgs.Where(o => OrgUsing2fa(orgAbilities, o.Id));
|
|
if (twoFactorOrgs.Any())
|
|
{
|
|
var userOrgs = await _organizationRepository.GetManyByUserIdAsync(user.Id);
|
|
firstEnabledOrg = userOrgs.FirstOrDefault(
|
|
o => orgs.Any(om => om.Id == o.Id) && o.TwoFactorIsEnabled());
|
|
}
|
|
}
|
|
|
|
var requires2FA = individualRequired || firstEnabledOrg != null;
|
|
var requires2FABecauseNewDevice = !requires2FA
|
|
&&
|
|
await _userService.Needs2FABecauseNewDeviceAsync(
|
|
user,
|
|
GetDeviceFromRequest(request)?.Identifier,
|
|
request.GrantType);
|
|
|
|
requires2FA = requires2FA || requires2FABecauseNewDevice;
|
|
|
|
return new Tuple<bool, bool, Organization>(requires2FA, requires2FABecauseNewDevice, firstEnabledOrg);
|
|
}
|
|
|
|
private async Task<bool> IsValidAuthTypeAsync(User user, string grantType)
|
|
{
|
|
if (grantType == "authorization_code" || grantType == "client_credentials")
|
|
{
|
|
// Already using SSO to authorize, finish successfully
|
|
// Or login via api key, skip SSO requirement
|
|
return true;
|
|
}
|
|
|
|
// Is user apart of any orgs? Use cache for initial checks.
|
|
var orgs = (await _currentContext.OrganizationMembershipAsync(_organizationUserRepository, user.Id))
|
|
.ToList();
|
|
if (orgs.Any())
|
|
{
|
|
// Get all org abilities
|
|
var orgAbilities = await _applicationCacheService.GetOrganizationAbilitiesAsync();
|
|
// Parse all user orgs that are enabled and have the ability to use sso
|
|
var ssoOrgs = orgs.Where(o => OrgCanUseSso(orgAbilities, o.Id));
|
|
if (ssoOrgs.Any())
|
|
{
|
|
// Parse users orgs and determine if require sso policy is enabled
|
|
var userOrgs = await _organizationUserRepository.GetManyDetailsByUserAsync(user.Id,
|
|
OrganizationUserStatusType.Confirmed);
|
|
foreach (var userOrg in userOrgs.Where(o => o.Enabled && o.UseSso))
|
|
{
|
|
var orgPolicy = await _policyRepository.GetByOrganizationIdTypeAsync(userOrg.OrganizationId,
|
|
PolicyType.RequireSso);
|
|
// Owners and Admins are exempt from this policy
|
|
if (orgPolicy != null && orgPolicy.Enabled &&
|
|
userOrg.Type != OrganizationUserType.Owner && userOrg.Type != OrganizationUserType.Admin)
|
|
{
|
|
return false;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// Default - continue validation process
|
|
return true;
|
|
}
|
|
|
|
private bool OrgUsing2fa(IDictionary<Guid, OrganizationAbility> orgAbilities, Guid orgId)
|
|
{
|
|
return orgAbilities != null && orgAbilities.ContainsKey(orgId) &&
|
|
orgAbilities[orgId].Enabled && orgAbilities[orgId].Using2fa;
|
|
}
|
|
|
|
private bool OrgCanUseSso(IDictionary<Guid, OrganizationAbility> orgAbilities, Guid orgId)
|
|
{
|
|
return orgAbilities != null && orgAbilities.ContainsKey(orgId) &&
|
|
orgAbilities[orgId].Enabled && orgAbilities[orgId].UseSso;
|
|
}
|
|
|
|
private Device GetDeviceFromRequest(ValidatedRequest request)
|
|
{
|
|
var deviceIdentifier = request.Raw["DeviceIdentifier"]?.ToString();
|
|
var deviceType = request.Raw["DeviceType"]?.ToString();
|
|
var deviceName = request.Raw["DeviceName"]?.ToString();
|
|
var devicePushToken = request.Raw["DevicePushToken"]?.ToString();
|
|
|
|
if (string.IsNullOrWhiteSpace(deviceIdentifier) || string.IsNullOrWhiteSpace(deviceType) ||
|
|
string.IsNullOrWhiteSpace(deviceName) || !Enum.TryParse(deviceType, out DeviceType type))
|
|
{
|
|
return null;
|
|
}
|
|
|
|
return new Device
|
|
{
|
|
Identifier = deviceIdentifier,
|
|
Name = deviceName,
|
|
Type = type,
|
|
PushToken = string.IsNullOrWhiteSpace(devicePushToken) ? null : devicePushToken
|
|
};
|
|
}
|
|
|
|
private void BeforeVerifyTwoFactor(User user, TwoFactorProviderType type, bool requires2FABecauseNewDevice)
|
|
{
|
|
if (type == TwoFactorProviderType.Email && requires2FABecauseNewDevice)
|
|
{
|
|
user.SetTwoFactorProviders(new Dictionary<TwoFactorProviderType, TwoFactorProvider>
|
|
{
|
|
[TwoFactorProviderType.Email] = new TwoFactorProvider
|
|
{
|
|
MetaData = new Dictionary<string, object> { ["Email"] = user.Email.ToLowerInvariant() },
|
|
Enabled = true
|
|
}
|
|
});
|
|
}
|
|
}
|
|
|
|
private void AfterVerifyTwoFactor(User user, TwoFactorProviderType type, bool requires2FABecauseNewDevice)
|
|
{
|
|
if (type == TwoFactorProviderType.Email && requires2FABecauseNewDevice)
|
|
{
|
|
user.ClearTwoFactorProviders();
|
|
}
|
|
}
|
|
|
|
private async Task<bool> VerifyTwoFactor(User user, Organization organization, TwoFactorProviderType type,
|
|
string token)
|
|
{
|
|
switch (type)
|
|
{
|
|
case TwoFactorProviderType.Authenticator:
|
|
case TwoFactorProviderType.Email:
|
|
case TwoFactorProviderType.Duo:
|
|
case TwoFactorProviderType.YubiKey:
|
|
case TwoFactorProviderType.WebAuthn:
|
|
case TwoFactorProviderType.Remember:
|
|
if (type != TwoFactorProviderType.Remember &&
|
|
!(await _userService.TwoFactorProviderIsEnabledAsync(type, user)))
|
|
{
|
|
return false;
|
|
}
|
|
return await _userManager.VerifyTwoFactorTokenAsync(user,
|
|
CoreHelpers.CustomProviderName(type), token);
|
|
case TwoFactorProviderType.OrganizationDuo:
|
|
if (!organization?.TwoFactorProviderIsEnabled(type) ?? true)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
return await _organizationDuoWebTokenProvider.ValidateAsync(token, organization, user);
|
|
default:
|
|
return false;
|
|
}
|
|
}
|
|
|
|
private async Task<Dictionary<string, object>> BuildTwoFactorParams(Organization organization, User user,
|
|
TwoFactorProviderType type, TwoFactorProvider provider)
|
|
{
|
|
switch (type)
|
|
{
|
|
case TwoFactorProviderType.Duo:
|
|
case TwoFactorProviderType.WebAuthn:
|
|
case TwoFactorProviderType.Email:
|
|
case TwoFactorProviderType.YubiKey:
|
|
if (!(await _userService.TwoFactorProviderIsEnabledAsync(type, user)))
|
|
{
|
|
return null;
|
|
}
|
|
|
|
var token = await _userManager.GenerateTwoFactorTokenAsync(user,
|
|
CoreHelpers.CustomProviderName(type));
|
|
if (type == TwoFactorProviderType.Duo)
|
|
{
|
|
return new Dictionary<string, object>
|
|
{
|
|
["Host"] = provider.MetaData["Host"],
|
|
["Signature"] = token
|
|
};
|
|
}
|
|
else if (type == TwoFactorProviderType.WebAuthn)
|
|
{
|
|
if (token == null)
|
|
{
|
|
return null;
|
|
}
|
|
|
|
return JsonSerializer.Deserialize<Dictionary<string, object>>(token);
|
|
}
|
|
else if (type == TwoFactorProviderType.Email)
|
|
{
|
|
return new Dictionary<string, object>
|
|
{
|
|
["Email"] = token
|
|
};
|
|
}
|
|
else if (type == TwoFactorProviderType.YubiKey)
|
|
{
|
|
return new Dictionary<string, object>
|
|
{
|
|
["Nfc"] = (bool)provider.MetaData["Nfc"]
|
|
};
|
|
}
|
|
return null;
|
|
case TwoFactorProviderType.OrganizationDuo:
|
|
if (await _organizationDuoWebTokenProvider.CanGenerateTwoFactorTokenAsync(organization))
|
|
{
|
|
return new Dictionary<string, object>
|
|
{
|
|
["Host"] = provider.MetaData["Host"],
|
|
["Signature"] = await _organizationDuoWebTokenProvider.GenerateAsync(organization, user)
|
|
};
|
|
}
|
|
return null;
|
|
default:
|
|
return null;
|
|
}
|
|
}
|
|
|
|
protected async Task<bool> KnownDeviceAsync(User user, ValidatedTokenRequest request) =>
|
|
(await GetKnownDeviceAsync(user, request)) != default;
|
|
|
|
protected async Task<Device> GetKnownDeviceAsync(User user, ValidatedTokenRequest request)
|
|
{
|
|
if (user == null)
|
|
{
|
|
return default;
|
|
}
|
|
|
|
return await _deviceRepository.GetByIdentifierAsync(GetDeviceFromRequest(request).Identifier, user.Id);
|
|
}
|
|
|
|
private async Task<Device> SaveDeviceAsync(User user, ValidatedTokenRequest request)
|
|
{
|
|
var device = GetDeviceFromRequest(request);
|
|
if (device != null)
|
|
{
|
|
var existingDevice = await GetKnownDeviceAsync(user, request);
|
|
if (existingDevice == null)
|
|
{
|
|
device.UserId = user.Id;
|
|
await _deviceService.SaveAsync(device);
|
|
|
|
var now = DateTime.UtcNow;
|
|
if (now - user.CreationDate > TimeSpan.FromMinutes(10))
|
|
{
|
|
var deviceType = device.Type.GetType().GetMember(device.Type.ToString())
|
|
.FirstOrDefault()?.GetCustomAttribute<DisplayAttribute>()?.GetName();
|
|
if (!_globalSettings.DisableEmailNewDevice)
|
|
{
|
|
await _mailService.SendNewDeviceLoggedInEmail(user.Email, deviceType, now,
|
|
_currentContext.IpAddress);
|
|
}
|
|
}
|
|
|
|
return device;
|
|
}
|
|
|
|
return existingDevice;
|
|
}
|
|
|
|
return null;
|
|
}
|
|
|
|
private async Task ResetFailedAuthDetailsAsync(User user)
|
|
{
|
|
// Early escape if db hit not necessary
|
|
if (user == null || user.FailedLoginCount == 0)
|
|
{
|
|
return;
|
|
}
|
|
|
|
user.FailedLoginCount = 0;
|
|
user.RevisionDate = DateTime.UtcNow;
|
|
await _userRepository.ReplaceAsync(user);
|
|
}
|
|
|
|
private async Task UpdateFailedAuthDetailsAsync(User user, bool twoFactorInvalid, bool unknownDevice)
|
|
{
|
|
if (user == null)
|
|
{
|
|
return;
|
|
}
|
|
|
|
var utcNow = DateTime.UtcNow;
|
|
user.FailedLoginCount = ++user.FailedLoginCount;
|
|
user.LastFailedLoginDate = user.RevisionDate = utcNow;
|
|
await _userRepository.ReplaceAsync(user);
|
|
|
|
if (ValidateFailedAuthEmailConditions(unknownDevice, user))
|
|
{
|
|
if (twoFactorInvalid)
|
|
{
|
|
await _mailService.SendFailedTwoFactorAttemptsEmailAsync(user.Email, utcNow, _currentContext.IpAddress);
|
|
}
|
|
else
|
|
{
|
|
await _mailService.SendFailedLoginAttemptsEmailAsync(user.Email, utcNow, _currentContext.IpAddress);
|
|
}
|
|
}
|
|
}
|
|
|
|
private bool ValidateFailedAuthEmailConditions(bool unknownDevice, User user)
|
|
{
|
|
var failedLoginCeiling = _globalSettings.Captcha.MaximumFailedLoginAttempts;
|
|
var failedLoginCount = user?.FailedLoginCount ?? 0;
|
|
return unknownDevice && failedLoginCeiling > 0 && failedLoginCount == failedLoginCeiling;
|
|
}
|
|
}
|
|
}
|