Package com.broadleafcommerce.auth.user.session.environment

Class UserDetailsValidationProperties

java.lang.Object
com.broadleafcommerce.auth.user.session.environment.UserDetailsValidationProperties
@ConfigurationProperties("broadleaf.auth.user-details-validation") public class UserDetailsValidationProperties extends Object
Properties configuring validation of OAuth2UserDetails.

  • Constructor Details

    • UserDetailsValidationProperties

      public UserDetailsValidationProperties()

  • Method Details

    • isSkipCredExpCheckForThirdPartyLogin

      public boolean isSkipCredExpCheckForThirdPartyLogin()

      Components such as OAuth2SessionAuthenticationProvider are responsible for rejecting authentication attempts if the associated user's UserDetails.isCredentialsNonExpired() flag (AKA User.isChangePasswordRequired()) has a value that should prevent login.

      However, this validation typically does not make sense if the user is logging in via a third party identity provider (3PIDP). In that case, whether their Broadleaf-managed credentials are expired or require change should not have any bearing on their ability to log in. This is especially relevant for new-user sign-ups, where a user may be created without a password and with the User.isChangePasswordRequired() flag set - in this state, the user should still be able to log in via 3PIDP without being forced to reset/establish a Broadleaf-managed password.

      This property toggles whether the 'expired credentials' validation is engaged if the system detects the user has logged in via a 3PIDP. If true, credentials expiration checks are skipped when the user has signed in via 3PIDP. If false, credentials expiration checks will engage even when the user is attempting to sign in with 3PIDP.

      Note - to be clear, this setting does not impact the validations that run when the user is signing in directly via BLC (first party form login, etc). The validations in OAuth2SessionAuthenticationProvider and the first-party-login FormLoginAuthenticationProvider (specifically the 'pre' and 'post' authentication checks flows) will continue executing as normal.

    • setSkipCredExpCheckForThirdPartyLogin

      public void setSkipCredExpCheckForThirdPartyLogin(boolean skipCredExpCheckForThirdPartyLogin)

      Components such as OAuth2SessionAuthenticationProvider are responsible for rejecting authentication attempts if the associated user's UserDetails.isCredentialsNonExpired() flag (AKA User.isChangePasswordRequired()) has a value that should prevent login.

      However, this validation typically does not make sense if the user is logging in via a third party identity provider (3PIDP). In that case, whether their Broadleaf-managed credentials are expired or require change should not have any bearing on their ability to log in. This is especially relevant for new-user sign-ups, where a user may be created without a password and with the User.isChangePasswordRequired() flag set - in this state, the user should still be able to log in via 3PIDP without being forced to reset/establish a Broadleaf-managed password.

      This property toggles whether the 'expired credentials' validation is engaged if the system detects the user has logged in via a 3PIDP. If true, credentials expiration checks are skipped when the user has signed in via 3PIDP. If false, credentials expiration checks will engage even when the user is attempting to sign in with 3PIDP.

      Note - to be clear, this setting does not impact the validations that run when the user is signing in directly via BLC (first party form login, etc). The validations in OAuth2SessionAuthenticationProvider and the first-party-login FormLoginAuthenticationProvider (specifically the 'pre' and 'post' authentication checks flows) will continue executing as normal.

    • equals

      public boolean equals(Object o)
      Overrides:
      equals in class Object

    • canEqual

      protected boolean canEqual(Object other)

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object