diff --git applications/party/template/party/profileblocks/UserLogin.ftl applications/party/template/party/profileblocks/UserLogin.ftl index bee922f209..b1a197916b 100644 --- applications/party/template/party/profileblocks/UserLogin.ftl +++ applications/party/template/party/profileblocks/UserLogin.ftl @@ -53,6 +53,9 @@ under the License. <#if security.hasEntityPermission("SECURITY", "_VIEW", session)> ${uiLabelMap.SecurityGroups} + <#if security.hasEntityPermission("IMPERSONATE", "_ADMIN", session)> + ${uiLabelMap.CommonImpersonate} + diff --git applications/party/template/party/profileblocks/Visits.ftl applications/party/template/party/profileblocks/Visits.ftl index 3f2486bc03..54f49fb5f8 100644 --- applications/party/template/party/profileblocks/Visits.ftl +++ applications/party/template/party/profileblocks/Visits.ftl @@ -31,6 +31,7 @@ under the License. ${uiLabelMap.PartyVisitId} ${uiLabelMap.PartyUserLogin} + ${uiLabelMap.CommonImpersonateUserLogin} ${uiLabelMap.PartyNewUser} ${uiLabelMap.PartyWebApp} ${uiLabelMap.PartyClientIP} @@ -39,11 +40,16 @@ under the License. <#list visits as visitObj> <#if (visitObj_index > 4)><#break> + <#assign userLoginHistory = EntityQuery.use(delegator).from("UserLoginHistory").where('visitId',visitObj.visitId!).queryFirst()!> + <#if userLoginHistory??> + <#assign impersonateUserLoginId = userLoginHistory.originUserLoginId!> + ${visitObj.visitId!} ${visitObj.userLoginId!} + ${impersonateUserLoginId!} ${visitObj.userCreated!} ${visitObj.webappName!} ${visitObj.clientIpAddress!} diff --git applications/party/widget/partymgr/PartyMenus.xml applications/party/widget/partymgr/PartyMenus.xml index 603a13ec14..c45ca6b77b 100644 --- applications/party/widget/partymgr/PartyMenus.xml +++ applications/party/widget/partymgr/PartyMenus.xml @@ -772,5 +772,11 @@ - + + + + + + + diff --git applications/party/widget/partymgr/PartyVisitForms.xml applications/party/widget/partymgr/PartyVisitForms.xml index c4120db184..a6f9d234fc 100644 --- applications/party/widget/partymgr/PartyVisitForms.xml +++ applications/party/widget/partymgr/PartyVisitForms.xml @@ -41,7 +41,6 @@ under the License. odd-row-style="alternate-row" header-row-style="header-row-2" default-table-style="basic-table hover-bar"> - @@ -51,7 +50,15 @@ under the License. - + + + + + + + + + @@ -64,6 +71,7 @@ under the License. + diff --git framework/common/config/CommonUiLabels.xml framework/common/config/CommonUiLabels.xml index fcc5fd8c17..149a0725db 100644 --- framework/common/config/CommonUiLabels.xml +++ framework/common/config/CommonUiLabels.xml @@ -5533,6 +5533,22 @@ 图片 圖片 + + Impersonate + Incarner + + + User impersonated + Utilisateur incarné + + + Impersonation in process + Incarnation en cours + + + Stop impersonation + Arrêter l'incarnation + Import 导入 @@ -8239,6 +8255,13 @@ 机构图标 機構商標 + + Herkunft Benutzeranmeldung ID + Origin User Login ID + Código de usuario de origen + Identifiant de connexion d'origine + Codice utente di origine + أخرى Jiný(á) diff --git framework/common/config/SecurityextUiLabels.xml framework/common/config/SecurityextUiLabels.xml index 7de0db2def..0f27a62e7c 100644 --- framework/common/config/SecurityextUiLabels.xml +++ framework/common/config/SecurityextUiLabels.xml @@ -107,6 +107,14 @@ 登录时发生下列错误：${errorMessage} 登入時發生錯誤: ${errorMessage}. + + You can't impersonate yourself ... What are you trying to do ? + Vous ne pouvez pas vous incarner vous même ... Qu'essayez-vous donc de faire ? + + + You need to be in FULLADMIN security group to impersonate another login at that permission level + Vous devez être dans le groupe de sécurité FULLADMIN pour incarner un autre identifiant avec ce niveau de permission + Ein neues Passwort wurde erzeugt und Ihnen per E-Mail zugeschickt. Überprüfen Sie bitte Ihren E-Mail-Eingang. A new password has been created and sent to you. Please check your Email. @@ -245,6 +253,10 @@ Problem getting User Login Security Question record. Problème durant la lecture de votre question de sécurité + + You already have an impersonation in process. Please leave it before continue + Vous avez déjà une incarnation en cours, veuillez mettre fin à celle-ci avant de continuer + You cannot login to this tenant No puede conectarse con esta organización diff --git framework/common/data/CommonSecurityGroupDemoData.xml framework/common/data/CommonSecurityGroupDemoData.xml index 62b91d67ef..0f91c425c5 100644 --- framework/common/data/CommonSecurityGroupDemoData.xml +++ framework/common/data/CommonSecurityGroupDemoData.xml @@ -40,4 +40,9 @@ + + + + + diff --git framework/common/data/CommonSecurityPermissionSeedData.xml framework/common/data/CommonSecurityPermissionSeedData.xml index 5ea573fcfd..0d69d81bc4 100644 --- framework/common/data/CommonSecurityPermissionSeedData.xml +++ framework/common/data/CommonSecurityPermissionSeedData.xml @@ -36,12 +36,15 @@ - + + + - + + diff --git framework/common/servicedef/services.xml framework/common/servicedef/services.xml index 348bebaba9..083f81d5d5 100644 --- framework/common/servicedef/services.xml +++ framework/common/servicedef/services.xml @@ -381,6 +381,18 @@ under the License. + + Used to Automatically Authenticate a username/password; create a UserLogin object + + + + + + + + + + Create a UserLogin diff --git framework/common/src/main/java/org/apache/ofbiz/common/login/LoginServices.java framework/common/src/main/java/org/apache/ofbiz/common/login/LoginServices.java index 43e50d95b1..00d23f5710 100644 --- framework/common/src/main/java/org/apache/ofbiz/common/login/LoginServices.java +++ framework/common/src/main/java/org/apache/ofbiz/common/login/LoginServices.java @@ -435,6 +435,91 @@ public class LoginServices { return result; } + /** + * Login service to authenticate no external auth username without password, storing history + * + * @return Map of results including (userLogin) GenericValue object + */ + public static Map userImpersonate(DispatchContext ctx, Map context) { + Locale locale = (Locale) context.get("locale"); + Delegator delegator = ctx.getDelegator(); + + Map result = ServiceUtil.returnSuccess(); + + String userLoginIdToImpersonate = (String) context.get("userLoginIdToImpersonate"); + GenericValue originUserLogin = (GenericValue) context.get("userLogin"); + + // get the visitId for the history entity + String visitId = (String) context.get("visitId"); + + if (UtilValidate.isEmpty(userLoginIdToImpersonate)) { + return ServiceUtil.returnError(UtilProperties.getMessage(resource, "loginservices.username_missing", locale)); + } else { + + if ("true".equalsIgnoreCase(EntityUtilProperties.getPropertyValue("security", "username.lowercase", delegator))) { + userLoginIdToImpersonate = userLoginIdToImpersonate.toLowerCase(); + } + + GenericValue userLogin; + + try { + userLogin = EntityQuery.use(delegator).from("UserLogin").where("userLoginId", userLoginIdToImpersonate).queryOne(); + } catch (GenericEntityException e) { + Debug.logError(e, module); + return ServiceUtil.returnError(e.getMessage()); + } + + if (userLogin != null && + originUserLogin.getString("userLoginId").equals(userLogin.getString("userLoginId"))) { + return ServiceUtil.returnError(UtilProperties.getMessage(resource, "loginevents.impersonate_yourself", locale)); + } + + if (userLogin != null) { + // Impersonate only active logins + if ((UtilValidate.isEmpty(userLogin.getString("enabled")) + || "Y".equals(userLogin.getString("enabled"))) + && UtilValidate.isEmpty(userLogin.getString("disabledBy"))) { + + Map userLoginSessionMap = LoginWorker.getUserLoginSession(userLogin); + + // grab the hasLoggedOut flag + boolean hasLoggedOut = userLogin.get("hasLoggedOut") != null && "Y".equalsIgnoreCase(userLogin.getString("hasLoggedOut")); + + // return the UserLoginSession Map + if (userLoginSessionMap != null) { + result.put("userLoginSession", userLoginSessionMap); + } + + result.put("userLogin", userLogin); + result.put("originUserLogin", originUserLogin); + try { + // update the hasLoggedOut flag + if (hasLoggedOut) { + userLogin.set("hasLoggedOut", "N"); + userLogin.store(); + } + + if ("true".equals(EntityUtilProperties.getPropertyValue("security", "store.login.history", delegator))) { + Map ulhCreateMap = UtilMisc.toMap("userLoginId", userLoginIdToImpersonate, "visitId", visitId, + "fromDate", UtilDateTime.nowTimestamp(), "successfulLogin", "Y"); + ulhCreateMap.put("partyId", userLogin.get("partyId")); + ulhCreateMap.put("originUserLoginId", originUserLogin.get("userLoginId")); + delegator.create("UserLoginHistory", ulhCreateMap); + } + } catch (GenericEntityException e) { + Debug.logError(e, module); + return ServiceUtil.returnError(e.getMessage()); + } + } else { + Map messageMap = UtilMisc.toMap("username", userLoginIdToImpersonate); + return ServiceUtil.returnError(UtilProperties.getMessage(resource, "loginservices.account_for_user_login_id_disabled", messageMap, locale)); + } + } + } + + return result; + } + public static void createUserLoginPasswordHistory(Delegator delegator,String userLoginId, String currentPassword) throws GenericEntityException{ int passwordChangeHistoryLimit = 0; try { diff --git framework/common/webcommon/WEB-INF/common-controller.xml framework/common/webcommon/WEB-INF/common-controller.xml index ed52c93241..3cde470944 100644 --- framework/common/webcommon/WEB-INF/common-controller.xml +++ framework/common/webcommon/WEB-INF/common-controller.xml @@ -53,6 +53,18 @@ under the License. + + + + + + + + + + + + diff --git framework/security/data/SecurityGroupDemoData.xml framework/security/data/SecurityGroupDemoData.xml index a2605e8997..bd903bcf73 100644 --- framework/security/data/SecurityGroupDemoData.xml +++ framework/security/data/SecurityGroupDemoData.xml @@ -25,7 +25,8 @@ under the License. - + + diff --git framework/security/entitydef/entitymodel.xml framework/security/entitydef/entitymodel.xml index 1a056e868a..4dd7913c09 100644 --- framework/security/entitydef/entitymodel.xml +++ framework/security/entitydef/entitymodel.xml @@ -106,11 +106,15 @@ under the License. + + + + errMsgList = new LinkedList<>(); + if (UtilValidate.isNotEmpty(session.getAttribute("originUserLogin"))) { + errMsgList.add(UtilProperties.getMessage(resourceWebapp, "loginevents.origin_username_is_present", UtilHttp.getLocale(request))); + } + if (UtilValidate.isEmpty(userLoginIdToImpersonate)) { + errMsgList.add(UtilProperties.getMessage(resourceWebapp, "loginevents.username_was_empty_reenter", UtilHttp.getLocale(request))); + } + + try { + GenericValue userLoginToImpersonate = delegator.findOne("UserLogin", false, "userLoginId", userLoginIdToImpersonate); + if (!hasBasePermission(userLoginToImpersonate, request)) { + errMsgList.add(UtilProperties.getMessage(resourceWebapp, "loginevents.unable_to_login_this_application", UtilHttp.getLocale(request))); + } + + //Check if user is trying to impersonate a full admin user + GenericValue userLoginSecurityGroup = EntityQuery.use(delegator).from("UserLoginSecurityGroup") + .where("userLoginId", userLoginIdToImpersonate, "groupId", "FULLADMIN").queryFirst(); + if (userLoginSecurityGroup != null) { + userLoginSecurityGroup = EntityQuery.use(delegator).from("UserLoginSecurityGroup") + .where("userLoginId",userLogin.getString("userLoginId"), "groupId", "FULLADMIN").queryFirst(); + if (userLoginSecurityGroup == null) { + String errMsg = UtilProperties.getMessage(resourceWebapp, "loginevents.impersonate_needsFullAdmin", UtilHttp.getLocale(request)); + Debug.logError(errMsg, module); + request.setAttribute("_ERROR_MESSAGE_", errMsg); + return "error"; + } + } + } catch (GenericEntityException e) { + String errMsg ="Error impersonating the userLoginId" + userLoginIdToImpersonate; + Debug.logError(e, errMsg, module); + errMsgList.add(errMsg); + request.setAttribute("_ERROR_MESSAGE_LIST_", errMsgList); + return "error"; + } + if (!errMsgList.isEmpty()) { + request.setAttribute("_ERROR_MESSAGE_LIST_", errMsgList); + return "error"; + } + + // After this line, contrary to in the login method, multi-tenant is not handled + ServletContext servletContext = session.getServletContext(); + + // Set default delegator + Debug.logInfo("Setting default delegator", module); + String delegatorName = delegator.getDelegatorBaseName(); + delegator = DelegatorFactory.getDelegator(delegatorName); + dispatcher = WebAppUtil.makeWebappDispatcher(servletContext, delegator); + + Map result; + try { + // get the visit id to pass to the userLogin for history + String visitId = VisitHandler.getVisitId(session); + result = dispatcher.runSync("userImpersonate", + UtilMisc.toMap("userLoginIdToImpersonate", userLoginIdToImpersonate, + "userLogin", userLogin,"visitId", visitId, "locale", UtilHttp.getLocale(request))); + } catch (GenericServiceException e) { + Debug.logError(e, "Error calling userImpersonate service", module); + Map messageMap = UtilMisc.toMap("errorMessage", e.getMessage()); + String errMsg = UtilProperties.getMessage(resourceWebapp, "loginevents.following_error_occurred_during_login", messageMap, UtilHttp.getLocale(request)); + request.setAttribute("_ERROR_MESSAGE_", errMsg); + return "error"; + } + + if (ModelService.RESPOND_SUCCESS.equals(result.get(ModelService.RESPONSE_MESSAGE))) { + userLogin = (GenericValue) result.get("userLogin"); + GenericValue originUserLogin = (GenericValue) result.get("originUserLogin"); + + Map userLoginSession = checkMap(result.get("userLoginSession"), String.class, Object.class); + + // check on JavaScriptEnabled + String javaScriptEnabled = "N"; + if ("Y".equals(request.getParameter("JavaScriptEnabled"))) { + javaScriptEnabled = "Y"; + } + try { + dispatcher.runSync("setUserPreference", UtilMisc.toMap("userPrefTypeId", "javaScriptEnabled", + "userPrefGroupTypeId", "GLOBAL_PREFERENCES", "userPrefValue", javaScriptEnabled, "userLogin", userLogin)); + } catch (GenericServiceException e) { + Debug.logError(e, "Error setting user preference", module); + } + + //add originUserLogin in session + session.setAttribute("originUserLogin", originUserLogin); + // finally do the main login routine to set everything else up in the session, etc + return doMainLogin(request, response, userLogin, userLoginSession); + } else { + Map messageMap = UtilMisc.toMap("errorMessage", result.get(ModelService.ERROR_MESSAGE)); + String errMsg = UtilProperties.getMessage(resourceWebapp, "loginevents.following_error_occurred_during_login", messageMap, UtilHttp.getLocale(request)); + request.setAttribute("_ERROR_MESSAGE_", errMsg); + return "error"; + } + } + + /** + * An HTTP WebEvent handler to reverse an impersonate login. + * + * @param request The HTTP request object for the current JSP or Servlet request. + * @param response The HTTP response object for the current JSP or Servlet request. + * @return Return a boolean which specifies whether or not the calling Servlet or + * JSP should generate its own content. This allows an event to override the default content. + */ + public static String depersonateLogin(HttpServletRequest request, HttpServletResponse response) { + HttpSession session = request.getSession(); + GenericValue originUserLogin = (GenericValue) session.getAttribute("originUserLogin"); + session.removeAttribute("originUserLogin"); + + List errMsgList = new LinkedList<>(); + if (null == originUserLogin) { + errMsgList.add(UtilProperties.getMessage(resourceWebapp, "loginevents.username_was_empty_reenter", UtilHttp.getLocale(request))); + } + if (!errMsgList.isEmpty()) { + request.setAttribute("_ERROR_MESSAGE_LIST_", errMsgList); + return "error"; + } + + // logout the impersonated user + autoLoginRemove(request, response); + logout(request, response); + // ignore the return value; even if the operation failed we want to set the new UserLogin + + // Log back the impersonating user + return doMainLogin(request, response, originUserLogin, null); + } + protected static void setWebContextObjects(HttpServletRequest request, HttpServletResponse response, Delegator delegator, LocalDispatcher dispatcher) { HttpSession session = request.getSession(); // NOTE: we do NOT want to set this in the servletContext, only in the request and session diff --git themes/bluelight/template/Header.ftl themes/bluelight/template/Header.ftl index 7cdc4a4995..8866f27d4c 100644 --- themes/bluelight/template/Header.ftl +++ themes/bluelight/template/Header.ftl @@ -113,6 +113,7 @@ under the License. + <#include "component://common-theme/template/ImpersonateBanner.ftl"/> diff --git themes/common-theme/template/ImpersonateBanner.ftl themes/common-theme/template/ImpersonateBanner.ftl new file mode 100644 index 0000000000..2dd3e9f2d1 --- /dev/null +++ themes/common-theme/template/ImpersonateBanner.ftl @@ -0,0 +1,11 @@ +<#if parameters.originUserLogin??> + ${uiLabelMap.CommonImpersonateTitle} +
+
+ × +

${uiLabelMap.CommonImpersonateTitle}

+

${uiLabelMap.CommonImpersonateUserLogin} : ${context.userLogin.userLoginId!}

+ ${uiLabelMap.CommonImpersonateStop} +
+
+ diff --git themes/common-theme/webapp/common/css/impersonate.css themes/common-theme/webapp/common/css/impersonate.css new file mode 100644 index 0000000000..25d7b5e54d --- /dev/null +++ themes/common-theme/webapp/common/css/impersonate.css @@ -0,0 +1,132 @@ +#impersonateBtn{ + position:fixed; + bottom:37px; + right:20px; + z-index:10000; + width: 79px; + height: 60px; + cursor:pointer; +} + +#impersonateBtn img{ + width:100%; + max-width:79px; + height:auto; + opacity: 0.6; + transition: opacity .6s; +} + +#impersonateBtn:hover img{ + opacity: 1; +} + +#impersonateContent:before { + content: ""; + display: none; + background: rgba(225, 225, 225, 0.8); + position: fixed; + top: 0; + left: 0; + right: 0; + bottom: 0; + z-index: 10; +} + +#impersonateContent:target:before { + display: block; +} + +#impersonateContent:target .impersonateModal { + opacity:1; + bottom: 117px; + right: 20px; + -webkit-transform: translate(0, 0); + -ms-transform: translate(0, 0); + transform: translate(0, 0); +} + +.impersonateModal { + opacity:0; + position: fixed; + background: #FFF; + text-align: center; + padding:30px 30px 15px 30px; + border-radius: 5px; + z-index: 11; + box-shadow: 0 0 5px 0 rgba(0, 0, 0, 0.15); + -webkit-transform: translate(0, -500%); + -ms-transform: translate(0, -500%); + transform: translate(0, -500%); + -webkit-transition: -webkit-transform 0.3s ease-out; + -moz-transition: -moz-transform 0.3s ease-out; + -o-transition: -o-transform 0.3s ease-out; + transition: transform 0.3s ease-out; +} + +.impersonateModal:before { + content: ""; + position: absolute; + bottom: -20px; + right: 37px; + border: 1em solid #FFF; + border-color: transparent transparent #FFF #FFF; + transform-origin: 0 0; + transform: rotate(-45deg); + box-shadow: -3px 3px 5px 0 rgba(0, 0, 0, 0.05); +} + +#impersonateContent .btn-close { + color: #aaa; + font-size: 25px; + text-decoration: none; + position: absolute; + right: 10px; + top: 10px; +} + +#impersonateContent .btn-close:hover { + color: #919191; +} + +#impersonateContent h3 { + font-size:26px; + font-weight: normal; + letter-spacing: 0.5px; + line-height: 24px; + color:#f08906; + border-bottom:1px solid #F2F2F2; + padding-bottom: 10px; + margin:15px 0 20px 0; +} + +#impersonateContent p { + font-size:18px; + color:#666; + letter-spacing: 0.3px; +} + +#impersonateContent p strong { + color:#005982; + font-weight:bold; +} + +#impersonateContent .btn{ + border-radius: 2px; + border:1px solid #005982; + padding:7px 12px; + text-transform:uppercase; + letter-spacing: 1px; + color:#005982; + margin:30px 0 10px 0; + line-height:22px; + display:inline-block; + -webkit-transition: 0.2s ease-out; + -moz-transition: 0.2s ease-out; + -o-transition: 0.2s ease-out; + transition: 0.2s ease-out; +} + +#impersonateContent .btn:hover{ + color:#f08906; + border-color:#f08906; +} diff --git themes/common-theme/webapp/images/img/impersonate-ico.png themes/common-theme/webapp/images/img/impersonate-ico.png new file mode 100644 index 0000000000..d12c252dfc Binary files /dev/null and themes/common-theme/webapp/images/img/impersonate-ico.png differ diff --git themes/common-theme/widget/CommonScreens.xml themes/common-theme/widget/CommonScreens.xml index 2b42e6694c..5aa38f7043 100644 --- themes/common-theme/widget/CommonScreens.xml +++ themes/common-theme/widget/CommonScreens.xml @@ -155,6 +155,7 @@ under the License. + diff --git themes/flatgrey/template/Header.ftl themes/flatgrey/template/Header.ftl index 56550f7077..e83cdc32db 100644 --- themes/flatgrey/template/Header.ftl +++ themes/flatgrey/template/Header.ftl @@ -93,6 +93,7 @@ under the License. <#assign organizationLogoLinkURL = "${layoutSettings.organizationLogoLinkUrl!}"> + <#include "component://common-theme/template/ImpersonateBanner.ftl"/> diff --git themes/rainbowstone/template/includes/TopAppBar.ftl themes/rainbowstone/template/includes/TopAppBar.ftl index cb05b52b07..6967ee9a47 100644 --- themes/rainbowstone/template/includes/TopAppBar.ftl +++ themes/rainbowstone/template/includes/TopAppBar.ftl @@ -30,6 +30,7 @@ under the License. +<#include "component://common-theme/template/ImpersonateBanner.ftl"/> diff --git themes/tomahawk/template/Header.ftl themes/tomahawk/template/Header.ftl index 87d4327cbf..7e04c8ff3e 100644 --- themes/tomahawk/template/Header.ftl +++ themes/tomahawk/template/Header.ftl @@ -98,6 +98,7 @@ under the License. <#assign organizationLogoLinkURL = "${layoutSettings.organizationLogoLinkUrl!}"> + <#include "component://common-theme/template/ImpersonateBanner.ftl"/>