1 package FS::Password_Mixin;
3 use FS::Record qw(qsearch);
5 use FS::password_history;
6 use Authen::Passphrase;
7 use Authen::Passphrase::BlowfishCrypt;
8 # https://rt.cpan.org/Ticket/Display.html?id=72743
12 FS::UID->install_callback( sub {
13 $conf = FS::Conf->new;
15 #eval "use Authen::Passphrase::BlowfishCrypt;";
18 our $me = '[' . __PACKAGE__ . ']';
20 our $BLOWFISH_COST = 10;
24 FS::Password_Mixin - Object methods for accounts that have passwords governed
25 by the password policy.
31 =item is_password_allowed PASSWORD
33 Checks the password against the system password policy. Returns an error
34 message on failure, an empty string on success.
36 This MUST NOT be called from check(). It should be called by the office UI,
37 self-service ClientAPI, or other I<user-interactive> code that processes a
38 password change, and only if the user has taken some action with the intent
39 of changing the password.
43 sub is_password_allowed {
47 # check length and complexity here
49 if ( $conf->config('password-no_reuse') =~ /^(\d+)$/ ) {
53 # "the last N" passwords includes the current password and the N-1
54 # passwords before that.
55 warn "$me checking password reuse limit of $no_reuse\n" if $DEBUG;
56 my @latest = qsearch({
57 'table' => 'password_history',
58 'hashref' => { $self->password_history_key => $self->get($self->primary_key) },
59 'order_by' => " ORDER BY created DESC LIMIT $no_reuse",
62 # don't check the first one; reusing the current password is allowed.
65 foreach my $history (@latest) {
66 warn "$me previous password created ".$history->created."\n" if $DEBUG;
67 if ( $history->password_equals($password) ) {
69 if ( $no_reuse == 1 ) {
70 $message = "This password is the same as your previous password.";
72 $message = "This password was one of the last $no_reuse passwords on this account.";
78 } # end of no_reuse checking
83 =item password_history_key
85 Returns the name of the field in L<FS::password_history> that's the foreign
90 sub password_history_key {
92 $self->table . '__' . $self->primary_key;
95 =item insert_password_history
97 Creates a L<FS::password_history> record linked to this object, with its
102 sub insert_password_history {
104 my $encoding = $self->_password_encoding;
105 my $password = $self->_password;
108 if ( $encoding eq 'bcrypt' ) {
109 # our format, used for contact and access_user passwords
110 my ($cost, $salt, $hash) = split(',', $password);
111 $auth = Authen::Passphrase::BlowfishCrypt->new(
113 salt_base64 => $salt,
114 hash_base64 => $hash,
117 } elsif ( $encoding eq 'crypt' ) {
119 # it's smart enough to figure this out
120 $auth = Authen::Passphrase->from_crypt($password);
122 } elsif ( $encoding eq 'ldap' ) {
124 $password =~ s/^{PLAIN}/{CLEARTEXT}/i; # normalize
125 $auth = Authen::Passphrase->from_rfc2307($password);
126 if ( $auth->isa('Authen::Passphrase::Clear') ) {
127 # then we've been given the password in cleartext
128 $auth = $self->_blowfishcrypt( $auth->passphrase );
131 } elsif ( $encoding eq 'plain' ) {
133 $auth = $self->_blowfishcrypt( $password );
137 my $password_history = FS::password_history->new({
138 _password => $auth->as_rfc2307,
140 $self->password_history_key => $self->get($self->primary_key),
143 my $error = $password_history->insert;
144 return "recording password history: $error" if $error;
149 =item _blowfishcrypt PASSWORD
151 For internal use: takes PASSWORD and returns a new
152 L<Authen::Passphrase::BlowfishCrypt> object representing it.
158 my $passphrase = shift;
159 return Authen::Passphrase::BlowfishCrypt->new(
160 cost => $BLOWFISH_COST,
162 passphrase => $passphrase,
170 L<FS::password_history>