diff --git a/application/src/main/java/org/thingsboard/server/controller/TwoFaConfigController.java b/application/src/main/java/org/thingsboard/server/controller/TwoFaConfigController.java index 60239f3603..4b34b95f59 100644 --- a/application/src/main/java/org/thingsboard/server/controller/TwoFaConfigController.java +++ b/application/src/main/java/org/thingsboard/server/controller/TwoFaConfigController.java @@ -218,10 +218,10 @@ public class TwoFaConfigController extends BaseController { @ApiOperation(value = "Save platform 2FA settings (savePlatformTwoFaSettings)", notes = "Save 2FA settings for platform. The settings have following properties:\n" + "- `providers` - the list of 2FA providers' configs. Users will only be allowed to use 2FA providers from this list. \n\n" + - "- `minVerificationCodeSendPeriod` - minimal period in seconds to wait after verification code send request to send next request. " + - "The format is standard: 'amountOfRequests:periodInSeconds'. The value of '1:60' would limit verification " + - "code sending requests to one per minute.\n" + + "- `minVerificationCodeSendPeriod` - minimal period in seconds to wait after verification code send request to send next request. \n" + "- `verificationCodeCheckRateLimit` - rate limit configuration for verification code checking.\n" + + "The format is standard: 'amountOfRequests:periodInSeconds'. The value of '1:60' would limit verification " + + "code checking requests to one per minute.\n" + "- `maxVerificationFailuresBeforeUserLockout` - maximum number of verification failures before a user gets disabled.\n" + "- `totalAllowedTimeForVerification` - total amount of time in seconds allotted for verification. " + "Basically, this property sets a lifetime for pre-verification token. If not set, default value of 30 minutes is used.\n" + NEW_LINE + diff --git a/application/src/main/java/org/thingsboard/server/service/security/auth/mfa/DefaultTwoFactorAuthService.java b/application/src/main/java/org/thingsboard/server/service/security/auth/mfa/DefaultTwoFactorAuthService.java index 5929f04468..78bf0cdcf6 100644 --- a/application/src/main/java/org/thingsboard/server/service/security/auth/mfa/DefaultTwoFactorAuthService.java +++ b/application/src/main/java/org/thingsboard/server/service/security/auth/mfa/DefaultTwoFactorAuthService.java @@ -88,7 +88,7 @@ public class DefaultTwoFactorAuthService implements TwoFactorAuthService { if (checkLimits) { Integer minVerificationCodeSendPeriod = twoFaSettings.getMinVerificationCodeSendPeriod(); String rateLimit = null; - if (minVerificationCodeSendPeriod != null && minVerificationCodeSendPeriod > 0) { + if (minVerificationCodeSendPeriod != null && minVerificationCodeSendPeriod > 4) { rateLimit = "1:" + minVerificationCodeSendPeriod; } checkRateLimits(user.getId(), accountConfig.getProviderType(), rateLimit, verificationCodeSendingRateLimits); diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/security/model/mfa/PlatformTwoFaSettings.java b/common/data/src/main/java/org/thingsboard/server/common/data/security/model/mfa/PlatformTwoFaSettings.java index 930b858316..9b660758d8 100644 --- a/common/data/src/main/java/org/thingsboard/server/common/data/security/model/mfa/PlatformTwoFaSettings.java +++ b/common/data/src/main/java/org/thingsboard/server/common/data/security/model/mfa/PlatformTwoFaSettings.java @@ -33,6 +33,7 @@ public class PlatformTwoFaSettings { @Valid private List providers; + @Min(value = 5, message = "minimum verification code sent period must be greater than or equal 5") private Integer minVerificationCodeSendPeriod; @Pattern(regexp = "[1-9]\\d*:[1-9]\\d*", message = "verification code check rate limit configuration is invalid") private String verificationCodeCheckRateLimit; diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/security/model/mfa/provider/BackupCodeTwoFaProviderConfig.java b/common/data/src/main/java/org/thingsboard/server/common/data/security/model/mfa/provider/BackupCodeTwoFaProviderConfig.java index 92def57ee4..e8d4b90e03 100644 --- a/common/data/src/main/java/org/thingsboard/server/common/data/security/model/mfa/provider/BackupCodeTwoFaProviderConfig.java +++ b/common/data/src/main/java/org/thingsboard/server/common/data/security/model/mfa/provider/BackupCodeTwoFaProviderConfig.java @@ -22,7 +22,7 @@ import javax.validation.constraints.Min; @Data public class BackupCodeTwoFaProviderConfig implements TwoFaProviderConfig { - @Min(1) + @Min(value = 1, message = "backup codes quantity must be greater than 0") private int codesQuantity; @Override diff --git a/ui-ngx/src/app/core/http/two-factor-authentication.service.ts b/ui-ngx/src/app/core/http/two-factor-authentication.service.ts index 2e3a7caeeb..a22da972ad 100644 --- a/ui-ngx/src/app/core/http/two-factor-authentication.service.ts +++ b/ui-ngx/src/app/core/http/two-factor-authentication.service.ts @@ -40,8 +40,8 @@ export class TwoFactorAuthenticationService { return this.http.get(`/api/2fa/settings`, defaultHttpOptionsFromConfig(config)); } - saveTwoFaSettings(settings: TwoFactorAuthSettings, config?: RequestConfig): Observable { - return this.http.post(`/api/2fa/settings`, settings, defaultHttpOptionsFromConfig(config)); + saveTwoFaSettings(settings: TwoFactorAuthSettings, config?: RequestConfig): Observable { + return this.http.post(`/api/2fa/settings`, settings, defaultHttpOptionsFromConfig(config)); } getAvailableTwoFaProviders(config?: RequestConfig): Observable> { diff --git a/ui-ngx/src/app/modules/home/pages/admin/two-factor-auth-settings.component.ts b/ui-ngx/src/app/modules/home/pages/admin/two-factor-auth-settings.component.ts index 7567d57d73..72480b4d44 100644 --- a/ui-ngx/src/app/modules/home/pages/admin/two-factor-auth-settings.component.ts +++ b/ui-ngx/src/app/modules/home/pages/admin/two-factor-auth-settings.component.ts @@ -79,7 +79,8 @@ export class TwoFactorAuthSettingsComponent extends PageComponent implements OnI providers.forEach(provider => delete provider.enable); const config = Object.assign(setting, {providers}); this.twoFaService.saveTwoFaSettings(config).subscribe( - () => { + (settings) => { + this.setAuthConfigFormValue(settings); this.twoFaFormGroup.markAsUntouched(); this.twoFaFormGroup.markAsPristine(); } @@ -124,8 +125,8 @@ export class TwoFactorAuthSettingsComponent extends PageComponent implements OnI Validators.pattern(/^\d*$/) ]], verificationCodeCheckRateLimitEnable: [false], - verificationCodeCheckRateLimitNumber: ['3', this.posIntValidation], - verificationCodeCheckRateLimitTime: ['900', this.posIntValidation], + verificationCodeCheckRateLimitNumber: [{value: 3, disabled: true}, this.posIntValidation], + verificationCodeCheckRateLimitTime: [{value: 900, disabled: true}, this.posIntValidation], minVerificationCodeSendPeriod: ['30', [Validators.required, Validators.min(5), Validators.pattern(/^\d*$/)]], providers: this.fb.array([]) });