///<summary>Updates a password for a given Userod account and saves it to the database. Suggested hash type is SHA3-512.
///Throws an exception if a passed in hash type is not implimented.</summary>
public static bool UpdatePasswordUserod(Userod user, string inputPass, HashTypes hashType = HashTypes.SHA3_512)
{
//No need to check RemotingRole; no call to db.
//Calculate the password strength.
bool passStrength = String.IsNullOrEmpty(Userods.IsPasswordStrong(inputPass));
PasswordContainer loginDetails = GenerateLoginDetails(inputPass, hashType);
try {
Userods.UpdatePassword(user, loginDetails, passStrength);
}
catch {
return(false);
}
return(true);
}
///<summary>Checks to see if the hash of inputPass matches for a Userod object. If the user password is blank, inputPass must be
///blank as well. When isEcw is true then inputPass should already be hashed.
///If the inputPass is correct, the algorithm used was MD5, and updateIfNeeded is true then the password stored in the database will be updated to SHA3-512</summary>
public static bool CheckPassword(Userod userod, string inputPass, bool isEcw = false)
{
//No need to check RemotingRole; no call to db.
PasswordContainer loginDetails = userod.LoginDetails;
if (loginDetails.HashType == HashTypes.None)
{
return(inputPass == "");
}
if (isEcw)
{
return(ConstantEquals(inputPass, loginDetails.Hash));
}
if (!CheckPassword(inputPass, loginDetails))
{
return(false);
}
//The password passed in was correct.
return(true);
}
///<summary>Generates a username and password if necessary for this patient. If the patient is not eligible to be given access, this will return null.
///Otherwise returns the UserWeb (Item1), PlainTextPassword (Item2), PasswordContainer (Item3).
///If PlainTextPassword (Item2) is empty then assume new password generation was not necessary.
///Will insert a new UserWeb if none found for this Patient. Will leave UserWeb.PasswordHash blank.
///Call UpdateNewPatientPortalCredentials() using results of this method if you want to save password to db.</summary>
///<param name="passwordOverride">If a password has already been generated for this patient, pass it in here so that the password returned
///will match.</param>
public static Tuple <UserWeb, string, PasswordContainer> GetNewPatientPortalCredentials(Patient pat, string passwordOverride = "")
{
//No need to check RemotingRole; no call to db.
if (string.IsNullOrEmpty(PrefC.GetString(PrefName.PatientPortalURL)))
{
return(null); //Haven't set up patient portal yet.
}
string errors;
if (!UserWebs.ValidatePatientAccess(pat, out errors))
{
return(null); //Patient is missing necessary fields.
}
UserWeb userWeb = UserWebs.GetByFKeyAndType(pat.PatNum, UserWebFKeyType.PatientPortal);
if (userWeb == null)
{
userWeb = new UserWeb()
{
UserName = UserWebs.CreateUserNameFromPat(pat, UserWebFKeyType.PatientPortal, new List <string>()),
FKey = pat.PatNum,
FKeyType = UserWebFKeyType.PatientPortal,
RequireUserNameChange = true,
LoginDetails = new PasswordContainer(HashTypes.None, "", ""),
IsNew = true,
};
//Always insert here. We may not ever end up updating UserWeb.PasswordHash if an email is not sent to this patient.
//This will leave a UserWeb row with a UserName (for next time) but no password. This row will be updated with a password at the appropriate time.
UserWebs.Insert(userWeb);
}
bool isNewPasswordRequired = false;
if (string.IsNullOrEmpty(userWeb.UserName)) //Fixing B11013 so new UserName and Password should be generated.
{
userWeb.UserName = UserWebs.CreateUserNameFromPat(pat, UserWebFKeyType.PatientPortal, new List <string>());
userWeb.RequireUserNameChange = true;
//UserName fields have been changed so update db.
UserWebs.Update(userWeb);
isNewPasswordRequired = true;
}
if (userWeb.RequirePasswordChange) //Could be a new UserWeb or a subsequent invite being generated for the same patient (had a second appointment).
{
isNewPasswordRequired = true;
}
if (string.IsNullOrEmpty(userWeb.PasswordHash)) //Patient has no password so portal access has not been previously granted.
{
isNewPasswordRequired = true;
}
string passwordPlainText = "";
PasswordContainer loginDetails = userWeb.LoginDetails;
if (isNewPasswordRequired)
{
//PP invites will often times call this method and get this far but not actually want to save the new creds to the db.
//For that reason we won't actually update the db with the new password here.
//The caller of this method will need to call ProcessNewPatientPortalCredentialsOut() if they really want this new password to persist to the db.
passwordPlainText = passwordOverride == "" ? UserWebs.GenerateRandomPassword(8) : passwordOverride;
loginDetails = Authentication.GenerateLoginDetails(passwordPlainText, HashTypes.SHA3_512);
}
return(new Tuple <UserWeb, string, PasswordContainer>(userWeb, passwordPlainText, loginDetails));
}
///<summary>Updates password info in db for given inputs if PlainTextPassword (Item2) is not empty.
///Insert EhrMeasureEvent OnlineAccessProvided if previous db version of UserWeb had no PasswordHash (access has now been granted to portal).
///Returns true if UserWeb row was updated. Otherwise returns false.</summary>
public static bool UpdateNewPatientPortalCredentials(Tuple <UserWeb, string, PasswordContainer> args)
{
//No need to check RemotingRole; no call to db.
if (args == null)
{
return(false);
}
UserWeb userWeb = args.Item1; string passwordPlainText = args.Item2; PasswordContainer loginDetails = args.Item3;
if (userWeb != null && !string.IsNullOrEmpty(passwordPlainText))
{
//Only insert an EHR event if the password was previously blank (meaning they don't currently have access).
if (string.IsNullOrEmpty(userWeb.PasswordHash))
{
EhrMeasureEvents.Insert(new EhrMeasureEvent()
{
DateTEvent = DateTime.Now,
EventType = EhrMeasureEventType.OnlineAccessProvided,
PatNum = userWeb.FKey, //PatNum.
MoreInfo = "",
});
}
//New password was created so set the flag for the user to change on next login and update the db accordingly.
userWeb.RequirePasswordChange = true;
userWeb.LoginDetails = loginDetails;
UserWebs.Update(userWeb);
return(true);
}
return(false);
}
///<summary>Compares a password against the values in a PasswordContainer struct.</summary>
public static bool CheckPassword(string inputPass, PasswordContainer loginDetails)
{
//No need to check RemotingRole; no call to db.
return(CheckPassword(inputPass, loginDetails.Salt, loginDetails.Hash, loginDetails.HashType));
}
