Esempio n. 1
0
        ///<summary>Updates a password for a given Userod account and saves it to the database.  Suggested hash type is SHA3-512.
        ///Throws an exception if a passed in hash type is not implimented.</summary>
        public static bool UpdatePasswordUserod(Userod user, string inputPass, HashTypes hashType = HashTypes.SHA3_512)
        {
            //No need to check RemotingRole; no call to db.
            //Calculate the password strength.
            bool passStrength = String.IsNullOrEmpty(Userods.IsPasswordStrong(inputPass));
            PasswordContainer loginDetails = GenerateLoginDetails(inputPass, hashType);

            try {
                Userods.UpdatePassword(user, loginDetails, passStrength);
            }
            catch {
                return(false);
            }
            return(true);
        }
Esempio n. 2
0
        ///<summary>Checks to see if the hash of inputPass matches for a Userod object.  If the user password is blank, inputPass must be
        ///blank as well.  When isEcw is true then inputPass should already be hashed.
        ///If the inputPass is correct, the algorithm used was MD5, and updateIfNeeded is true then the password stored in the database will be updated to SHA3-512</summary>
        public static bool CheckPassword(Userod userod, string inputPass, bool isEcw = false)
        {
            //No need to check RemotingRole; no call to db.
            PasswordContainer loginDetails = userod.LoginDetails;

            if (loginDetails.HashType == HashTypes.None)
            {
                return(inputPass == "");
            }
            if (isEcw)
            {
                return(ConstantEquals(inputPass, loginDetails.Hash));
            }
            if (!CheckPassword(inputPass, loginDetails))
            {
                return(false);
            }
            //The password passed in was correct.
            return(true);
        }
Esempio n. 3
0
        ///<summary>Generates a username and password if necessary for this patient. If the patient is not eligible to be given access, this will return null.
        ///Otherwise returns the UserWeb (Item1), PlainTextPassword (Item2), PasswordContainer (Item3).
        ///If PlainTextPassword (Item2) is empty then assume new password generation was not necessary.
        ///Will insert a new UserWeb if none found for this Patient. Will leave UserWeb.PasswordHash blank.
        ///Call UpdateNewPatientPortalCredentials() using results of this method if you want to save password to db.</summary>
        ///<param name="passwordOverride">If a password has already been generated for this patient, pass it in here so that the password returned
        ///will match.</param>
        public static Tuple <UserWeb, string, PasswordContainer> GetNewPatientPortalCredentials(Patient pat, string passwordOverride = "")
        {
            //No need to check RemotingRole; no call to db.
            if (string.IsNullOrEmpty(PrefC.GetString(PrefName.PatientPortalURL)))
            {
                return(null);               //Haven't set up patient portal yet.
            }
            string errors;

            if (!UserWebs.ValidatePatientAccess(pat, out errors))
            {
                return(null);               //Patient is missing necessary fields.
            }
            UserWeb userWeb = UserWebs.GetByFKeyAndType(pat.PatNum, UserWebFKeyType.PatientPortal);

            if (userWeb == null)
            {
                userWeb = new UserWeb()
                {
                    UserName = UserWebs.CreateUserNameFromPat(pat, UserWebFKeyType.PatientPortal, new List <string>()),
                    FKey     = pat.PatNum,
                    FKeyType = UserWebFKeyType.PatientPortal,
                    RequireUserNameChange = true,
                    LoginDetails          = new PasswordContainer(HashTypes.None, "", ""),
                    IsNew = true,
                };
                //Always insert here. We may not ever end up updating UserWeb.PasswordHash if an email is not sent to this patient.
                //This will leave a UserWeb row with a UserName (for next time) but no password. This row will be updated with a password at the appropriate time.
                UserWebs.Insert(userWeb);
            }
            bool isNewPasswordRequired = false;

            if (string.IsNullOrEmpty(userWeb.UserName))              //Fixing B11013 so new UserName and Password should be generated.
            {
                userWeb.UserName = UserWebs.CreateUserNameFromPat(pat, UserWebFKeyType.PatientPortal, new List <string>());
                userWeb.RequireUserNameChange = true;
                //UserName fields have been changed so update db.
                UserWebs.Update(userWeb);
                isNewPasswordRequired = true;
            }
            if (userWeb.RequirePasswordChange)              //Could be a new UserWeb or a subsequent invite being generated for the same patient (had a second appointment).
            {
                isNewPasswordRequired = true;
            }
            if (string.IsNullOrEmpty(userWeb.PasswordHash))              //Patient has no password so portal access has not been previously granted.
            {
                isNewPasswordRequired = true;
            }
            string            passwordPlainText = "";
            PasswordContainer loginDetails      = userWeb.LoginDetails;

            if (isNewPasswordRequired)
            {
                //PP invites will often times call this method and get this far but not actually want to save the new creds to the db.
                //For that reason we won't actually update the db with the new password here.
                //The caller of this method will need to call ProcessNewPatientPortalCredentialsOut() if they really want this new password to persist to the db.
                passwordPlainText = passwordOverride == "" ? UserWebs.GenerateRandomPassword(8) : passwordOverride;
                loginDetails      = Authentication.GenerateLoginDetails(passwordPlainText, HashTypes.SHA3_512);
            }
            return(new Tuple <UserWeb, string, PasswordContainer>(userWeb, passwordPlainText, loginDetails));
        }
Esempio n. 4
0
        ///<summary>Updates password info in db for given inputs if PlainTextPassword (Item2) is not empty.
        ///Insert EhrMeasureEvent OnlineAccessProvided if previous db version of UserWeb had no PasswordHash (access has now been granted to portal).
        ///Returns true if UserWeb row was updated. Otherwise returns false.</summary>
        public static bool UpdateNewPatientPortalCredentials(Tuple <UserWeb, string, PasswordContainer> args)
        {
            //No need to check RemotingRole; no call to db.
            if (args == null)
            {
                return(false);
            }
            UserWeb userWeb = args.Item1; string passwordPlainText = args.Item2; PasswordContainer loginDetails = args.Item3;

            if (userWeb != null && !string.IsNullOrEmpty(passwordPlainText))
            {
                //Only insert an EHR event if the password was previously blank (meaning they don't currently have access).
                if (string.IsNullOrEmpty(userWeb.PasswordHash))
                {
                    EhrMeasureEvents.Insert(new EhrMeasureEvent()
                    {
                        DateTEvent = DateTime.Now,
                        EventType  = EhrMeasureEventType.OnlineAccessProvided,
                        PatNum     = userWeb.FKey,                   //PatNum.
                        MoreInfo   = "",
                    });
                }
                //New password was created so set the flag for the user to change on next login and update the db accordingly.
                userWeb.RequirePasswordChange = true;
                userWeb.LoginDetails          = loginDetails;
                UserWebs.Update(userWeb);
                return(true);
            }
            return(false);
        }
Esempio n. 5
0
 ///<summary>Compares a password against the values in a PasswordContainer struct.</summary>
 public static bool CheckPassword(string inputPass, PasswordContainer loginDetails)
 {
     //No need to check RemotingRole; no call to db.
     return(CheckPassword(inputPass, loginDetails.Salt, loginDetails.Hash, loginDetails.HashType));
 }