From d50d21076160af381fb01e1850e703981565420a Mon Sep 17 00:00:00 2001
From: Michael Russo <russomichael@google.com>
Date: Wed, 24 May 2017 21:45:04 -0700
Subject: [PATCH 01/11] Add new parameter that can be used in the JSP
 viewables.

---
 .../config/src/main/resources/usergrid-default.properties  | 1 +
 .../usergrid/rest/management/users/UserResource.java       | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/stack/config/src/main/resources/usergrid-default.properties b/stack/config/src/main/resources/usergrid-default.properties
index d153ef1e3f..68734469c5 100644
--- a/stack/config/src/main/resources/usergrid-default.properties
+++ b/stack/config/src/main/resources/usergrid-default.properties
@@ -750,6 +750,7 @@ usergrid.api.url.base=http://localhost:8080/ROOT
 # instead, use character class ([.] instead of backslash-period)
 usergrid.org.config.property.regex=usergrid[.]view[.].*
 
+usergrid.viewable.loginEndpoint=http://localhost:8080
 
 
 ###########################  Usergrid Email Templates  ########################
diff --git a/stack/rest/src/main/java/org/apache/usergrid/rest/management/users/UserResource.java b/stack/rest/src/main/java/org/apache/usergrid/rest/management/users/UserResource.java
index 066f734105..95f607b6d9 100644
--- a/stack/rest/src/main/java/org/apache/usergrid/rest/management/users/UserResource.java
+++ b/stack/rest/src/main/java/org/apache/usergrid/rest/management/users/UserResource.java
@@ -66,6 +66,9 @@ public class UserResource extends AbstractContextResource {
 
     String token = null;
 
+    String loginEndpoint;
+
+
 
     public UserResource() {
     }
@@ -296,6 +299,7 @@ public Viewable handlePasswordResetForm( @Context UriInfo ui, @FormParam( "token
                     if ( ( password1 != null ) && password1.equals( password2 ) ) {
                         management.setAdminUserPassword( user.getUuid(), password1 );
                         management.revokeAccessTokenForAdminUser( user.getUuid(), token );
+                        loginEndpoint = properties.getProperty("usergrid.viewable.loginEndpoint");
                         return handleViewable( "resetpw_set_success", this, organizationId );
                     }
                     else {
@@ -342,6 +346,9 @@ public String getErrorMsg() {
         return errorMsg;
     }
 
+    public String getLoginEndpoint() {
+        return loginEndpoint;
+    }
 
     public String getToken() {
         return token;

From 7ca125a314635c467c2eaaab978ddb0bfab11f22 Mon Sep 17 00:00:00 2001
From: Mike Dunker <mdunker@google.com>
Date: Fri, 28 Jul 2017 14:04:49 -0700
Subject: [PATCH 02/11] Fix check for missing keyspace in Astayanax bad request
 exception

---
 .../persistence/core/migration/util/AstayanxUtils.java   | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/util/AstayanxUtils.java b/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/util/AstayanxUtils.java
index 7ae4748be7..d500c68e0d 100644
--- a/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/util/AstayanxUtils.java
+++ b/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/util/AstayanxUtils.java
@@ -35,13 +35,10 @@ public static void isKeyspaceMissing(final String rethrowMessage,  final Excepti
 
         if ( cassandraException instanceof BadRequestException ) {
 
-            //check if it's b/c the keyspace is missing, if so
-            final String message = cassandraException.getMessage();
-
-            //no op, just swallow
-            if(message.contains( "why:Keyspace" ) && message.contains( "does not exist" )){
+            //check if it's b/c the keyspace is missing
+            if (((BadRequestException) cassandraException).isKeyspaceDoestNotExist()) {
                 return;
-            };
+            }
         }
 
        throw new RuntimeException( rethrowMessage, cassandraException );

From 550efbf82d3bfe3aed5370b7ad74435357a70bd9 Mon Sep 17 00:00:00 2001
From: Mike Dunker <mdunker@google.com>
Date: Fri, 28 Jul 2017 14:11:31 -0700
Subject: [PATCH 03/11] fix html encode in jsp

---
 .../apache/usergrid/rest/TestResource/error.jsp   |  4 ++--
 .../apache/usergrid/rest/TestResource/test.jsp    |  5 +++--
 .../ApplicationResource/authorize_form.jsp        | 15 ++++++++-------
 .../applications/ApplicationResource/error.jsp    |  4 ++--
 .../applications/users/UserResource/activate.jsp  |  4 ++--
 .../applications/users/UserResource/confirm.jsp   |  4 ++--
 .../applications/users/UserResource/error.jsp     |  4 ++--
 .../users/UserResource/resetpw_email_form.jsp     | 11 ++++++-----
 .../users/UserResource/resetpw_email_success.jsp  |  4 ++--
 .../users/UserResource/resetpw_set_form.jsp       |  9 +++++----
 .../users/UserResource/resetpw_set_success.jsp    |  4 ++--
 .../applications/users/UsersResource/error.jsp    |  4 ++--
 .../users/UsersResource/resetpw_email_form.jsp    |  9 +++++----
 .../users/UsersResource/resetpw_email_success.jsp |  4 ++--
 .../ManagementResource/authorize_form.jsp         | 15 ++++++++-------
 .../rest/management/ManagementResource/error.jsp  |  4 ++--
 .../OrganizationResource/activate.jsp             |  4 ++--
 .../OrganizationResource/confirm.jsp              |  4 ++--
 .../organizations/OrganizationResource/error.jsp  |  4 ++--
 .../management/users/UserResource/activate.jsp    |  4 ++--
 .../management/users/UserResource/confirm.jsp     |  4 ++--
 .../rest/management/users/UserResource/error.jsp  |  4 ++--
 .../users/UserResource/resetpw_email_form.jsp     |  9 +++++----
 .../users/UserResource/resetpw_email_success.jsp  |  4 ++--
 .../users/UserResource/resetpw_set_form.jsp       |  8 ++++----
 .../users/UserResource/resetpw_set_success.jsp    |  4 ++--
 .../rest/management/users/UsersResource/error.jsp |  4 ++--
 .../users/UsersResource/resetpw_email_form.jsp    |  6 +++---
 .../users/UsersResource/resetpw_email_success.jsp |  4 ++--
 29 files changed, 87 insertions(+), 80 deletions(-)

diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/TestResource/error.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/TestResource/error.jsp
index be184b1cf2..d02ad40958 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/TestResource/error.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/TestResource/error.jsp
@@ -27,7 +27,7 @@ limitations under the License.
 </head>
 <body>
 
-	<p>An error occurred <c:out value="${it}"/>.</p>
+	<p>An error occurred <c:out value="${it}" escapeXml="true"/>.</p>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/TestResource/test.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/TestResource/test.jsp
index 83a6ad198b..68c12f212d 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/TestResource/test.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/TestResource/test.jsp
@@ -1,5 +1,6 @@
 <%@ page language="java" contentType="text/html; charset=ISO-8859-1"
     pageEncoding="ISO-8859-1"%>
+<%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn"%>
 <!--
 Licensed to the Apache Software Foundation (ASF) under one or more
 contributor license agreements.  See the NOTICE file distributed with
@@ -24,6 +25,6 @@ limitations under the License.
 	<link rel="stylesheet" type="text/css" href="/css/styles.css" />
 </head>
 <body>
-<h1>${it.foo}</h1> 
+<h1>${fn:escapeXml(it.foo)}</h1>
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/ApplicationResource/authorize_form.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/ApplicationResource/authorize_form.jsp
index 6b1b8b2b0b..0079bcf0a6 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/ApplicationResource/authorize_form.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/ApplicationResource/authorize_form.jsp
@@ -2,6 +2,7 @@
 	pageEncoding="ISO-8859-1"%>
 <%@ page import="org.apache.usergrid.rest.AbstractContextResource"%>
 <%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>
+<%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn"%>
 <!--
 Licensed to the Apache Software Foundation (ASF) under one or more
 contributor license agreements.  See the NOTICE file distributed with
@@ -28,13 +29,13 @@ limitations under the License.
 <body>
 
 	<div class="dialog-area">
-		<c:if test="${!empty it.errorMsg}"><div class="dialog-form-message">${it.errorMsg}</div></c:if>
+		<c:if test="${!empty fn:escapeXml(it.errorMsg)}"><div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div></c:if>
 		<form class="dialog-form" action="" method="post">
-			<input type="hidden" name="response_type" value="${it.responseType}">
-			<input type="hidden" name="client_id" value="${it.clientId}">
-			<input type="hidden" name="redirect_uri" value="${it.redirectUri}">
-			<input type="hidden" name="scope" value="${it.scope}">
-			<input type="hidden" name="state" value="${it.state}">
+			<input type="hidden" name="response_type" value="${fn:escapeXml(it.responseType)}">
+			<input type="hidden" name="client_id" value="${fn:escapeXml(it.clientId)}">
+			<input type="hidden" name="redirect_uri" value="${fn:escapeXml(it.redirectUri)}">
+			<input type="hidden" name="scope" value="${fn:escapeXml(it.scope)}">
+			<input type="hidden" name="state" value="${fn:escapeXml(it.state)}">
 			<fieldset>
 				<p>
 					<label for="username">Username</label>
@@ -56,4 +57,4 @@ limitations under the License.
 	</div>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/ApplicationResource/error.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/ApplicationResource/error.jsp
index be184b1cf2..d02ad40958 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/ApplicationResource/error.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/ApplicationResource/error.jsp
@@ -27,7 +27,7 @@ limitations under the License.
 </head>
 <body>
 
-	<p>An error occurred <c:out value="${it}"/>.</p>
+	<p>An error occurred <c:out value="${it}" escapeXml="true"/>.</p>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/activate.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/activate.jsp
index dfcf3b7349..20e69b8d1f 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/activate.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/activate.jsp
@@ -26,7 +26,7 @@ limitations under the License.
 </head>
 <body>
 
-	<p>Your account with email address <c:out value="${it.user.email}"/> has been successfully activated.</p>
+	<p>Your account with email address <c:out value="${it.user.email}" escapeXml="true"/> has been successfully activated.</p>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/confirm.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/confirm.jsp
index 02e9ee37d5..d7f3acca82 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/confirm.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/confirm.jsp
@@ -26,8 +26,8 @@ limitations under the License.
 </head>
 <body>
 
-	<p>Your account with email address <c:out value="${it.user.email}"/> has been successfully confirmed.
+	<p>Your account with email address <c:out value="${it.user.email}" escapeXml="true"/> has been successfully confirmed.
 	You will received an email soon to let you know when you account has been activated</p>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/error.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/error.jsp
index be184b1cf2..d02ad40958 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/error.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/error.jsp
@@ -27,7 +27,7 @@ limitations under the License.
 </head>
 <body>
 
-	<p>An error occurred <c:out value="${it}"/>.</p>
+	<p>An error occurred <c:out value="${it}" escapeXml="true"/>.</p>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_email_form.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_email_form.jsp
index 0f53bfcbbd..59026bf0d8 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_email_form.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_email_form.jsp
@@ -1,6 +1,7 @@
 <%@ page language="java" contentType="text/html; charset=ISO-8859-1"
 	pageEncoding="ISO-8859-1"%>
 <%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>
+<%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn"%>
 <!--
 Licensed to the Apache Software Foundation (ASF) under one or more
 contributor license agreements.  See the NOTICE file distributed with
@@ -26,17 +27,17 @@ limitations under the License.
 </head>
 <body>
 	<div class="dialog-area">
-		<c:if test="${!empty it.errorMsg}">
-			<div class="dialog-form-message">${it.errorMsg}</div>
+		<c:if test="${!empty fn:escapeXml(it.errorMsg)}">
+			<div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div>
 		</c:if>
 		<form class="dialog-form" action="" method="post">
 			<fieldset>
 				<p>
 					Enter the captcha to have your password reset instructions sent to
-					<c:out value="${it.user.email}" />
+					<c:out value="${it.user.email}" escapeXml="true" />
 				</p>
 				<p id="human-proof"></p>
-				${it.reCaptchaHtml}
+				${fn:escapeXml(it.reCaptchaHtml)}
 				<p class="buttons">
 					<input type="submit" value="submit" />
 				</p>
@@ -44,4 +45,4 @@ limitations under the License.
 		</form>
 	</div>
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_email_success.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_email_success.jsp
index 23f85087d7..41c5176c38 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_email_success.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_email_success.jsp
@@ -29,7 +29,7 @@ limitations under the License.
 </head>
 <body>
 
-	<p>Email with instructions for password reset sent to <c:out value="${it.user.email}"/></p>
+	<p>Email with instructions for password reset sent to <c:out value="${it.user.email}" escapeXml="true"/></p>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_set_form.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_set_form.jsp
index a83d80d60e..19b6528f4a 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_set_form.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_set_form.jsp
@@ -4,6 +4,7 @@
 <%@ page import="net.tanesha.recaptcha.ReCaptchaFactory"%>
 <%@ page import="org.apache.usergrid.rest.AbstractContextResource"%>
 <%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>
+<%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn"%>
 <!--
 Licensed to the Apache Software Foundation (ASF) under one or more
 contributor license agreements.  See the NOTICE file distributed with
@@ -30,12 +31,12 @@ limitations under the License.
 <body>
 
 	<div class="dialog-area">
-		<c:if test="${!empty it.errorMsg}"><div class="dialog-form-message">${it.errorMsg}</div></c:if>
+		<c:if test="${!empty fn:escapeXml(it.errorMsg)}"><div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div></c:if>
 		<form class="dialog-form" action="" method="post">
-			<input type="hidden" name="token" value="${it.token}">
+			<input type="hidden" name="token" value="${fn:escapeXml(it.token)}">
 			<fieldset>
 				<p>
-					<label for="password1">Please enter your new password for <c:out value="${it.user.email}"/>.</label>
+					<label for="password1">Please enter your new password for <c:out value="${it.user.email}" escapeXml="true"/>.</label>
 				</p>
 				<p>
 					<input class="text_field" id="password1" name="password1" type="password" />
@@ -54,4 +55,4 @@ limitations under the License.
 	</div>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_set_success.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_set_success.jsp
index 9de90bab1c..39150843ab 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_set_success.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_set_success.jsp
@@ -29,7 +29,7 @@ limitations under the License.
 </head>
 <body>
 
-	<p>New password set for <c:out value="${it.user.email}"/></p>
+	<p>New password set for <c:out value="${it.user.email}" escapeXml="true"/></p>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UsersResource/error.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UsersResource/error.jsp
index be184b1cf2..d02ad40958 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UsersResource/error.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UsersResource/error.jsp
@@ -27,7 +27,7 @@ limitations under the License.
 </head>
 <body>
 
-	<p>An error occurred <c:out value="${it}"/>.</p>
+	<p>An error occurred <c:out value="${it}" escapeXml="true"/>.</p>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UsersResource/resetpw_email_form.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UsersResource/resetpw_email_form.jsp
index 3211a3abd5..f86240f2f5 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UsersResource/resetpw_email_form.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UsersResource/resetpw_email_form.jsp
@@ -1,6 +1,7 @@
 <%@ page language="java" contentType="text/html; charset=ISO-8859-1"
 	pageEncoding="ISO-8859-1"%>
 <%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>
+<%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn"%>
 <!--
 Licensed to the Apache Software Foundation (ASF) under one or more
 contributor license agreements.  See the NOTICE file distributed with
@@ -27,8 +28,8 @@ limitations under the License.
 <body>
 
 	<div class="dialog-area">
-		<c:if test="${!empty it.errorMsg}">
-			<div class="dialog-form-message">${it.errorMsg}</div>
+		<c:if test="${!empty fn:escapeXml(it.errorMsg)}">
+			<div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div>
 		</c:if>
 		<form class="dialog-form" action="" method="post">
 			<fieldset>
@@ -41,7 +42,7 @@ limitations under the License.
 					<input class="text_field" id="email" name="email" type="text" />
 				</p>
 				<p id="human-proof"></p>
-				${it.reCaptchaHtml}
+				${fn:escapeXml(it.reCaptchaHtml)}
 				<p class="buttons">
 					<button type="submit">Submit</button>
 				</p>
@@ -50,4 +51,4 @@ limitations under the License.
 	</div>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UsersResource/resetpw_email_success.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UsersResource/resetpw_email_success.jsp
index 23f85087d7..41c5176c38 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UsersResource/resetpw_email_success.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UsersResource/resetpw_email_success.jsp
@@ -29,7 +29,7 @@ limitations under the License.
 </head>
 <body>
 
-	<p>Email with instructions for password reset sent to <c:out value="${it.user.email}"/></p>
+	<p>Email with instructions for password reset sent to <c:out value="${it.user.email}" escapeXml="true"/></p>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/ManagementResource/authorize_form.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/ManagementResource/authorize_form.jsp
index 6b1b8b2b0b..0079bcf0a6 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/ManagementResource/authorize_form.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/ManagementResource/authorize_form.jsp
@@ -2,6 +2,7 @@
 	pageEncoding="ISO-8859-1"%>
 <%@ page import="org.apache.usergrid.rest.AbstractContextResource"%>
 <%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>
+<%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn"%>
 <!--
 Licensed to the Apache Software Foundation (ASF) under one or more
 contributor license agreements.  See the NOTICE file distributed with
@@ -28,13 +29,13 @@ limitations under the License.
 <body>
 
 	<div class="dialog-area">
-		<c:if test="${!empty it.errorMsg}"><div class="dialog-form-message">${it.errorMsg}</div></c:if>
+		<c:if test="${!empty fn:escapeXml(it.errorMsg)}"><div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div></c:if>
 		<form class="dialog-form" action="" method="post">
-			<input type="hidden" name="response_type" value="${it.responseType}">
-			<input type="hidden" name="client_id" value="${it.clientId}">
-			<input type="hidden" name="redirect_uri" value="${it.redirectUri}">
-			<input type="hidden" name="scope" value="${it.scope}">
-			<input type="hidden" name="state" value="${it.state}">
+			<input type="hidden" name="response_type" value="${fn:escapeXml(it.responseType)}">
+			<input type="hidden" name="client_id" value="${fn:escapeXml(it.clientId)}">
+			<input type="hidden" name="redirect_uri" value="${fn:escapeXml(it.redirectUri)}">
+			<input type="hidden" name="scope" value="${fn:escapeXml(it.scope)}">
+			<input type="hidden" name="state" value="${fn:escapeXml(it.state)}">
 			<fieldset>
 				<p>
 					<label for="username">Username</label>
@@ -56,4 +57,4 @@ limitations under the License.
 	</div>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/ManagementResource/error.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/ManagementResource/error.jsp
index be184b1cf2..d02ad40958 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/ManagementResource/error.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/ManagementResource/error.jsp
@@ -27,7 +27,7 @@ limitations under the License.
 </head>
 <body>
 
-	<p>An error occurred <c:out value="${it}"/>.</p>
+	<p>An error occurred <c:out value="${it}" escapeXml="true"/>.</p>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/organizations/OrganizationResource/activate.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/organizations/OrganizationResource/activate.jsp
index 85114cd6c2..f5fa14d1af 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/organizations/OrganizationResource/activate.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/organizations/OrganizationResource/activate.jsp
@@ -26,7 +26,7 @@ limitations under the License.
 </head>
 <body>
 
-	<p>Your organization <c:out value="${it.organization.name}"/> has been successfully activated.</p>
+	<p>Your organization <c:out value="${it.organization.name}" escapeXml="true"/> has been successfully activated.</p>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/organizations/OrganizationResource/confirm.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/organizations/OrganizationResource/confirm.jsp
index f4307b781f..5fb41c70ab 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/organizations/OrganizationResource/confirm.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/organizations/OrganizationResource/confirm.jsp
@@ -26,8 +26,8 @@ limitations under the License.
 </head>
 <body>
 
-	<p>Your organization <c:out value="${it.organization.name}"/> has been successfully confirmed.
+	<p>Your organization <c:out value="${it.organization.name}" escapeXml="true"/> has been successfully confirmed.
 	You will received an email soon to let you know when you organization has been activated</p>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/organizations/OrganizationResource/error.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/organizations/OrganizationResource/error.jsp
index be184b1cf2..d02ad40958 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/organizations/OrganizationResource/error.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/organizations/OrganizationResource/error.jsp
@@ -27,7 +27,7 @@ limitations under the License.
 </head>
 <body>
 
-	<p>An error occurred <c:out value="${it}"/>.</p>
+	<p>An error occurred <c:out value="${it}" escapeXml="true"/>.</p>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/activate.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/activate.jsp
index dfcf3b7349..20e69b8d1f 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/activate.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/activate.jsp
@@ -26,7 +26,7 @@ limitations under the License.
 </head>
 <body>
 
-	<p>Your account with email address <c:out value="${it.user.email}"/> has been successfully activated.</p>
+	<p>Your account with email address <c:out value="${it.user.email}" escapeXml="true"/> has been successfully activated.</p>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/confirm.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/confirm.jsp
index 02e9ee37d5..d7f3acca82 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/confirm.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/confirm.jsp
@@ -26,8 +26,8 @@ limitations under the License.
 </head>
 <body>
 
-	<p>Your account with email address <c:out value="${it.user.email}"/> has been successfully confirmed.
+	<p>Your account with email address <c:out value="${it.user.email}" escapeXml="true"/> has been successfully confirmed.
 	You will received an email soon to let you know when you account has been activated</p>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/error.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/error.jsp
index be184b1cf2..d02ad40958 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/error.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/error.jsp
@@ -27,7 +27,7 @@ limitations under the License.
 </head>
 <body>
 
-	<p>An error occurred <c:out value="${it}"/>.</p>
+	<p>An error occurred <c:out value="${it}" escapeXml="true"/>.</p>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_email_form.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_email_form.jsp
index 3e56cd1578..c9f8309973 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_email_form.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_email_form.jsp
@@ -1,6 +1,7 @@
 <%@ page language="java" contentType="text/html; charset=ISO-8859-1"
 	pageEncoding="ISO-8859-1"%>
 <%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>
+<%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn"%>
 <!--
 Licensed to the Apache Software Foundation (ASF) under one or more
 contributor license agreements.  See the NOTICE file distributed with
@@ -26,17 +27,17 @@ limitations under the License.
 </head>
 <body>
 	<div class="dialog-area password-reset-form">
-		<c:if test="${!empty it.errorMsg}">
-			<div class="dialog-form-message">${it.errorMsg}</div>
+		<c:if test="${!empty fn:escapeXml(it.errorMsg)}">
+			<div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div>
 		</c:if>
 		<form class="dialog-form" action="" method="post">
 			<fieldset>
 				<p>
 					Enter the captcha to have your password reset instructions sent to
-					<c:out value="${it.user.email}" />
+					<c:out value="${it.user.email}" escapeXml="true" />
 				</p>
 				<p id="human-proof"></p>
-				${it.reCaptchaHtml}
+				${fn:escapeXml(it.reCaptchaHtml)}
 				<p class="buttons">
 					<input type="submit" value="submit" />
 				</p>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_email_success.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_email_success.jsp
index 23f85087d7..41c5176c38 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_email_success.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_email_success.jsp
@@ -29,7 +29,7 @@ limitations under the License.
 </head>
 <body>
 
-	<p>Email with instructions for password reset sent to <c:out value="${it.user.email}"/></p>
+	<p>Email with instructions for password reset sent to <c:out value="${it.user.email}" escapeXml="true"/></p>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_set_form.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_set_form.jsp
index a83d80d60e..60384c43ff 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_set_form.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_set_form.jsp
@@ -30,12 +30,12 @@ limitations under the License.
 <body>
 
 	<div class="dialog-area">
-		<c:if test="${!empty it.errorMsg}"><div class="dialog-form-message">${it.errorMsg}</div></c:if>
+		<c:if test="${!empty fn:escapeXml(it.errorMsg)}"><div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div></c:if>
 		<form class="dialog-form" action="" method="post">
-			<input type="hidden" name="token" value="${it.token}">
+			<input type="hidden" name="token" value="${fn:escapeXml(it.token)}">
 			<fieldset>
 				<p>
-					<label for="password1">Please enter your new password for <c:out value="${it.user.email}"/>.</label>
+					<label for="password1">Please enter your new password for <c:out value="${it.user.email}" escapeXml="true"/>.</label>
 				</p>
 				<p>
 					<input class="text_field" id="password1" name="password1" type="password" />
@@ -54,4 +54,4 @@ limitations under the License.
 	</div>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_set_success.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_set_success.jsp
index 9de90bab1c..39150843ab 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_set_success.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_set_success.jsp
@@ -29,7 +29,7 @@ limitations under the License.
 </head>
 <body>
 
-	<p>New password set for <c:out value="${it.user.email}"/></p>
+	<p>New password set for <c:out value="${it.user.email}" escapeXml="true"/></p>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UsersResource/error.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UsersResource/error.jsp
index be184b1cf2..d02ad40958 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UsersResource/error.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UsersResource/error.jsp
@@ -27,7 +27,7 @@ limitations under the License.
 </head>
 <body>
 
-	<p>An error occurred <c:out value="${it}"/>.</p>
+	<p>An error occurred <c:out value="${it}" escapeXml="true"/>.</p>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UsersResource/resetpw_email_form.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UsersResource/resetpw_email_form.jsp
index 8643016e00..8b15cd436d 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UsersResource/resetpw_email_form.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UsersResource/resetpw_email_form.jsp
@@ -27,7 +27,7 @@ limitations under the License.
 <body>
 
 	<div class="dialog-area">
-		<c:if test="${!empty it.errorMsg}"><div class="dialog-form-message">${it.errorMsg}</div></c:if>
+		<c:if test="${!empty fn:escnapeXml(it.errorMsg)}"><div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div></c:if>
 		<form class="dialog-form" action="" method="post">
 			<fieldset>
 				<p>
@@ -38,7 +38,7 @@ limitations under the License.
 					<input class="text_field" id="email" name="email" type="text" />
 				</p>
 				<p id="human-proof"></p>
-				${it.reCaptchaHtml}
+				${fn:escapeXml(it.reCaptchaHtml)}
 				<p class="buttons">
 					<button type="submit">Submit</button>
 				</p>
@@ -47,4 +47,4 @@ limitations under the License.
 	</div>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UsersResource/resetpw_email_success.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UsersResource/resetpw_email_success.jsp
index 23f85087d7..41c5176c38 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UsersResource/resetpw_email_success.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UsersResource/resetpw_email_success.jsp
@@ -29,7 +29,7 @@ limitations under the License.
 </head>
 <body>
 
-	<p>Email with instructions for password reset sent to <c:out value="${it.user.email}"/></p>
+	<p>Email with instructions for password reset sent to <c:out value="${it.user.email}" escapeXml="true"/></p>
 
 </body>
-</html>
\ No newline at end of file
+</html>

From 551b8a04157d69355cc34a73423092ae81cc4331 Mon Sep 17 00:00:00 2001
From: Mike Dunker <mdunker@google.com>
Date: Fri, 28 Jul 2017 15:09:09 -0700
Subject: [PATCH 04/11] add password complexity check before submitting during
 reset password flow

---
 .../rest/applications/users/UserResource.java |   8 +
 .../rest/management/users/UserResource.java   |   9 +
 .../management/ManagementService.java         |  10 +-
 .../cassandra/ManagementServiceImpl.java      |  14 ++
 .../usergrid/security/PasswordPolicy.java     |  53 ++++++
 .../usergrid/security/PasswordPolicyFig.java  |  79 +++++++++
 .../usergrid/security/PasswordPolicyImpl.java | 156 ++++++++++++++++++
 .../services/guice/ServiceModuleImpl.java     |   7 +
 8 files changed, 331 insertions(+), 5 deletions(-)
 create mode 100644 stack/services/src/main/java/org/apache/usergrid/security/PasswordPolicy.java
 create mode 100644 stack/services/src/main/java/org/apache/usergrid/security/PasswordPolicyFig.java
 create mode 100644 stack/services/src/main/java/org/apache/usergrid/security/PasswordPolicyImpl.java

diff --git a/stack/rest/src/main/java/org/apache/usergrid/rest/applications/users/UserResource.java b/stack/rest/src/main/java/org/apache/usergrid/rest/applications/users/UserResource.java
index 5435f7e37f..f0dbc14553 100644
--- a/stack/rest/src/main/java/org/apache/usergrid/rest/applications/users/UserResource.java
+++ b/stack/rest/src/main/java/org/apache/usergrid/rest/applications/users/UserResource.java
@@ -17,6 +17,7 @@
 package org.apache.usergrid.rest.applications.users;
 
 
+import java.util.Collection;
 import java.util.Map;
 import java.util.UUID;
 
@@ -465,6 +466,13 @@ public Viewable handlePasswordResetForm( @Context UriInfo ui, @FormParam("token"
             if ( ( password1 != null ) || ( password2 != null ) ) {
                 if ( management.checkPasswordResetTokenForAppUser( getApplicationId(), getUserUuid(), token ) ) {
                     if ( ( password1 != null ) && password1.equals( password2 ) ) {
+                        // validate password
+                        Collection<String> violations = management.passwordPolicyCheck(password1, false);
+                        if (violations.size() > 0) {
+                            // password not valid
+                            errorMsg = management.getPasswordDescription(false);
+                            return handleViewable( "resetpw_set_form", this, getOrganizationName() );
+                        }
                         management.setAppUserPassword( getApplicationId(), getUser().getUuid(), password1 );
                         management.revokeAccessTokenForAppUser( token );
                         return handleViewable( "resetpw_set_success", this, getOrganizationName() );
diff --git a/stack/rest/src/main/java/org/apache/usergrid/rest/management/users/UserResource.java b/stack/rest/src/main/java/org/apache/usergrid/rest/management/users/UserResource.java
index 95f607b6d9..cac5f2bb4a 100644
--- a/stack/rest/src/main/java/org/apache/usergrid/rest/management/users/UserResource.java
+++ b/stack/rest/src/main/java/org/apache/usergrid/rest/management/users/UserResource.java
@@ -43,6 +43,7 @@
 import javax.ws.rs.core.Context;
 import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.UriInfo;
+import java.util.Collection;
 import java.util.Map;
 import java.util.UUID;
 
@@ -297,6 +298,14 @@ public Viewable handlePasswordResetForm( @Context UriInfo ui, @FormParam( "token
             if ( ( password1 != null ) || ( password2 != null ) ) {
                 if ( management.checkPasswordResetTokenForAdminUser( user.getUuid(), tokenInfo ) ) {
                     if ( ( password1 != null ) && password1.equals( password2 ) ) {
+                        // validate password
+                        Collection<String> violations = management.passwordPolicyCheck(password1, true);
+                        if (violations.size() > 0) {
+                            // password not valid
+                            errorMsg = management.getPasswordDescription(true);
+                            return handleViewable( "resetpw_set_form", this, organizationId );
+                        }
+
                         management.setAdminUserPassword( user.getUuid(), password1 );
                         management.revokeAccessTokenForAdminUser( user.getUuid(), token );
                         loginEndpoint = properties.getProperty("usergrid.viewable.loginEndpoint");
diff --git a/stack/services/src/main/java/org/apache/usergrid/management/ManagementService.java b/stack/services/src/main/java/org/apache/usergrid/management/ManagementService.java
index 2b88b07d4d..df42d6a7ca 100644
--- a/stack/services/src/main/java/org/apache/usergrid/management/ManagementService.java
+++ b/stack/services/src/main/java/org/apache/usergrid/management/ManagementService.java
@@ -17,11 +17,7 @@
 package org.apache.usergrid.management;
 
 
-import java.util.List;
-import java.util.Map;
-import java.util.Properties;
-import java.util.Set;
-import java.util.UUID;
+import java.util.*;
 
 import org.apache.usergrid.persistence.CredentialsInfo;
 import org.apache.usergrid.persistence.Entity;
@@ -372,6 +368,10 @@ PrincipalCredentialsToken getPrincipalCredentialsTokenForClientCredentials( Stri
 
 	Observable<Id> deleteAllEntities(final UUID applicationId,final int limit);
 
+	Collection<String> passwordPolicyCheck(String password, boolean isAdminUser);
+
+	String getPasswordDescription(boolean isAdminUser);
+
 
     // DO NOT REMOVE BELOW METHODS, THEY ARE HERE TO ALLOW EXTERNAL CLASSES TO OVERRIDE AND HOOK INTO POST PROCESSING
     void createOrganizationPostProcessing( final OrganizationInfo orgInfo,
diff --git a/stack/services/src/main/java/org/apache/usergrid/management/cassandra/ManagementServiceImpl.java b/stack/services/src/main/java/org/apache/usergrid/management/cassandra/ManagementServiceImpl.java
index 876cd5ba90..2d60441df5 100644
--- a/stack/services/src/main/java/org/apache/usergrid/management/cassandra/ManagementServiceImpl.java
+++ b/stack/services/src/main/java/org/apache/usergrid/management/cassandra/ManagementServiceImpl.java
@@ -54,6 +54,7 @@
 import org.apache.usergrid.persistence.model.entity.SimpleId;
 import org.apache.usergrid.security.AuthPrincipalInfo;
 import org.apache.usergrid.security.AuthPrincipalType;
+import org.apache.usergrid.security.PasswordPolicy;
 import org.apache.usergrid.security.crypto.EncryptionService;
 import org.apache.usergrid.security.oauth.AccessInfo;
 import org.apache.usergrid.security.oauth.ClientCredentialsInfo;
@@ -172,6 +173,8 @@ public class ManagementServiceImpl implements ManagementService {
 
     protected LocalShiroCache localShiroCache;
 
+    protected PasswordPolicy passwordPolicy;
+
 
     private LoadingCache<UUID, OrganizationConfig> orgConfigByAppCache = CacheBuilder.newBuilder().maximumSize( 1000 )
         .expireAfterWrite( Long.valueOf( System.getProperty(ORG_CONFIG_CACHE_PROP, "30000") ) , TimeUnit.MILLISECONDS)
@@ -215,6 +218,7 @@ public ManagementServiceImpl(Injector injector) {
         this.service = injector.getInstance(ApplicationService.class);
         this.localShiroCache = injector.getInstance(LocalShiroCache.class);
 
+        this.passwordPolicy = injector.getInstance(PasswordPolicy.class);
     }
 
     @Autowired
@@ -3496,6 +3500,16 @@ private void invalidateManagementAppAuthCache() {
         localShiroCache.invalidateAll();
     }
 
+    @Override
+    public Collection<String> passwordPolicyCheck(String password, boolean isAdminUser) {
+        return passwordPolicy.policyCheck(password, isAdminUser);
+    }
+
+    @Override
+    public String getPasswordDescription(boolean isAdminUser) {
+        return passwordPolicy.getDescription(isAdminUser);
+    }
+
     @Override
     public void createOrganizationPostProcessing( final OrganizationInfo orgInfo,
                                                   final Map<String,String> properties ){
diff --git a/stack/services/src/main/java/org/apache/usergrid/security/PasswordPolicy.java b/stack/services/src/main/java/org/apache/usergrid/security/PasswordPolicy.java
new file mode 100644
index 0000000000..cc29b2038f
--- /dev/null
+++ b/stack/services/src/main/java/org/apache/usergrid/security/PasswordPolicy.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.usergrid.security;
+
+
+import java.util.Collection;
+
+
+/**
+ * Interface to password policy.
+ */
+public interface PasswordPolicy {
+
+    String ERROR_POLICY_VIOLIATION    = "error_password_policy_violation";
+
+    String ERROR_UPPERCASE_POLICY     = "error_uppercase_policy";
+
+    String ERROR_DIGITS_POLICY        = "error_digits_policy";
+
+    String ERROR_SPECIAL_CHARS_POLICY = "error_special_chars_policy";
+
+    String ERROR_LENGTH_POLICY        = "error_length_policy";
+
+
+    /**
+     * Check to see if password conforms to policy.
+     *
+     * @param password Password to check.
+     * @return Collection of error strings, one for each policy violated or empty if password conforms.
+     */
+    Collection<String> policyCheck( String password, boolean isAdminUser );
+
+
+    /**
+     * Get description of password policy for error messages.
+     */
+    String getDescription( boolean isAdminUser );
+}
diff --git a/stack/services/src/main/java/org/apache/usergrid/security/PasswordPolicyFig.java b/stack/services/src/main/java/org/apache/usergrid/security/PasswordPolicyFig.java
new file mode 100644
index 0000000000..e93f8e4748
--- /dev/null
+++ b/stack/services/src/main/java/org/apache/usergrid/security/PasswordPolicyFig.java
@@ -0,0 +1,79 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.usergrid.security;
+
+import org.safehaus.guicyfig.Default;
+import org.safehaus.guicyfig.FigSingleton;
+import org.safehaus.guicyfig.GuicyFig;
+import org.safehaus.guicyfig.Key;
+
+
+@FigSingleton
+public interface PasswordPolicyFig extends GuicyFig {
+
+    String ALLOWED_SPECIAL_CHARS       = "usergrid.password-policy.allowed-special-chars";
+
+    String MIN_UPPERCASE_ADMIN         = "usergrid.password-policy.min-uppercase-admin";
+    String MIN_UPPERCASE               = "usergrid.password-policy.min-uppercase";
+
+    String MIN_DIGITS_ADMIN            = "usergrid.password-policy.min-digits-admin";
+    String MIN_DIGITS                  = "usergrid.password-policy.min-digits";
+
+    String MIN_SPECIAL_CHARS_ADMIN     = "usergrid.password-policy.min-special-chars-admin";
+    String MIN_SPECIAL_CHARS           = "usergrid.password-policy.min-special-chars";
+
+    String MIN_LENGTH_ADMIN            = "usergrid.password-policy.min-length-admin";
+    String MIN_LENGTH                  = "usergrid.password-policy.min-length";
+
+
+    @Key(MIN_UPPERCASE_ADMIN)
+    @Default("0")
+    int getMinUppercaseAdmin();
+
+    @Key(MIN_UPPERCASE)
+    @Default("0")
+    int getMinUppercase();
+
+    @Key(MIN_DIGITS_ADMIN)
+    @Default("0")
+    int getMinDigitsAdmin();
+
+    @Key(MIN_DIGITS)
+    @Default("0")
+    int getMinDigits();
+
+    @Key(MIN_SPECIAL_CHARS_ADMIN)
+    @Default("0")
+    int getMinSpecialCharsAdmin();
+
+    @Key(MIN_SPECIAL_CHARS)
+    @Default("0")
+    int getMinSpecialChars();
+
+    @Key(MIN_LENGTH_ADMIN)
+    @Default("4")
+    int getMinLengthAdmin();
+
+    @Key(MIN_LENGTH)
+    @Default("4")
+    int getMinLength();
+
+    @Key(ALLOWED_SPECIAL_CHARS)
+    @Default("`~!@#$%^&*()-_=+[{]}\\|;:'\",<.>/?")
+    String getAllowedSpecialChars();
+}
diff --git a/stack/services/src/main/java/org/apache/usergrid/security/PasswordPolicyImpl.java b/stack/services/src/main/java/org/apache/usergrid/security/PasswordPolicyImpl.java
new file mode 100644
index 0000000000..500592a4d4
--- /dev/null
+++ b/stack/services/src/main/java/org/apache/usergrid/security/PasswordPolicyImpl.java
@@ -0,0 +1,156 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.usergrid.security;
+
+import com.google.inject.Inject;
+import org.apache.commons.lang3.StringUtils;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+
+
+public class PasswordPolicyImpl implements PasswordPolicy {
+
+    private final PasswordPolicyFig passwordPolicyFig;
+
+
+    @Inject
+    PasswordPolicyImpl( PasswordPolicyFig passwordPolicyFig ) {
+        this.passwordPolicyFig = passwordPolicyFig;
+    }
+
+
+    @Override
+    public String getDescription( boolean isAdminUser ) {
+
+        final int minLength;
+        final int minUppercase;
+        final int minDigits;
+        final int minSpecialChars;
+
+        if ( isAdminUser ) {
+            minLength       = passwordPolicyFig.getMinLengthAdmin();
+            minUppercase    = passwordPolicyFig.getMinUppercaseAdmin();
+            minDigits       = passwordPolicyFig.getMinDigitsAdmin();
+            minSpecialChars = passwordPolicyFig.getMinSpecialCharsAdmin();
+        } else {
+            minLength       = passwordPolicyFig.getMinLength();
+            minUppercase    = passwordPolicyFig.getMinUppercase();
+            minDigits       = passwordPolicyFig.getMinDigits();
+            minSpecialChars = passwordPolicyFig.getMinSpecialChars();
+        }
+
+        StringBuilder sb = new StringBuilder();
+        sb.append( "Password must be at least " ).append( minLength ).append(" characters. ");
+        if ( minUppercase > 0 ) {
+            sb.append( "Must include " ).append( minUppercase ).append(" uppercase characters. ");
+        }
+        if ( minDigits > 0 ) {
+            sb.append( "Must include " ).append( minDigits ).append(" numbers. ");
+        }
+        if ( minSpecialChars > 0 ) {
+            sb.append( "Must include " ).append( minUppercase ).append(" special characters. ");
+        }
+        return sb.toString();
+    }
+
+
+    @Override
+    public Collection<String> policyCheck( String password, boolean isAdminUser ) {
+
+        final int minLength;
+        final int minUppercase;
+        final int minDigits;
+        final int minSpecialChars;
+
+        if ( isAdminUser ) {
+            minLength       = passwordPolicyFig.getMinLengthAdmin();
+            minUppercase    = passwordPolicyFig.getMinUppercaseAdmin();
+            minDigits       = passwordPolicyFig.getMinDigitsAdmin();
+            minSpecialChars = passwordPolicyFig.getMinSpecialCharsAdmin();
+        } else {
+            minLength       = passwordPolicyFig.getMinLength();
+            minUppercase    = passwordPolicyFig.getMinUppercase();
+            minDigits       = passwordPolicyFig.getMinDigits();
+            minSpecialChars = passwordPolicyFig.getMinSpecialChars();
+        }
+
+        return policyCheck( password, minLength, minUppercase, minDigits, minSpecialChars );
+    }
+
+
+    public Collection<String> policyCheck(
+        String password, int minLength, int minUppercase, int minDigits, int minSpecialChars ) {
+
+
+        List<String> violations = new ArrayList<>(3);
+
+        // check length
+        if ( password == null || password.length() < minLength ) {
+            violations.add( PasswordPolicy.ERROR_LENGTH_POLICY
+                + ": must be at least " + minLength + " characters" );
+        }
+
+        // count upper case
+        if ( minUppercase > 0 ) {
+            int upperCaseCount = 0;
+            for (char c : password.toCharArray()) {
+                if (StringUtils.isAllUpperCase( String.valueOf( c ) )) {
+                    upperCaseCount++;
+                }
+            }
+            if (upperCaseCount < minUppercase) {
+                violations.add( PasswordPolicy.ERROR_UPPERCASE_POLICY
+                    + ": requires " + minUppercase + " uppercase characters" );
+            }
+        }
+
+        // count digits case
+        if ( minDigits > 0 ) {
+            int digitCount = 0;
+            for (char c : password.toCharArray()) {
+                if (StringUtils.isNumeric( String.valueOf( c ) )) {
+                    digitCount++;
+                }
+            }
+            if (digitCount < minDigits) {
+                violations.add( PasswordPolicy.ERROR_DIGITS_POLICY
+                    + ": requires " + minDigits + " digits" );
+            }
+        }
+
+        // count special characters
+        if ( minSpecialChars > 0 ) {
+            int specialCharCount = 0;
+            for (char c : password.toCharArray()) {
+                if (passwordPolicyFig.getAllowedSpecialChars().contains( String.valueOf( c ) )) {
+                    specialCharCount++;
+                }
+            }
+            if (specialCharCount < minSpecialChars) {
+                violations.add( PasswordPolicy.ERROR_SPECIAL_CHARS_POLICY
+                    + ": requires " + minSpecialChars + " special characters" );
+            }
+        }
+
+        return violations;
+    }
+
+
+}
diff --git a/stack/services/src/main/java/org/apache/usergrid/services/guice/ServiceModuleImpl.java b/stack/services/src/main/java/org/apache/usergrid/services/guice/ServiceModuleImpl.java
index 58b301ae6f..9e5485b3cf 100644
--- a/stack/services/src/main/java/org/apache/usergrid/services/guice/ServiceModuleImpl.java
+++ b/stack/services/src/main/java/org/apache/usergrid/services/guice/ServiceModuleImpl.java
@@ -31,8 +31,12 @@
 import org.apache.usergrid.persistence.cache.impl.ScopedCacheSerialization;
 import org.apache.usergrid.persistence.cache.impl.ScopedCacheSerializationImpl;
 import org.apache.usergrid.persistence.core.migration.data.MigrationPlugin;
+import org.apache.usergrid.security.PasswordPolicy;
+import org.apache.usergrid.security.PasswordPolicyFig;
+import org.apache.usergrid.security.PasswordPolicyImpl;
 import org.apache.usergrid.security.shiro.UsergridAuthenticationInfo;
 import org.apache.usergrid.security.shiro.UsergridAuthorizationInfo;
+import org.safehaus.guicyfig.GuicyFigModule;
 
 
 // <bean id="notificationsQueueListener" class="org.apache.usergrid.services.notifications.QueueListener"
@@ -70,5 +74,8 @@ protected void configure() {
         bind(    new TypeLiteral<ScopedCacheSerialization<String, UsergridAuthenticationInfo>>() {})
             .to( new TypeLiteral<ScopedCacheSerializationImpl<String, UsergridAuthenticationInfo>>() {});
 
+        bind( PasswordPolicy.class ).to( PasswordPolicyImpl.class );
+
+        install( new GuicyFigModule( PasswordPolicyFig.class ) );
     }
 }

From 48b628c0f812620ff86a367a767916d7a9f0aa5e Mon Sep 17 00:00:00 2001
From: Mike Dunker <mdunker@google.com>
Date: Fri, 28 Jul 2017 16:33:07 -0700
Subject: [PATCH 05/11] additional info statement when describe keyspace fails

---
 .../persistence/core/migration/schema/MigrationManagerImpl.java  | 1 +
 1 file changed, 1 insertion(+)

diff --git a/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManagerImpl.java b/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManagerImpl.java
index db694fe461..f41ece9fdc 100644
--- a/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManagerImpl.java
+++ b/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManagerImpl.java
@@ -137,6 +137,7 @@ private void testAndCreateKeyspace() throws ConnectionException {
             logger.info( "Received a NotFoundException when attempting to describe keyspace.  It does not exist" );
         }
         catch(Exception e){
+            logger.info("describeKeyspace exception: {}", e.getMessage());
             AstayanxUtils.isKeyspaceMissing("Unable to connect to cassandra", e);
         }
 

From bc0889856154dc15bbf6896250beb5cb058f9e5a Mon Sep 17 00:00:00 2001
From: Mike Dunker <mdunker@google.com>
Date: Fri, 4 Aug 2017 11:11:14 -0700
Subject: [PATCH 06/11] Add astayanax drop keyspace during test setup, because
 there seems to be a race condition between Hector dropping keyspace and
 Astayanax detecting it.

---
 .../usergrid/corepersistence/CpSetup.java      | 12 +++++++++---
 .../usergrid/persistence/cassandra/Setup.java  |  8 ++++++++
 .../persistence/CoreSchemaManager.java         |  6 ++++++
 .../migration/schema/MigrationManager.java     |  5 +++++
 .../migration/schema/MigrationManagerImpl.java | 18 ++++++++++++++++++
 .../usergrid/cassandra/SchemaManager.java      |  3 +++
 .../usergrid/cassandra/FakeSchemaManager.java  |  7 ++++++-
 7 files changed, 55 insertions(+), 4 deletions(-)

diff --git a/stack/core/src/main/java/org/apache/usergrid/corepersistence/CpSetup.java b/stack/core/src/main/java/org/apache/usergrid/corepersistence/CpSetup.java
index 623400d750..8213a35bc5 100644
--- a/stack/core/src/main/java/org/apache/usergrid/corepersistence/CpSetup.java
+++ b/stack/core/src/main/java/org/apache/usergrid/corepersistence/CpSetup.java
@@ -76,12 +76,18 @@ public CpSetup( final EntityManagerFactory emf,
 
     @Override
     public void initSchema() throws Exception {
+        initSchema(false);
+    }
+
+
+    @Override
+    public void initSchema(boolean dropKeyspace) throws Exception {
 
         // Initialize the management app index in Elasticsearch
         this.emf.initializeManagementIndex();
 
         // Create the schema (including keyspace) in Cassandra
-        setupSchema();
+        setupSchema(dropKeyspace);
         setupLegacySchema();
 
     }
@@ -138,11 +144,11 @@ private void setupLegacySchema() throws Exception {
      *
      */
 
-    private void setupSchema() throws Exception {
+    private void setupSchema(boolean dropKeyspace) throws Exception {
 
         MigrationManager m = injector.getInstance( MigrationManager.class );
         try {
-            m.migrate();
+            m.migrate(dropKeyspace);
         }
         catch ( MigrationException ex ) {
             throw new RuntimeException( "Error migrating Core Persistence", ex );
diff --git a/stack/core/src/main/java/org/apache/usergrid/persistence/cassandra/Setup.java b/stack/core/src/main/java/org/apache/usergrid/persistence/cassandra/Setup.java
index 697cd21f73..9379edd374 100644
--- a/stack/core/src/main/java/org/apache/usergrid/persistence/cassandra/Setup.java
+++ b/stack/core/src/main/java/org/apache/usergrid/persistence/cassandra/Setup.java
@@ -25,6 +25,14 @@ public interface Setup {
     void initSchema() throws Exception;
 
 
+    /**
+     * Initialize all configuration for the system setup. Creates keyspaces and elasticsearch indexes,
+     * dropping keyspaces first if requested
+     * @throws Exception
+     */
+    void initSchema(boolean dropKeyspace) throws Exception;
+
+
     /**
      * Bootstrap the root application to allow the system to function.
      * @throws Exception
diff --git a/stack/core/src/test/java/org/apache/usergrid/persistence/CoreSchemaManager.java b/stack/core/src/test/java/org/apache/usergrid/persistence/CoreSchemaManager.java
index 28f2c9f8ee..ce98735457 100644
--- a/stack/core/src/test/java/org/apache/usergrid/persistence/CoreSchemaManager.java
+++ b/stack/core/src/test/java/org/apache/usergrid/persistence/CoreSchemaManager.java
@@ -50,6 +50,12 @@ public CoreSchemaManager( final Setup setup, final Cluster cluster, Injector inj
 
     @Override
     public void create() {
+        create(false);
+    }
+
+
+    @Override
+    public void create(boolean dropKeyspace) {
         try {
             setup.initSchema();
             lockManager.setup();
diff --git a/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManager.java b/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManager.java
index df84247b79..80c93ba46b 100644
--- a/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManager.java
+++ b/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManager.java
@@ -31,4 +31,9 @@ public interface MigrationManager {
      * not exist
      */
     public void migrate() throws MigrationException;
+
+    /**
+     * Perform any migration necessary in the application.  Will drop keyspaces first if requested.
+     */
+    public void migrate(boolean dropKeyspace) throws MigrationException;
 }
diff --git a/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManagerImpl.java b/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManagerImpl.java
index f41ece9fdc..cb62f4a299 100644
--- a/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManagerImpl.java
+++ b/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManagerImpl.java
@@ -68,10 +68,20 @@ public MigrationManagerImpl( final Keyspace keyspace, final Set<Migration> migra
 
     @Override
     public void migrate() throws MigrationException {
+        migrate(false);
+    }
+
+
+    @Override
+    public void migrate(boolean dropKeyspace) throws MigrationException {
 
 
         try {
 
+            if (dropKeyspace) {
+                dropKeyspace();
+            }
+
             testAndCreateKeyspace();
 
             for ( Migration migration : migrations ) {
@@ -120,6 +130,14 @@ private void testAndCreateColumnFamilyDef( MultiTenantColumnFamilyDefinition col
     }
 
 
+    /**
+     * Drop keyspace.
+     */
+    private void dropKeyspace() throws ConnectionException {
+        keyspace.dropKeyspace();
+    }
+
+
     /**
      * Check if they keyspace exists.  If it doesn't create it
      */
diff --git a/stack/test-utils/src/main/java/org/apache/usergrid/cassandra/SchemaManager.java b/stack/test-utils/src/main/java/org/apache/usergrid/cassandra/SchemaManager.java
index 7e87ba112a..2c475aa113 100644
--- a/stack/test-utils/src/main/java/org/apache/usergrid/cassandra/SchemaManager.java
+++ b/stack/test-utils/src/main/java/org/apache/usergrid/cassandra/SchemaManager.java
@@ -23,6 +23,9 @@ public interface SchemaManager {
     /** Create any schema necessary for test execution. */
     void create();
 
+    /** Create any schema necessary for test execution, dropping keyspace if requested. */
+    void create(boolean dropKeyspace);
+
     /** Any breath-of-life data needed for the base system */
     void populateBaseData();
 
diff --git a/stack/test-utils/src/test/java/org/apache/usergrid/cassandra/FakeSchemaManager.java b/stack/test-utils/src/test/java/org/apache/usergrid/cassandra/FakeSchemaManager.java
index cdbdc9f1f8..e9b2c3251d 100644
--- a/stack/test-utils/src/test/java/org/apache/usergrid/cassandra/FakeSchemaManager.java
+++ b/stack/test-utils/src/test/java/org/apache/usergrid/cassandra/FakeSchemaManager.java
@@ -23,7 +23,12 @@ public class FakeSchemaManager implements SchemaManager {
     public void create() {
 
     }
-    
+
+    @Override
+    public void create(boolean dropKeyspace) {
+
+    }
+
 
     @Override
     public void populateBaseData() {

From 01050ab35574e534b9871d1ede814503a93c9d65 Mon Sep 17 00:00:00 2001
From: Mike Dunker <mdunker@google.com>
Date: Mon, 7 Aug 2017 10:01:10 -0700
Subject: [PATCH 07/11] fix some race conditions in test by making sure each
 test is going against different collection

---
 .../applications/queries/AndOrQueryTest.java  | 46 ++++++++++---------
 .../rest/applications/utils/TestUtils.java    |  4 ++
 2 files changed, 29 insertions(+), 21 deletions(-)

diff --git a/stack/rest/src/test/java/org/apache/usergrid/rest/applications/queries/AndOrQueryTest.java b/stack/rest/src/test/java/org/apache/usergrid/rest/applications/queries/AndOrQueryTest.java
index 4bdd3fcabe..3d0498768c 100644
--- a/stack/rest/src/test/java/org/apache/usergrid/rest/applications/queries/AndOrQueryTest.java
+++ b/stack/rest/src/test/java/org/apache/usergrid/rest/applications/queries/AndOrQueryTest.java
@@ -27,6 +27,7 @@
 import java.io.IOException;
 import java.util.List;
 
+import static org.apache.usergrid.rest.applications.utils.TestUtils.getCollectionNameWithUUID;
 import static org.junit.Assert.*;
 
 
@@ -47,13 +48,13 @@ public class AndOrQueryTest extends QueryTestBase {
     @Test
     public void queryAndInclusive() throws IOException {
         int numOfEntities = 20;
-        String collectionName = "activities";
+        String collectionName = getCollectionNameWithUUID("activities");
         // create our test entities
         generateTestEntities(numOfEntities, collectionName);
         // Query where madeup = true (the last half) and the last quarter of entries
         QueryParameters params = new QueryParameters()
             .setQuery("select * where madeup = true AND ordinal >= " + (numOfEntities - numOfEntities / 4));
-        Collection activities = this.app().collection("activities").get(params);
+        Collection activities = this.app().collection(collectionName).get(params);
         // results should have madeup = true and ordinal 15-19
         assertEquals(numOfEntities / 4, activities.getResponse().getEntityCount());
         // loop though entities that were returned, and test against the ordinals and values we are
@@ -71,13 +72,13 @@ public void queryAndInclusive() throws IOException {
     @Test
     public void someTestProp() throws IOException {
         int numOfEntities = 20;
-        String collectionName = "activities";
+        String collectionName = getCollectionNameWithUUID("activities");
         // create our test entities
         generateTestEntities(numOfEntities, collectionName);
         // Query where madeup = true (the last half) and the last quarter of entries
         QueryParameters params = new QueryParameters()
             .setQuery("where sometestprop = 'testprop'");
-        Collection activities = this.app().collection("activities").get(params);
+        Collection activities = this.app().collection(collectionName).get(params);
         // results should have madeup = true and ordinal 15-19
         assertEquals(10, activities.getResponse().getEntityCount());
 
@@ -87,13 +88,13 @@ public void someTestProp() throws IOException {
     @Test
     public void someTestPropPartialContains() throws IOException {
         int numOfEntities = 20;
-        String collectionName = "activities";
+        String collectionName = getCollectionNameWithUUID("activities");
         // create our test entities
         generateTestEntities(numOfEntities, collectionName);
         // Query where madeup = true (the last half) and the last quarter of entries
         QueryParameters params = new QueryParameters()
             .setQuery("where sometestprop contains 'test*'");
-        Collection activities = this.app().collection("activities").get(params);
+        Collection activities = this.app().collection(collectionName).get(params);
         // results should have madeup = true and ordinal 15-19
         assertEquals(10, activities.getResponse().getEntityCount());
 
@@ -108,14 +109,14 @@ public void someTestPropPartialContains() throws IOException {
     @Test
     public void queryAndExclusive() throws IOException {
         int numOfEntities = 20;
-        String collectionName = "activities";
+        String collectionName = getCollectionNameWithUUID("activities");
 
         generateTestEntities(numOfEntities, collectionName);
 
         //Query where madeup = true (the last half) and NOT the last quarter of entries
         QueryParameters params = new QueryParameters()
             .setQuery("select * where madeup = true AND NOT ordinal >= " + (numOfEntities - numOfEntities / 4));
-        Collection activities = this.app().collection("activities").get(params);
+        Collection activities = this.app().collection(collectionName).get(params);
         //results should have madeup = true and ordinal 10-14
         assertEquals(numOfEntities / 4, activities.getResponse().getEntityCount());
         // loop though entities that were returned, and test against the ordinals and values we are
@@ -138,7 +139,7 @@ public void queryAndExclusive() throws IOException {
     @Test
     public void queryOrInclusive() throws IOException {
         int numOfEntities = 20;
-        String collectionName = "activities";
+        String collectionName = getCollectionNameWithUUID("activities");
 
         generateTestEntities(numOfEntities, collectionName);
 
@@ -146,7 +147,7 @@ public void queryOrInclusive() throws IOException {
         QueryParameters params = new QueryParameters()
             .setQuery("select * where madeup = false OR ordinal >= " + (numOfEntities - numOfEntities / 4))
             .setLimit((numOfEntities));
-        Collection activities = this.app().collection("activities").get(params);
+        Collection activities = this.app().collection(collectionName).get(params);
         int index = numOfEntities - 1;
         int count = 0;
         int returnSize = activities.getResponse().getEntityCount();
@@ -181,7 +182,7 @@ else if (index >= (numOfEntities - numOfEntities / 4)) {
     @Test
     public void queryOrExclusive() throws IOException {
         int numOfEntities = 30;
-        String collectionName = "activities";
+        String collectionName = getCollectionNameWithUUID("activities");
 
         generateTestEntities(numOfEntities, collectionName);
 
@@ -189,7 +190,7 @@ public void queryOrExclusive() throws IOException {
         QueryParameters params = new QueryParameters()
             .setQuery("select * where (verb = 'go' OR ordinal >= " + (numOfEntities - numOfEntities / 4) + ") AND NOT (verb = 'go' AND ordinal >= " + (numOfEntities - numOfEntities / 4) + ")")
             .setLimit((numOfEntities));
-        Collection activities = this.app().collection("activities").get(params);
+        Collection activities = this.app().collection(collectionName).get(params);
 
         int index = numOfEntities - 1;
         int count = 0;
@@ -224,14 +225,15 @@ else if (ordinal >= (numOfEntities - numOfEntities / 4)) {
     @Test
     public void queryWithAndPastLimit() throws IOException {
         int numValuesTested = 40;
+        String collectionName = getCollectionNameWithUUID("activities");
 
-        generateTestEntities(numValuesTested, "activities");
+        generateTestEntities(numValuesTested,collectionName);
         //3. Query all entities where "madeup = true"
         String errorQuery = "select * where madeup = true";
         QueryParameters params = new QueryParameters()
             .setQuery(errorQuery)
             .setLimit(numValuesTested / 2);//4. Limit the query to half of the number of entities
-        Collection activities = this.app().collection("activities").get(params);
+        Collection activities = this.app().collection(collectionName).get(params);
         //5. Ensure the correct entities are returned
         assertEquals(numValuesTested / 2, activities.getResponse().getEntityCount());
         while (activities.hasNext()) {
@@ -251,13 +253,14 @@ public void queryWithAndPastLimit() throws IOException {
     @Test
     public void queryNegated() throws IOException {
         int numValuesTested = 20;
+        String collectionName = getCollectionNameWithUUID("activities");
 
-        generateTestEntities(numValuesTested, "activities");
+        generateTestEntities(numValuesTested,collectionName);
         //1. Query all entities where "NOT verb = 'go'"
         String query = "select * where not verb = 'go'";
         //2. Limit the query to half of the number of entities
         QueryParameters params = new QueryParameters().setQuery(query).setLimit(numValuesTested / 2);
-        Collection activities = this.app().collection("activities").get(params);
+        Collection activities = this.app().collection(collectionName).get(params);
         //3. Ensure the returned entities have "verb = 'stop'"
         assertEquals(numValuesTested / 2, activities.getResponse().getEntityCount());
         while (activities.hasNext()) {
@@ -277,12 +280,13 @@ public void queryNegated() throws IOException {
     @Test
     public void queryReturnCount() throws Exception {
         int numValuesTested = 20;
+        String collectionName = getCollectionNameWithUUID("activities");
 
-        generateTestEntities(numValuesTested, "activities");
+        generateTestEntities(numValuesTested, collectionName);
         //1. Query for a subset of the entities
         String inCorrectQuery = "select * where ordinal >= " + (numValuesTested / 2) + " order by ordinal asc";
         QueryParameters params = new QueryParameters().setQuery(inCorrectQuery).setLimit(numValuesTested / 2);
-        Collection activities = this.app().collection("activities").get(params);
+        Collection activities = this.app().collection(collectionName).get(params);
         //2. Validate that the correct entities are returned
         assertEquals(numValuesTested / 2, activities.getResponse().getEntityCount());
 
@@ -303,7 +307,7 @@ public void queryReturnCount() throws Exception {
     @Test
     public void queryCheckAsc() throws Exception {
         int numOfEntities = 20;
-        String collectionName = "imagination";
+        String collectionName = getCollectionNameWithUUID("imagination");
 
         generateTestEntities(numOfEntities, collectionName);
 
@@ -332,7 +336,7 @@ public void queryCheckAsc() throws Exception {
     @Test
     public void queryReturnCheck() throws Exception {
         int numOfEntities = 20;
-        String collectionName = "imagination";
+        String collectionName = getCollectionNameWithUUID("imagination");
 
         generateTestEntities(numOfEntities, collectionName);
 
@@ -359,7 +363,7 @@ public void queryReturnCheck() throws Exception {
     @Test
     public void queryReturnCheckWithShortHand() throws Exception {
         int numOfEntities = 10;
-        String collectionName = "imagination";
+        String collectionName = getCollectionNameWithUUID("imagination");
 
         generateTestEntities(numOfEntities, collectionName);
 
diff --git a/stack/rest/src/test/java/org/apache/usergrid/rest/applications/utils/TestUtils.java b/stack/rest/src/test/java/org/apache/usergrid/rest/applications/utils/TestUtils.java
index 9a7d71c791..1482110534 100644
--- a/stack/rest/src/test/java/org/apache/usergrid/rest/applications/utils/TestUtils.java
+++ b/stack/rest/src/test/java/org/apache/usergrid/rest/applications/utils/TestUtils.java
@@ -62,4 +62,8 @@ public static UUID getIdFromSearchResults( Collection collection, int index ) {
 
         return UUIDUtils.tryExtractUUID( entity.get( "uuid" ).toString() );
     }
+
+    public static String getCollectionNameWithUUID(String collectionBase) {
+        return collectionBase + "_" + UUIDUtils.newTimeUUID().toString();
+    }
 }

From 3ddf5221c3bb0da5e90d237a56a7c6a16be6995f Mon Sep 17 00:00:00 2001
From: Mike Dunker <mdunker@google.com>
Date: Wed, 9 Aug 2017 14:54:40 -0700
Subject: [PATCH 08/11] during tests, drop keyspaces using astyanax driver

---
 .../persistence/CoreSchemaManager.java        | 21 ++-----------------
 .../schema/MigrationManagerImpl.java          | 10 ++++++++-
 .../setup/ConcurrentProcessSingleton.java     |  2 +-
 3 files changed, 12 insertions(+), 21 deletions(-)

diff --git a/stack/core/src/test/java/org/apache/usergrid/persistence/CoreSchemaManager.java b/stack/core/src/test/java/org/apache/usergrid/persistence/CoreSchemaManager.java
index ce98735457..8038d365d9 100644
--- a/stack/core/src/test/java/org/apache/usergrid/persistence/CoreSchemaManager.java
+++ b/stack/core/src/test/java/org/apache/usergrid/persistence/CoreSchemaManager.java
@@ -57,7 +57,7 @@ public void create() {
     @Override
     public void create(boolean dropKeyspace) {
         try {
-            setup.initSchema();
+            setup.initSchema(dropKeyspace);
             lockManager.setup();
         }
         catch ( Exception ex ) {
@@ -87,24 +87,7 @@ public void populateBaseData() {
 
     @Override
     public void destroy() {
-        logger.info( "dropping keyspaces" );
-        try {
-            cluster.dropKeyspace( CassandraService.getApplicationKeyspace() );
-        }
-        catch ( RuntimeException ire ) {
-            //swallow if it just doesn't exist
-        }
-
-
-        try {
-            cluster.dropKeyspace( CassandraService.getApplicationKeyspace() );
-        }
-        catch ( RuntimeException ire ) {
-            //swallow if it just doesn't exist
-        }
-
-        logger.info( "keyspaces dropped" );
-
+        logger.info( "keyspace dropping deferred" );
 
         final EsProvider provider =
             SpringResource.getInstance().getBean( Injector.class ).getInstance( EsProvider.class );
diff --git a/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManagerImpl.java b/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManagerImpl.java
index cb62f4a299..003565e0f2 100644
--- a/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManagerImpl.java
+++ b/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManagerImpl.java
@@ -134,7 +134,15 @@ private void testAndCreateColumnFamilyDef( MultiTenantColumnFamilyDefinition col
      * Drop keyspace.
      */
     private void dropKeyspace() throws ConnectionException {
-        keyspace.dropKeyspace();
+        try {
+            keyspace.dropKeyspace();
+        }
+        catch (NotFoundException nfe) {
+            logger.info( "Received a NotFoundException when attempting to drop keyspace.  It does not exist" );
+        }
+        catch (ConnectionException e) {
+            logger.info( "Received a ConnectionException when attempting to drop keyspace: {}", e.getMessage());
+        }
     }
 
 
diff --git a/stack/test-utils/src/main/java/org/apache/usergrid/setup/ConcurrentProcessSingleton.java b/stack/test-utils/src/main/java/org/apache/usergrid/setup/ConcurrentProcessSingleton.java
index 3b08bc8125..5363381c22 100644
--- a/stack/test-utils/src/main/java/org/apache/usergrid/setup/ConcurrentProcessSingleton.java
+++ b/stack/test-utils/src/main/java/org/apache/usergrid/setup/ConcurrentProcessSingleton.java
@@ -98,7 +98,7 @@ private void startSystem() {
 
                 // create our schema
                 logger.info("Creating database");
-                schemaManager.create();
+                schemaManager.create(CLEAN_STORAGE);
 
                 logger.info( "Populating database" );
                 schemaManager.populateBaseData();

From 75a08abc26ac2c71ee1c08fa0005458ef3c9642b Mon Sep 17 00:00:00 2001
From: Mike Dunker <mdunker@google.com>
Date: Wed, 9 Aug 2017 15:17:00 -0700
Subject: [PATCH 09/11] During test startup, if dropping keyspace, don't check
 again for existence.

---
 .../migration/schema/MigrationManagerImpl.java   | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManagerImpl.java b/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManagerImpl.java
index 003565e0f2..3f31a4ca10 100644
--- a/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManagerImpl.java
+++ b/stack/corepersistence/common/src/main/java/org/apache/usergrid/persistence/core/migration/schema/MigrationManagerImpl.java
@@ -80,10 +80,11 @@ public void migrate(boolean dropKeyspace) throws MigrationException {
 
             if (dropKeyspace) {
                 dropKeyspace();
+                createKeyspace();
+            } else {
+                testAndCreateKeyspace();
             }
 
-            testAndCreateKeyspace();
-
             for ( Migration migration : migrations ) {
 
                 final Collection<MultiTenantColumnFamilyDefinition> columnFamilies = migration.getColumnFamilies();
@@ -172,13 +173,20 @@ private void testAndCreateKeyspace() throws ConnectionException {
             return;
         }
 
+        createKeyspace();
+
+    }
 
+    /**
+     * Create keyspace, it must not exist (either have checked for it or dropped it).
+     */
+    private void createKeyspace() throws ConnectionException {
         ImmutableMap.Builder<String, Object> strategyOptions = getKeySpaceProps();
 
 
         ImmutableMap<String, Object> options =
-                ImmutableMap.<String, Object>builder().put( "strategy_class", fig.getStrategyClass() )
-                            .put( "strategy_options", strategyOptions.build() ).build();
+            ImmutableMap.<String, Object>builder().put( "strategy_class", fig.getStrategyClass() )
+                .put( "strategy_options", strategyOptions.build() ).build();
 
 
         keyspace.createKeyspace( options );

From 7552d58018333db91ed6e22a55773ad78995d077 Mon Sep 17 00:00:00 2001
From: Mike Dunker <mdunker@google.com>
Date: Wed, 9 Aug 2017 16:06:00 -0700
Subject: [PATCH 10/11] change test Cassandra timeout for astyanax to allow for
 long request to drop keyspace

---
 stack/core/src/test/resources/usergrid-custom-test.properties   | 2 +-
 .../graph/src/test/resources/usergrid-UNIT.properties           | 2 +-
 stack/rest/src/test/resources/usergrid-custom-test.properties   | 2 +-
 .../services/src/test/resources/usergrid-custom-test.properties | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/stack/core/src/test/resources/usergrid-custom-test.properties b/stack/core/src/test/resources/usergrid-custom-test.properties
index dd6612fcde..3dc6c043ce 100644
--- a/stack/core/src/test/resources/usergrid-custom-test.properties
+++ b/stack/core/src/test/resources/usergrid-custom-test.properties
@@ -14,7 +14,7 @@
 
 # these settings allow tests to run and consistently pass on 16GB MacBook Pro
 # with ug.heapmax=5000m and ug.heapmin=3000m (set in Maven settings.xml)
-cassandra.timeout=2000
+cassandra.timeout=20000
 cassandra.connections=1000
 
 
diff --git a/stack/corepersistence/graph/src/test/resources/usergrid-UNIT.properties b/stack/corepersistence/graph/src/test/resources/usergrid-UNIT.properties
index eb060012e4..2a4d29513d 100644
--- a/stack/corepersistence/graph/src/test/resources/usergrid-UNIT.properties
+++ b/stack/corepersistence/graph/src/test/resources/usergrid-UNIT.properties
@@ -5,7 +5,7 @@ cassandra.version=1.2
 cassandra.hosts=localhost
 cassandra.cluster_name=Usergrid
 collections.keyspace=Usergrid_Collections
-cassandra.timeout=2000
+cassandra.timeout=20000
 cassandra.embedded=true
 
 
diff --git a/stack/rest/src/test/resources/usergrid-custom-test.properties b/stack/rest/src/test/resources/usergrid-custom-test.properties
index d845fcce9c..299247678a 100644
--- a/stack/rest/src/test/resources/usergrid-custom-test.properties
+++ b/stack/rest/src/test/resources/usergrid-custom-test.properties
@@ -16,7 +16,7 @@
 # REST module test properties
 
 cassandra.startup=external
-cassandra.timeout=2000
+cassandra.timeout=20000
 cassandra.connections=800
 
 elasticsearch.startup=external
diff --git a/stack/services/src/test/resources/usergrid-custom-test.properties b/stack/services/src/test/resources/usergrid-custom-test.properties
index 9a800c99cc..f8bbb010f8 100644
--- a/stack/services/src/test/resources/usergrid-custom-test.properties
+++ b/stack/services/src/test/resources/usergrid-custom-test.properties
@@ -16,7 +16,7 @@
 # with ug.heapmax=5000m and ug.heapmin=3000m (set in Maven settings.xml)
 cassandra.startup=external
 elasticsearch.startup=external
-cassandra.timeout=2000
+cassandra.timeout=20000
 cassandra.connections=1000
 
 #Poll interval to check for new jobs in millseconds. 10 milliseconds for testing

From c737d7cf310c4885fff7b14cfd31d8a92938dc25 Mon Sep 17 00:00:00 2001
From: Mike Dunker <mdunker@google.com>
Date: Wed, 9 Aug 2017 18:39:23 -0700
Subject: [PATCH 11/11] fix broken recaptcha

---
 .../rest/applications/ApplicationResource/authorize_form.jsp  | 2 +-
 .../applications/users/UserResource/resetpw_email_form.jsp    | 4 ++--
 .../rest/applications/users/UserResource/resetpw_set_form.jsp | 2 +-
 .../applications/users/UsersResource/resetpw_email_form.jsp   | 4 ++--
 .../rest/management/ManagementResource/authorize_form.jsp     | 2 +-
 .../rest/management/users/UserResource/resetpw_email_form.jsp | 4 ++--
 .../rest/management/users/UserResource/resetpw_set_form.jsp   | 2 +-
 .../management/users/UsersResource/resetpw_email_form.jsp     | 4 ++--
 8 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/ApplicationResource/authorize_form.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/ApplicationResource/authorize_form.jsp
index 0079bcf0a6..ed934a72d6 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/ApplicationResource/authorize_form.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/ApplicationResource/authorize_form.jsp
@@ -29,7 +29,7 @@ limitations under the License.
 <body>
 
 	<div class="dialog-area">
-		<c:if test="${!empty fn:escapeXml(it.errorMsg)}"><div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div></c:if>
+		<c:if test="${!empty it.errorMsg}"><div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div></c:if>
 		<form class="dialog-form" action="" method="post">
 			<input type="hidden" name="response_type" value="${fn:escapeXml(it.responseType)}">
 			<input type="hidden" name="client_id" value="${fn:escapeXml(it.clientId)}">
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_email_form.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_email_form.jsp
index 59026bf0d8..5230ea7381 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_email_form.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_email_form.jsp
@@ -27,7 +27,7 @@ limitations under the License.
 </head>
 <body>
 	<div class="dialog-area">
-		<c:if test="${!empty fn:escapeXml(it.errorMsg)}">
+		<c:if test="${!empty it.errorMsg}">
 			<div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div>
 		</c:if>
 		<form class="dialog-form" action="" method="post">
@@ -37,7 +37,7 @@ limitations under the License.
 					<c:out value="${it.user.email}" escapeXml="true" />
 				</p>
 				<p id="human-proof"></p>
-				${fn:escapeXml(it.reCaptchaHtml)}
+				${it.reCaptchaHtml}
 				<p class="buttons">
 					<input type="submit" value="submit" />
 				</p>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_set_form.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_set_form.jsp
index 19b6528f4a..c0203ce239 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_set_form.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UserResource/resetpw_set_form.jsp
@@ -31,7 +31,7 @@ limitations under the License.
 <body>
 
 	<div class="dialog-area">
-		<c:if test="${!empty fn:escapeXml(it.errorMsg)}"><div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div></c:if>
+		<c:if test="${!empty it.errorMsg}"><div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div></c:if>
 		<form class="dialog-form" action="" method="post">
 			<input type="hidden" name="token" value="${fn:escapeXml(it.token)}">
 			<fieldset>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UsersResource/resetpw_email_form.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UsersResource/resetpw_email_form.jsp
index f86240f2f5..01dfc5729b 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UsersResource/resetpw_email_form.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/applications/users/UsersResource/resetpw_email_form.jsp
@@ -28,7 +28,7 @@ limitations under the License.
 <body>
 
 	<div class="dialog-area">
-		<c:if test="${!empty fn:escapeXml(it.errorMsg)}">
+		<c:if test="${!empty it.errorMsg}">
 			<div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div>
 		</c:if>
 		<form class="dialog-form" action="" method="post">
@@ -42,7 +42,7 @@ limitations under the License.
 					<input class="text_field" id="email" name="email" type="text" />
 				</p>
 				<p id="human-proof"></p>
-				${fn:escapeXml(it.reCaptchaHtml)}
+				${it.reCaptchaHtml}
 				<p class="buttons">
 					<button type="submit">Submit</button>
 				</p>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/ManagementResource/authorize_form.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/ManagementResource/authorize_form.jsp
index 0079bcf0a6..ed934a72d6 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/ManagementResource/authorize_form.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/ManagementResource/authorize_form.jsp
@@ -29,7 +29,7 @@ limitations under the License.
 <body>
 
 	<div class="dialog-area">
-		<c:if test="${!empty fn:escapeXml(it.errorMsg)}"><div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div></c:if>
+		<c:if test="${!empty it.errorMsg}"><div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div></c:if>
 		<form class="dialog-form" action="" method="post">
 			<input type="hidden" name="response_type" value="${fn:escapeXml(it.responseType)}">
 			<input type="hidden" name="client_id" value="${fn:escapeXml(it.clientId)}">
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_email_form.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_email_form.jsp
index c9f8309973..6341d601d6 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_email_form.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_email_form.jsp
@@ -27,7 +27,7 @@ limitations under the License.
 </head>
 <body>
 	<div class="dialog-area password-reset-form">
-		<c:if test="${!empty fn:escapeXml(it.errorMsg)}">
+		<c:if test="${!empty it.errorMsg}">
 			<div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div>
 		</c:if>
 		<form class="dialog-form" action="" method="post">
@@ -37,7 +37,7 @@ limitations under the License.
 					<c:out value="${it.user.email}" escapeXml="true" />
 				</p>
 				<p id="human-proof"></p>
-				${fn:escapeXml(it.reCaptchaHtml)}
+				${it.reCaptchaHtml}
 				<p class="buttons">
 					<input type="submit" value="submit" />
 				</p>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_set_form.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_set_form.jsp
index 60384c43ff..63344665db 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_set_form.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UserResource/resetpw_set_form.jsp
@@ -30,7 +30,7 @@ limitations under the License.
 <body>
 
 	<div class="dialog-area">
-		<c:if test="${!empty fn:escapeXml(it.errorMsg)}"><div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div></c:if>
+		<c:if test="${!empty it.errorMsg}"><div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div></c:if>
 		<form class="dialog-form" action="" method="post">
 			<input type="hidden" name="token" value="${fn:escapeXml(it.token)}">
 			<fieldset>
diff --git a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UsersResource/resetpw_email_form.jsp b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UsersResource/resetpw_email_form.jsp
index 8b15cd436d..f8cf496256 100644
--- a/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UsersResource/resetpw_email_form.jsp
+++ b/stack/rest/src/main/webapp/WEB-INF/jsp/org/apache/usergrid/rest/management/users/UsersResource/resetpw_email_form.jsp
@@ -27,7 +27,7 @@ limitations under the License.
 <body>
 
 	<div class="dialog-area">
-		<c:if test="${!empty fn:escnapeXml(it.errorMsg)}"><div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div></c:if>
+		<c:if test="${!empty it.errorMsg}"><div class="dialog-form-message">${fn:escapeXml(it.errorMsg)}</div></c:if>
 		<form class="dialog-form" action="" method="post">
 			<fieldset>
 				<p>
@@ -38,7 +38,7 @@ limitations under the License.
 					<input class="text_field" id="email" name="email" type="text" />
 				</p>
 				<p id="human-proof"></p>
-				${fn:escapeXml(it.reCaptchaHtml)}
+				${it.reCaptchaHtml}
 				<p class="buttons">
 					<button type="submit">Submit</button>
 				</p>