summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRob Crittenden <rcritten@redhat.com>2011-09-16 15:08:17 -0400
committerMartin Kosek <mkosek@redhat.com>2011-10-04 15:16:15 +0200
commitbd227b356280f54f48bc01901275833a51f87fd7 (patch)
tree2a6746e8032067843ce020daa5c642fd46a57e29
parent28603e0c3ac20390a860347afb7a6ed976166e03 (diff)
downloadfreeipa-bd227b356280f54f48bc01901275833a51f87fd7.tar.gz
freeipa-bd227b356280f54f48bc01901275833a51f87fd7.tar.xz
freeipa-bd227b356280f54f48bc01901275833a51f87fd7.zip
Require current password when using passwd to change your own password.
Add a new required parameter, current_password. In order to ask this first I added a new parameter option, sortorder. The lower the value the earlier it will be prompted for. I also changed the way autofill works. It will attempt to get the default and if it doesn't get anything will continue prompting interactively. Since current_password is required I'm passing a magic value that means changing someone else's password. We need to pass something since current_password is required. The python-ldap passwd command doesn't seem to use the old password at all so I do a simple bind to validate it. https://fedorahosted.org/freeipa/ticket/1808
-rw-r--r--API.txt5
-rw-r--r--VERSION2
-rw-r--r--ipalib/cli.py6
-rw-r--r--ipalib/frontend.py2
-rw-r--r--ipalib/parameters.py1
-rw-r--r--ipalib/plugins/passwd.py40
-rw-r--r--ipaserver/plugins/ldap2.py11
7 files changed, 59 insertions, 8 deletions
diff --git a/API.txt b/API.txt
index ac6560b0b..10b3f86a8 100644
--- a/API.txt
+++ b/API.txt
@@ -1829,9 +1829,10 @@ output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), 'User-friendly
output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
output: Output('value', <type 'unicode'>, "The primary_key value of the entry, e.g. 'jdoe' for a user")
command: passwd
-args: 2,0,3
+args: 3,0,3
arg: Str('principal', validate_principal, autofill=True, cli_name='user', create_default=<lambda>, label=Gettext('User name', domain='ipa', localedir=None), normalizer=<lambda>, primary_key=True)
-arg: Password('password', label=Gettext('Password', domain='ipa', localedir=None))
+arg: Password('password', label=Gettext('New Password', domain='ipa', localedir=None))
+arg: Password('current_password', autofill=True, confirm=False, default_from=<lambda>, label=Gettext('Current Password', domain='ipa', localedir=None), sortorder=-1)
output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), 'User-friendly description of action performed')
output: Output('result', <type 'bool'>, 'True means the operation was successful')
output: Output('value', <type 'unicode'>, "The primary_key value of the entry, e.g. 'jdoe' for a user")
diff --git a/VERSION b/VERSION
index d7eaa8611..51711efe3 100644
--- a/VERSION
+++ b/VERSION
@@ -79,4 +79,4 @@ IPA_DATA_VERSION=20100614120000
# #
########################################################
IPA_API_VERSION_MAJOR=2
-IPA_API_VERSION_MINOR=11
+IPA_API_VERSION_MINOR=12
diff --git a/ipalib/cli.py b/ipalib/cli.py
index 0a7d1a4cf..86365e7ca 100644
--- a/ipalib/cli.py
+++ b/ipalib/cli.py
@@ -1048,12 +1048,14 @@ class cli(backend.Executioner):
for param in cmd.params():
if (param.required and param.name not in kw) or \
(param.alwaysask and honor_alwaysask) or self.env.prompt_all:
+ if param.autofill:
+ kw[param.name] = param.get_default(**kw)
+ if param.name in kw and kw[param.name] is not None:
+ continue
if param.password:
kw[param.name] = self.Backend.textui.prompt_password(
param.label, param.confirm
)
- elif param.autofill:
- kw[param.name] = param.get_default(**kw)
else:
default = param.get_default(**kw)
error = None
diff --git a/ipalib/frontend.py b/ipalib/frontend.py
index c2ae4e744..61e7f493f 100644
--- a/ipalib/frontend.py
+++ b/ipalib/frontend.py
@@ -777,6 +777,8 @@ class Command(HasParam):
self._create_param_namespace('options')
def get_key(p):
if p.required:
+ if p.sortorder < 0:
+ return p.sortorder
if p.default_from is None:
return 0
return 1
diff --git a/ipalib/parameters.py b/ipalib/parameters.py
index e7e75782a..f9e171b0e 100644
--- a/ipalib/parameters.py
+++ b/ipalib/parameters.py
@@ -317,6 +317,7 @@ class Param(ReadOnly):
('flags', frozenset, frozenset()),
('hint', (str, Gettext), None),
('alwaysask', bool, False),
+ ('sortorder', int, 2), # see finalize()
# The 'default' kwarg gets appended in Param.__init__():
# ('default', self.type, None),
diff --git a/ipalib/plugins/passwd.py b/ipalib/plugins/passwd.py
index b7d82f355..b26f7e9fd 100644
--- a/ipalib/plugins/passwd.py
+++ b/ipalib/plugins/passwd.py
@@ -23,6 +23,7 @@ from ipalib import Str, Password
from ipalib import _
from ipalib import output
from ipalib.plugins.user import split_principal, validate_principal, normalize_principal
+from ipalib.request import context
__doc__ = _("""
Set a user's password
@@ -43,6 +44,22 @@ EXAMPLES:
ipa passwd tuser1
""")
+# We only need to prompt for the current password when changing a password
+# for yourself, but the parameter is still required
+MAGIC_VALUE = u'CHANGING_PASSWORD_FOR_ANOTHER_USER'
+
+def get_current_password(principal):
+ """
+ If the user is changing their own password then return None so the
+ current password is prompted for, otherwise return a fixed value to
+ be ignored later.
+ """
+ current_principal = util.get_current_principal()
+ if current_principal == normalize_principal(principal):
+ return None
+ else:
+ return MAGIC_VALUE
+
class passwd(Command):
__doc__ = _("Set a user's password.")
@@ -56,14 +73,21 @@ class passwd(Command):
normalizer=lambda value: normalize_principal(value),
),
Password('password',
- label=_('Password'),
+ label=_('New Password'),
+ ),
+ Password('current_password',
+ label=_('Current Password'),
+ confirm=False,
+ default_from=lambda principal: get_current_password(principal),
+ autofill=True,
+ sortorder=-1,
),
)
has_output = output.standard_value
msg_summary = _('Changed password for "%(value)s"')
- def execute(self, principal, password):
+ def execute(self, principal, password, current_password):
"""
Execute the passwd operation.
@@ -74,6 +98,7 @@ class passwd(Command):
:param principal: The login name or principal of the user
:param password: the new password
+ :param current_password: the existing password, if applicable
"""
ldap = self.api.Backend.ldap2
@@ -82,7 +107,16 @@ class passwd(Command):
",".join([api.env.container_user, api.env.basedn])
)
- ldap.modify_password(dn, password)
+ if principal == getattr(context, 'principal') and \
+ current_password == MAGIC_VALUE:
+ # No cheating
+ self.log.warn('User attempted to change password using magic value')
+ raise errors.ACIError(info='Invalid credentials')
+
+ if current_password == MAGIC_VALUE:
+ ldap.modify_password(dn, password)
+ else:
+ ldap.modify_password(dn, password, current_password)
return dict(
result=True,
diff --git a/ipaserver/plugins/ldap2.py b/ipaserver/plugins/ldap2.py
index a2e592d30..b12403b93 100644
--- a/ipaserver/plugins/ldap2.py
+++ b/ipaserver/plugins/ldap2.py
@@ -899,6 +899,17 @@ class ldap2(CrudBackend, Encoder):
def modify_password(self, dn, new_pass, old_pass=''):
"""Set user password."""
dn = self.normalize_dn(dn)
+
+ # The python-ldap passwd command doesn't verify the old password
+ # so we'll do a simple bind to validate it.
+ if old_pass != '':
+ try:
+ conn = _ldap.initialize(self.ldap_uri)
+ conn.simple_bind_s(dn, old_pass)
+ conn.unbind()
+ except _ldap.LDAPError, e:
+ _handle_errors(e, **{})
+
try:
self.conn.passwd_s(dn, old_pass, new_pass)
except _ldap.LDAPError, e: