Password change capability for form-based auth

IPA server web form-based authentication allows logins for users
which for some reason cannot use Kerberos authentication. However,
when a password for such users expires, they are unable change the
password via web interface.

This patch adds a new WSGI script attached to URL
/ipa/session/change_password which can be accessed without
authentication and which provides password change capability
for web services.

The actual password change in the script is processed by LDAP
password change command.

Password result is passed both in the resulting HTML page, but
also in HTTP headers for easier parsing in web services:
  X-IPA-Pwchange-Result: {ok, invalid-password, policy-error, error}
  (optional) X-IPA-Pwchange-Policy-Error: $policy_error_text

https://fedorahosted.org/freeipa/ticket/2276

2 files changed, 161 insertions, 0 deletions

diff --git a/tests/test_ipaserver/httptest.py b/tests/test_ipaserver/httptest.py
new file mode 100644
index 000000000..7f1b5b136
--- /dev/null
+++ b/tests/test_ipaserver/httptest.py
@@ -0,0 +1,52 @@
+# Authors:
+#   Martin Kosek <mkosek@redhat.com>
+#
+# Copyright (C) 2012  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+"""
+Base class for HTTP request tests
+"""
+
+import urllib
+import httplib
+
+from ipalib import api
+
+class Unauthorized_HTTP_test(object):
+    """
+    Base class for simple HTTP request tests executed against URI
+    with no required authorization
+    """
+    app_uri = ''
+    host = api.env.host
+    content_type = 'application/x-www-form-urlencoded'
+
+    def send_request(self, method='POST', params=None):
+        """
+        Send a request to HTTP server
+
+        :param key When not None, overrides default app_uri
+        """
+        if params is not None:
+            params = urllib.urlencode(params, True)
+        url = 'https://' + self.host + self.app_uri
+
+        headers = {'Content-Type' : self.content_type,
+                   'Referer' : url}
+
+        conn = httplib.HTTPSConnection(self.host)
+        conn.request(method, self.app_uri, params, headers)
+        return conn.getresponse()
diff --git a/tests/test_ipaserver/test_changepw.py b/tests/test_ipaserver/test_changepw.py
new file mode 100644
index 000000000..035766855
--- /dev/null
+++ b/tests/test_ipaserver/test_changepw.py
@@ -0,0 +1,109 @@
+# Authors:
+#   Martin Kosek <mkosek@redhat.com>
+#
+# Copyright (C) 2012  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import nose
+
+from httptest import Unauthorized_HTTP_test
+from tests.test_xmlrpc.xmlrpc_test import XMLRPC_test
+from tests.util import assert_equal, assert_not_equal
+from ipalib import api, errors
+from ipalib.dn import DN
+import ldap
+
+testuser = u'tuser'
+old_password = u'old_password'
+new_password = u'new_password'
+
+class test_changepw(XMLRPC_test, Unauthorized_HTTP_test):
+    app_uri = '/ipa/session/change_password'
+
+    def setUp(self):
+        super(test_changepw, self).setUp()
+        try:
+            api.Command['user_add'](uid=testuser, givenname=u'Test', sn=u'User')
+            api.Command['passwd'](testuser, password=u'old_password')
+        except errors.ExecutionError, e:
+            raise nose.SkipTest(
+                'Cannot set up test user: %s' % e
+            )
+
+    def tearDown(self):
+        try:
+            api.Command['user_del']([testuser])
+        except errors.NotFound:
+            pass
+        super(test_changepw, self).tearDown()
+
+    def _changepw(self, user, old_password, new_password):
+        return self.send_request(params={'user': str(user),
+                                  'old_password' : str(old_password),
+                                  'new_password' : str(new_password)},
+                                 )
+
+    def _checkpw(self, user, password):
+        dn = str(DN(('uid', user),
+                    api.env.container_user,
+                    api.env.basedn))
+        conn = ldap.initialize(api.env.ldap_uri)
+        try:
+            conn.simple_bind_s(dn, password)
+        finally:
+            conn.unbind_s()
+
+    def test_bad_options(self):
+        for params in (None,                    # no params
+                      {'user': 'foo'},          # missing options
+                      {'user': 'foo',
+                       'old_password' : 'old'}, # missing option
+                      {'user': 'foo',
+                       'old_password' : 'old',
+                       'new_password' : ''},    # empty option
+                      ):
+            response = self.send_request(params=params)
+            assert_equal(response.status, 400)
+            assert_equal(response.reason, 'Bad Request')
+
+    def test_invalid_auth(self):
+        response = self._changepw(testuser, 'wrongpassword', 'new_password')
+
+        assert_equal(response.status, 200)
+        assert_equal(response.getheader('X-IPA-Pwchange-Result'), 'invalid-password')
+
+        # make sure that password is NOT changed
+        self._checkpw(testuser, old_password)
+
+    def test_pwpolicy_error(self):
+        response = self._changepw(testuser, old_password, '1')
+
+        assert_equal(response.status, 200)
+        assert_equal(response.getheader('X-IPA-Pwchange-Result'), 'policy-error')
+        assert_equal(response.getheader('X-IPA-Pwchange-Policy-Error'),
+                     'Constraint violation: Password is too short')
+
+        # make sure that password is NOT changed
+        self._checkpw(testuser, old_password)
+
+    def test_pwpolicy_success(self):
+        response = self._changepw(testuser, old_password, new_password)
+
+        assert_equal(response.status, 200)
+        assert_equal(response.getheader('X-IPA-Pwchange-Result'), 'ok')
+
+        # make sure that password IS changed
+        self._checkpw(testuser, new_password)