From a67b24878a6156eab17b9098fa649f0279256f5d Mon Sep 17 00:00:00 2001 From: Derek Higgins Date: Wed, 9 May 2012 15:55:46 +0100 Subject: Invalidate user tokens when password is changed Fixes bug 996595 This commit will cause all valid tokens to be deleted for a user who's password is changed (implemented for the sql and kvs backends) Change-Id: I6ad7da8957b7041983a3fc91d9ba9368667d06ac --- tests/test_keystoneclient.py | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) (limited to 'tests') diff --git a/tests/test_keystoneclient.py b/tests/test_keystoneclient.py index 064a8e34..a02af87c 100644 --- a/tests/test_keystoneclient.py +++ b/tests/test_keystoneclient.py @@ -286,6 +286,29 @@ class KeystoneClientTests(object): username='blah', password='blah') + def test_change_password_invalidates_token(self): + from keystoneclient import exceptions as client_exceptions + + client = self.get_client(admin=True) + + username = uuid.uuid4().hex + passwd = uuid.uuid4().hex + user = client.users.create(name=username, password=passwd, + email=uuid.uuid4().hex) + + token_id = client.tokens.authenticate(username=username, + password=passwd).id + + # authenticate with a token should work before a password change + client.tokens.authenticate(token=token_id) + + client.users.update_password(user=user.id, password=uuid.uuid4().hex) + + # authenticate with a token should not work after a password change + self.assertRaises(client_exceptions.Unauthorized, + client.tokens.authenticate, + token=token_id) + def test_user_create_update_delete(self): from keystoneclient import exceptions as client_exceptions -- cgit