From 628149b3dc6b58b91fd08e6ca8d91c728ccb8626 Mon Sep 17 00:00:00 2001 From: Derek Higgins Date: Fri, 11 May 2012 13:42:43 +0100 Subject: Invalidate user tokens when a user is disabled Fixes Bug 997194 Delete valid tokens for a user when they have been disabled Moved logic to delete tokens into update_user, as this can be called directly form the REST API. Also checks if a user is enabled when creating a token from another token, this helps in cases there the backend didn't support listing of tokens (and as a result weren't deleted) Change-Id: Ib5ed73a7873bfa66ef31bf6d0f0322f50e677688 --- tests/test_keystoneclient.py | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) (limited to 'tests') diff --git a/tests/test_keystoneclient.py b/tests/test_keystoneclient.py index a02af87c..37f877f2 100644 --- a/tests/test_keystoneclient.py +++ b/tests/test_keystoneclient.py @@ -309,6 +309,23 @@ class KeystoneClientTests(object): client.tokens.authenticate, token=token_id) + def test_disable_user_invalidates_token(self): + from keystoneclient import exceptions as client_exceptions + + admin_client = self.get_client(admin=True) + foo_client = self.get_client(self.user_foo) + + admin_client.users.update_enabled(user=self.user_foo['id'], + enabled=False) + + self.assertRaises(client_exceptions.Unauthorized, + foo_client.tokens.authenticate, + token=foo_client.auth_token) + + self.assertRaises(client_exceptions.Unauthorized, + self.get_client, + self.user_foo) + def test_user_create_update_delete(self): from keystoneclient import exceptions as client_exceptions @@ -332,7 +349,7 @@ class KeystoneClientTests(object): user = client.users.get(user.id) self.assertFalse(user.enabled) - self.assertRaises(client_exceptions.AuthorizationFailure, + self.assertRaises(client_exceptions.Unauthorized, self._client, username=test_username, password='password') @@ -880,7 +897,7 @@ class KcEssex3TestCase(CompatTestCase, KeystoneClientTests): user = client.users.get(user.id) self.assertFalse(user.enabled) - self.assertRaises(client_exceptions.AuthorizationFailure, + self.assertRaises(client_exceptions.Unauthorized, self._client, username=test_username, password='password') -- cgit