jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

do not reset password for LDAP and SAML users or rehash on API calls (#2916)

Browse Source
This commit is contained in:
Kevin Papst
2021-11-10 11:34:50 +01:00
committed by GitHub
parent 73ab26c7b7
commit 21dbfdb4f9
4 changed files with 10 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/Ldap/LdapUserHydrator.php
View File

@@ -75,9 +75,11 @@ class LdapUserHydrator
}
// fill them after hydrating account, so they can't be overwritten
$user->setPassword('');
// by the mapping attributes
if ($user->getId() === null) {
$user->setPassword('');
}
$user->setAuth(User::AUTH_LDAP);
$user->setPreferenceValue('ldap.dn', $ldapEntry['dn']);
}

6
src/Saml/User/SamlUserFactory.php
View File

@@ -28,6 +28,7 @@ final class SamlUserFactory
$user = new User();
$user->setEnabled(true);
$user->setUsername($token->getUsername());
$user->setPassword('');
$this->hydrateUser($user, $token);
@@ -73,8 +74,11 @@ final class SamlUserFactory
}
// fill them after hydrating account, so they can't be overwritten
// by the mapping attributes
if ($user->getId() === null) {
$user->setPassword('');
}
$user->setUsername($token->getUsername());
$user->setPassword('');
$user->setAuth(User::AUTH_SAML);
}

12
src/Security/TokenAuthenticator.php
View File

@@ -19,9 +19,8 @@ use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Security\Core\User\UserProviderInterface;
use Symfony\Component\Security\Guard\AbstractGuardAuthenticator;
use Symfony\Component\Security\Guard\PasswordAuthenticatedInterface;
class TokenAuthenticator extends AbstractGuardAuthenticator implements PasswordAuthenticatedInterface
class TokenAuthenticator extends AbstractGuardAuthenticator
{
public const HEADER_USERNAME = 'X-AUTH-USER';
public const HEADER_TOKEN = 'X-AUTH-TOKEN';
@@ -158,13 +157,4 @@ class TokenAuthenticator extends AbstractGuardAuthenticator implements PasswordA
{
return false;
}
public function getPassword($credentials): ?string
{
if (!\is_array($credentials) || !\array_key_exists('token', $credentials) || empty($credentials['token'])) {
return null;
}
return $credentials['token'];
}
}

16
tests/Security/TokenAuthenticatorTest.php
View File

@@ -42,22 +42,6 @@ class TokenAuthenticatorTest extends TestCase
self::assertFalse($sut->supports($request));
}
public function testGetPassword()
{
$factory = $this->createMock(EncoderFactoryInterface::class);
$sut = new TokenAuthenticator($factory);
self::assertNull($sut->getPassword('asdfgh'));
self::assertNull($sut->getPassword(null));
self::assertNull($sut->getPassword([]));
self::assertNull($sut->getPassword(['password' => '1234567890']));
self::assertNull($sut->getPassword(['token' => null]));
self::assertNull($sut->getPassword(['token' => 0]));
self::assertNull($sut->getPassword(['token' => '']));
self::assertNull($sut->getPassword(['token' => false]));
self::assertEquals('foo-bar', $sut->getPassword(['token' => 'foo-bar']));
}
public function testGetCredentials()
{
$factory = $this->createMock(EncoderFactoryInterface::class);