Check if a user is disabled before logging in #782
Conversation
|
@adombeck Does this look good? I see that the tests are failing on main branch as well. So I am hoping that it is not me. |
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #782 +/- ##
==========================================
- Coverage 83.43% 83.16% -0.28%
==========================================
Files 83 96 +13
Lines 8689 9644 +955
Branches 74 74
==========================================
+ Hits 7250 8020 +770
- Misses 1111 1243 +132
- Partials 328 381 +53 ☔ View full report in Codecov by Sentry. |
shiv-tyagi
changed the title
| @@ -138,6 +138,12 @@ func (s Service) SelectBroker(ctx context.Context, req *authd.SBRequest) (resp * | |||
| lang = "C" | |||
| } | |||
|
|
|||
| // Throw an error if the user trying to authenticate already exists in cache and is disabled | |||
There was a problem hiding this comment.
We use the term "database" instead of "cache" now (related: #775)
| // Throw an error if the user trying to authenticate already exists in cache and is disabled | |
| // Throw an error if the user trying to authenticate already exists in the database and is disabled |
|
Hi @shiv-tyagi, yes this looks good, thanks! One small thing: I would prefer to have a |
|
There should also be a new test case "Error_when_user_is_disabled" in https://github.com/shiv-tyagi/authd/blob/fed39218cfcce6c23e80e0d02fe2a2d748d3d912/internal/brokers/manager_test.go#L187-L190. |
|
Oh and I don't think it makes sense to merge this before we have code which actually causes a user to be disabled (i.e. the command-line tool). If you still plan to work on that soon, feel free to repurpose this PR. Otherwise, I'll start working on that soon and would then cherry-pick your commits to a new branch. |
shiv-tyagi
force-pushed
the
user-disable
branch
from
e6410f4 to
a7d839c
Compare
Sure. I will do that.
Noted.
Yes, I really intend to work on that. I will push my work soon :) |
| @@ -328,6 +328,16 @@ func (m *Manager) UpdateBrokerForUser(username, brokerID string) error { | |||
| return nil | |||
| } | |||
|
|
|||
| // IsUserDisabled returns true if the user with the given user name is disabled, false otherwise | |||
| func (m *Manager) IsUserDisabled(username string) (bool, error) { | |||
| usr, err := m.cache.UserByName(username) | |||
There was a problem hiding this comment.
| usr, err := m.cache.UserByName(username) | |
| u, err := m.cache.UserByName(username) |
As discussed in #640, this adds a property to the UserDB to mark a user enable/disabled. Before creating an authentication session in pam, we check if the user exists in the cache and is disabled.