Adds **kwargs parameter to password_hash to support more algorithms. #45692

mfuchs · 2018-09-16T14:17:56Z

SUMMARY

Adds **kwargs parameter to password_hash to support more algorithms.

This adds support for the bcrypt algorithm as described in the documentation.
The msdcc and msdcc2 algorithm are also supported now.

Fixes #45392

ISSUE TYPE

Bugfix Pull Request

COMPONENT NAME

utils/encrypt

ANSIBLE VERSION

ansible 2.7.0rc2.post0

mfuchs · 2018-09-16T14:19:33Z

@abadger I know you were not a fan of **kwargs in #21215.
But I am not sure if it is good to add even further parameters to the functions (i.e. 'user' and 'ident').

mscherer · 2018-09-16T14:26:43Z

Please do separate PR if you start to do multiple change, or at least, multiple commits.

ansibot · 2018-09-16T14:28:45Z

cc @acozine
click here for bot help

lib/ansible/utils/encrypt.py

mscherer · 2018-09-16T14:30:15Z

lib/ansible/utils/encrypt.py

@@ -170,7 +174,10 @@ def _hash(self, secret, salt, salt_size, rounds):

        # starting with passlib 1.7 'using' and 'hash' should be used instead of 'encrypt'
        if hasattr(self.crypt_algo, 'hash'):
-            result = self.crypt_algo.using(**settings).hash(secret)
+            if self.algorithm in ('msdcc', 'msdcc2'):
+                result = self.crypt_algo.hash(secret, **settings)


So, this doesn't verify anymore that user is set, unlike the previous PR, I think that should be corrected.

It is done implicitly by passlib.
So if the user is not set an exception would be thrown, similar to what #45392 experienced.

This is the same behaviour as for all other hashing algorithms.
I.e. the checking of what parameters are supported/needed is done by passlib.

Throwing a exception do not seems like great UX for users.

I think from a maintenance point it is easier to let passlib handle the parameters.
Otherwise we would have to take care of each algorithm ourselves and have a list of required and optional parameters for them.
It becomes worse if algorithms retrieve new paramters that we already support.
Now iff new algorithms are added to passlib we support them automatically.
Given that they use the 'using' and 'hash' functions.

abadger · 2018-09-16T15:12:59Z

I would add the parameters. Kwargs don't actually mean we haven't added the parameters... It just means that we haven't made those parameters easy to see and easy to error check. If it doesn't make sense to add more parameters explicitly then it would also not make sense to add them via kwargs.

…

On Sun, Sep 16, 2018, 7:19 AM Matthias Fuchs ***@***.***> wrote: @abadger <https://github.com/abadger> I know you were not a fan of **kwargs in #21215 <#21215>. But I am not sure if it is good to add even further parameters to the functions (i.e. 'user' and 'ident'). — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#45692 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAMxWti0TMZwabwws2Btbq9bRpqP9AUiks5ubl36gaJpZM4Wq3wB> .

mfuchs · 2018-09-16T18:09:52Z

@mscherer do you mean splitting it up into two commits: One adding bcrypt support and the other for msdcc/msdcc/2?

@abadger ok, I removed **kwargs again. :)

mscherer · 2018-09-16T19:53:46Z

Yes, so it is easier to see the meaning of each, and review them.

mfuchs · 2018-09-17T18:36:07Z

@mscherer I split the commit into two parts.

samccann · 2019-06-05T18:45:10Z

@mfuchs Sorry for the delays. Can you rebase and resolve any open review comments on this PR?

Thanks!

The ident parameter, as described in the documentation, was not supported.

This is done by adding the 'user' parameters for msdcc/msdcc2. Furthermore msdcc/msdcc2 does not support the 'using' function with passlib 1.7 and newer. Thus there is specific handling if these algorithms are used. Fixes ansible#45392

mfuchs · 2019-06-08T18:27:24Z

@samccann rebased and also resolved all comments.

samccann · 2019-07-02T17:50:04Z

@mscherer @abadger - can you take another look at this PR to see if everything has been addressed? (and merge if you approve?) Thanks!

mscherer · 2019-10-24T14:54:23Z

docs/docsite/rst/user_guide/playbooks_filters.rst

@@ -848,6 +848,13 @@ Some hash types allow providing a rounds parameter::

    {{ 'secretpassword' | password_hash('sha256', 'mysecretsalt', rounds=10000) }}

+When`Passlib <https://passlib.readthedocs.io/en/stable/>`_ is installed
+`password_hash` supports more crypt schematas::


Small typo (not blocking, but since I review)

mscherer · 2019-10-24T14:54:54Z

You should also add a changelog fragment (IIRC the new merging rule, I am a bit out of touch)

tumluliu · 2020-09-08T07:32:38Z

Hi @mfuchs , thanks a lot for the nice job! Is there any news that when this can be merged? The ident param is very required in our use cases

bcoca · 2022-01-12T19:10:56Z

ident was already added in parallel, if you still wish to add 'user' parameter please update the PR (solve conflicts) and add a changelog.

waiting_on_contributor

mfuchs mentioned this pull request Sep 16, 2018

Adds support for the msdcc and msdcc2 algorithm. #45691

Closed

mscherer suggested changes Sep 16, 2018

View changes

mfuchs force-pushed the bcrypt_msdcc_support branch from c10fb30 to 3adeff9 Compare Sep 16, 2018

mfuchs force-pushed the bcrypt_msdcc_support branch from 3adeff9 to 45b4e2a Compare Sep 17, 2018

ansibot added stale_ci This PR has been tested by CI more than one week ago. Close and re-open this PR to get it retested. stale_review Updates were made after the last review and the last review is more than 7 days old. labels Sep 26, 2018

ansibot added needs_rebase https://docs.ansible.com/ansible/devel/dev_guide/developing_rebasing.html and removed stale_review Updates were made after the last review and the last review is more than 7 days old. labels Oct 12, 2018

ansibot removed the support:community This issue/PR relates to code supported by the Ansible community. label Nov 26, 2018

ansibot added the docsite This issue/PR relates to the documentation website. label Dec 4, 2018

mkrizek mentioned this pull request Dec 14, 2018

docs: remove not implemented password_hash feature #49945

Merged

samccann added the needs_info This issue requires further information. Please answer any outstanding questions. label Jun 5, 2019

mfuchs added 2 commits Jun 8, 2019

Adds support to specify the algorithm to use for bcrypt.

9667289

The ident parameter, as described in the documentation, was not supported.

Adds support for the msdcc/msdcc2 algorithms.

8dd74c2

This is done by adding the 'user' parameters for msdcc/msdcc2. Furthermore msdcc/msdcc2 does not support the 'using' function with passlib 1.7 and newer. Thus there is specific handling if these algorithms are used. Fixes ansible#45392

mfuchs force-pushed the bcrypt_msdcc_support branch from 45b4e2a to 8dd74c2 Compare Jun 8, 2019

ansibot added stale_ci This PR has been tested by CI more than one week ago. Close and re-open this PR to get it retested. stale_review Updates were made after the last review and the last review is more than 7 days old. labels Jun 18, 2019

ansibot removed the stale_review Updates were made after the last review and the last review is more than 7 days old. label Jun 26, 2019

ansibot added the stale_review Updates were made after the last review and the last review is more than 7 days old. label Jul 2, 2019

mscherer approved these changes Oct 24, 2019

View changes

mkrizek mentioned this pull request Mar 17, 2020

Please add ident option to password_hash #68214

Closed

ansibot added the needs_triage Needs a first human triage before being processed. label May 16, 2020

mkrizek removed the needs_triage Needs a first human triage before being processed. label May 18, 2020

ansibot added the has_issue label May 18, 2020

ansibot added pre_azp This PR was last tested before migration to Azure Pipelines. and removed stale_ci This PR has been tested by CI more than one week ago. Close and re-open this PR to get it retested. labels Dec 5, 2020

ansibot added the waiting_on_contributor This would be accepted but there are no plans to actively work on it. label May 6, 2022

Adds **kwargs parameter to password_hash to support more algorithms. #45692

Adds **kwargs parameter to password_hash to support more algorithms. #45692

mfuchs commented Sep 16, 2018

mfuchs commented Sep 16, 2018

mscherer commented Sep 16, 2018

ansibot commented Sep 16, 2018

mscherer Sep 16, 2018

mfuchs Sep 16, 2018

mscherer Sep 16, 2018

mfuchs Sep 17, 2018

abadger commented Sep 16, 2018

mfuchs commented Sep 16, 2018

mscherer commented Sep 16, 2018

mfuchs commented Sep 17, 2018

samccann commented Jun 5, 2019

mfuchs commented Jun 8, 2019

samccann commented Jul 2, 2019

mscherer Oct 24, 2019

mscherer commented Oct 24, 2019

tumluliu commented Sep 8, 2020

bcoca commented Jan 12, 2022

Adds **kwargs parameter to password_hash to support more algorithms. #45692

Are you sure you want to change the base?

Adds **kwargs parameter to password_hash to support more algorithms. #45692

Conversation

mfuchs commented Sep 16, 2018

SUMMARY

ISSUE TYPE

COMPONENT NAME

ANSIBLE VERSION

mfuchs commented Sep 16, 2018

mscherer commented Sep 16, 2018

ansibot commented Sep 16, 2018

mscherer Sep 16, 2018

Choose a reason for hiding this comment

mfuchs Sep 16, 2018

Choose a reason for hiding this comment

mscherer Sep 16, 2018

Choose a reason for hiding this comment

mfuchs Sep 17, 2018

Choose a reason for hiding this comment

abadger commented Sep 16, 2018

mfuchs commented Sep 16, 2018

mscherer commented Sep 16, 2018

mfuchs commented Sep 17, 2018

samccann commented Jun 5, 2019

mfuchs commented Jun 8, 2019

samccann commented Jul 2, 2019

mscherer Oct 24, 2019

Choose a reason for hiding this comment

mscherer commented Oct 24, 2019

tumluliu commented Sep 8, 2020

bcoca commented Jan 12, 2022