EZP-29703: Legacy LDAP users cause error message on login

[glye]

https://jira.ez.no/browse/EZP-29703
Ready for review

Users created by the LDAP login handler have password_hash_type = 0 and password_hash is empty string. On login the standard login handler runs first. It currently doesn't recognise these users and logs an error: Password hash type ID '0' is not recognized. Defaulting to eZUser::DEFAULT_PASSWORD_HASH. We should accept this case without errors.

Resolved by adding new type eZUser::PASSWORD_HASH_EMPTY = 0 and by not running createHash() for this hash type. Log error if it still happens.

[andrerom]

As I think we did the password hash things on 2017.xx release, you may rebase this for 2017.12 branch

[andrerom]

@glye change base branch here first, then force push. So Travis gets right base branch to merge into and test for when it is triggered.

PS: remember to pull in changes on 2017.12 before rebasing btw, added commit there to enable Travis there 20-30min ago.

[andrerom]

1) eZTextFileUserTest::testLoginWrongPassword
Failed asserting that true matches expected false.

[glye]

Update to fix textfile handler test error.

[glye]

@andrerom Ok now that tests are passing?

[andrerom]

Kind of, but I'm also a bit unsure if the code in createHash is correct or not, does it really enter that code path when ldap is correctly configured? if not, maybe we should rather fail here as it like @gggeek points out feel wrong that we silently accept.

[glye]

@andrerom @gggeek Rewrite after the release of security advisory http://share.ez.no/community-project/security-advisories/ezsa-2018-005-passwordless-login-for-ldap-users

• Let authenticateHash() fail immediately on empty login, empty password, or hash type PASSWORD_HASH_EMPTY
• Ensure that createHash() is not run for hash type PASSWORD_HASH_EMPTY
• Log error if createHash() is somehow still run for hash type PASSWORD_HASH_EMPTY or for unknown hash type.

[andrerom]

There are some cases in ldap which could be changed to use PASSWORD_HASH_EMPTY now.

[glye]

• Reshuffled createHash else-if for readability
• Used self::PASSWORD_HASH_EMPTY for 0 in eZLDAPUser (found just one case)

[glye]

@gggeek I guess you're busy these days, but if you can take a look, the code is more like what you wanted now.

[glye]

Sent to QA.