Skip to content
This repository has been archived by the owner on Jul 1, 2022. It is now read-only.

User Created Although Password not Long Enough #9

Open
LeoNerdoG opened this issue Oct 28, 2020 · 4 comments
Open

User Created Although Password not Long Enough #9

LeoNerdoG opened this issue Oct 28, 2020 · 4 comments

Comments

@LeoNerdoG
Copy link

If user wants to create a user that does not meet the minimum password requirements, the user is created anyway, after the error disappears and the new user dialogue box is closed.

Testflow:

  1. Login as kapua-sys
  2. Go to Accounts, create an account (e.g. acco0)
  3. Select acc0, go to Account settings, change password.min.lenght to 255
  4. Change infinite child users to True
  5. Try to create a user - observe the error
  6. Close the dialogue box, observe the User list - user is created anywaty

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
/

Version of Kapua
https://github.com/lorthirk/kapua/tree/feature-configurablePasswordLength

Type of deployment
[ ] Local Vagrant deployment
[x] Docker
[ ] Openshift (in its variants)
[ ] Others

Main component affected
[x] Console (in case of console please report info on which browser you encountered the problem)
[ ] REST API -> did not try rest api!!! -> please check!
[ ] Message Broker
[ ] - Others

Additional context
Add any other context about the problem here.

@LeoNerdoG
Copy link
Author

Hey @lorthirk,
I have checked this in the latest commit and the user is still created if password is not valid.

@lorthirk
Copy link
Owner

While this could actually be an issue, it should not happen anymore after fixing #14. So I'd say to keep this open but postpone an actual fix for a patch release.

@LeoNerdoG
Copy link
Author

I have verified that this issue does not manifest itself anymore, but as said above - we are keeping it open.

@LeoNerdoG
Copy link
Author

Ok so in the latest commit I found that there is a way to create a user although password is not long enough. It is a super-corner case and it is not likely to be reproduced in e.g. production, but we have to be aware of it.

  1. Login as kapua-sys, create an account (e.g. account0)
  2. Set min password length for account0 to e.g. 40
  3. Create a user in account0 (e.g. user0) and add ALL permission to him
  4. Now open second browser, login as user0
  5. Go to users, click ADD
  6. in the first browser change the min password length to e.g. 50
  7. In the second browser try to create a user with password lengh of 40 - observe the error
  8. Close the Add new user window and observe the new user - it has been created, although password was not long enoguh.

As said before, this is a corner case and it is really har dto reproduce it, becasue admin user would have to change min password length when the sub-user has opened "add new user" dialogu window.
Nonetheless, I am keeping it here, so we don't forget about it.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants