Enable changing passwords in user_ldap #1715

GitHubUser4234 · 2016-10-12T08:56:17Z

Continuing PR #600 here due to some GitHub issues, sorry for inconvenience caused. 😅

@blizzz : All your comments have hopefully been taken care of :)

mention-bot · 2016-10-12T08:56:20Z

@GitHubUser4234, thanks for your PR! By analyzing the history of the files in this pull request, we identified @MorrisJobke, @blizzz and @butonic to be potential reviewers.

MorrisJobke · 2016-10-12T09:39:42Z

apps/user_ldap/lib/LDAP.php

@@ -194,6 +195,16 @@ public function search($link, $baseDN, $filter, $attr, $attrsOnly = 0, $limit =

 	/**
 	 * @param LDAP $link
+* @param string $userDN


Some whitespace is missing here

Should be fine now, thanks ~

GitHubUser4234 · 2016-10-12T11:20:06Z

Ok, this has been discussed in IRC and @blizzz had this great idea to make the error message a combination of a generic translatable message plus a hint message containing the non-translatable message returned by the LDAP server.

I will apply this tmw.

GitHubUser4234 · 2016-10-13T07:31:07Z

Ok, this has been discussed in IRC and @blizzz had this great idea to make the error message a combination of a generic translatable message plus a hint message containing the non-translatable message returned by the LDAP server.

I will apply this tmw.

Applied & pushed.

blizzz · 2016-10-13T11:24:25Z

apps/user_ldap/lib/LDAP.php

+	 * @param string $password
+	 * @return bool
+	 */
+	public function modReplace($link, $userDN, $password) {


Could you also add this method to the ILDAPWrapper interface, please?

blizzz · 2016-10-13T11:27:08Z

apps/user_ldap/lib/LDAP.php

+	 * @return bool
+	 */
+	public function modReplace($link, $userDN, $password) {
+		try {


Could we move the try-and-catch logic to Access::setPassword() to avoid logic in here? Would also avoid "funny" messages if it was used for another reason in the future while the same base error is thrown.

blizzz · 2016-10-13T11:34:11Z

apps/user_ldap/lib/LDAP.php

+		try {
+			return $this->invokeLDAPMethod('mod_replace', $link, $userDN, array('userPassword' => $password));
+		} catch(ConstraintViolationException $e) {
+			throw new HintException('Password change rejected. Hint: '.$e->getMessage(), '', $e->getCode());


Probably I was not clear about the second parameter which is currently the emtpy string, sorry. That one is the "Hint" parameter which accepts also text. I would pass $e->getMessage() to it. As first parameter 'Password change rejected.' would be good. To tranlsate that we would need to get from \OC::$server->getL10N('user_ldap');, as we do not inject it at this point (in neither Access not User_LDAP). Injecting it is cumbersome of course with the necessary changes, so for I10L it's probably survivable to not do it for now…

I tried, but the result was that the first parameter didn't get displayed in the UI. When looking at the HintException code it looks like it either has to be first or second parameter?

public function getHint() { if (empty($this->hint)) { return $this->message; } return $this->hint; }

As discussed in IRC, necessary changes in core will be conducted, so that the UI can show both parameters.

blizzz · 2016-10-13T11:39:50Z

apps/user_ldap/templates/settings.php

@@ -101,6 +101,8 @@
 				<p><label for="ldap_dynamic_group_member_url"><?php p($l->t('Dynamic Group Member URL'));?></label><input type="text" id="ldap_dynamic_group_member_url" name="ldap_dynamic_group_member_url" title="<?php p($l->t('The LDAP attribute that on group objects contains an LDAP search URL that determines what objects belong to the group. (An empty setting disables dynamic group membership functionality.)'));?>" data-default="<?php p($_['ldap_dynamic_group_member_url_default']); ?>" /></p>
 				<p><label for="ldap_nested_groups"><?php p($l->t('Nested Groups'));?></label><input type="checkbox" id="ldap_nested_groups" name="ldap_nested_groups" value="1" data-default="<?php p($_['ldap_nested_groups_default']); ?>"  title="<?php p($l->t('When switched on, groups that contain groups are supported. (Only works if the group member attribute contains DNs.)'));?>" /></p>
 				<p><label for="ldap_paging_size"><?php p($l->t('Paging chunksize'));?></label><input type="number" id="ldap_paging_size" name="ldap_paging_size" title="<?php p($l->t('Chunksize used for paged LDAP searches that may return bulky results like user or group enumeration. (Setting it 0 disables paged LDAP searches in those situations.)'));?>" data-default="<?php p($_['ldap_paging_size_default']); ?>" /></p>
+				<p><label for="ldap_turn_on_pwd_change"><?php p($l->t('Enable LDAP password changes per user'));?></label><span class="inlinetable"><span class="tablerow left"><input type="checkbox" id="ldap_turn_on_pwd_change" name="ldap_turn_on_pwd_change" value="1" data-default="<?php p($_['ldap_turn_on_pwd_change_default']); ?>" title="<?php p($l->t('Allow LDAP users to change their password and allow Super Administrators and Group Administrators to change the password of their LDAP users. Only works when access control policies are configured accordingly on the LDAP server. As passwords are sent in plaintext to the LDAP server, transport encryption must be used and password hashing should be configured on the LDAP server.'));?>" /><span class="tablecell">(New password is sent as plain text to LDAP)</span></span>


Wrap the new "(New password…" text into <?php p($l->t($text)); ?> so it can get translated

oops, fixed that one 😅

blizzz · 2016-10-13T11:43:34Z

apps/user_ldap/lib/Access.php

+	/**
+	 * Set password for an LDAP user identified by a DN
+	 * @param string $userDN the user in question
+	 * @param LDAP $password the new password


$password should be of type string

blizzz · 2016-10-13T11:57:10Z

apps/user_ldap/lib/User_LDAP.php

+	 * @return bool
+	 */
+	public function setPassword($uid, $password) {
+		$ldapRecord = $this->getLDAPUserByLoginName($uid);


$uid is not the login name, but the internal username. If both differ, it won't work (seen here while testing). You can directly fetch the corresponding user by $user = $this->access->userManager->get($uid);. Then it'll work :)

Ok~~ I saw something similar in thecheckPassword() method, does this apply there, too?

checkPassword() is provided with the login name (it is used for login), different to this method where we get the username/uid.

Oh i see, then the naming of that parameter doesn't seem to reflect it, at least not for an outsider like me 😆 If acceptable, it might be helpful in the future when we'd change it from $uid to $loginName? I saw that some classes like OC\User\Manager are in fact doing that while most classes don't.

Totally agree!

As discussed in IRC, the name change is fine, but would be done in a separate PR for fixing variable names.

blizzz · 2016-10-13T13:10:18Z

Btw, with the next commit please do a signoff like git commit --signoff, (see Sign Your Work on https://github.com/nextcloud/server/blob/master/CONTRIBUTING.md)

codecov-io · 2016-10-20T09:53:45Z

Current coverage is 57.25% (diff: 33.33%)

Merging #1715 into master will decrease coverage by <.01%

@@             master      #1715   diff @@
==========================================
  Files          1075       1075          
  Lines         61314      61344    +30   
  Methods        6849       6853     +4   
  Messages          0          0          
  Branches          0          0          
==========================================
+ Hits          35112      35125    +13   
- Misses        26202      26219    +17   
  Partials          0          0

Diff Coverage	File Path
0%	apps/user_ldap/lib/User_Proxy.php
0%	apps/user_ldap/lib/Access.php
0%	apps/user_ldap/lib/LDAP.php
0%	apps/user_ldap/templates/settings.php
••••••• 78%	apps/user_ldap/lib/User_LDAP.php
•••••••••• 100%	apps/user_ldap/lib/Configuration.php

Powered by Codecov. Last update 598c145...8ad776a

Signed-off-by: Roger Szabo <roger.szabo@web.de> remove notification part Signed-off-by: Roger Szabo <roger.szabo@web.de> blizzz comments Signed-off-by: Roger Szabo <roger.szabo@web.de> morris comment Signed-off-by: Roger Szabo <roger.szabo@web.de> improved error message for changing password Signed-off-by: Roger Szabo <roger.szabo@web.de> blizz comments 20161013 Signed-off-by: Roger Szabo <roger.szabo@web.de> Signed-off-by: Roger Szabo <roger.szabo@web.de> Adjust HintException usage Signed-off-by: Roger Szabo <roger.szabo@web.de> Signed-off-by: Roger Szabo <roger.szabo@web.de>

GitHubUser4234 · 2016-10-24T07:24:57Z

After discussion in #1787 this got updated, rebased and pushed.

GitHubUser4234 · 2016-10-27T07:13:39Z

@blizzz : great thing is the personal page bug #1874 has been fixed, so this can be tested without obstacles.

blizzz · 2016-11-23T15:51:42Z

Tested and works 👍

On the Users page, when changing a password and confirming with pressing Enter, the response handling fails (no confirmation, input field stays with focus, despite successful change - but some in error case), but this issue is also present with master and thus out of scope. Password change on personal page works.

Another reviewer please? @nextcloud/ldap @LukasReschke

LukasReschke · 2016-11-23T17:26:03Z

apps/user_ldap/lib/Access.php

+	 * @param string $password the new password
+	 * @return bool
+	 */
+	public function setPassword($userDN, $password) {


Missing tests. Will add myself so we get this done.

LukasReschke · 2016-11-23T17:26:47Z

apps/user_ldap/lib/User_LDAP.php

+		$user = $this->access->userManager->get($uid);
+
+		if(!$user instanceof User) {
+			throw new \Exception('LDAP setPassword: Could not get user object for uid ' . $uid .


Not covered by tests. Will add.

LukasReschke · 2016-11-23T17:26:52Z

apps/user_ldap/lib/User_LDAP.php

+			return $this->access->setPassword($user->getDN(), $password);
+		}
+
+		return false;


Not covered by tests. Will add.

LukasReschke · 2016-11-23T17:27:08Z

apps/user_ldap/lib/User_Proxy.php

+	 *
+	 */
+	public function setPassword($uid, $password) {
+		return $this->handleRequest($uid, 'setPassword', array($uid, $password));


Not covered by tests. Will add.

LukasReschke · 2016-11-23T18:59:55Z

Replaced by #2286 where I added some tests.

LukasReschke · 2016-11-23T19:55:18Z

And merged 🚀

GitHubUser4234 · 2016-11-24T06:41:00Z

Wow, finally the rocket took off and that at light speed! Thanks A LOT @blizzz, @LukasReschke, @MorrisJobke for the effort put into this ✨

MorrisJobke reviewed Oct 12, 2016

View reviewed changes

blizzz mentioned this pull request Oct 12, 2016

Enable changing passwords in user_ldap #600

Closed

blizzz added enhancement feature: ldap labels Oct 13, 2016

blizzz added this to the Nextcloud 11.0 milestone Oct 13, 2016

blizzz requested changes Oct 13, 2016

View reviewed changes

blizzz mentioned this pull request Oct 18, 2016

make ChangePasswordController and UI Code respect Message and Hint fr… #1787

Closed

GitHubUser4234 force-pushed the ldap_password_pr branch from 632493b to b1b593c Compare October 20, 2016 09:11

MorrisJobke mentioned this pull request Oct 20, 2016

Nextcloud 11 overview #745

Closed

47 tasks

GitHubUser4234 force-pushed the ldap_password_pr branch from b1b593c to 8ad776a Compare October 24, 2016 07:22

GitHubUser4234 added the 3. to review Waiting for reviews label Nov 14, 2016

blizzz approved these changes Nov 23, 2016

View reviewed changes

LukasReschke requested changes Nov 23, 2016

View reviewed changes

LukasReschke mentioned this pull request Nov 23, 2016

LDAP PR with tests #2286

Merged

LukasReschke closed this Nov 23, 2016

GitHubUser4234 mentioned this pull request Nov 24, 2016

Documentation for enabling changing passwords in user_ldap nextcloud/documentation#240

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enable changing passwords in user_ldap #1715

Enable changing passwords in user_ldap #1715

GitHubUser4234 commented Oct 12, 2016

mention-bot commented Oct 12, 2016

MorrisJobke Oct 12, 2016

GitHubUser4234 Oct 12, 2016

GitHubUser4234 commented Oct 12, 2016

GitHubUser4234 commented Oct 13, 2016

blizzz Oct 13, 2016

GitHubUser4234 Oct 14, 2016

blizzz Oct 13, 2016

GitHubUser4234 Oct 14, 2016

blizzz Oct 13, 2016

GitHubUser4234 Oct 14, 2016

GitHubUser4234 Oct 18, 2016

blizzz Oct 13, 2016

GitHubUser4234 Oct 14, 2016

blizzz Oct 13, 2016

GitHubUser4234 Oct 14, 2016

blizzz Oct 13, 2016

GitHubUser4234 Oct 14, 2016

blizzz Oct 17, 2016

GitHubUser4234 Oct 18, 2016 •

edited

Loading

blizzz Oct 18, 2016

GitHubUser4234 Oct 18, 2016

blizzz commented Oct 13, 2016

codecov-io commented Oct 20, 2016 •

edited

Loading

GitHubUser4234 commented Oct 24, 2016

GitHubUser4234 commented Oct 27, 2016

blizzz commented Nov 23, 2016

LukasReschke Nov 23, 2016

LukasReschke Nov 23, 2016

LukasReschke Nov 23, 2016

LukasReschke Nov 23, 2016

LukasReschke commented Nov 23, 2016

LukasReschke commented Nov 23, 2016

GitHubUser4234 commented Nov 24, 2016

Enable changing passwords in user_ldap #1715

Enable changing passwords in user_ldap #1715

Conversation

GitHubUser4234 commented Oct 12, 2016

mention-bot commented Oct 12, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

GitHubUser4234 commented Oct 12, 2016

GitHubUser4234 commented Oct 13, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

GitHubUser4234 Oct 18, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

blizzz commented Oct 13, 2016

codecov-io commented Oct 20, 2016 • edited Loading

Current coverage is 57.25% (diff: 33.33%)

GitHubUser4234 commented Oct 24, 2016

GitHubUser4234 commented Oct 27, 2016

blizzz commented Nov 23, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

LukasReschke commented Nov 23, 2016

LukasReschke commented Nov 23, 2016

GitHubUser4234 commented Nov 24, 2016

GitHubUser4234 Oct 18, 2016 •

edited

Loading

codecov-io commented Oct 20, 2016 •

edited

Loading