Finish password expiration #224

grahamu · 2016-09-10T19:51:31Z

This pull request completes password expiration functionality.

Add management command for setting user-specific password expiry.
Add management command for setting user password history.
Add documentation for password expiration.
Add Django admin configuration for PasswordExpiry, PasswordHistory models.
Add "password expired" message using contrib.messages.
Add middleware which checks for expired password.
Comprehensive tests.

Add mgmt command for setting user-specific password expiry. Add documentation for password expiry.

coveralls · 2016-09-10T19:55:35Z

Coverage decreased (-0.5%) to 68.791% when pulling d4d0939 on expiry-docs into 1a5cab5 on master.

Revise model migration. Add user_password_history command. Add management command tests. Improve password tests. Add Django admin functionality for new PasswordExpiry and PasswordHistory models.

coveralls · 2016-09-13T15:09:29Z

Coverage increased (+1.05%) to 70.36% when pulling 23edd12 on expiry-docs into 1a5cab5 on master.

Use middleware to detect password expiration and redirect to password change page if expired. Added to CHANGELOG.md. Removed outdated docs/changelog.rst. Added documentation for password middleware.

coveralls · 2016-09-13T18:38:25Z

Coverage increased (+3.2%) to 72.532% when pulling c9c73d8 on expiry-docs into 1a5cab5 on master.

coveralls · 2016-09-13T18:45:55Z

Coverage increased (+3.4%) to 72.727% when pulling ac43310 on expiry-docs into 1a5cab5 on master.

coveralls · 2016-09-13T18:47:27Z

Coverage increased (+3.2%) to 72.532% when pulling 527b9cc on expiry-docs into 1a5cab5 on master.

coveralls · 2016-09-13T18:54:55Z

Coverage increased (+3.2%) to 72.532% when pulling 527b9cc on expiry-docs into 1a5cab5 on master.

coveralls · 2016-09-13T18:59:17Z

Coverage increased (+3.2%) to 72.532% when pulling 527b9cc on expiry-docs into 1a5cab5 on master.

Add "Password is expired" message. Add `password_expired` signal. Update signals documentation.

Improve verbose plural model name.

coveralls · 2016-09-13T20:02:17Z

Coverage increased (+3.3%) to 72.611% when pulling f69f798 on expiry-docs into 1a5cab5 on master.

coveralls · 2016-09-13T20:08:15Z

Coverage increased (+3.4%) to 72.708% when pulling 06c4309 on expiry-docs into 1a5cab5 on master.

coveralls · 2016-09-13T20:40:37Z

Coverage increased (+3.2%) to 72.553% when pulling 2954278 on expiry-docs into 1a5cab5 on master.

If middleware detects expired password, add "?next=" to redirect URL with expected page.

Improve creation of redirect URL with "next" value.

coveralls · 2016-09-13T22:52:26Z

Coverage increased (+3.5%) to 72.766% when pulling 40d419d on expiry-docs into 1a5cab5 on master.

coveralls · 2016-09-13T22:52:26Z

Coverage increased (+3.5%) to 72.766% when pulling 40d419d on expiry-docs into 1a5cab5 on master.

coveralls · 2016-09-13T22:52:26Z

Coverage increased (+3.5%) to 72.766% when pulling 40d419d on expiry-docs into 1a5cab5 on master.

coveralls · 2016-09-13T22:52:26Z

Coverage increased (+3.5%) to 72.766% when pulling 40d419d on expiry-docs into 1a5cab5 on master.

grahamu · 2016-09-13T23:21:54Z

@brosner this is complete and ready for final thorough review, thanks!

coveralls · 2016-09-13T23:25:46Z

Coverage increased (+3.5%) to 72.766% when pulling 83c9efc on expiry-docs into 1a5cab5 on master.

grahamu · 2016-09-14T00:30:40Z

Hmm, seems like we need management command documentation.

coveralls · 2016-09-14T00:39:40Z

Coverage increased (+3.5%) to 72.766% when pulling b557fd7 on expiry-docs into 1a5cab5 on master.

coveralls · 2016-09-14T00:39:40Z

Coverage increased (+3.5%) to 72.766% when pulling b557fd7 on expiry-docs into 1a5cab5 on master.

coveralls · 2016-09-14T00:39:40Z

Coverage increased (+3.5%) to 72.766% when pulling b557fd7 on expiry-docs into 1a5cab5 on master.

coveralls · 2016-09-14T00:39:40Z

Coverage increased (+3.5%) to 72.766% when pulling b557fd7 on expiry-docs into 1a5cab5 on master.

grahamu · 2016-09-14T00:53:50Z

@brosner besides code review you can test this for real by cloning the latest cloudspotting "dua-password-expiry" branch, pinax/cloudspotting#14, currently found at:

pinax/cloudspotting@c7e4e53

Install and run cloudspotting as per docs (specifying latest hash of that branch), create a couple users, play around with management commands user_password_history and user_password_expiry, change ACCOUNT_PASSWORD_EXPIRY in settings.py to 60 (one minute), etc. Try to bust the system. Thanks.

coveralls · 2016-09-15T15:55:31Z

Coverage increased (+3.5%) to 72.766% when pulling 1f44952 on expiry-docs into 1a5cab5 on master.

coveralls · 2016-09-15T16:13:51Z

Coverage increased (+3.5%) to 72.766% when pulling 55ae160 on expiry-docs into 1a5cab5 on master.

coveralls · 2016-09-15T16:19:05Z

Coverage increased (+3.5%) to 72.766% when pulling 1e0d672 on expiry-docs into 1a5cab5 on master.

grahamu

These areas would appreciate thoughtful consideration, thanks.

grahamu · 2016-09-15T16:14:56Z

account/management/commands/user_password_expiry.py

+            user.password_expiry.expiry = expire
+            user.password_expiry.save()
+
+        return "User \"{}\" password expiration set to {} seconds".format(username, expire)


This handle_label method works fine for one or a handful of users, but doesn't scale nicely for a large userbase or for all users in a system. Should we improve this mechanism or leave be until someone complains?

I'm not sure of the particulars of the use case driving these changes, but I think it'd be useful to set an expiration for all users if

adding the middleware to an existing project using DUA and wanting to set a "baseline" expiration for all existing users

enforcing a reset for all users in response to some kind of security breach

I don't have a strong opinion on that functionality being required from the get-go, and perhaps a new issue to track that functionality is useful and it can be added later when required.

@jwegner your first point is handled by the global setting ACCOUNT_PASSWORD_EXPIRY, which is used by default if password expiration is enabled and the user does not have their own PasswordExpiry instance. Good thought on the second case, but I'd prefer to track the idea separately.

grahamu · 2016-09-15T16:24:43Z

account/middleware.py

+                        messages.WARNING,
+                        _("Your password has expired. Please save a new password.")
+                    )
+                    redirect_field_name = "next"  # fragile!


This redirect field name reference ("next") is quite fragile because if the project uses a different string this will break. Note that the redirect field name in classes protected by LoginRequiredMixin and methods protected by login_required default to "next" but can be overridden by class attribute or by invocation parameter. However this code is middleware with no way to set/reset the redirect field name.

To resolve this fragility I suggest using an account global, something like ACCOUNT_REDIRECT_FIELD_NAME.

I agree with removing fragility and standardizing that field name.

We might consider relying on / aliasing from django.contrib.auth.REDIRECT_FIELD_NAME, but still allowing the the overrides on the existing classes/methods above.

So REDIRECT_FIELD_NAME is the default unless overridden.

grahamu · 2016-09-15T16:26:31Z

account/migrations/0003_passwordexpiry_passwordhistory.py

@@ -28,7 +29,7 @@ class Migration(migrations.Migration):
            fields=[
                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
                ('password', models.CharField(max_length=255)),
-                ('timestamp', models.DateTimeField(auto_now=True)),
+                ('timestamp', models.DateTimeField(default=django.utils.timezone.now)),


auto_now=True does not work for timestamp field because we need to set the timestamp explicitly when creating PasswordHistory via management command.

grahamu · 2016-09-15T16:29:32Z

docs/changelog.rst

---
-
-* initial release
-* if migrating from Pinax; see :ref:`migration`


This file appeared to be an orphan, superseded by /CHANGELOG.md.

coveralls · 2016-09-15T16:34:36Z

Coverage increased (+3.5%) to 72.766% when pulling d16099b on expiry-docs into 1a5cab5 on master.

Allow customization, but use REDIRECT_FIELD_NAME as default.

grahamu · 2016-09-19T16:24:25Z

@jacobwegner how does this look with regard to next page redirect?

coveralls · 2016-09-19T16:29:06Z

Coverage increased (+3.4%) to 72.753% when pulling 32b7623 on expiry-docs into 1a5cab5 on master.

brosner

I am happy with the direction here. This will be an excellent addition to DUA 2.0.

Expand tests, fix logic, add docs

d4d0939

Add mgmt command for setting user-specific password expiry. Add documentation for password expiry.

Add mgmt commands and tests

23edd12

Revise model migration. Add user_password_history command. Add management command tests. Improve password tests. Add Django admin functionality for new PasswordExpiry and PasswordHistory models.

grahamu added 2 commits September 13, 2016 12:33

Add ExpiredPasswordMiddleware

c9c73d8

Use middleware to detect password expiration and redirect to password change page if expired. Added to CHANGELOG.md. Removed outdated docs/changelog.rst. Added documentation for password middleware.

Fix documentation formatting

d20a523

grahamu added 3 commits September 13, 2016 12:39

Update installation docs for pw expiration

c2b3316

Improve verbiage

ac43310

Improve comments

527b9cc

grahamu added 2 commits September 13, 2016 13:56

Add messages and signals

f69f798

Add "Password is expired" message. Add `password_expired` signal. Update signals documentation.

Send signal for password expired

06c4309

Improve verbose plural model name.

Improve admin display, expired pw message

2954278

grahamu added 3 commits September 13, 2016 15:25

Add "?next=" when expired password detected

127613f

If middleware detects expired password, add "?next=" to redirect URL with expected page.

Update test to check "?next=" in URL

3108ddb

Add ACCOUNT_LOGOUT_URL

40d419d

Improve creation of redirect URL with "next" value.

grahamu changed the title ~~WIP Expand password expiration tests, fix logic, add docs~~ Finish password expiration Sep 13, 2016

Add note about "staff" user skipping pw check

83c9efc

Update version: "2.0.0.dev2"

b557fd7

Add management command documentation

1f44952

grahamu added 2 commits September 15, 2016 10:07

Fix docs

55ae160

Improve directions

1e0d672

Improve commands doc

d16099b

grahamu commented Sep 15, 2016

View reviewed changes

Use django.contrib.auth.REDIRECT_FIELD_NAME

32b7623

Allow customization, but use REDIRECT_FIELD_NAME as default.

brosner approved these changes Sep 19, 2016

View reviewed changes

brosner merged commit c4a40be into master Sep 19, 2016

brosner deleted the expiry-docs branch September 19, 2016 21:07

Finish password expiration #224

Finish password expiration #224

Conversation

grahamu commented Sep 10, 2016 • edited Loading

coveralls commented Sep 10, 2016 • edited Loading

coveralls commented Sep 13, 2016 • edited Loading

coveralls commented Sep 13, 2016 • edited Loading

coveralls commented Sep 13, 2016 • edited Loading

coveralls commented Sep 13, 2016 • edited Loading

coveralls commented Sep 13, 2016 • edited Loading

coveralls commented Sep 13, 2016 • edited Loading

coveralls commented Sep 13, 2016 • edited Loading

coveralls commented Sep 13, 2016 • edited Loading

coveralls commented Sep 13, 2016 • edited Loading

coveralls commented Sep 13, 2016

coveralls commented Sep 13, 2016

coveralls commented Sep 13, 2016

coveralls commented Sep 13, 2016 • edited Loading

grahamu commented Sep 13, 2016

coveralls commented Sep 13, 2016 • edited Loading

grahamu commented Sep 14, 2016

coveralls commented Sep 14, 2016 • edited Loading

coveralls commented Sep 14, 2016

coveralls commented Sep 14, 2016

coveralls commented Sep 14, 2016

grahamu commented Sep 14, 2016

coveralls commented Sep 15, 2016 • edited Loading

coveralls commented Sep 15, 2016 • edited Loading

coveralls commented Sep 15, 2016 • edited Loading

grahamu left a comment

Choose a reason for hiding this comment

grahamu Sep 15, 2016

Choose a reason for hiding this comment

jacobwegner Sep 15, 2016

Choose a reason for hiding this comment

grahamu Sep 19, 2016

Choose a reason for hiding this comment

grahamu Sep 15, 2016 • edited Loading

Choose a reason for hiding this comment

jacobwegner Sep 15, 2016

Choose a reason for hiding this comment

grahamu Sep 15, 2016

Choose a reason for hiding this comment

grahamu Sep 15, 2016

Choose a reason for hiding this comment

coveralls commented Sep 15, 2016 • edited Loading

grahamu commented Sep 19, 2016

coveralls commented Sep 19, 2016 • edited Loading

brosner left a comment

Choose a reason for hiding this comment

grahamu commented Sep 10, 2016 •

edited

Loading

coveralls commented Sep 10, 2016 •

edited

Loading

coveralls commented Sep 13, 2016 •

edited

Loading

coveralls commented Sep 13, 2016 •

edited

Loading

coveralls commented Sep 13, 2016 •

edited

Loading

coveralls commented Sep 13, 2016 •

edited

Loading

coveralls commented Sep 13, 2016 •

edited

Loading

coveralls commented Sep 13, 2016 •

edited

Loading

coveralls commented Sep 13, 2016 •

edited

Loading

coveralls commented Sep 13, 2016 •

edited

Loading

coveralls commented Sep 13, 2016 •

edited

Loading

coveralls commented Sep 13, 2016 •

edited

Loading

coveralls commented Sep 13, 2016 •

edited

Loading

coveralls commented Sep 14, 2016 •

edited

Loading

coveralls commented Sep 15, 2016 •

edited

Loading

coveralls commented Sep 15, 2016 •

edited

Loading

coveralls commented Sep 15, 2016 •

edited

Loading

grahamu Sep 15, 2016 •

edited

Loading

coveralls commented Sep 15, 2016 •

edited

Loading

coveralls commented Sep 19, 2016 •

edited

Loading