IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Added fix for notifying user about locked user account in WebUI

Browse Source 
User in now notified about "Locked User account" message instead of
"The password or username you entered is incorrect" or any generic error
message

Fixes : https://fedorahosted.org/freeipa/ticket/5076

Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
This commit is contained in:
Abhijeet Kasurde 2016-04-20 11:09:53 +05:30 committed by Martin Basti
parent 05cb4ba4e9
commit 3d07c889ce
4 changed files with 24 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
install/ui/src/freeipa/ipa.js
View File

@ -498,7 +498,8 @@ IPA.login_password = function(username, password) {
if (reason === 'password-expired' || if (reason === 'password-expired' ||
reason === 'denied' || reason === 'denied' ||
reason === 'krbprincipal-expired' || reason === 'krbprincipal-expired' ||
reason === 'invalid-password') { reason === 'invalid-password' ||
reason === 'user-locked') {
result = reason; result = reason;
} }
} }

5
install/ui/src/freeipa/widgets/LoginScreen.js
View File

@ -71,6 +71,8 @@ define(['dojo/_base/declare',
invalid_password: "The password you entered is incorrect. ", invalid_password: "The password you entered is incorrect. ",
user_locked: "The user account you entered is locked. ",
//nodes: //nodes:
login_btn_node: null, login_btn_node: null,
reset_btn_node: null, reset_btn_node: null,
@ -240,6 +242,9 @@ define(['dojo/_base/declare',
} else if (result === 'invalid-password') { } else if (result === 'invalid-password') {
password_f.set_value(''); password_f.set_value('');
val_summary.add_error('login', this.invalid_password); val_summary.add_error('login', this.invalid_password);
} else if (result === 'user-locked') {
password_f.set_value('');
val_summary.add_error('login', this.user_locked);
} else { } else {
password_f.set_value(''); password_f.set_value('');
val_summary.add_error('login', this.form_auth_failed); val_summary.add_error('login', this.form_auth_failed);

6
ipalib/errors.py
View File

@ -607,6 +607,12 @@ class KrbPrincipalExpired(SessionError):
""" """
errno = 1203 errno = 1203
class UserLocked(SessionError):
"""
**1204** Raised when a user account is locked.
"""
errno = 1204
############################################################################## ##############################################################################
# 2000 - 2999: Authorization errors # 2000 - 2999: Authorization errors
class AuthorizationError(PublicError): class AuthorizationError(PublicError):

12
ipaserver/rpcserver.py
View File

@ -43,7 +43,7 @@ from ipalib.capabilities import VERSION_WITHOUT_CAPABILITIES
from ipalib.backend import Executioner from ipalib.backend import Executioner
from ipalib.errors import (PublicError, InternalError, CommandError, JSONError, from ipalib.errors import (PublicError, InternalError, CommandError, JSONError,
CCacheError, RefererError, InvalidSessionPassword, NotFound, ACIError, CCacheError, RefererError, InvalidSessionPassword, NotFound, ACIError,
ExecutionError, PasswordExpired, KrbPrincipalExpired) ExecutionError, PasswordExpired, KrbPrincipalExpired, UserLocked)
from ipalib.request import context, destroy_context from ipalib.request import context, destroy_context
from ipalib.rpc import (xml_dumps, xml_loads, from ipalib.rpc import (xml_dumps, xml_loads,
json_encode_binary, json_decode_binary) json_encode_binary, json_decode_binary)
@ -954,6 +954,11 @@ class login_password(Backend, KerberosSession, HTTP_Status):
start_response, start_response,
str(e), str(e),
'krbprincipal-expired') 'krbprincipal-expired')
except UserLocked as e:
return self.unauthorized(environ,
start_response,
str(e),
'user-locked')
return self.finalize_kerberos_acquisition('login_password', ipa_ccache_name, environ, start_response) return self.finalize_kerberos_acquisition('login_password', ipa_ccache_name, environ, start_response)
@ -993,9 +998,14 @@ class login_password(Backend, KerberosSession, HTTP_Status):
' has expired while getting initial credentials') in str(e): ' has expired while getting initial credentials') in str(e):
raise KrbPrincipalExpired(principal=principal, raise KrbPrincipalExpired(principal=principal,
message=unicode(e)) message=unicode(e))
elif ('kinit: Clients credentials have been revoked '
'while getting initial credentials') in str(e):
raise UserLocked(principal=principal,
message=unicode(e))
raise InvalidSessionPassword(principal=principal, raise InvalidSessionPassword(principal=principal,
message=unicode(e)) message=unicode(e))
class change_password(Backend, HTTP_Status): class change_password(Backend, HTTP_Status):
content_type = 'text/plain' content_type = 'text/plain'