mirror of
https://github.com/hanzoai/team.git
synced 2026-09-30 01:57:35 +00:00
bf8ab43647
* Add parser and hasher packages The new `password` module includes two packages: - `hashers` provides a structure allowing for seamless migrations between password hashing methods. It also implements two password hashers: bcrypt, which was the current hashing method, and PBKDF2, which is the one we are migrating to. - `parser` provides types and primitives to parse PHC[0] strings, serving as the foundation of the `PasswordHasher` interface and implementations, which are all PHC-based. [0] https://github.com/P-H-C/phc-string-format/blob/master/phc-sf-spec.md * Use latest hasher to hash new passwords The previous commit added a LatestHasher variable, that contains the `PasswordHasher` currently in use. Here, we make sure we use it for hashing new passwords, instead of the currently hardcoded bcrypt. * Use errors from hashers' package Some chore work to unify errors defined in `hashers`, not from external packages like `bcrypt`. * Implement password migration logic This commit implements the actual logic to migrate passwords, which can be summarized as: 0. When the user enters their password (either for login in `App.CheckPasswordAndAllCriteria` or for double-checking the password when the app needs additional confirmation for anything in `App.DoubleCheckPassword`), this process is started. 1. The new `App.checkUserPassword` is called. In `users.CheckUserPassword`, we parse the stored hashed password with the new PHC parser and identify whether it was generated with the current hashing method (PBKDF2). If it is, just verify the password as usual and continue normally. 2. If not, start the migration calling `App.migratePassword`: a. First, we call `Users.MigratePassword`, which validates that the stored hash and the provided password match, using the hasher that generated the old hash. b. If the user-provided password matches the old hash, then we simply re-hash that password with our current hasher, the one in `hashers.LatestHasher`. If not, we fail. c. Back in `App.migratePassword`, if the migration was successful, then we update the user in the database with the newly generated hash. * make i18n-extract * Rename getDefaultHasher to getOriginalHasher * Refactor App checkUserPsasword and migratePassword Simplify the flow in these two methods, removing the similarly named users.CheckUserPassword and users.MigratePassword, inlining the logic needed in the App layer and at the same time removing the need to parse the stored hash twice. This implements a package-level function, CompareHashAndPassword: the first step to unexport LatestHasher. * Add a package level Hash method This completely removes the need to expose LatestHasher, and lets us also remove model.HashPassword, in favour of the new hashers.Hash * Unexport LatestHasher * Remove tests for removed functions * Make the linter happy * Remove error no longer used * Allow for parameter migrations on the same hasher Before this, we were only checking that the function ID of the stored hash was the ID of the latest hashing method. Here, we no longer ignore the parameters, so that if in the future we need to migrate to the same hashing method with a different parameter (let's say PBKDF2 with work factor 120,000 instead of work factor 60,000), we can do it by updating the latestHasher variable. IsPHCValid will detect this change and force a migration if needed. * Document new functions * make i18n-extract * Fix typo in comment Co-authored-by: Ben Cooke <[email protected]> * Rename parser package to phcparser * Simplify phcparser.New documentation * Rename scanSymbol to scanSeparator Redefine the list of separator tokens, including EOF as one. * Document undocumented functions that are unexported * Reorder error block in checkUserPassword * Add unit tests for IsLatestHasher * Reorder code in parser.go * Enforce SHA256 as internal function for PBKDF2 * Fix typo in comment Co-authored-by: Eva Sarafianou <[email protected]> --------- Co-authored-by: Ben Cooke <[email protected]> Co-authored-by: Eva Sarafianou <[email protected]> Co-authored-by: Mattermost Build <[email protected]>
546 lines
17 KiB
Go
546 lines
17 KiB
Go
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
|
// See LICENSE.txt for license information.
|
|
|
|
package app
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strconv"
|
|
"sync"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/dgryski/dgoogauth"
|
|
"github.com/stretchr/testify/mock"
|
|
"github.com/stretchr/testify/require"
|
|
"golang.org/x/crypto/bcrypt"
|
|
|
|
"github.com/mattermost/mattermost/server/public/model"
|
|
"github.com/mattermost/mattermost/server/v8/channels/app/password/hashers"
|
|
"github.com/mattermost/mattermost/server/v8/einterfaces/mocks"
|
|
)
|
|
|
|
func TestParseAuthTokenFromRequest(t *testing.T) {
|
|
mainHelper.Parallel(t)
|
|
cases := []struct {
|
|
header string
|
|
cookie string
|
|
query string
|
|
expectedToken string
|
|
expectedLocation TokenLocation
|
|
}{
|
|
{"", "", "", "", TokenLocationNotFound},
|
|
{"token mytoken", "", "", "mytoken", TokenLocationHeader},
|
|
{"BEARER mytoken", "", "", "mytoken", TokenLocationHeader},
|
|
{"", "mytoken", "", "mytoken", TokenLocationCookie},
|
|
{"", "a very large token to test out tokentokentokentokentokentokentokentokentokentokentokentokentoken", "", "a very large token to test out tokentokentokentoke", TokenLocationCookie},
|
|
{"", "", "mytoken", "mytoken", TokenLocationQueryString},
|
|
{"mytoken", "", "", "mytoken", TokenLocationCloudHeader},
|
|
}
|
|
|
|
for testnum, tc := range cases {
|
|
pathname := "/test/here"
|
|
if tc.query != "" {
|
|
pathname += "?access_token=" + tc.query
|
|
}
|
|
req := httptest.NewRequest("GET", pathname, nil)
|
|
switch tc.expectedLocation {
|
|
case TokenLocationHeader:
|
|
req.Header.Add(model.HeaderAuth, tc.header)
|
|
case TokenLocationCloudHeader:
|
|
req.Header.Add(model.HeaderCloudToken, tc.header)
|
|
case TokenLocationCookie:
|
|
req.AddCookie(&http.Cookie{
|
|
Name: model.SessionCookieToken,
|
|
Value: tc.cookie,
|
|
})
|
|
}
|
|
|
|
token, location := ParseAuthTokenFromRequest(req)
|
|
|
|
require.Equal(t, tc.expectedToken, token, "Wrong token on test "+strconv.Itoa(testnum))
|
|
require.Equal(t, tc.expectedLocation, location, "Wrong location on test "+strconv.Itoa(testnum))
|
|
}
|
|
}
|
|
|
|
func TestCheckPasswordAndAllCriteria(t *testing.T) {
|
|
mainHelper.Parallel(t)
|
|
th := Setup(t).InitBasic()
|
|
defer th.TearDown()
|
|
|
|
const maxFailedLoginAttempts = 3
|
|
const concurrentAttempts = maxFailedLoginAttempts + 1
|
|
th.App.UpdateConfig(func(cfg *model.Config) {
|
|
*cfg.ServiceSettings.MaximumLoginAttempts = maxFailedLoginAttempts
|
|
*cfg.ServiceSettings.EnableMultifactorAuthentication = true
|
|
})
|
|
|
|
password := "newpassword1"
|
|
appErr := th.App.UpdatePassword(th.Context, th.BasicUser, password)
|
|
require.Nil(t, appErr)
|
|
|
|
// setup MFA
|
|
secret, appErr := th.App.GenerateMfaSecret(th.BasicUser.Id)
|
|
require.Nil(t, appErr)
|
|
err := th.Server.Store().User().UpdateMfaActive(th.BasicUser.Id, true)
|
|
require.NoError(t, err)
|
|
err = th.Server.Store().User().UpdateMfaSecret(th.BasicUser.Id, secret.Secret)
|
|
require.NoError(t, err)
|
|
|
|
t.Run("should run successfully when attempts are available", func(t *testing.T) {
|
|
err = th.App.Srv().Store().User().UpdateFailedPasswordAttempts(th.BasicUser.Id, maxFailedLoginAttempts-1)
|
|
require.NoError(t, err)
|
|
code := dgoogauth.ComputeCode(secret.Secret, time.Now().UTC().Unix()/30)
|
|
token := fmt.Sprintf("%06d", code)
|
|
|
|
appErr = th.App.CheckPasswordAndAllCriteria(th.Context, th.BasicUser.Id, password, token)
|
|
require.Nil(t, appErr)
|
|
})
|
|
|
|
t.Run("validate concurrent failed attempts to bypass checks", func(t *testing.T) {
|
|
testCases := []struct {
|
|
name string
|
|
password string
|
|
mfaToken string
|
|
expectedErrID string
|
|
}{
|
|
{
|
|
name: "should not breach max. login attempts when password is wrong",
|
|
password: "wrong password",
|
|
expectedErrID: "api.user.check_user_password.invalid.app_error",
|
|
},
|
|
{
|
|
name: "should not breach max. login attempts when MFA is wrong",
|
|
password: password,
|
|
mfaToken: "123456",
|
|
expectedErrID: "api.user.check_user_mfa.bad_code.app_error",
|
|
},
|
|
}
|
|
|
|
for _, tc := range testCases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
// Reset login attempts
|
|
err := th.App.Srv().Store().User().UpdateFailedPasswordAttempts(th.BasicUser.Id, 0)
|
|
require.NoError(t, err)
|
|
|
|
// Capture all concurrent errors
|
|
appErrs := make([]*model.AppError, concurrentAttempts)
|
|
|
|
// Wait to complete the test
|
|
var completeWG sync.WaitGroup
|
|
completeWG.Add(concurrentAttempts)
|
|
|
|
for i := range concurrentAttempts {
|
|
go func(i int) {
|
|
defer completeWG.Done()
|
|
// Simulate concurrent failed login checks by same user
|
|
appErrs[i] = th.App.CheckPasswordAndAllCriteria(th.Context, th.BasicUser.Id, tc.password, tc.mfaToken)
|
|
}(i)
|
|
}
|
|
|
|
completeWG.Wait()
|
|
|
|
expectedErrsCount := 0
|
|
for i := range concurrentAttempts {
|
|
if appErrs[i].Id == tc.expectedErrID {
|
|
expectedErrsCount++
|
|
continue
|
|
}
|
|
|
|
require.Equal(t, "api.user.check_user_login_attempts.too_many.app_error", appErrs[i].Id, "All other errors should be of too many login attempts only.")
|
|
}
|
|
|
|
// Password/MFA failure attempts should not breach the maxFailedAttempts
|
|
// even during concurrent access by the same user.
|
|
require.Equal(t, maxFailedLoginAttempts, expectedErrsCount)
|
|
})
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestCheckLdapUserPasswordAndAllCriteria(t *testing.T) {
|
|
th := SetupEnterprise(t).InitBasic()
|
|
defer th.TearDown()
|
|
|
|
// update config
|
|
const maxFailedLoginAttempts = 3
|
|
th.App.UpdateConfig(func(cfg *model.Config) {
|
|
*cfg.LdapSettings.MaximumLoginAttempts = maxFailedLoginAttempts
|
|
*cfg.ServiceSettings.EnableMultifactorAuthentication = true
|
|
})
|
|
|
|
mockLdap := &mocks.LdapInterface{}
|
|
th.App.Channels().Ldap = mockLdap
|
|
|
|
authData := model.NewRandomString(32)
|
|
|
|
// create an ldap user by calling createUser
|
|
ldapUser := &model.User{
|
|
Email: "[email protected]",
|
|
Username: "ldapuser",
|
|
AuthService: model.UserAuthServiceLdap,
|
|
AuthData: &authData,
|
|
EmailVerified: true,
|
|
}
|
|
user, appErr := th.App.CreateUser(th.Context, ldapUser)
|
|
require.Nil(t, appErr)
|
|
user.AuthData = &authData
|
|
|
|
testCases := []struct {
|
|
name string
|
|
password string
|
|
expectedErrID string
|
|
mockDoLogin func()
|
|
}{
|
|
{
|
|
name: "valid password",
|
|
password: "password",
|
|
expectedErrID: "",
|
|
mockDoLogin: func() {
|
|
mockLdap.Mock.On("DoLogin", th.Context, authData, "password").Return(user, nil)
|
|
},
|
|
},
|
|
{
|
|
name: "invalid password",
|
|
password: "wrongpassword",
|
|
expectedErrID: "api.user.check_user_password.invalid.app_error",
|
|
mockDoLogin: func() {
|
|
mockLdap.Mock.On("DoLogin", th.Context, authData, "wrongpassword").Return(nil, &model.AppError{Id: "ent.ldap.do_login.invalid_password.app_error"})
|
|
},
|
|
},
|
|
{
|
|
name: "too many login attempts",
|
|
password: "wrongpassword",
|
|
expectedErrID: "api.user.check_user_login_attempts.too_many_ldap.app_error",
|
|
mockDoLogin: func() {
|
|
mockLdap.Mock.On("DoLogin", th.Context, authData, "wrongpassword").Return(nil, &model.AppError{Id: "ent.ldap.do_login.invalid_password.app_error"}).Once()
|
|
},
|
|
},
|
|
}
|
|
|
|
for _, tc := range testCases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
// Reset login attempts
|
|
err := th.App.Srv().Store().User().UpdateFailedPasswordAttempts(user.Id, 0)
|
|
require.NoError(t, err)
|
|
|
|
tc.mockDoLogin()
|
|
|
|
ldapUser := user
|
|
|
|
// Simulate failed login attempts if necessary
|
|
if tc.expectedErrID == "api.user.check_user_login_attempts.too_many_ldap.app_error" {
|
|
for range maxFailedLoginAttempts - 1 {
|
|
_, appErr = th.App.checkLdapUserPasswordAndAllCriteria(th.Context, ldapUser, "wrongpassword", "")
|
|
require.NotNil(t, appErr)
|
|
require.Equal(t, "ent.ldap.do_login.invalid_password.app_error", appErr.Id)
|
|
}
|
|
}
|
|
// Call the method with the test case parameters
|
|
_, appErr := th.App.checkLdapUserPasswordAndAllCriteria(th.Context, ldapUser, tc.password, "")
|
|
|
|
// Verify the returned error matches the expected error
|
|
if tc.expectedErrID == "" {
|
|
require.Nil(t, appErr)
|
|
} else {
|
|
require.NotNil(t, appErr)
|
|
}
|
|
|
|
if tc.expectedErrID == "api.user.check_user_login_attempts.too_many_ldap.app_error" {
|
|
updatedUser, err := th.App.GetUser(ldapUser.Id)
|
|
require.Nil(t, err)
|
|
require.Equal(t, maxFailedLoginAttempts, updatedUser.FailedAttempts)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestCheckLdapUserPasswordConcurrency(t *testing.T) {
|
|
th := SetupEnterprise(t).InitBasic()
|
|
defer th.TearDown()
|
|
|
|
// update config
|
|
const maxFailedLoginAttempts = 1
|
|
const concurrentAttempts = 10
|
|
th.App.UpdateConfig(func(cfg *model.Config) {
|
|
*cfg.LdapSettings.MaximumLoginAttempts = maxFailedLoginAttempts
|
|
*cfg.ServiceSettings.EnableMultifactorAuthentication = true
|
|
})
|
|
|
|
authData := model.NewRandomString(32)
|
|
|
|
// create an ldap user by calling createUser
|
|
ldapUser := &model.User{
|
|
Email: "[email protected]",
|
|
Username: "ldapuser",
|
|
AuthService: model.UserAuthServiceLdap,
|
|
AuthData: &authData,
|
|
EmailVerified: true,
|
|
}
|
|
user, appErr := th.App.CreateUser(th.Context, ldapUser)
|
|
require.Nil(t, appErr)
|
|
|
|
// setup MFA
|
|
secret, appErr := th.App.GenerateMfaSecret(user.Id)
|
|
require.Nil(t, appErr)
|
|
err := th.Server.Store().User().UpdateMfaActive(user.Id, true)
|
|
require.NoError(t, err)
|
|
err = th.Server.Store().User().UpdateMfaSecret(user.Id, secret.Secret)
|
|
require.NoError(t, err)
|
|
|
|
user, appErr = th.App.GetUser(user.Id)
|
|
require.Nil(t, appErr)
|
|
user.AuthData = &authData
|
|
|
|
t.Run("validate concurrent failed attempts to bypass checks", func(t *testing.T) {
|
|
testCases := []struct {
|
|
name string
|
|
password string
|
|
mfaToken string
|
|
expectedErrID string
|
|
doLoginExpectedErrID string
|
|
}{
|
|
{
|
|
name: "should not breach max. login attempts when password is wrong",
|
|
password: "wrong password",
|
|
mfaToken: "",
|
|
doLoginExpectedErrID: "ent.ldap.do_login.invalid_password.app_error",
|
|
expectedErrID: "ent.ldap.do_login.invalid_password.app_error",
|
|
},
|
|
{
|
|
name: "should not breach max. login attempts when MFA is wrong",
|
|
password: "password",
|
|
mfaToken: "123456",
|
|
doLoginExpectedErrID: "",
|
|
expectedErrID: "api.user.check_user_mfa.bad_code.app_error",
|
|
},
|
|
}
|
|
|
|
for _, tc := range testCases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
mockLdap := &mocks.LdapInterface{}
|
|
th.App.Channels().Ldap = mockLdap
|
|
// Reset login attempts
|
|
err := th.App.Srv().Store().User().UpdateFailedPasswordAttempts(user.Id, 0)
|
|
require.NoError(t, err)
|
|
|
|
// Capture all concurrent errors
|
|
appErrs := make([]*model.AppError, concurrentAttempts)
|
|
|
|
// Wait to complete the test
|
|
var completeWG sync.WaitGroup
|
|
completeWG.Add(concurrentAttempts)
|
|
|
|
for i := range concurrentAttempts {
|
|
go func(i int) {
|
|
defer completeWG.Done()
|
|
|
|
if tc.doLoginExpectedErrID == "ent.ldap.do_login.invalid_password.app_error" {
|
|
mockLdap.Mock.On("DoLogin", mock.AnythingOfType("*request.Context"), mock.AnythingOfType("string"), mock.AnythingOfType("string")).Return(nil, &model.AppError{Id: tc.doLoginExpectedErrID})
|
|
} else {
|
|
mockLdap.Mock.On("DoLogin", mock.AnythingOfType("*request.Context"), mock.AnythingOfType("string"), tc.password).Return(user, nil)
|
|
}
|
|
_, appErrs[i] = th.App.checkLdapUserPasswordAndAllCriteria(th.Context, user, tc.password, tc.mfaToken)
|
|
}(i)
|
|
}
|
|
|
|
completeWG.Wait()
|
|
|
|
expectedErrsCount := 0
|
|
for i := range concurrentAttempts {
|
|
if appErrs[i].Id == tc.expectedErrID {
|
|
expectedErrsCount++
|
|
continue
|
|
}
|
|
|
|
if appErrs[i] != nil {
|
|
require.Equal(t, "api.user.check_user_login_attempts.too_many_ldap.app_error", appErrs[i].Id, "All other errors should be of too many login attempts only.")
|
|
}
|
|
}
|
|
|
|
// Password/MFA failure attempts should not breach the maxFailedAttempts
|
|
// even during concurrent access by the same user.
|
|
require.Equal(t, maxFailedLoginAttempts, expectedErrsCount)
|
|
})
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestCheckUserPassword(t *testing.T) {
|
|
th := Setup(t).InitBasic()
|
|
defer th.TearDown()
|
|
|
|
pwd := "testPassword123$"
|
|
pwdBcryptBytes, err := bcrypt.GenerateFromPassword([]byte(pwd), 10)
|
|
require.NoError(t, err)
|
|
pwdBcrypt := string(pwdBcryptBytes)
|
|
pwdPBKDF2, err := hashers.Hash(pwd)
|
|
require.NoError(t, err)
|
|
|
|
createUserWithHash := func(hash string) *model.User {
|
|
t.Helper()
|
|
|
|
user := th.CreateUser()
|
|
|
|
// Update the hash directly in the store (otherwise the app hashes it)
|
|
err := th.Server.Store().User().UpdatePassword(user.Id, hash)
|
|
require.NoError(t, err)
|
|
th.App.InvalidateCacheForUser(user.Id)
|
|
|
|
updatedUser, appErr := th.App.GetUser(user.Id)
|
|
require.Nil(t, appErr)
|
|
require.Equal(t, hash, updatedUser.Password)
|
|
|
|
return updatedUser
|
|
}
|
|
|
|
t.Run("valid password with current hashing", func(t *testing.T) {
|
|
user := createUserWithHash(pwdPBKDF2)
|
|
err := th.App.checkUserPassword(user, pwd, false)
|
|
require.Nil(t, err)
|
|
})
|
|
|
|
t.Run("valid password with current hashing and cache invalidation", func(t *testing.T) {
|
|
user := createUserWithHash(pwdPBKDF2)
|
|
err := th.App.checkUserPassword(user, pwd, true)
|
|
require.Nil(t, err)
|
|
})
|
|
|
|
t.Run("invalid password", func(t *testing.T) {
|
|
user := createUserWithHash(pwdPBKDF2)
|
|
|
|
err := th.App.checkUserPassword(user, "wrongpassword", false)
|
|
require.NotNil(t, err)
|
|
require.Equal(t, "api.user.check_user_password.invalid.app_error", err.Id)
|
|
|
|
updatedUser, err := th.App.GetUser(user.Id)
|
|
require.Nil(t, err)
|
|
require.Equal(t, user.FailedAttempts+1, updatedUser.FailedAttempts)
|
|
})
|
|
|
|
t.Run("password migration from outdated hash", func(t *testing.T) {
|
|
user := createUserWithHash(pwdBcrypt)
|
|
require.Contains(t, user.Password, "$2a$10")
|
|
require.NotContains(t, user.Password, "pbkdf2")
|
|
|
|
err := th.App.checkUserPassword(user, pwd, false)
|
|
require.Nil(t, err)
|
|
|
|
updatedUser, err := th.App.GetUser(user.Id)
|
|
require.Nil(t, err)
|
|
require.NotEqual(t, pwdBcrypt, updatedUser.Password)
|
|
require.Contains(t, updatedUser.Password, "$pbkdf2")
|
|
|
|
// Re-check with updated password
|
|
err = th.App.checkUserPassword(user, pwd, false)
|
|
require.Nil(t, err)
|
|
})
|
|
|
|
t.Run("password migration fails with invalid password", func(t *testing.T) {
|
|
user := createUserWithHash(pwdBcrypt)
|
|
|
|
err := th.App.checkUserPassword(user, "wrongpassword", false)
|
|
require.NotNil(t, err)
|
|
require.Equal(t, "api.user.check_user_password.invalid.app_error", err.Id)
|
|
|
|
updatedUser, err := th.App.GetUser(user.Id)
|
|
require.Nil(t, err)
|
|
require.Equal(t, user.FailedAttempts+1, updatedUser.FailedAttempts)
|
|
})
|
|
|
|
t.Run("empty password", func(t *testing.T) {
|
|
user := createUserWithHash(pwdPBKDF2)
|
|
|
|
user, err := th.App.GetUser(user.Id)
|
|
require.Nil(t, err)
|
|
|
|
err = th.App.checkUserPassword(user, "", false)
|
|
require.NotNil(t, err)
|
|
require.Equal(t, "api.user.check_user_password.invalid.app_error", err.Id)
|
|
})
|
|
|
|
t.Run("user with empty password hash", func(t *testing.T) {
|
|
user := createUserWithHash("")
|
|
|
|
user, err := th.App.GetUser(user.Id)
|
|
require.Nil(t, err)
|
|
|
|
err = th.App.checkUserPassword(user, pwd, false)
|
|
require.NotNil(t, err)
|
|
require.Equal(t, "api.user.check_user_password.invalid.app_error", err.Id)
|
|
})
|
|
|
|
t.Run("successful migration from PBKDF2 with old parameter to new parameter", func(t *testing.T) {
|
|
// Create a PBKDF2 hasher with work factor = 10000 instead of the default 60000
|
|
oldParamPBKDF2, err := hashers.NewPBKDF2(10000, 32)
|
|
require.NoError(t, err)
|
|
|
|
pwdOldParamPBKDF2, err := oldParamPBKDF2.Hash(pwd)
|
|
require.NoError(t, err)
|
|
|
|
user := createUserWithHash(pwdOldParamPBKDF2)
|
|
require.Contains(t, user.Password, "$pbkdf2")
|
|
// The user hash contains the old parameter
|
|
require.Contains(t, user.Password, "w=10000")
|
|
|
|
appErr := th.App.checkUserPassword(user, pwd, false)
|
|
require.Nil(t, appErr)
|
|
|
|
updatedUser, appErr := th.App.GetUser(user.Id)
|
|
require.Nil(t, appErr)
|
|
require.NotEqual(t, pwdBcrypt, updatedUser.Password)
|
|
require.Contains(t, updatedUser.Password, "$pbkdf2")
|
|
// The new user hash contains the new parameter
|
|
require.Contains(t, updatedUser.Password, "w=60000")
|
|
|
|
// Re-check with updated password
|
|
appErr = th.App.checkUserPassword(user, pwd, false)
|
|
require.Nil(t, appErr)
|
|
})
|
|
}
|
|
|
|
func TestMigratePassword(t *testing.T) {
|
|
th := Setup(t).InitBasic()
|
|
defer th.TearDown()
|
|
|
|
pwd := "testPassword123$"
|
|
pwdBcryptBytes, err := bcrypt.GenerateFromPassword([]byte(pwd), 10)
|
|
require.NoError(t, err)
|
|
pwdBcrypt := string(pwdBcryptBytes)
|
|
|
|
createUserWithHash := func(hash string) *model.User {
|
|
t.Helper()
|
|
|
|
user := th.CreateUser()
|
|
|
|
// Update the hash directly in the store (otherwise the app hashes it)
|
|
err := th.Server.Store().User().UpdatePassword(user.Id, hash)
|
|
require.NoError(t, err)
|
|
th.App.InvalidateCacheForUser(user.Id)
|
|
|
|
updatedUser, appErr := th.App.GetUser(user.Id)
|
|
require.Nil(t, appErr)
|
|
require.Equal(t, hash, updatedUser.Password)
|
|
|
|
return updatedUser
|
|
}
|
|
|
|
t.Run("successful migration from BCrypt to PBKDF2", func(t *testing.T) {
|
|
user := createUserWithHash(pwdBcrypt)
|
|
|
|
err := th.App.migratePassword(user, pwd)
|
|
require.Nil(t, err)
|
|
|
|
updatedUser, err := th.App.GetUser(user.Id)
|
|
require.Nil(t, err)
|
|
require.NotEqual(t, pwdBcrypt, updatedUser.Password)
|
|
require.Contains(t, updatedUser.Password, "$pbkdf2")
|
|
|
|
// Re-check with updated password
|
|
err = th.App.checkUserPassword(user, pwd, false)
|
|
require.Nil(t, err)
|
|
})
|
|
}
|