Problem/Motivation

When the user is logged in and he tries to reset its password we should completely deny the access to /user/password route when the following conditions are met:

  1. The user account is linked to a CAS account.
  2. restrict_password_management is TRUE.

Proposed resolution

The solution could be borrowed from https://github.com/openeuropa/oe_authentication. See the oe_authentication.external_user_access_checker service and relevant code in src/Routing/RouteSubscriber.php.

Remaining tasks

None.

User interface changes

When restrict_password_management is TRUE, logged in CAS user will be denied when they try to access /user/password.

API changes

None.

Data model changes

None.

Release notes snippet

N/A

CommentFileSizeAuthor
#3 3075110-3.interdiff.txt439 bytesclaudiu.cristea
#3 3075110-3.patch13.65 KBclaudiu.cristea
#2 3075110-2.patch13.65 KBclaudiu.cristea
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

claudiu.cristea created an issue. See original summary.

claudiu.cristea’s picture

claudiu.cristea
Primary language Romanian
Location Arad 🇷🇴
CreditAttribution: claudiu.cristea as a volunteer and at Webikon for European Commission and European Union Institutions, Agencies and Bodies commented
Status: Active » Needs review
FileSize
3075110-2.patch13.65 KB

Basically the CasAdminSettingsTest has tested the password reset so I renamed the testing class.

claudiu.cristea’s picture

claudiu.cristea
Primary language Romanian
Location Arad 🇷🇴
CreditAttribution: claudiu.cristea as a volunteer and at Webikon for European Commission and European Union Institutions, Agencies and Bodies commented
FileSize
3075110-3.patch13.65 KB
3075110-3.interdiff.txt439 bytes

A better naming for the access checker service.

bkosborne’s picture

bkosborne
Primary language English
Location New Jersey, USA
CreditAttribution: bkosborne at Princeton University commented
Status: Needs review » Fixed

This looks great, thank you for the great patch and tests! I'm surprised that Drupal doesn't restrict /user/password for authenticated users already, since the password form is already on the main user edit form.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.