lasdf1234 opened a new issue, #13925:
URL: https://github.com/apache/gravitino/issues/13925
### What would you like to be improved?
Local user store (`idp-basic`) password updates today only accept the new
password:
```http
PUT /api/idp/users/{user}
{"password":"{new_password}"}
```
Callers authenticate with HTTP Basic using their current credentials. Docs
(`docs/security/local-users-and-groups.md`) explicitly say the request carries
the new password only and no current password.
That means anyone who holds a valid Basic session (or a stolen session /
scripted client) can change a user's password without proving knowledge of the
existing password again. Self-service password change should re-verify the
current password in the request body. Admin reset of another user's password
should stay a privileged reset and must not require that user's current
password.
### How should we improve?
Change `PUT /api/idp/users/{user}` password semantics as follows:
1. **Self password change** (caller updates their own username):
- Request must include the current password (`currentPassword`) and the
new `password`.
- Server must verify `currentPassword` against the stored hash before
applying the new password.
- Verification failure returns an auth/validation error (do not update).
- This applies to **any** user, including a service admin changing their
**own** password.
2. **Admin resets another user's password** (caller is a service admin and
`{user}` ≠ caller):
- Request may send only `password` (and optionally `enabled` as today).
- `currentPassword` is not required and must not be required for that
other user's old password.
- If `currentPassword` is sent on an admin reset of another user, reject
or ignore it; do not validate against the target user's password.
Suggested follow-ups in the same change set:
- Extend `UpdateUserRequest` / OpenAPI (`docs/open-api/idp/`) with optional
`currentPassword`.
- Enforce the rules in `IdpUserOperations` (or manager) based on whether the
path user equals the authenticated principal and whether the caller is a
service admin.
- Update `docs/security/local-users-and-groups.md` and examples.
- Add unit/IT coverage for: self change with correct/incorrect/missing
current password; admin reset of another user without current password; admin
self-change still requiring current password.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
