lasdf1234 opened a new pull request, #13926:
URL: https://github.com/apache/gravitino/pull/13926
### What changes were proposed in this pull request?
Require `currentPassword` when a caller changes their own local IdP
password, and verify it against the stored hash before applying the new
password. Service admins resetting another user's password continue to send
only `password` and must omit `currentPassword`.
- Extend `UpdateUserRequest` / OpenAPI with optional `currentPassword`
- Enforce the self vs admin-reset rules in `IdpUserOperations`
- Map `UnauthorizedException` from a failed current-password check to HTTP
401 in IdP REST
- Update docs and unit/IT coverage
### Why are the changes needed?
Self-service password change previously accepted only the new password. A
caller with a valid Basic session could change their password without proving
knowledge of the existing password again.
Fix: #13925
### Does this PR introduce _any_ user-facing change?
Yes. `PUT /api/idp/users/{user}` for a self password change now requires:
```json
{"password":"{new_password}","currentPassword":"{current_password}"}
```
A service admin resetting another user still uses
`{"password":"{new_password}"}`. Sending `currentPassword` on an admin reset of
another user is rejected.
### How was this patch tested?
- `./gradlew :plugins:idp-basic:test --tests
org.apache.gravitino.idp.TestIdpUserGroupManager --tests
org.apache.gravitino.idp.dto.requests.TestUpdateUserRequest --tests
org.apache.gravitino.idp.web.rest.TestIdpOperations -PskipITs`
- `./gradlew :docs:build`
Made with [Cursor](https://cursor.com)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
