From d7c3433bf81661003d90809b4870a3a1c4211387 Mon Sep 17 00:00:00 2001 From: Denis Leemann Date: Thu, 4 Jan 2024 10:18:40 +0100 Subject: [PATCH] [FIX][15.0]auth_saml: password reset when deactivating the config settings --- auth_saml/models/ir_config_parameter.py | 10 ++++++++++ auth_saml/tests/test_pysaml.py | 25 ++++++++++++++++++++++++- 2 files changed, 34 insertions(+), 1 deletion(-) diff --git a/auth_saml/models/ir_config_parameter.py b/auth_saml/models/ir_config_parameter.py index 9fb503afac..dd8677d0fa 100644 --- a/auth_saml/models/ir_config_parameter.py +++ b/auth_saml/models/ir_config_parameter.py @@ -27,3 +27,13 @@ def write(self, vals): if self.filtered(lambda param: param.key == ALLOW_SAML_UID_AND_PASSWORD): self.env["res.users"].allow_saml_and_password_changed() return result + + def unlink(self): + """Redefined to update users when our parameter is deleted.""" + param_saml = self.filtered( + lambda param: param.key == ALLOW_SAML_UID_AND_PASSWORD + ) + result = super().unlink() + if result and param_saml: + self.env["res.users"].allow_saml_and_password_changed() + return result diff --git a/auth_saml/tests/test_pysaml.py b/auth_saml/tests/test_pysaml.py index c05235b747..7549e2546f 100644 --- a/auth_saml/tests/test_pysaml.py +++ b/auth_saml/tests/test_pysaml.py @@ -198,7 +198,7 @@ def test_login_with_saml(self): # User should now be able to log in with the token self.authenticate(user="test@example.com", password=token) - def test_disallow_user_password_when_changing_setting(self): + def test_disallow_user_password_when_changing_ir_config_parameter(self): """Test that disabling users from having both a password and SAML ids remove users password.""" # change the option @@ -336,3 +336,26 @@ def test_redirect_after_login(self): self.base_url() + "/web#action=37&model=ir.module.module&view_type=kanban&menu_id=5", ) + + def test_disallow_user_password_when_changing_settings(self): + """Test that disabling the setting will remove passwords from related users""" + # We activate the settings to allow password login + self.env["res.config.settings"].create( + { + "allow_saml_uid_and_internal_password": True, + } + ).execute() + + # Test the user can login with the password + self.authenticate(user="user@example.com", password="NesTNSte9340D720te>/-A") + + self.env["res.config.settings"].create( + { + "allow_saml_uid_and_internal_password": False, + } + ).execute() + + with self.assertRaises(AccessDenied): + self.authenticate( + user="user@example.com", password="NesTNSte9340D720te>/-A" + )