search

IdentityPython / djangosaml2

Django SAML2 Service Provider based on pySAML2
Apache License 2.0
254 stars 143 forks source link

Set unusable password for new created users #398

Closed pandafy closed 4 months ago

pandafy commented 4 months ago

I see the changelog mentions setting unusable password on the user object, but I can't find it in the code.

https://github.com/IdentityPython/djangosaml2/blob/169fc486fc387a0ed57ae01ee67140a424a83a46/CHANGES#L386C1-L388C70

Perhaps, this change was lost while deprecating configure_user method?

peppelinux commented 4 months ago

Here https://github.com/IdentityPython/djangosaml2/blob/master/djangosaml2/backends.py#L256

pandafy commented 4 months ago

If the user is not present on the system (when the user is first created), then this code will be triggered

https://github.com/IdentityPython/djangosaml2/blob/169fc486fc387a0ed57ae01ee67140a424a83a46/djangosaml2/backends.py#L291-L298

And, this does not set an unusable password.

pandafy commented 4 months ago

@peppelinux I opened #399 after updating an existing test case to verify that the created user has a usable_password.

Please check the logs of the Ci build https://github.com/IdentityPython/djangosaml2/actions/runs/7913492573/job/21601260980?pr=399#step:5:740